*Please note: this topic page is a preliminary draft version. Although its contents have been reviewed for accuracy, a revised and expanded version will be available later.
- Karen Staman, MS
Regulatory structures surrounding clinical research in the United States represent the accretion of more than a century’s worth of efforts to ensure the safety and trustworthiness of medical products and to protect patients and consumers from fraud and abuse. However, the multiple regulatory regimes that currently govern research and the related bureaucracies that create and enforce these regulations have been criticized as complex, unclear, inconsistent, and increasingly and unsustainably burdensome [1-4].
In this Topic:
- U.S. Regulatory Agencies
- Regulatory Frameworks
- Institutional Regulatory Oversight
- Accrediting Bodies
- Emerging Regulatory Issues
Critics have charged that regulations can hinder important research  and contribute significantly to the expense  and difficulty of conducting trials . A key challenge for the realization of a learning health system is how to evolve a regulatory structure that protects patients and the public while remaining efficient and flexible enough to facilitate needed research and methodological innovation. In this chapter, we describe key regulatory agencies and regulatory frameworks. We also discuss challenges and recent developments in the regulatory sphere that affect the ability to conduct effective, efficient, and affordable research.
U.S. Regulatory Agencies
Department of Health & Human Services
The Department of Health and Human Services (HHS) is the United States government’s principal agency for protecting the health of all Americans. Most of the agencies and institutes within DHHS are bound by a regulatory system known as the Common Rule, which is described in detail below.
Agency for Healthcare Research and Quality (AHRQ)
The Agency for Healthcare Research and Quality (AHRQ) is responsible for supporting research designed to improve the quality of healthcare, reduce its costs, address patient safety and medical errors, and broaden access to essential services.
The National Institutes of Health (NIH)
The National Institutes of Health (NIH) supports biomedical and behavioral research domestically and abroad, conducts research in its own laboratories and clinics, trains promising young researchers, and promotes acquisition and distribution of medical knowledge. The NIH comprises 27 individual institutes, each with its own specific focus on a disease area, organ system, or patient population.
The Office for Human Research Protections (OHRP)
The Office for Human Research Protections (OHRP) is a part of the Office of the Assistant Secretary (OASH) in the Department of Health and Human Services (HHS). It oversees the system that protects the rights, welfare, and well-being of research participants and ensures that research is carried out in accordance with regulations described in the Code of Federal Regulations (CFR).
The U.S. Food & Drug Administration (FDA)
Among its many responsibilities, the U.S. Food and Drug Administration (FDA) oversees the safety of food, drugs, medical devices, and products that emit radiation:
What Does FDA Do? "FDA is responsible for: - Protecting the public health by assuring that foods (except for meat from livestock, poultry and some egg products which are regulated by the U.S. Department of Agriculture) are safe, wholesome, sanitary and properly labeled; ensuring that human and veterinary drugs, and vaccines and other biological products and medical devices intended for human use are safe and effective - Protecting the public from electronic product radiation - Assuring cosmetics and dietary supplements are safe and properly labeled - Regulating tobacco products - Advancing the public health by helping to speed product innovations"
FDA regulates all clinical trials that are performed with the intent of bringing a new medical product to market, or of expanding marketing approval for an existing, approved therapy to a new indication. Although the FDA is part of DHHS, unlike other DHHS agencies and institutes it does not use the Common Rule as the basis for its regulations but is governed by a largely similar regulatory framework, described below.
The Common Rule
In 1991, the Department for Health and Human Services (DHHS) and 14 other federal departments adopted a set of rules for the protection of human subjects, The Federal Policy for the Protection of Human Subjects, also known as the Common Rule. The Common Rule is based on 45 CFR 46 subpart A and includes identical language in the separate regulations of those departments and agencies. (Click here for a list of the departments and agencies that adhere to the Common Rule.) The Common Rule applies to most federally funded research (or research conducted in federally funded institutions) and outlines the basic requirements for Institutional Review Boards (IRBs), obtaining and documenting informed consent, and assurances of compliance by research institutions.
The Common Rule defines research as “a systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge.”
Specific Provisions of the Common Rule (45 CFR 46)
- Subpart A: basic regulations regarding the protection of human subjects (issued 1974; revised 1981 and 1991).
- Subpart B: additional protections for pregnant women, human fetuses, and neonates involved in research (issued 1975; revised 2001).
- Subpart C: additional protections pertaining to biomedical and behavioral research involving prisoners (issued 1978).
- Subpart D: additional protections for children involved as subjects in research (issued 1983).
- Subpart E: requires registration of institutional review boards (IRBs) that conduct review of human research studies conducted or supported by HHS (issued 2009).
As part of Subpart E, OHRP maintains a registry of Institutional Review Boards (IRBs), maintains regulatory oversight, and provides interpretation and guidance, educational programs and materials on human subjects research.
The FDA has special authority to oversee research conducted for the purpose of marketing approval for medical products. These FDA regulations are published in Title 21 of the Code of Federal Regulations (CFR); those that concern the protection of human research subjects include:
- 21 CFR part 50, Protection of Human Subjects
- 21 CFR part 56, Institutional Review Boards
- 21 CFR part 312, Investigational New Drug Application
- 21 CFR part 812, Investigational Device Exemptions
Although the provisions of 21 CFR and the Common Rule are similar, there are some important differences. Click here for a table that compares FDA and other DHHS human subjects protection regulations. Regardless of the source of funding, most of the research conducted in the U.S. to support government approval for marketing is required to adhere to FDA regulations, as well as broader guidelines that govern research conduct, such as the International Conference on Harmonisation (ICH) guidelines for good clinical practice (GCP).
