Chapter 06: Two Decades Overseeing Human-Subject Research
Files
Loading...
Description
In this chapter, Dr. Freedman discusses his more than twenty years of experience overseeing human subject research on the Institutional Review Board (IRB). He sketches the history of human subject guidelines and clarifies IRB procedures, potential conflicts of interest (between IRB members and the institution), and the kinds of research protocols of concern to the IRB, whose primary function is the protection of human subjects. He then discusses his belief that regulation is very necessary, but that it has currently gone too far. He points out that different protocols represent different levels of risk, some of which may not require IRB regulation, such as experiments in which the main risk is to patient privacy. Dr. Freedman offers rich detail about the challenges to researchers and describes systems that might satisfy the public’s need for privacy and information security while easing the burden on researchers who want to move ahead quickly with their work. “We needed these systems yesterday,” Dr. Freedman asserts. He gives examples of how his understanding of the need for regulation and its potential complexity evolved as his experience as a researcher grew, then expands his focus again and discusses how regulation can influence how a researcher focuses his or her career.
Identifier
FreedmanR_02_20120301_C06
Publication Date
3-1-2012
City
Houston, Texas
Interview Session
Topics Covered
The University of Texas MD Anderson Cancer Center - Building the Institution; Building/Transforming the Institution; MD Anderson History; MD Anderson Snapshot; MD Anderson and Government; Understanding Cancer, the History of Science, Cancer Research The History of Health Care, Patient CareLeadershipEthicsProfessional PracticeThe Professional at Work
Creative Commons License
This work is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 License.
Disciplines
History of Science, Technology, and Medicine | Oncology | Oral History
Transcript
Ralph Freedman, MD
So a vice president, a lawyer from Compliance—we used to have the lawyers from Compliance in the committee, and the problem––as I told Jessica––is the issue for us is that Compliance, their mission is to protect the institution overall, primarily. I mean, they do protect patients. When the patient has a complaint, they take these things out, but I think, at the end of the day, the primary purpose is to protect the institution from lawsuits, from bad publicity, whatever it is. Our role is to protect the subjects and not to––although indirectly, we protect the institution but not to have the protection of the institution as the direct object of our deliberations. Obviously, we’re not going to do anything stupid that would put the patient––the institution in jeopardy, but it’s not our main objective. So what’s happened is those individuals, they get invited on an as needed basis, like if there’s an issue that comes up that we feel the expertise is not in the IRB, we have the authority to ask to bring in those experts from wherever. It could be from Compliance, it could be from across the road, from anywhere in order to assist the committee in making its deliberations, and that is actually stated in the regulations that you can do that. But these individuals would not have voting rights, so they can come and present, and they’ll be asked questions, and then we let them go out, and there’s further discussion. Then the motion comes up, and the vote is taken with these people out of the room.
Tacey Ann Rosolowski, PhD
What’s the relationship between the IRB and the ethics and compliance and clinical research? That was the conference that you were talking about earlier.
Ralph Freedman, MD
Oh, okay.
Tacey Ann Rosolowski, PhD
Is there a link between those or–– ?
Ralph Freedman, MD
Yeah, so the IRB––so the vice president, Dr. [Aman] Buzdar got together with the chairs of the IRB, and we came up with a program. This would be after the conference. It’s an international conference, and the idea is to choose topics that are maybe a bit controversial, but they’re not––we feel that faculty may need to know more about the subjects, and the IRB––certainly members––would maybe need to know more about it so that they can make decisions, the appropriate decisions. A lot of what human subject research is, there’s different aspects of it. One is basically the regulation, the law, following the regulation, following the guidance with the intent that subjects are notified, but there’s a lot of education, as well. Our primary role is not punitive; it’s not to discipline people. Our primary role is to ensure that patients are protected through good practices, so often we have to teach those practices. And it may be an individual protocol, issues that arise with that protocol, and a corrective action plan is required, so you hope they go through that experience, that the investigator and the team members will have learned from that, so the next time they face that situation, they won’t have to deal with it. So our last resort is a punitive decision where you close down some research. And in most instances, literally ninety-nine out of 100 instances, we’re able to correct the behavior of individuals and actually provide them with new pathways and new guidelines for doing things. I mean, their regulations are not really guidelines but just change their behavior so that the ultimate result is that the subjects are protected.
Tacey Ann Rosolowski, PhD
What’s the landscape of the protocols that come under your eyes? I mean, what percentage of them go through, and they’re well-designed, and they satisfy guidelines? What’s the percentage that need some tweaking? What’s the percentage where people actually need some intervention, and what are the numbers that actually have to closed down?
