Chapter 3 Human Subject Protection and Research Regulation

3.1 Introduction

3.1.1 Module Goal

The goal for this module is to introduce the essential elements of human subjects’ protections and regulatory requirements pertinent to the conduct of clinical trials. Essential aspects of human subjects’ protections and regulatory requirements provided in this module include:

  • Institutional Review Boards.
  • Health Insurance Portability and Accountability Act (HIPAA).
  • Data Use Agreements (DUA).
  • ClinicalTrials Registration.
  • Data Safety Monitoring.
  • Informed Consent.
  • Adverse Event Monitoring and Reporting.

3.1.2 General Considerations About Federal Regulations

The regulation of clinical trials can be complex. What may be seen by investigators as trivial regulations or minor misdemeanors can have serious consequences for the individual investigator, their institutions, sponsors, and trial subjects. Therefore, it is wise to be over-cautious and anticipate problems before they arise. As regulatory issues can play a critical role in your trial design, it is strongly advised to consider these issues from the very start of project planning (e.g. grant preparation) by consulting with your Institutional Review Board (IRB), and making sure you understand existing regulations and institutional policies.

Federal agencies including the U.S. Food and Drug Administration (FDA) and the Department of Health and Human Services (HHS), which includes National Institutes of Health (NIH), make and enforce regulations to ensure the safety of participants in clinical trials, and retain final authority for determining whether an institution has been compliant. Investigators should review the specific regulations of the funding or over-seeing agency and confer with the IRB to determine whether additional regulations or policies apply. The investigator must keep in mind that when more than one regulation, guidance, or policy applies the most stringent must be followed.

HHS regulated trials (includes NIH): HHS requirements for federally funded human subjects’ research is codified in 45 CFR Part 46 “Protection of Human Subjects”. This set of regulations are based on the Belmont Report.

FDA Regulated Trials: The FDA has their own set of human subject regulations and regulations CFR – Code of Federal Regulations Title 21 governing IRB activities, which goes beyond the scope of this module. A key initial step is to determine whether or not your trial falls under the regulatory jurisdiction of the FDA which generally oversees drug and device trials. For more information check FDA regulations.

Office of Human Research Protections (OHRP): The OHRP is the federal body responsible for compliance monitoring. Under Title IV of the Public Health Service Act (42 USC 281 et seq.), OHRP has the authority to investigate complaints about human subject protections in HHS-funded research, or other research covered by the institution’s Assurance of Compliance. For general regulatory issues, particularly for federally funded trials, refer to the OHRP website.

International Conference on Harmonization (ICH) Good Clinical Practice (GCP): While federal regulations provide the standards by which human subjects research is to be conducted, guidance documents and institutional policies add specificity and provide direction on how to apply regulatory requirements. One such guidance is the ICH GCP guidance. Compliance with the ICH GCP assures that the rights and well-being of trial subjects are protected and that the clinical trial data are credible.

3.1.3 Resources

3.2 Institutional Review Board (IRB)

3.2.1 What

An Institutional Review Board (IRB) is an appropriately constituted group formally designated to review, approve and monitor research involving human subjects to ensure it is conducted in accordance with applicable federal regulations, institutional policies, and ethical guidelines.

While all IRBs are responsible to adhere to the same regulations as defined by OHRP, each IRB is required to have its own institutional policies and operates differently. It is critical to understand the requirements of the IRB overseeing your project. Specific information relevant to HSL IRB can be found on the IRB section of the HSL website as well as the internal HSL “HUB”.

3.2.1.1 Categories of IRB oversight

Depending on the study design and degree to which human subjects are involved, the IRB will review the research and will make a determination on the appropriate review level. The basic levels of review include:

  • Exempt (determination by IRB Chair or her designee).
  • Expedited (review/approval by IRB Chair or her designee).

Full Board (review/approval by the convened IRB) Most clinical trials will require full IRB review.

3.2.1.2 IRB applications and reviews

IRB applications include:

  • Initial application.
  • Annual/continuing review.
  • Amendments/modifications to the protocol or study materials.
  • Incident reports for:
    • Unanticipated problems.
    • Non-Compliance.
3.2.1.2.1 Initial review of research application

All human subjects’ research must be reviewed and approved by an IRB before human subjects activities can begin. This includes recruitment efforts, and receiving or collecting data. Per Federal and Institutional policy, no funds for research involving human subjects activities will be released until the appropriate IRB approval has been secured.