FDA Research Regulations A complete roundup of FDA regulations governing research is available here. For additional discussion of Common Rule and 21 CFR regulations as they apply to informed consent, click here.
The Health Insurance Portability and Accountability Act (HIPAA)
The Health Insurance Portability and Accountability Act of 1996 (HIPAA), Public Law 104-191, requires the Secretary of the Department of Health and Human Services (HHS) to publicize standards for the electronic exchange, privacy, and security of health information . To implement this law, HHS developed and published the Standards for Privacy of Individually Identifiable Health Information, known as the Privacy Rule, in December 2000, with final revisions taking effect in March 2002 . The Privacy Rule, which protects the privacy of individually identifiable health information, is enforced by the Department of Health and Human Services’ Office for Civil Rights. The rule applies to “covered entities,” which include health plans, healthcare clearinghouses, and those healthcare providers that conduct certain healthcare-related transactions electronically.
Privacy Resources Department of Health & Human Services: Summary of HIPAA Privacy Rule (PDF) Descriptions of "covered entities"
A key aim of the Privacy Rule is “…to assure that individuals’ health information is properly protected while allowing the flow of health information needed to provide and promote high quality health care and to protect the public’s health and well being. The rule strikes a balance that permits important uses of information, while protecting the privacy of people who seek care and healing .”
Privacy is a crucial factor for maintaining trust between a healthcare system and those it serves, and for allowing “the flow of health information” to inform both research and clinical care. However, public mistrust regarding the handling of sensitive data remains a significant factor; nearly 1 in 8 patients has withheld information from a healthcare provider due to privacy concerns .
International Conference on Harmonisation Good Clinical Practice (ICH-GCP)
In June of 1996, the International Conference on Harmonisation of Technical Requirements for Registration of Pharmaceuticals for Human Use published their guidelines for good clinical practice (ICH-GCP) (PDF). The guidelines were meant provide a uniform standard to protect the safety and rights of participants in trials and ensure the documentation of informed consent and the integrity of the data, and were intended to facilitate the conduct of multinational drug trials sponsored by the pharmaceutical industry .
“Good Clinical Practice (GCP) is an international ethical and scientific quality standard for designing, conducting, recording and reporting trials that involve the participation of human subjects. Compliance with this standard provides public assurance that the rights, safety and well-being of trial subjects are protected, consistent with the principles that have their origin in the Declaration of Helsinki, and that the clinical trial data are credible .”
Although ICH is a standards organization, not a regulatory agency, and its guidelines do not carry the legal force of federal regulations, ICH guidelines nevertheless have been widely adopted across national and international research settings and govern the conduct of much clinical investigation.
Institutional Regulatory Oversight
Institutional Review Boards
The Common Rule requires that all research involving human subjects be reviewed by an institutional review board (IRB) (also known as an ethics board). IRBs can be local (with oversight of a single hospital or health system) or may involve multiple health systems or institutions. Some, known as central IRBs (CIRBs) may provide review of proposed research for large numbers of institutions and systems. In order for an IRB to approve research, the following criteria must be met:
- Risks to subjects are minimized
- Risks to subjects are reasonable in relation to anticipated benefits
- Selection of subjects is equitable
- Informed consent is sought and appropriately documented from each prospective subject or the subject’s legally authorized representative
- The research plan makes adequate provision for monitoring of data
- There are adequate provisions to protect the privacy of subjects and to maintain the quality of data.
- Additional safeguards have been taken for vulnerable populations
More information regarding IRB study approval criteria can be found in 45 CFR 46.111.
An IRB is “…any board committee, or other group formally designated by an institution to review, to approve the initiation of, and to conduct periodic review of biomedical research involving human subjects (21 CFR 56.102g).”
IRBs and Informed Consent
Guided by regulations and guidance established by DHHS/FDA, the IRB decides how and what information should be furnished to research participants as a part of the informed consent process, and it requires documentation of informed consent unless documentation can be waived. A detailed summary of informed consent and its related regulatory issues can be found here.
The Association for the Accreditation of Human Research Protection Programs, Inc. (AAHRPP) is an independent, nonprofit accrediting body that uses a voluntary, peer-driven education model to accredit human research protection programs. Accreditation by AAHRPP is considered a global gold standard, and recent articles detail issues involved in the expansion AAHRPP accreditation to research sites in India  and China .
Emerging Regulatory Issues
Advance Notice of Proposed Rulemaking (ANPRM): Changes to the Common Rule
In the decades following the enactment of the Common Rule, the growth and expansion of human subjects research has led to questions about the adequacy of the regulatory framework for the protection of human subjects in the 21st century . In response, HHS announced that the federal government was contemplating changes to regulations on research on human subjects. The changes under consideration can be found in an Advance Notice of Proposed Rulemaking (ANPRM).