Ralph Freedman, MD
Oh, first of all, there’s virtually no protocol. That doesn’t have some contingency attached to it because there’s always some improvement that people can do. We don’t try to change the science. Once it’s gone through the scientific committees, and the science is accepted, although the IRB has the prerogative to look into the science, and sometimes we’ve sent the protocol back to the science committee to re-review it, but I would say that, in most cases, it’s an approval with a contingency. There are few that are rejected. If a protocol is rejected, that’s a big issue because. For one thing, we have to forward it to the OHRP that we’ve actually rejected a study.
Tacey Ann Rosolowski, PhD
What is the OHRP?
Ralph Freedman, MD
The Office for Human Research Protection in Washington, and the reason for that is that what people have done is they’ve gone around and done IRB shopping to get their protocol approved. And some of the companies have even done that, so they’ll go to a central IRB that’s got a better record of approving studies than others with the least amount of difficulty. So I would say most––there are really few that are actually––so in most cases, you would approval with contingency, and you might have defer––defer which is another action. In other words, there are real concerns about the study but not something that can’t be retrieved and redesigned and amended, and then they’ll come back, and often they’ll get approved.
Tacey Ann Rosolowski, PhD
What are some of the issues that come up that can be of concern?
Ralph Freedman, MD
Well, is it ethical to do the work? In other words, is it appropriate to have a placebo control? When is it appropriate to have a placebo control in a study? And basically a placebo control, it’s ethical if there is clinical equipoise. In other words, you have a group of experts who cannot decide which arm of a treatment is better. So you might allow a placebo in that situation with an opportunity to cross over for those patients, or if it’s, say, near the end of life, and you’re looking at a treatment that has subjective component to it but is a placebo effect, you might allow comparison with a placebo because it’s over a short period of time and it’s the only way that you can show a difference between the arms. The placebo might be accepted there. Or you might permit a placebo to combine with an active drug, so two active drugs and one arm, one active drug plus a placebo in the other arm where you’re mainly interested in the matching to the placebo with the only arm that has the two drugs––the one drug of the two that’s new, and the one that goes along with the placebo would be a standard drug. So you’d have standard plus test drug, standard plus placebo in the other arm, and that’s done not infrequently today. So there are situations with placebos not only ethical but it’s necessary in order to show benefit.
Tacey Ann Rosolowski, PhD
All right. We’re back after a brief break.
Ralph Freedman, MD
So I think the IRB actually––if we understand that the test––its role is certainly protection of human subjects—that’s certainly number one—but also educating physicans and their teams. Today, it’s a team––most research that’s done on patients is a team approach—and it should be because it’s––there are few studies today that can be done by a single person. For example, you need a research nurse. We couldn’t do without research nurses because there’s so much documentation and submission of forms, submission of reports, and the physicians are also seeing patients in for standard of care in addition to doing clinical research, so they need as much help as they can get in making sure that they do things adequately. They need all this support, and then, of course, you need other investigators to help you do that work. And there are different levels of research, and they are basically related to risk. The newest drugs first in human trials are going to be at the top in certainIND studies. Investigation of a new drug—which, by the way, all thatIND means is permission that the FDA gives an investigator was sponsor to take a drug across state lines, so they can do the study in different states. That’s what theIND does. This is compared, say, to new drug application where a new sponsor wants to obtain approval for a specific indication related to a new drug. They first have to have theIND in order to conduct the studies, and then they come up with a new drug application once they’ve got the studies underway in order to see if the FDA will approve the indication that’s being approved for that drug. FDA doesn’t actually approve the drug. They approve the indication for the drug.
Tacey Ann Rosolowski, PhD
I think it was last time you had mentioned something about how very needed regulation was but that had gone too far, and is this a time to maybe talk about this issue?