3.2.1.2.2 Annual/Continuing review

Investigators must receive continuing approval of their research at least annually. On some occasions, more frequent review may be required by the IRB. Continuing approval is required until all activities with human subjects are complete (this includes access to data with participant identifiers or with codes that can be linked back to research participants).

3.2.1.2.3 Amendment submissions

Investigators must submit all changes to the research or research materials and receive IRB approval for those changes prior to implementation (except when necessary to eliminate apparent immediate hazards to research participants).

3.2.2 Why

The IRB assures that a clinical trial is in compliance with federal and state regulations, institutional policies, and accepted ethical guidelines, to protect the rights and welfare of research subjects.

3.2.3 How

3.2.3.1 IRB review for single site trials

The procedures for IRB review differ by institution but have common main elements. It is wise before you embark on your IRB application to consult with the IRB office to review the general study design and anticipate key review considerations.

The HSL IFAR IRB uses an electronic submissions system (Cayuse). Forms are templated and will guide you through the required elements. Application submissions must meet deadlines stipulated in the HSL IFAR IRB Standard Operating Procedures.

3.2.3.2 IRB review for multi-site trials

Many clinical trials involve multiple sites and/or investigators from multiple institutions. Many clinical trials involve multiple sites that are clearly engaged in human subjects’ research (i.e., site personnel are recruiting subjects, implementing an intervention, or collecting data). Regulatory oversight of these trials can be done either by:

  • Single IRB review (one IRB reviews the research, and the other IRBs rely on the reviewing IRB).
  • Multiple IRB reviews (e.g. each institution conducts its own IRB review/approval).

In June 2016, the NIH established a policy effective May 25, 2017, requiring a single IRB for all NIH-funded multisite studies, with only rare exceptions.

IRBs of engaged sites and investigators may cede oversight responsibility to the IRB reviewing the research (also referred to as the IRB of record). Relying on an external IRB, or ceded review, is documented with a formal agreement between the reviewing and relying site IRBs and must be signed by an Institutional Official. Note: If you are conducting research with Harvard affiliates, you may rely on the Harvard Catalyst Reliance Agreement, rather than an IRB Authorization Agreement. See the HSL IRB office for more information.

Some study sites engaging in human subjects’ research (e.g., community nursing homes) may not be associated with an IRB. In this case the reviewing IRB may agree to provide IRB oversight for the external site through a formalized agreement (Individual Investigator Agreement) between the two parties. Alternatively, a commercial IRB may be engaged in a contract to provide oversight for that external site. Sites that receive direct federal awards for research purposes may also need a FederalWide Assurances. These determinations will be made by the prime IRB responsible for the trial.

3.2.4 Special Considerations for Older Subjects

There are two special considerations for special protections governing research with elderly subjects: cognitive impairment and institutionalization. Under those conditions, a number of issues must be taken into consideration. See OHRPs related guidance and HSL IRB’s Standard Operating Procedures (SOPs). See also Informed Consent related to the decision making capacity.

3.2.5 Common Pitfalls

  • Not seeking IRB guidance in the process of trial design and well in advance of your planned start date.
  • Underestimating the time it takes to get IRB approval.
  • Underestimating regulatory requirements. Failure to meet requirements could lead to serious consequences for yourself and your institution. Be overly cautious and always report anything of potential concern to your IRB.
  • Flippant or casual comments about human subjects’ or regulatory issues about your trial via emails or text. If a problem occurs, all related communication may be become eventually become relevant.

3.3 The Health Insurance Portability and Accountability Act (HIPAA)

3.3.1 What

The HIPAA, enacted through the Privacy Rule, establishes national standards for the protection of protected health information (PHI). The rule establishes conditions under which PHI may be used by covered entities1, including for research2 purposes. With regards to research, the Privacy Rule also defines the means by which individuals should be informed of uses of their medical information for research purposes, and their rights to access information about them held by covered entities.

1Covered entities: health plans, health care clearinghouses and health care providers who transmit any health information in connection with transactions for which HHS has adopted standards.

2Research: Defined in the Privacy Rule “a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge.”