The government is seeking public input on issues related to ethics, safety, and oversight of human subjects. The intent is to revise the Common Rule and to modernize, simplify, and enhance the current system . After a period of public comment, the next step in the process will be to generate a Proposed Rule, although the public has been informed of no change in status since the ANPRM was announced.
For detailed discussion of proposed changes to informed consent regulations under the ANPRM, please click here.
Minimal Risk Research: Calibrating the Level of Review to the Level of Risk
Federally funded research involving human subjects is reviewed by a convened IRB or through an expedited review process that involves less than the full IRB. Research can qualify for expedited review if the research study conveys no more than minimal risk, or contains only minor changes in previously approved research in the previous year. Research must also fall into one of the research activities listed as eligible for expedited review.
Minimal risk means that the probability and magnitude of harm or discomfort anticipated in the research are not greater in and of themselves than those ordinarily encountered in daily life or during the performance of routine physical or psychological examinations or tests. Expedited review. Under an expedited review procedure, the review may be carried out by the IRB chairperson or by one or more experienced reviewers designated by the chairperson from among members of the IRB. –45 CFR 36
Many studies that use only activities listed as eligible for expedited review, particularly in the social sciences and behavioral fields, have been required to undergo review by a fully convened IRB . The ANPRM authors suggest that the regulations contain a presumption that if a study includes only activities on the eligible activities list, then it is a minimal risk study and should qualify for expedited review . To provide greater clarity about the definition of minimal risk, the authors suggest that the list of eligible activities be periodically reviewed and updated based on a systematic, empirical assessment of the levels of risk .
Numerous questions have been raised about how best to define minimal risk: Does randomization itself cause more than minimal risk? In a cluster-randomized trial (CRT) (one that randomizes groups of patients or entire facilities rather than individual patients ), if sites are randomized to treatment protocols thought to be in equipoise, does that constitute minimal risk? Should minimal risk be judged relative to healthy people or to people with the disease or problem under investigation? In a cluster, is minimal risk determination an assessment of the average or does the study need to be minimal risk for every person in it?
When treatments are thought to be in equipoise, clinical investigators are in a state of genuine uncertainty the regarding the superiority of one treatment for a given condition over the other . This principle is based on the obligations of investigators to provide patients with the best possible care , although there is considerable disagreement about appropriate definitions and acceptable levels of equipoise required for the ethical treatment of individuals .
Costs associated with expedited study reviews are roughly the same as for full reviews , and at least half of IRB costs are devoted to evaluating minimal-risk research . In addition, IRBs spend considerable time reviewing such studies, potentially diverting time and resources that might be better applied to research that poses greater risks. Because of this, some have suggested that minimal-risk research should be exempted from federal regulations . Other critics also argue that IRBs implement federal minimal-risk standard too cautiously , and point to considerable variability in IRB processes, even in minimal-risk studies .
The Institute of Medicine (IOM) report on research protections recommends calibrating the degree of scrutiny, oversight, and safety monitoring to a study’s degree of risk . Reducing burdens that do not translate into meaningful protections of human subjects would limit unnecessary drain on resources and allow high-risk studies to receive the extra time and attention they require .
The ANPRM describes potential refinements to ensure that protections are commensurate with the level of risk of the research study . The suggested revisions to the Common Rule would:
- Establish mandatory data security and information protection standards for identifiable information, and adopt the standards regarding what constitutes individually identifiable information.
- For minimal risk studies that undergo expedited review, eliminate the requirement for continuing review. For studies that undergo review by a convened IRB, eliminate continuing review after the study reaches the stage where procedures are limited to either analyzing data or accessing follow-up clinical data.
- Routinely revise the criteria for minimal-risk expedited review studies.
- Exempt from IRB review and approval any research on data collected for clinical purposes but secondarily used for research purposes. A one or two page registration of study with IRB/institution will be required instead.
- Require consent for research on biospecimens collected for clinical purposes even if specimens are not identifiable.
Research Studying Standard-of-Care Interventions
On August 28, 2013, HHS held a public meeting to gather input on how IRBs should assess risks of research involving randomization to one or more treatments within the standard of care for particular interventions, and what reasonably foreseeable risks of the research should be disclosed to research subjects as part of the informed consent process. Meeting transcripts can be found here.
IRB Review of Multisite Studies
IRB review of multisite studies can present a significant impediment to efficient conduct of multisite studies without conferring any countervailing benefit to patients . IRB review has been shown to be burdensome and may result in substantial delays and costs [24-27]; it can also be inefficient [28-30] and duplicative .
For example, if one IRB requires changes to the research protocol of a multisite study, the investigators must re-submit the revised protocol to all of the reviewing IRBs . Additionally, the level of review required from IRB to IRB can differ substantially, even for identical studies . In addition, local IRBs may lack expertise in evaluating issues created by certain study designs, such as a cluster-randomized trial (CRTs), while centralized IRBs (CIRB) may lack adequate context or knowledge relevant to local circumstances.
The Common Rule requires that each institution engaged in a multisite study obtain IRB approval of the study. However, it does allow for joint review. Sites conducting multisite research currently have the option to utilize a CIRB for study review , but institutions have been reluctant to replace local review with centralized oversight [24, 32]. To counterbalance this, the ANPRM authors propose mandating that all domestic sites in a multisite study rely upon a single IRB .
