Abstract
PURPOSE This article explores the challenges that practice-based research networks (PBRNs) face with respect to the regulatory requirements for institutional review board (IRB) review and the protection of human subjects in research.
METHODS We used a regulatory and literature review, our previous research involving PBRN researchers, and our experience to identify issues in regulatory compliance and human subjects protections that present challenges to PBRNs and to suggest possible responses.
RESULTS We identified 3 challenges that PBRNs face with respect to regulatory compliance and human subjects protections. First, ensuring compliance with federal regulations governing human subjects research across all participating practices may be difficult. Clinicians may be unfamiliar with the regulatory requirements and may not have access to an IRB that can provide the required protocol review; moreover, different IRBs may impose inconsistent requirements. Second, conducting research in the practice setting presents unique issues regarding identification of human subjects, consent, and confidentiality. Finally, the use of electronic databases across practices for research raises concerns about how to respect the wishes of participants when combining data and how to maintain confidentiality of data.
CONCLUSIONS PBRN research makes unique contributions to the clinical evidence base by collecting data in community settings where most clinical care is provided. Such research, however, also presents unique challenges to human subject protections and regulatory compliance. Addressing these challenges is necessary to maintain public trust in and support for PBRN research. With careful planning, these ethical and regulatory challenges can be overcome.
- Practice-based research
- ethics committees, research
- institutional review boards
- research subjects
- legislation, medical
- public policy
INTRODUCTION
Concerns that clinical research conducted in tertiary care centers was not generalizable to the primary care setting led to the development of practice-based research networks (PBRNs). Practice-based research focuses on questions relevant to community-based patient populations in the primary care setting.1–3 Unlike single-site research, practice-based research conducted in PBRNs takes place across many sites in busy practices in the community. As a result, the research can provide a more accurate picture of illness and health care in the community. The participating practices, however, may not have the same resources as a network of academic research centers. Although many drug companies reimburse the costs of clinical research in physician offices, PBRNs generally do not.4
PBRN research raises special challenges regarding regulatory compliance and human subjects protections. In this article, we focus on 3 of these challenges. First, ensuring compliance with federal regulations governing human subjects research across all participating practices may be difficult. Clinicians may be unfamiliar with the regulatory requirements and may not have access to an institutional review board (IRB) that can provide the required protocol review. We suggest ways for ensuring compliance and facilitating review. Second, conducting research in the practice setting presents unique issues regarding identification of human subjects, consent, and confidentiality. Patients may not understand how they are involved in the ongoing research, and practices and staff may be involved as subjects, researchers, or both. In addition, the practice setting may pose different risks to confidentiality. We suggest ways for thinking through these issues and respecting the interests of the patients, practice, and staff. Finally, the use of electronic databases across practices for research raises special concerns. We provide specific suggestions for addressing these issues.
REGULATORY ISSUES: IRB REVIEW AND ASSURANCES
Obtaining necessary IRB review may be challenging for PBRNs working in multiple practices.5,6 We have identified 3 primary challenges. First, practices may not be aware of the need for IRB review. Practice-based physicians may not have research training and may not be aware of the regulatory requirements. PBRNs may need to help participating practices understand those requirements and ensure compliance. Second, many practices may not have access to an IRB because they are not affiliated with an academic medical center or hospital. Finally, the need to obtain approval from multiple IRBs may lead to inconsistent requirements at different sites, and PBRNs need to know how to respond to these differences.
Required IRB Review and Assurance of Compliance
Research involving human participants raises ethical concerns because individuals may experience risks and inconveniences primarily to benefit others by advancing scientific knowledge. Federal regulations govern research involving human participants. The Federal Policy for the Protection of Human Subjects—also known as the Common Rule, codified by the Department of Health and Human Services (HHS) regulations at 45 CFR part 46, Subpart A—applies to human subjects research conducted or supported by any of the 16 federal departments and agencies that has adopted the Common Rule.7 In addition, institutions with an HHS-approved Federalwide Assurance (FWA) often apply those regulations to all human subjects research conducted at their institution. Although the Common Rule is most relevant to PBRN research, there are also separate Food and Drug Administration regulations that apply to research regulated by this agency.8
Institutions engaged in human subjects research conducted or supported by HHS are required to provide written assurance of compliance with the regulations, including designating the IRB or IRBs that review the research. The most common assurance being submitted is the FWA. The secretary of HHS has delegated authority to approve these assurances to the Office for Human Research Protections (OHRP). OHRP provides guidance to help determine when an institution is engaged in human subjects research.7
Institutions engaged in human subjects research that is subject to the HHS regulations must have an OHRP-approved assurance of compliance and certify that the research has been approved by an IRB before any research commences.9 These requirements apply to all research, not otherwise exempt, involving human participants, including pilot studies. HHS regulations define research as “a systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge.” A human subject is defined as “a living individual about whom an investigator … conducting research obtains (1) data through intervention or interaction with the individual, or (2) identifiable private information.”8 The type of IRB review that is required will depend on the level of risk presented by the study.9 The primary focus of the IRB review is on the safety and well-being of research participants.10
Practice-based physicians may not be aware of the federal regulations governing research. Most physicians will not have received training in clinical research or human subjects protections. Some practice-based research moreover may resemble quality improvement efforts that physician practices routinely undertake without IRB oversight. For example, a PBRN may undertake a study to increase use of cholesterol-lowering drugs in patients for whom they are recommended.11 Although physicians could undertake this effort to improve quality of care within their practice, which would not be considered research, when the PBRN does so, it undertakes a systematic investigation to develop or contribute to generalizable knowledge and that would be research. If the data are obtained through an intervention or interaction with a living individual or are identifiable private information about a living individual, the project falls within the federal definition of human subjects research.