3.3.2 Why

The Privacy Rule protects the privacy of individually identifiable health information, while at the same time ensuring that researchers have access to medical information necessary to conduct vital research.

3.3.3 How

The Privacy Rule builds upon the protections provided to human subjects in the Common Rule (45 CFR Part 46, Subpart A), and/or the Food and Drug Administration’s (FDA) human subject protection regulations (21 CFR Parts 50 and 56). There are three main areas for researchers to consider.

3.3.3.1 Screening patients for recruitment

Selection of subjects for a clinical trial often requires identifying patients with specific characteristics (e.g., a diagnosis) from a large patient population using data considered PHI. To facilitate such efforts, covered entities are permitted to use and disclose PHI for research purposes pursuant to a waiver of authorization by an IRB or Privacy Board. At HSL, the IRB also serves as the Privacy Board.

3.3.3.3 Handling of PHI throughout the trial

A core tenant of HIPAA and the use of PHI is to use the minimum necessary information in order to maintain and protect patient privacy. As such, clinical trials must be designed and conducted to minimize unnecessary data collection and maximize subject confidentiality. Whenever possible, information obtained from patients or their medical records should be collected without identifiers. When identifiable data is collected, the protocol must be designed to maintain confidentiality of identifiable data, and data security measures appropriate to the degree of risk from disclosure.

A complete summary of key elements of the Privacy Rule including who is covered, what information is protected, and how PHI can be used and disclosed is presented in the “Summary of the HIPAA Privacy Rule. HSL-specific policies regarding HIPAA, and the use of PHI in research can be found in the HSL IRB SOP.

3.3.4 Special considerations for older subjects

NONE

3.3.5 Common Pitfalls

  • Inadequate protection PHI (e.g., transporting patient files with identifiers in an unsecure manner, unencrypted laptops or databases that contain PHI etc).

3.3.6 Resources

Internal

3.4 Data Use Agreements (DUA)

3.4.1 What

A data use agreement (DUA) is a contractual agreement required under the Privacy Rule between a HIPAA covered entity (e.g., HSL) and a third party who wishes to obtain PHI with limited identifiers, referred to as a Limited Data Set (LDS). DUAs address issues such as limitations on use of the data, obligations to safeguard the data, liability for harm arising from the use of the data, publication, and privacy rights that are associated with transfers of confidential or protected data. Refer to HIPAA, Section 45 CFR part 160 Subparts A and E of Part 164 for details. A common example of a study that requires a DUA, is one that utilizes Medicare data for which a DUA must be set up with the Centers for Medicare and Medicaid. See resources below for guidance.

3.4.2 Why

In addition to the requirements set forth in the Privacy Rule, a DUA clearly establishes the rules and expectations related to provision and use of data by the involved parties (provider and recipient). DUA must be entered into before there is any use or disclosure of a limited data set to an outside institution or party.

3.4.3 How

The content, format, and processes of establishing DUAs differ depending on the entities involved. Investigators must use approved DUA frameworks at these entities and their institutions. HSL IFAR policies related to DUAs can be found on the HUB.

3.4.4 Special considerations for older subjects

NONE

3.4.5 Common Pitfalls

  • Not realizing a DUA is needed.
  • Being unaware the time required to process a DUA, especially with CMS.
  • Being unaware the cost required to use data from certain entities, especially CMS.
  • Narrowly written DUAs which do not account for the possibility of future analytic plans.

3.4.6 Resources

External

Internal

3.5 Clinical Trial Registration

3.5.1 What

ClinicalTrials.gov is an on-line public registry of clinical trials maintained by the U.S. National Institutes of Health (NIH) and National Library of Medicine. It was launched in 2000 and expanded by the Federal Drug Administration Amendment Act (FDAAA 801) in 2007 and is endorsed by the International Committee of Medical Journal Editors (ICMJE).

3.5.1.1 Which trials must be registered?

It is strongly recommended that ALL clinical trials are registered on ClinicalTrials.gov. By law, only trials that meet the FDAAA 801 definition of an “applicable clinical trial” must be registered which generally include interventional studies (with one or more arms) of FDA-regulated drugs, biological products, or devices. However, in 2014, the NIH proposed expanding clinicaltrials.gov registration requirements to include all NIH-funded clinical trials. Thus, even clinical trials in which the intervention is a behavior modification or clinical education program merits registration on ClinicalTrials.org. It is strongly recommended that ALL clinical trials are registered on ClinicalTrials.gov.