Joint Review “OHRP notes that multiple institutions may be engaged in the same non-exempt human subjects research project. For such cooperative research projects, institutions may enter into joint review arrangements, rely upon the review of another qualified IRB, or make similar arrangements to avoid duplication of effort, in accordance with HHS regulations at 45 CFR 46.114.” From 21 CFR 56.114: “Institutions involved in multi-institutional studies may use joint review, reliance upon the review of another qualified IRB, or similar arrangements aimed at avoidance of duplication of effort.”
Examples of Multisite Joint Review Models
- The Research Centers in Minority Institutions (RCMI) Translational Research Network (RTRN) is developing a community-partnered approach to streamlining IRB review across its consortium of 18 RCMI grantee institutions .
- Independent and commercial IRBs such as Western IRB and Copernicus offer centralized IRBs.
- National Cancer Institute’s (NCI) Central IRB Initiative was designed to help reduce the administrative burden on local IRBs and enable efficient enrollment of patients into NCI-sponsored clinical trials.
- The Department of Veterans Affairs’ Central Institutional Review Board reviews selected multisite projects funded by the VA Office of Research and Development.
- The Network for Excellence in Neuroscience Clinical Trials (NeuroNEXT) has a template (links to MS Word document) for central IRB authorization.
Vanderbilt University has developed the IRBshare system, which allows sites involved in a multisite clinical trial to share full board approved documents with other study sites. Other sites can use these documents in a shared review process with at least one local IRB member. If all federal guidelines are met and all local context issues are addressed, the study can then be approved. This allows the local site to remain actively involved, and there is no need to change submission processes that may already be in place.
Global Regulatory Agencies and IRBs
When trials involve more than one country, separate approval is often required from multiple organizations in multiple countries, and this may create significant delays . A list of global regulatory agencies can be found here.
The World Health Organization (WHO) Research Ethics Review Committee provides ethical review of all research that involves human participants and is funded or supported by WHO.
The WHO also provides guidance documents on global research ethics review committees:
- Standards and Operational Guidance for Ethics Review of Health-Related Research with Human Participants (PDF)
- International Ethical Guidelines for Biomedical Research involving Human Subjects (CIOMS 2002) (PDF)
- International Ethical Guidelines for Epidemiological Studies (CIOMS 2008) (PDF)
- The Strategic Initiative for Developing Capacity in Ethical Review (SIDCER) supports the implementation of the above WHO guidelines and accredits global Research Ethics Committees (RECs)
Navigating HIPAA Requirements
Although the HIPAA Privacy Rule was an important step in assuring patient protections, a number of unintended consequences resulted from its enactment . For example: before HIPAA, 89% of medical record and database research projects in Wisconsin went through an expedited review process ; after HIPAA (by 2002), this number dropped to 59%. In Michigan, researchers documented a substantial decline in the number of patients available for outcomes research, from 96% to 34% after HIPAA . Other studies documented post-HIPAA increases in the number of patients who drop out of studies and are not followed for major outcomes [36, 37]. In addition, selection biases and increases in costs, both scientific (e.g., decreased enrollment) and monetary, have been reported [33, 38].
Severe penalties for violating HIPAA provisions, such as fines and criminal prosecution, have led many covered entities to interpret the law in a relatively conservative and restrictive manner, and multiple conflicting interpretations of the law have been generated by differing regulatory bodies . These interpretations are sent to overburdened investigators and institutional review boards, and add significant additional paperwork and complexity .
The privacy rule requires a patient’s authorization for use of protected health information (PHI) for research unless the IRB or a privacy board grants a waiver, which can be a complex process . PHI refers to any “individually identifiable health information, including demographic data, that relates to:
- the individual’s past, present or future physical or mental health or condition,
- the provision of health care to the individual, or the past, present, or future payment for the provision of health care to the individual,
- and data that identifies the individual or for which there is a reasonable basis to believe it can be used to identify the individual .”
Like the Common Rule, HIPAA allows for a waiver of informed consent if the risk to individual privacy is considered low, if the research cannot practicably be conducted without a waiver, and if access to PHI is required to address the research question . Some registries have used an “opt-out” procedure for delivering information on the privacy rule. For example, the Vermont Diabetes Information System mailed passive consent letters to 7,558 eligible subjects, and 210 (2.8%) requested to withdraw , demonstrating the feasibility of recruiting a broad, representative study population while maintaining appropriate protections for research subjects. Other provider-led registries have combined quality improvement and research practices to develop data registries that capture clinical information and allow patients to be tracked over the long term . Such registries use agreements that permit data gathering and sharing (without consent) for QI purposes, and the aggregated data is then de-identified and used for research. Public health operations, including activities such as reporting, surveillance, investigations and interventions have been largely exempted from HIPAA’s restrictions .