PBRNs, therefore, should be prepared to help practices understand and comply with these regulations. The requirements of the regulations should be explained early to practices interested in participating in the network or a given project. For example, in the Digitalis Investigation Group (DIG) trial, a large clinical trial conducted by the National Heart, Lung, and Blood Institute and the Department of Veterans Affairs Cooperative Studies Program, the coordinating center discussed the requirements and processing of an assurance with OHRP at one of its initial meetings for potential investigators. The investigators interested in joining the trial were provided written materials. The coordinating center also reviewed all assurance statements before they were submitted to the federal regulators for approval and was able to correct many problems at that time.12 Much of the information that practices need can be found on the OHRP Web site (http://www.hhs.gov/ohrp); however, PBRNs may need to guide physician and group practices participating in research through this process.
PBRNs may also need to provide training to participating clinicians to ensure they understand their ethical obligations under the research regulations. Key personnel on federally funded projects must have training in the protection of human subjects. The National Institutes of Health (NIH) defines key personnel as “all individuals responsible for the design and conduct of the study.”13 This definition includes individuals without doctoral or professional degrees if they contribute substantively “to the scientific development or execution of the project.”14 Clinicians and their staff at PBRN practices may qualify as key personnel under this definition.5 Although institutions may have their own requirements, computer-based training sources, such as NIH’s online course15 or the PRIM&R Investigator 101 CD-ROM available to FWA institutions from OHRP,16 frequently are used to satisfy this requirement. These courses, however, may not meet the needs of practice-based clinicians and staff participating in practice-based research.5,6 PBRNs may be better served by developing their own written, video, or online training that focuses on the particular types of human subjects issues that practice staff will face in the conduct of PBRN research. Basic training should include coverage of the differences between clinical care and research, the need for voluntary informed consent, and the need to preserve confidentiality.5
Facilitating Review of PBRN Research
PBRNs can help participating practices obtain the necessary IRB review. This assistance may entail helping them obtain a federal assurance, identifying an appropriate IRB, and helping them prepare their IRB applications. One multisite trial group found that three fifths of the time required for protocol approval was devoted to preparing the IRB submission and making required revisions.17 Coordinating IRB submissions through a network committee might reduce the time required for approval, reduce the burden on individual investigators, and enhance consistency across sites.12,18
A PBRN may want to explore options to minimize the number of IRB reviews required for its research. These options are particularly appropriate because PBRN research takes place at multiple sites; involves a stable, well-defined group; and often presents only minimal risk to participants.5
Centralized IRB Review
In centralized IRB review, 1 IRB takes primary responsibility for review on an ongoing basis. The National Cancer Institute Central IRB (CIRB) pilot project and the Multicenter Academic Clinical Research Organization (MACRO) are examples of centralized IRB review.19,20 In both groups, a central IRB conducts the primary review, with administrative review by local IRBs to determine whether to accept the approval of the central IRB and conduct the research at their institution (Table 1⇓). Some groups with their own national IRB, such as the American Academy of Pediatrics, have used the national IRB to provide a centralized IRB in some cases.6,12 Investigators at institutions with their own IRB may still need to undergo review at their own institution, however, unless the institution designates the national IRB as their IRB of record for the protocol.
Centralized review has problems that need to be worked out. Institutions may be reluctant to rely on another IRB. Current centralized review models generally do not eliminate local IRB review, although the authority of the local IRB to request changes may be limited. Establishing a centralized IRB takes considerable time and effort. PBRNs need to judge whether there is sufficient benefit to justify those efforts.