3.5.2 Why

There are numerous reasons for registering a trial. Refer to [Clinicaltrials.gov]((https://clinicaltrials.gov/ct2/manage-recs/background) for elaboration.

3.5.2.1 Required by Law

Section 801 of the Food and Drug Administration Amendments Act (FDAAA 801) requires Responsible Parties to register and submit summary results of clinical trials with ClinicalTrials.gov. The law applies to certain clinical trials of drugs (including biological products) and medical devices.

3.5.2.2 Required for Journal Publication

The International Committee of Medical Journal Editors (ICMJE) requires trial registration as a condition of the publication of research results generated by a clinical trial. ClinicalTrials.gov is a registry where organizations and individuals can provide the World Health Organization (WHO) Trial Registration Data Set required by ICMJE. Top tier journals will scrutinize the registration of your trial on ClinicalTrials.gov and make sure that is aligns with the description provided in your paper. Most journals have a strict requirement that your trial be registered no more within 21 days after enrollment of the first participant and will reject your paper it is this is not the case.

3.5.3 How

Trial registry is done on the ClinicalTrials.gov. Protocol Registration and Results System (PRS). The PI (and in some circumstances, a lead person on the study team) should be assigned as the Responsible Party charged with initiating and maintaining the registration. Once submitted by the PI, institutional administrators (the HSL IRB Director at IFAR) are notified of the submission and must verify the information in the registration (including changes and updates to the study) and approve and release it before it is sent to administrators at ClinicalTrials.gov for review and eventual posting.

3.5.3.1 Initial submission

The clinical trial must be registered no later than 21 days after enrollment of the first participant. Note this rule is strictly enforced by major journals. If initial registration is not done within this timeframe, the trial results will be disqualified from consideration for publication. The application and direction are online at ClinicalTrials.gov.

3.5.3.2 Registration Updates

Responsible Parties should update their records within 30 days of a change to any of the following:

3.5.3.3 Submitting Results

The Responsible Party MUST submit summary results no later than 12 months after the Completion Date, defined in as the date of final data collection for the pre-specified “primary outcome measure” (see Primary Completion Date data element on ClinicalTrials.gov). Scientific information is submitted as four separate modules: Participant Flow, Baseline Characteristics, Outcome Measures and Statistical Analyses, and Adverse Events.

3.5.4 Special considerations for older subjects

NONE

3.5.5 Common Pitfalls

  • Failing to register the trial.
  • Failing to register the trial within a 21 days of enrolling the first participant.
  • Failing to maintain and update trial registration details.
  • Failing submit results.

3.5.6 Resources

3.6 Data Safety Monitoring

3.6.1 What

Funding agencies require that the safety of trial participants and integrity of data are ensured through systems of research oversight and monitoring. The type and level of monitoring required depends on the risk, nature, size and complexity of the clinical trial. It can be as simple as basic monitoring by the PI, an independent safety officer or medical monitor, or an NIH officer, or as complex as a full independent Data Safety Monitoring Board (DSMB). The decision about the level of data safety monitoring required for your study is ordinarily determined by the sponsor (i.e., NIH), but it may also be required by the IRB. The remainder of this module assumes your trial requires full DSMB.

The DSMB is a formally appointed independent group, consisting of at least three (3) voting members external to the research that typically include experts in the relevant field of study, statistics, and study design. The clinical trial PI(s) and lead statistician also typically participate as internal members on the DSMB.

The DSMB conducts interim monitoring of accumulating data from research activities to assure the continuing safety of human subjects, relevance of the study question, appropriateness of the study, and integrity of the accumulating data.

3.6.2 Why

The purpose of a DSMB is to ensure the safety of human subjects, relevance of the study question, appropriateness of the study, and integrity of the accumulating data. Additionally, the DSMB attempts to identify threats to credibility or the validity of the study related to slow rates of accrual, high rates of ineligibility after randomization, high rates of protocol violations, and unexpectedly high dropout rates.