“De-Identified Health Information. There are no restrictions on the use or disclosure of de-identified health information. De-identified health information neither identifies nor provides a reasonable basis to identify an individual. There are two ways to de-identify information; either: 1) a formal determination by a qualified statistician; or 2) the removal of specified identifiers of the individual and of the individual’s relatives, household members, and employers is required, and is adequate only if the covered entity has no actual knowledge that the remaining information could be used to identify the individual.” — From Summary of the Privacy Rule 
Research vs Quality Improvement
HIPAA provisions allow protected health information (PHI) to be collected, used, and disclosed without patient consent if the data will be used to improve healthcare operations. This includes “conducting quality assessment and improvement activities, including outcomes evaluation and development of clinical guidelines, provided that the obtaining of generalizable knowledge is not the primary purpose of any studies resulting from such activities.” It also includes “population-based activities relating to improving health or reducing health care costs, and protocol development.” Thus, if an activity is labeled as quality improvement (QI) and there is no intention to create or disseminate generalizable knowledge, the activity can be conducted without informing patients, obtaining IRB approval, or making provisions for monitoring beyond that provided by internal oversight within health system operations. Some research activities are labeled as QI in order to avoid the burdens of obtaining IRB approval and informed consent.
HIPAA Definitions A complete set of HIPAA definitions can be found here.
The Omnibus Rule
In January 2013, HHS issued an “Omnibus Rule” intended to strengthen individual rights while facilitating greater access to health information for research and to implement provisions in the Health Information Technology for Economic and Clinical Health (HITECH) Act.
The Omnibus Rule (PDF) includes two notable developments regarding the use of PHI in research. First, compound authorizations, which permit researchers to obtain authorization for multiple research-related purposes, are now allowed as long as the participant has the option to opt in or out. Studies involving PHI that have been required to use multiple consent forms will now be permitted to use a single form, which may prove less confusing to participants . Second, authorizations no longer have to be study-specific and a more general “prospective consent” for future research is permissible, as long as the description of the future research uses is sufficiently clear.
This change may facilitate the use of broad authorizations that that encompass a range of future research projects, including analyzing biomarkers, genetic associations, and other uses that might not be apparent when a study is begun, but could help answer critical questions in the future . As long as patients receive an adequate description of the scope of potential future research so that they can reasonably anticipate how their PHI might be used, prospective authorizations are possible .
Cluster Randomized Trials and the Ottawa Statement
In cluster-randomized trials (CRTs), groups such as medical practices, hospitals, clinics, schools or communities, are randomly allocated to study arms, and outcomes are then measured on individuals or groups within each study arm [15, 43–45]. The Ottawa Statement on the Ethical Design and Conduct of Cluster Randomized Trials provides detailed guidance on the unique issues affecting the ethical design, conduct, and review of CRTs . The authors describe 15 key recommendations for designing and conducting CRTs, and a series of related articles have explored specific issues in greater detail, including the following:
- Ethical Issues posed by cluster randomized trials in health research .
- Who is the research subject in cluster randomized trials in health research? 
- When, and from whom, is informed consent required in cluster randomized trials? 
- Does clinical equipoise apply to cluster randomized trials in health research? 
- Assessing benefits and harms in cluster randomized trials (In preparation)
- What is the role and authority of gatekeepers in cluster randomized trials? 
- Cluster randomized trials in vulnerable populations (In preparation)
A poster (PDF) summarizing the principles and implementation of the Ottawa Statement is available from the Ottawa Group.
Monitoring Clinical Research Activities
Monitoring, often as a part of an on-site visit to the investigative site, is conducted to oversee the progress of the trial, verify that the subjects are given informed consent, and ensure that the investigator and the IRB meet their regulatory responsibilities . According to ICH-GCP section 5.18.1, the purposes of trial monitoring are to verify that:
“(a) The rights and well-being of human subjects are protected. (b) The reported trial data are accurate, complete, and verifiable from source documents. (c) The conduct of the trial is in compliance with the currently approved protocol/amendment(s), with GCP, and with the applicable regulatory requirement(s).” 
ICH guidelines, including those describing monitoring obligations, were jointly developed by regulatory authorities and representatives from the medical products industry, but without involvement from academic experts in trial design and conduct . Despite the widespread adoption of ICH guidelines, there is little empirical evidence supporting their use , and critics have suggested that they have diverted resources into costly and time-consuming compliance activities of unknown value . For example, much emphasis is placed on ensuring the completeness and accuracy of data recorded, even though minor errors occurring in both treatment groups should not materially affect the findings .
There is general agreement that monitoring should focus on verifying that the rights and safety of participants are protected and on ensuring the reliability of study data . Monitoring should also be used to identify important problems early in a trial so that they can be addressed. However, the logistical and financial burdens created by frequent site monitoring visits may prove burdensome for community or routine healthcare settings .
Efforts to Streamline Monitoring
In response to the challenges posed by the increased number and diversity of sites involved in clinical trials, the Clinical Trials Transformation Initiative (CTTI) advocates the use of centralized statistical monitoring as part of a risk-based approach to ensuring trial quality . The authors recommend the identification and ongoing assessment of critical indicators that would indicate threats to patient safety or the integrity of results. This would enable early identification of issues and enable corrective actions, and emphasizes careful planning execution to reposition monitoring as a tool for evaluation and improvement . The FDA has endorsed risk-based monitoring , and European regulators have also recommended risk-based quality management .
A risk-based approach could also be applied to safety monitoring and reporting during trials. The ICH-GCP guidelines require that all serious adverse events (SAEs) be reported immediately to the sponsor except for those SAEs that the protocol or other document (e.g., Investigator’s Brochure) identifies as not needing immediate reporting . The ICH defines SAES as “any untoward medical occurrence that at any dose that:
- results in death,
- is life-threatening,
- requires inpatient hospitalization or prolongation of existing hospitalization,
- results in persistent or significant disability/incapacity, or
- is a congenital anomaly/birth defect.” 