Ralph Freedman, MD
Yeah, yeah, yeah. I think there’s––look, it’s with everything. It’s like a pendulum, and there comes a point where you’ve had a chance to work within a system and you can see what works and what doesn’t work. I think a lot of the research that we do is so-called minimal-risk research or low-risk research. Basically, the only issue of concern there is privacy, and I think many individuals today––the people who work with computers and have bank accounts and have to work with government or state at some level have an understanding for what is possible to protect their privacy or not. People used to talk a lot about don’t give out your social security number, and now I just heard that from Google, they can actually know so much about you––your profile and more. So when the patient agrees to provide samples or clinical information to an investigator to do research, I think they should have an understanding that the researcher––or the environment where that research is done––will do the best that it can in order to protect their privacy. But nothing is absolute. We cannot guarantee that privacy will be protected. With the new high tech act that came in last year, they’re subjecting institutions to big penalties for breakdowns in privacy, so this––and the problem is that it’s gotten––to protect privacy involves so much technical know-how and technology that it’s no longer fitting that the IRBs be responsible entirely for protecting that privacy. This came out last year when the HHS submitted a proposal to change the rules to broaden the area of minimal risk and they actually raised the question whether IRB should still be responsible for this. For that type of research–– And the other thing is that we’ve got regulation on board, because you were asking me specifically about regulation. The HIPAA regulation––Health Insurance Portability Act––was basically designed for insurance purposes, not for conducting human subject research, so they have different definitions of what a human subject is to what theHHS has. By the way, they’re all in the same group because HIPAA comes under the Office of Civil Rights under theHHS, you’ve got different offices. You got the Food and Drug Administration; you’ve got the Office for Human Research Protection; you’ve got the Office for Research Integrity––and they deal with fraudulent issues––and then you have the Office of Civil Rights.
And HIPAA is controlled by them, but all of this falls under the general umbrella of theHHS, so you’ve got agencies for all, and yet, they have different sets of rules and different sets of regulations. So for example, we have a federal-wide assurance, which says that we will be compliant withCFR45, 46, which are the regulations that relate to human subject research that is funded by the government. We could actually opt out of that by just signing one little box, but we haven’t, and so in the federal-wide assurance that the institution official signs, it says that we will comply with all these rules and if there are unanticipated problems, that we will report these to the government. They have––the first part of this is what’s called the common rule, which basically talks about definitions of human subject research, IRBs, how they should be formed and the responsibilities of the individuals, and then we get to vulnerable populations and so forth. In theHHSdefinition it says that only a living person is a subject. According to HIPAA, even if you’re deceased, you’re still a human subject, so the problem then for researchers who do a lot of edemiology-type research is that the population that they’re studying includes deceased people who, because of the research––and you’ve got to get authorization from family members in order to get access to that information, whereas under theHHSyou don’t need it because a deceased person is not a human subject, so then they allow you to get waivers––HIPAA will allow you and the other will allow you to get a waiver for informed consent or authorization. Informed consent is what we generally get from a participant. Authorization is what we require under HIPAA––authorization to access their records, authorization to use those for research—and the HIPAA requires you to be very specific about what you’re going to do with it. So whereas theHHSrules may be satisfied if you said I was going to do the laboratory research or there’s nothing going into patients––there’s no risk to them; it’s just privacy issue and protect the privacy the best we can—HIPAA will say no, you got to say exactly what lab experiments, and then if you want to change your research by adding different reagents or something, you’re supposed to come in and get their permission. That’s the way it is, so you can get a waiver if it’s not feasible to do the research without accessing the private information, and they use that the terminology, practicable––they use the word practicable, which means that it’s impossible, basically, to do it without getting access or without getting thePHI––the private information. Well, it’s always possible, and that’s where the problem is because it may take you two months to get authorization, find out who the family member is who’s responsible, who’s the legal authorized representative in order to grant you access when what we’re talking about is not any research that’s going to affect either the family members or the community, perhaps, because in those cases, we treat it separately, and we might actually require consent. For example, the Huntington’s chorea is a genetic disorder, and it occurs in families, so if you’re going to do research on that type of situation, you would want to get permission from them and also inform them how you would deal with that with the results, how you would disseminate them back––that problem happened with that in a South American country some years back––so there’s no harmony between the two groups. Basically, what we need is a system that the public can have confidence in. So we’re talking about hardware; we’re talking about software; we’re talking about processes––hardware computers, so now they are busy installing Windows 7––Windows 8––
Tacey Ann Rosolowski, PhD
I think eight.