The primary responsibilities of the DSMB are:

  • Periodic review and evaluation of the accumulated study data for participant safety, study conduct and progress, and, when appropriate, efficacy.
  • Provision of written documentation confirming review of the protocol and agreement with the study design and the data safety monitoring plan (DSMP).
  • Make recommendations to study sponsor concerning the continuation, modification, unmasking or termination of the trial.
  • Provide a written report to the IRB which summarizes oversight activities and recommendations, and any concerns regarding subject safety.

3.6.3 How

There are four basic steps in establishing a trial’s Data Safety Monitoring system:

3.6.3.1 Establish a Data Safety Monitoring Plan (DSMP)

The PI should create a Data Safety Monitoring Plan (DSMP) that is appropriate for the type and expected risks of the research. The DSMP must be included with the protocol in the initial submission to the IRB. Templates of DSMPs are available on the NIH website. DSMPs generally include the following elements:

  • Data or events to be captured under the monitoring provisions (e.g., unanticipated problems and adverse events).
  • The entity responsible (e.g., investigators, sponsor, a coordinating or statistical center, an independent monitor, DSMB) for monitoring the data collected and the time frames for reporting.
  • The frequency of assessments of data or events captured by the monitoring provisions.
  • Definition of specific triggers or stopping rules that dictate when action is required.
  • Procedures for communicating to the IRB(s), the study sponsor, the investigator(s), and other appropriate officials the outcome of the reviews by the monitoring entity.

3.6.3.2 Establish the DSMB membership

For NIH-funded studies, the Program Official (PO) holds primary responsibility for the formation of the DSMB and selecting the external members unless otherwise specified in the Terms of Award. External DSMB members should not have direct involvement in the conduct of the study or any financial, proprietary, professional, or other interests that may affect their impartiality. Study investigators should have opportunity to review the proposed members before the candidate’s interest and availability are confirmed.

Once the group has been formed, the PO will select the DSMB Chair. All external DSMB must sign a Conflict of Interest certification that should be kept in the Essential Documents binder. Each IRB should be informed of the membership and operating procedures.

3.6.3.3 Create DSMB Charter

Before the trial begins a DSMB charter must be prepared that details the roles and responsibilities of the DSMB. The charter is usually drafted by the PO and subject to approval by PIs and DSMB members (see DSMB/DSAC Charter in the Essential Documents Module that details the contents of the DSMB Charter). The DSMB Charter should be maintained in the Essential Documents binder.

3.6.3.4 Create DSMB Report Templates and Meeting Documentation

The next step is for the research team to work with the DSMB members to create templates for the Open and Closed Sessions of the DSMB meetings. Templates for these reports are described in the Data Safety and Monitoring Documents section of the Essential Documentations Module. Finally, a system to maintain agendas and minutes from the DSMB meetings should be established. All DSMB reports, agendas and minutes must be maintained in the Essential Documents binder.

3.6.3.5 Establish Meeting Schedule and Structure

Prior to the start of the trial, the DSMB should convene as many times as needed to review the protocol and approve all data safety monitoring protocols, templates of essential documents, and processes for conducting the business of the DSMB (e.g., schedule, voting rules, minutes, definition of a quorum).

Unless otherwise determined, the PO is responsible for convening meetings, and coordinating the distribution of materials to DSMB members and other meeting participants prior to the meeting. The agenda for each meeting is generally developed jointly by the PO, the PI (s) (regardless of whether a contract, cooperative agreement, or grant), the study statistician, and DSMB Chair. These details of these responsibilities should be agreed upon by the PO and PI (s).

Once a study has started, most DSMBs meet every 6 months, but at least annually. Additional DSMB meetings may be requested by DSMB members, the PO, collaborators, IRB, or PI at any time and up to the discretion of the PO and DSMB Chair.

Meetings may be held by telephone, videoconferences or in-person In the event a DSMB member cannot attend a meeting, he/she may receive a copy of the closed session DSMB report (see below) and either participate by conference call or provide written comments to the DSMB Chair for consideration at the meeting.

3.6.3.5.1 DSMB Meeting Format

The recommended meeting format consists of three sessions: Open Session, Closed Session, and Closed Executive Session.

A. Open Session (see NIH [Clinical Research Study Investigator’s Toolbox] (https://www.nia.nih.gov/research/dgcg/clinical-research-study-investigators-toolbox/data-and-safety-monitoring) for report template). This session is generally attended by the PI (s), project statistician, external DSMB members, and the PO. The opens session basically involves a complete review and discussion of all the elements in the open session report presented in the aggregate for both arms of the study.