“Suspected, unexpected” SAEs are typically reported on a case-by-case basis (rather than as grouped reports with a meaningful denominator) resulting in an overwhelming volume of reports on suspected unexpected serious adverse reactions . A more effective strategy could be based on the regular review of the safety data customarily collected by independent data monitoring committees, with the study and treatment assignments revealed and considered in the context of the efficacy results . The degree of reporting to regulatory authorities should be agreed on before the start of the trial and could depend on a number of risk-based factors, such as the amount of previous experience with the treatment being studied .
[Back to top]
1. Kramer JM, Smith PB, Califf RM. Impediments to clinical research in the United States. Clin Pharmacol Ther. 2012;91:535–541. PMID: 22318614. doi:10.1038/clpt.2011.341. ↑
2. Reith C, Landray M, Devereaux PJ, et al. Randomized clinical trials–removing unnecessary obstacles. N Engl J Med 2013;369:1061–1065. PMID: 24024845. doi: 10.1056/NEJMsb1300760. ↑
3. Institute of Medicine (US) Committee on Health Research and the Privacy of Health Information: The HIPAA Privacy Rule. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Nass SJ, Levit LA, Gostin LO, eds. Washington, DC: National Academies Press (US); 2009. Available at: http://www.ncbi.nlm.nih.gov/books/NBK9578/. Accessed December 15, 2013. PMID: 20662116. doi:10.1371/journal.pgen.l000167. ↑
4. Department of Health and Human Services. Human Subjects Research Protections: Enhancing Protections for Research Subjects and Reducing Burden, Delay, and Ambiguity for Investigators. 2011. Available at: http://www.gpo.gov/fdsys/pkg/FR-2011-07-26/pdf/2011-18792.pdf. ↑
5. Califf RM. Clinical trials bureaucracy: unintended consequences of well-intentioned policy. Clin Trials 2006;3:496–502. PMID: 17170032. doi: 10.1177/1740774506073173. ↑
6. McMahon AD, Conway DI, Macdonald TM, McInnes GT. The unintended consequences of clinical trials regulations. PLoS Med 2009;3:e1000131. PMID: 19918557. doi: 10.1371/journal.pmed.1000131. ↑
7. Health Insurance Portability and Accountability Act of 1996. Available at: http://www.hhs.gov/ocr/privacy/hipaa/administrative/statute/hipaastatutepdf.pdf. Accessed December 18, 2013. ↑
8. Department of Health and Human Services. Standards for Privacy of Individually Identifiable Health Information. 2002. Available at: http://www.hhs.gov/ocr/privacy/hipaa/administrative/privacyrule/privruletxt.txt. Accessed December 18, 2013. ↑
9. Department of Health and Human Services. Summary of the Privacy Rule. 2003. Available at: http://www.hhs.gov/ocr/privacy/hipaa/understanding/summary/privacysummary.pdf. Accessed December 17, 2013. ↑
10. Agaku IT, Adisa AO, Ayo-Yusuf OA, Connolly GN. Concern about security and privacy, and perceived control over collection and use of health information are related to withholding of health information from healthcare providers. J Am Med Inform Assoc 2014;21:374–378. PMID: 23975624. doi:10.1136/amiajnl-2013-002079. ↑
11. ICH Harmonised Tripartite Guideline. Guideline for Good Clinical Practice E6(R1). 1996. Available at: http://www.ich.org/fileadmin/Public_Web_Site/ICH_Products/Guidelines/Efficacy/E6_R1/Step4/E6_R1__Guideline.pdf. Accessed December 30, 2013. ↑
12. Bairy KL, Pereira P. Accreditation of human research protection program: An Indian perspective. Perspect Clin Res 2012;3:80–84. PMID: 22701825. doi: 10.4103/2229-3485.96455. ↑
13. Zi M, Tang X, Gao R. [The difference in acknowledging the AAHRPP between China and America]. Zhongguo Zhong Xi Yi Jie He Za Zhi 2012;32:1117–1120. PMID: 23173265. ↑
14. Hirshon JM, Krugman SD, Witting MD, et al. Variability in institutional review board assessment of minimal-risk research. Acad Emerg Med 2002;9:1417–1420. PMID: 12460847. doi: 10.1197/aemj.9.12.1417. ↑
15. Garrison MM, Mangione-Smith R. Cluster randomized trials for health care quality improvement research. Acad Pediatr 2013;13:S31–37. PMID: 24268082. doi: 10.1016/j.acap.2013.07.008. ↑
16. Freedman B. Equipoise and the ethics of clinical research. N Engl J Med 1987;317:141–145. PMID: 3600702. doi: 10.1056/NEJM198707163170304. ↑
17. Kukla R. Resituating the principle of equipoise: justice and access to care in non-ideal conditions. Kennedy Inst Ethics J 2007;17:171–202. PMID: 18210980. doi:10.1353/ken.2007.0014. ↑