Ralph Freedman, MD
––onto all the computers. Not all the computers can take it, so they’ve got to abandon those computers and now get new ones, but those can be encrypted––the information can be encrypted at least, so there needs to be––and we’ve talked about this––it needs the institution to come up with systems in place. This is the equipment that you are permitted to store patient information on. It has to be in a password protected area; it has to be encrypted. If you happen to have this on your laptop and you leave the facility and your laptop gets stolen, gets lost, nobody can get access to that information or it’s unlikely––really difficult. And then you have to have software that can be––also protect the individuals, and in the case of the FDA, they want you to be compliant with part eleven, which is that nobody can manipulate data. In other words, there’s signing in and signing out for every event that happens where that data’s taken out––if it’s worked on, calculations done with it, there’s a signature pathway that goes with it, so you’ve got information security; you’ve got information technology; you’ve got the people who buy the equipment––the contractors. But most of this is outside the domain of the IRB. Institutions should really have to pick up the ball here and provide the resources to the investigators or provide the investigators with solid guidelines as to what is acceptable practice to protect the subjects’ purity. Once we’ve got all this in place, I think you could come to the public with a strong argument and say we’ve got processes in place, which are equivalent to what your government has, what your state has, what your bank has, and we can’t guarantee that your privacy be protected, but if you want to participate in this research, this is what we’ve got in order to protect your privacy.
Tacey Ann Rosolowski, PhD
What’s the situation with all of those components at MD Anderson right now?
Ralph Freedman, MD
Right now, it’s evolving. Unfortunately, I think when a person view––and that is not mine or any others––is that we’ve lost a lot of time building these systems and building these processes. It’s taken events to happen, to get into the media to encourage us to do these things. There are committees that are working on this. We needed it yesterday––the moment we started working with this private information, so that––
Tacey Ann Rosolowski, PhD
But why has there been such a slow process to come up with–– ?
Ralph Freedman, MD
Well, it changed after 2003. HIPAA was enacted in 2003, and HIPAA changed everything because things were much easier. Now I don’t know that HIPAA has solved problems or has prevented problems from occurring to a great extent. It’s an extra layer of––it’s become an extra burden, basically, to researchers, and IRBs have to spend so much more time reviewing these things, so instead of taking care of physical and other risks to subjects, we’re spending a lot of time on privacy risk, where if the systems were in place, we shouldn’t be bothering about this. We should allow somebody who wants to submit a study to look at data from the institution, and if they’re going to comply with all these things, it should be able to go through on a templated-based system, and there may need to be a record of access and release, but the risks basically would not be very––they’d be very minor. So I think this is part of the thing is to have the systems in place for the researchers to use, and then regulations, so these regulations which we’re not sure protect anyone or they are certainly burdensome, and there should be a way of removing unnecessary––or there should be at least a very careful look at what we have to see where these things can be amended or changed so that patients can still be protected but not with additional burden to the researchers. That way, the research can get done more quickly. You can access the necessary patient information. We talk about honest broker systems––honest broker systems, which can––we don’t have any such thing at Anderson, but data tissue banks basically could be operated by honest brokers, and they don’t have to be a person, but it could be a technical thing that allows people access to only certain information but keepPHI back.
Tacey Ann Rosolowski, PhD
Okay. Because I have not heard that phrase before. I wasn’t––
Ralph Freedman, MD
Yeah, so that’s––I mean—it’s one of the recommendations of the NIH for developing tissue repositories as the honest broker system’s being placed. The only problem with the honest broker system that I see is that investigators need to have access to a lot of information, and the honest broker––if you’ve got many investigators, you may not have enough people doing––separating thePHI out from the information that the investigators are requesting, so it may not be feasible. On the other hand, if you have secure computers and secure programs, that may cover it, and I would say a lot of research today, you need more than just a pathology diagnosis. You may want to know, for example, what happens to these patients long term, so you may need a followup. If you only need the tissue in order to study something there, and that’s probably a minority of research that goes on, then it’s okay, because you can go to the tissue bank and say I want x number of tumors from certain a type of cancer, and I don’t want the identifiers, so they give them to you, and then you do the research. You probably should go with research exempt, so the exempt category, you don’t continuing review. You can be administratively approved, and you can go through, so the idea that was submitted in the federal register last year was to broaden this category—somehow to broaden it so that there were less barriers in the way to separating the investigators from the research material. So this is a major issue––getting to grips with the privacy issue, even case reports.
I mean, you may have someone who was treated at MD Anderson with an unusual history and the investigator wants to publish a case report. Well, according to the HIPAA law, you’ve got to get authorization even though the patient is deceased. You’ve got to get authorization from the family. Now, they’ve gone through a tough time maybe, and maybe they don’t want to talk to anybody over here about things at this time,"
Recommended Citation
Freedman, Ralph MD and Rosolowski, Tacey A. PhD, "Chapter 06: Two Decades Overseeing Human-Subject Research" (2012). Interview Chapters. 946.
https://openworks.mdanderson.org/mchv_interviewchapters/946
Conditions Governing Access
Open