B. Closed Session (see NIH [Clinical Research Study Investigator’s Toolbox] (https://www.nia.nih.gov/research/dgcg/clinical-research-study-investigators-toolbox/data-and-safety-monitoring) for report template). Generally only external voting members attend this meeting. However the DSMB may invite others to participate. The data reviewed in the closed session is similar to that presented in the open session, but is presented by study-arm in a semi-blinded fashion. For example, the arms are NOT identified by control or intervention, but as group 1 and group 2. If a study has an interim analysis with a pre-determined stopping rule, outcomes with statistical comparisons are also discussed in the closed session.

C. Closed Executive Session: This final session involves only DSMB voting members to ensure complete objectivity as they discuss outcome results, make decisions, and formulate recommendations regarding the study. If treatment codes have been made accessible to the DSMB, then the DSMB may unmask the data based on procedures identified in advance.

3.6.3.5.2 Voting

To hold a vote, a quorum, as defined by the DSMB in the initial meeting, must be present either in person or by conference call. After a thorough discussion, the final recommendations of each DSMB member should be solicited in Closed Executive Session. A consensus recommendation among members is not required. The final recommendations are identified as majority or minority positions and are accompanied by actual vote tallies for each divergent recommendation, i.e., as number of votes for or against a particular action, such as continuing or terminating a study, etc.

At the conclusion of the meeting, the DSMB sends their recommendations to the PO and PI as to whether the study should continue without change, be modified, or terminated. Recommendations could include:

  • Modifications of the study protocol

  • Suspension or early termination of the study or of one or more study arms because of serious concerns about subjects’ safety, inadequate performance or rate of enrollment

  • Suspension or early termination of the study or of one or more study arms because study objectives have been obtained according to pre-established statistical guidelines

  • Corrective actions regarding a study center whose performance appears unsatisfactory or suspicious.

Investigator must submit the DSMBs summary report to the IRB and any other site investigators for distribution to other IRBs as necessary as soon as it is available. DSMB/C reports should include a statement indicating that the data have been reviewed, the date of review and a summary of specific findings of the research study. If it is an FDA-regulated trial the summary report must be forwarded to the FDA.

3.6.4 Special considerations for older subjects

NONE

3.6.5 Common Pitfalls

  • Failure to establish a DSMB
  • Not communicating DSMB activities to the IRB
  • Not reporting all required data/information in DSMB reports
  • Not preparing DSMB reports within an adequate time frame before the meeting
  • Failure to establish a collegial and open working collaboration between the research team and DSMB

3.6.6 Resources

3.8 Adverse Events and Unanticipated Problems

There are numerous entities under which there is regulatory guidance on classifying and reporting unanticipated problems and adverse events (AEs), including the prime IRB, OHRP, NIH, HHS, and FDA. Investigators must be apprised of the guidelines specific to their IRB and agencies overseeing the trial.

3.8.1 Pre-trial preparation for Adverse Event monitoring and reporting

Investigators must include a plan for defining, detecting, monitoring and reporting any AEs that might occur in study subjects, including the type, probability and expected level of severity. The investigator should include a risk profile of the proposed research study as well as a description of how the risks of the research will be minimized and the plan for safety monitoring. Additionally, a description of potential AEs must be included in the manual of operating procedures, all regulatory/human subjects documents, DSMB, and consent forms.

3.8.2 Reporting Processes around AEs and Unanticipated problems

All AEs experienced by study participants and all unanticipated problems must be documented and reported as described in the study protocol. Adverse Events (AEs), Serious Adverse Events (SAEs), and Unanticipated Problems have specific definitions, reporting procedures and reporting requirements that may vary by sponsor, internal IRB requirements and study risk profile.

Detailed descriptions [NIAs requirements for reporting of the different categories of adverse events can be found in the NIA Clinical Research Study Investigator’s Toolbox. HSL’s IRB requirements are documented in the HSL IRB SOP.

3.8.3 Special considerations for older subjects

NONE

3.8.4 Common Pitfalls

  • Not understanding what needs to be communicated to the IRB, DSMB or other regulatory body overseeing the research.

  • Not communicating adverse events or unanticipated problems in the timeline required by regulatory bodies.

3.8.5 Resources

External

Internal