18. Mhaskar R, B Bercu B, Djulbegovic B. At what level of collective equipoise does a randomized clinical trial become ethical for the members of institutional review board/ethical committees? Acta Inform Med 2013;21:156–159. PMID: 24167382. doi: 10.5455/aim.2013.21.156-159. ↑
19. Sugarman J, Getz K, Speckman JL, et al. The cost of institutional review boards in academic medical centers. N Engl J Med 2005;352:1825–1827. PMID: 15858200. doi: 10.1056/NEJM200504283521723. ↑
20. Kim S, Ubel P, De Vries R. Pruning the regulatory tree. Nature 2009;457:534–535. PMID: 19177111. doi: 10.1038/457534a. ↑
21. Wendler D, Belsky L, Thompson KM, Emanuel EJ. Quantifying the federal minimal risk standard: implications for pediatric research without a prospect of direct benefit. JAMA 2005;294:826–832. PMID: 16106008. doi:10.1001/jama.294.7.826. ↑
22. Institute of Medicine (US) Committee on Assessing the System for Protecting Human Research Participants. Responsible Research: A Systems Approach to Protecting Research Participants. Federman DD, Hanna KE, Rodriguez LL, eds. Washington (DC): National Academies Press (US); 2002. Available at: http://www.ncbi.nlm.nih.gov/books/NBK43563/. Accessed December 14, 2013. ↑
23. Hammatt ZH, Nishitani J, Heslin KC, et al. Partnering to harmonize IRBs for community-engaged research to reduce health disparities. J Health Care Poor Underserved 2011;22:8–15. PMID: 22102302. doi: 10.1353/hpu.2011.0157. ↑
24. Emanuel EJ, Wood A, Fleischman A, et al. Oversight of human participants research: identifying problems to evaluate reform proposals. Ann Intern Med 2004;141:282–291. PMID: 15313744. doi: 10.7326/0003-4819-141-4-200408170-00008. ↑
25. Duley L, Antman K, Arena J, et al. Specific barriers to the conduct of randomized trials. Clin Trials 2008;5:40–48. PMID: 18283079. doi: 10.1177/1740774507087704. ↑
26. Helfand BT, Mongiu AK, Roehrborn CG, et al. Variation in institutional review board responses to a standard protocol for a multicenter randomized, controlled surgical trial. J Urol 2009;181:2674–2679. PMID: 19375101. doi: 10.1016/j.juro.2009.02.032. ↑
27. Vick CC, Finan KR, Kiefe C, Neumayer L, Hawn MT. Variation in Institutional Review processes for a multisite observational study. Am J Surg 2005;190:805–809. PMID: 16226962. doi: 10.1016/j.amjsurg.2005.07.024. ↑
28. Dziak K, Anderson R, Sevick MA, Weisman CS, Levine DW, Scholle SH. Variations among Institutional Review Board reviews in a multisite health services research study. Health Serv Res 2005;40:279–290. PMID: 15663713. doi: 10.1111/j.1475-6773.2005.00353.x. ↑
29. Greene SM, Geiger AM. A review finds that multicenter studies face substantial challenges but strategies exist to achieve Institutional Review Board approval. J Clin Epidemiol 2006;59:784–790. PMID: 16828670. doi:10.1016/j.jclinepi.2005.11.018. ↑
30. Sherwood ML, Buchinsky FJ, Quigley MR, et al. Unique challenges of obtaining regulatory approval for a multicenter protocol to study the genetics of RRP and suggested remedies. Otolaryngol Head Neck Surg 2006;135:189–196. PMID: 16890066. doi:10.1016/j.otohns.2006.03.028. ↑
31. Burman WJ, Reves RR, Cohn DL, Schooley RT. Breaking the camel’s back: multicenter clinical trials and local institutional review boards. Ann Intern Med 2001;134:152–157. PMID: 11177319. doi:10.7326/0003-4819-134-2-200101160-00016. ↑
32. Jansen LA. Local IRBs, multicenter trials, and the ethics of internal amendments. IRB 2005;27:7–11. PMID: 16220628. doi: 10.2307/3563955. ↑
33. Littenberg B, MacLean CD. Passive consent for clinical research in the age of HIPAA. J Gen Intern Med 2006;21:207–211. PMID:16637821. doi: 10.1111/j.1525-1497.2006.00339.x. ↑
34. O’Herrin JK, Fost N, Kudsk KA. Health Insurance Portability Accountability Act (HIPAA) regulations: effect on medical record research. Ann Surg 2004;239:772–776; discussion 776–778. PMID: 15166956. doi: 10.1111/j.1525-1497.2006.00339.x. ↑
35. Armstrong D, Kline-Rogers E, Jani SM, et al. Potential impact of the HIPAA privacy rule on data collection in a registry of patients with acute coronary syndrome. Arch Intern Med 2005;165:1125–1129. PMID: 15911725. doi:10.1001/archinte.165.10.1125. ↑
36. Armitage J, Souhami R, Friedman L, et al. The impact of privacy and confidentiality laws on the conduct of clinical trials. Clin Trials 2008;5:70–74. PMID: 18283083. doi: 10.1177/1740774507087602. ↑
37. Fleming TR. Addressing missing data in clinical trials. Ann Intern Med 2011;154:113–117. PMID: 21242367. doi: 10.7326/0003-4819-154-2-201101180-00010. ↑
38. Tu JV, Willison DJ, Silver FL, et al. Impracticability of informed consent in the Registry of the Canadian Stroke Network. N Engl J Med 2004;350:1414–1421. PMID: 15070791. doi: 10.1056/NEJMsa031697. ↑
39. Califf RM, Muhlbaier LH. Health Insurance Portability and Accountability Act (HIPAA): must there be a trade-off between privacy and quality of health care, or can we advance both? Circulation 2003;108:915–918. PMID: 12939241. doi: 10.1161/01.CIR.0000085720.65685.90. ↑
40. Peterson E. Research methods to speed the development of better evidence—the registries example. In: Washington DC: National Academies Press, 2007. Available at: http://www.ncbi.nlm.nih.gov/books/NBK52826/. Accessed December 18, 2013. ↑
41. Goldstein MM, Pewen WF. The HIPAA Omnibus Rule: implications for public health policy and practice. Public Health Rep 2013;128:554–558. PMID: 24179268. ↑
42. Anon. Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification rules under the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act; other modifications to the HIPAA rules. Fed Regist 2013;78:5565–5702. PMID: 23476971. ↑
43. Donner A, Klar N. Design and analysis of cluster randomization trials in health research. London: Arnold; 2000. PMID: 18364501. doi: 10.1093/jnci/djn066. ↑
44. Murray DM, Pals SL, Blitstein JL, Alfano CM, Lehman J. Design and analysis of group-randomized trials in cancer: a review of current practices. J Natl Cancer Inst 2008;100:483–491. PMID: 18364501. doi: 10.1093/jnci/djn066. ↑
45. Zwarenstein M, Treweek S, Gagnier JJ, et al. Improving the reporting of pragmatic trials: an extension of the CONSORT statement. BMJ 2008;337:a2390. PMID: 19001484. doi: 10.1136/bmj.a2390. ↑
46. Weijer C, Grimshaw JM, Eccles MP, et al. The Ottawa Statement on the Ethical Design and Conduct of Cluster Randomized Trials. PLoS Med 2012;9:e1001346. PMID: 23185138. doi: 10.1371/journal.pmed.1001346. ↑
47. Weijer C, Grimshaw JM, Taljaard M, et al. Ethical issues posed by cluster randomized trials in health research. Trials 2011;12:100. PMID: 21507237. doi: 10.1186/1745-6215-12-100. ↑
48. McRae AD, Weijer C, Binik A, et al. Who is the research subject in cluster randomized trials in health research? Trials 2011;12:183. PMID: 21791064. doi: 10.1186/1745-6215-12-183. ↑
49. McRae AD, Weijer C, Binik A, et al. When is informed consent required in cluster randomized trials in health research? Trials 2011;12:202. PMID: 21906277. doi: 10.1186/1745-6215-12-202. ↑
50. Binik A, Weijer C, McRae AD, et al. Does clinical equipoise apply to cluster randomized trials in health research? Trials 2011;12:118. PMID: 21569349. doi: 10.1186/1745-6215-12-118. ↑
51. Gallo A, Weijer C, White A, et al. What is the role and authority of gatekeepers in cluster randomized trials in health research? Trials 2012;13:116. PMID: 22834691. doi: 10.1186/1745-6215-13-116. ↑
52. Liu MB, Duke Clinical Research Institute. A clinical trials manual from the Duke Clinical Research Institute: lessons from a horse named Jim. 2nd ed. Chichester, West Sussex, UK ; Hoboken, NJ: Wiley-Blackwell; 2010. ↑
53. Morrison BW, Cochran CJ, White JG, et al. Monitoring the quality of conduct of clinical trials: a survey of current practices. Clin Trials 2011;8:342–349. PMID: 21730082. doi: 10.1177/1740774511402703. ↑
54. Grimes DA, Hubacher D, Nanda K, Schulz KF, Moher D, Altman DG. The Good Clinical Practice guideline: a bronze standard for clinical research. Lancet 2005;366:172–174. PMID: 16005342. doi:10.1016/S0140-6736(05)66875-4. ↑
55. Landray M, Grandinetti C, Kramer J, Morrison B, Ball L, Sherman RE. Clinical Trials: Rethinking How We Ensure Quality. Drug Inf J 2012;46:657–660. doi: 10.1177/0092861512464372. ↑
56. U.S. Department of Health and Human Services, Food and Drug Administration. Guidance for Industry: Oversight of clinical investigations, a risk based approach to monitoring. 2013. Available at: http://www.fda.gov/downloads/Drugs/Guidances/UCM269919.pdf. ↑
57. European Medicines Agency. Reflection paper on risk based quality management in clinical trials. 2011. Available at: http://www.ema.europa.eu/docs/en_GB/document _library/Scientific_guideline/2011/08/WC500110059.pdf. ↑
58. Sherman RB, Woodcock J, Norden J, Grandinetti C, Temple RJ. New FDA regulation to improve safety reporting in clinical trials. N Engl J Med 2011;365:3–5. PMID: 21651388. doi: 10.1056/NEJMp1103464. ↑
Topic chapter originally published on March 14, 2014.
- Questions or comments about Rethinking Clinical Trials can be submitted via email. Please add “Living Textbook” to the Subject line of the email.
- Follow the NIH Collaboratory on Twitter!