Relying on Other IRBs
PBRNs may be able to minimize multiple IRB reviews by getting institutions involved in the network to agree to rely on an external IRB’s review. This arrangement may be achieved through a formal agreement. The β-Carotene and Retinol Efficacy Trial (CARET), a multisite chemoprevention trial, provides an example of this approach. The CARET group obtained an agreement from all the CARET institutions designating, for that single study, that the IRB at the coordinating center would serve as the IRB of record for all research involving its repository, although local IRBs could modify or restrict the central IRB’s decision. In this particular case, institutions may have been more willing to agree to a central IRB because the trial’s intervention had ended and the data and the trial activities were centralized.21
When a PBRN relies on an external IRB for review of a protocol, the PBRN and the reviewing IRB should develop a formal agreement. The agreement may cover 1 protocol, several protocols, or a program of research. The signatory official of each institution should sign the agreement. The initial review and continuing oversight of the reviewing IRB must comply with the terms of the PBRN’s OHRP-approved assurance. The PBRN should take responsibility for ensuring compliance at all sites with the IRB’s determinations and with the terms of their assurance. OHRP provides a sample IRB Authorization Agreement that outlines the scope of the responsibilities for the IRB and the PBRN.22
PBRNs may develop other mechanisms for streamlining IRB review. For example, one PBRN has requested that the chairs of the 3 IRBs with whom it works most frequently use conference calls to address jointly low-risk, practice-based research protocols that qualify for review under the expedited process.6 Although face-to-face meetings are strongly recommended, OHRP recognizes that circumstances at times warrant IRB meetings to be conducted by telephone conference call, provided “each participating IRB member: (i) has received all pertinent material prior to the meeting, and (ii) can actively and equally participate in the discussion of all protocols.”23 In this case, individual IRBs retain authority, but because issues are raised jointly, the PBRN can address the concerns of all 3 IRBs at one time.
Forming a New IRB
In some instances, it may be beneficial to form a new IRB to take responsibility for a portion of or the whole PBRN. For example, a group of unaffiliated investigators who are also involved in research beyond the PBRN might establish their own IRB to review all research in which the group is involved. It may be difficult, however, to identify members who could provide independent oversight. Alternatively, PBRN investigators who are unaffiliated with an IRB may establish an IRB to provide overall review for the PBRN. If a group decides to form an IRB, they should consult the regulations24 and the OHRP Web site, which contains complete instructions and forms for registering an IRB.25 The PBRN may want to assist the investigators with this process. In the DIG trial, for example, the coordinating center helped 354 centers establish their own IRB or find another one willing to take responsibility for the center.12
Establishing a PBRN IRB could help avoid problems commonly encountered in obtaining IRB review for PBRN research. It could minimize the number of multiple reviews and, therefore, potentially conflicting recommendations. It is unlikely, however, to eliminate multiple reviews entirely, particularly if some PBRN investigators have affiliations with academic medical centers. In addition, it may be costly in terms of time and money to set up and maintain the IRB. PBRNs will need to consider their own experience with obtaining IRB review to determine whether establishing a separate IRB would be beneficial.
Role of Accreditation in PBRNs
The accreditation of an institution’s human subjects protection program may facilitate PBRN efforts to centralize review functions. For example, if accreditation becomes accepted as a mark of excellence, other institutions may be more willing to rely on an IRB that has received accreditation.26
Individual Investigator Agreements
An institution with an OHRP-approved FWA may extend their assurance to cover an external investigator who is collaborating and engaged in human subjects research at another institution that does not routinely conduct such research. The current mechanism used to do this is the Individual Investigator Agreement, which is available on the OHRP Web site.27 Some PBRNs have been successful in getting an internal IRB at the host FWA institution to take responsibility for unaffiliated investigators covered by this agreement.5,28
Addressing Differing IRB Requirements
IRBs reviewing the same protocol may impose different requirements.17,29–33 For example, in one multisite clinical trial of a treatment for asthma, IRB responses ranged from believing all patients should receive the experimental intervention to believing that the intervention was so dangerous that no patient should receive it. In that study, which involved 44 sites, 80% of IRBs asked investigators to make revisions to the standard protocol.17
Meeting different IRB requirements not only can be frustrating, but also can affect the study outcome. In a multisite health services research study, IRB requirements for contacting potential research subjects at different sites were associated with participation rates. Some IRBs permitted release of contact information to investigators without specific advance permission from potential participants, whereas others required oral advance permission and some required written advance permission to release the contact information. The response rate varied widely by contact mode, presenting a threat to study validity.33
When faced with different IRB requirements, PBRN investigators need to decide whether to make the protocol conform across all sites and, if not, whether to inform other IRBs reviewing the protocol of the changes required by 1 IRB. To answer these questions, PBRN investigators need to consider what the changes are. Many IRB requirements may affect only the documentation of the study, not its substance. For example, an IRB may request changes to the consent language to reflect locally approved language. When the underlying meaning is the same, an investigator may reasonably accept differences between sites without informing other IRBs about the requested changes.
A different approach is required when some IRBs require substantive changes to the study procedures or the selection of subjects. In such cases, the investigator should either inform all IRBs or drop nonconforming sites from the study. Some changes may undermine the study validity. For example, study participants at sites where the IRB requires written advance permission to contact individuals about study participation may differ considerably from those at sites where such permission is not required. Investigators can try to work with the IRBs to reach agreement. If the threat to generaliz-ability is deemed unacceptable, however, investigators may need to drop the sites where written advance permission is required. Investigators cannot ethically involve human subjects in research if the research is not likely to yield valid answers to the research question.5,34 Investigators should also inform other IRBs if 1 IRB raises a serious ethical concern about a study. Although not required by the regulations, doing so will help ensure the issues have been adequately considered by these IRBs and preserve the investigators’ relationship with the IRBs that review PBRN research.5
HUMAN SUBJECTS ISSUES IN PBRN RESEARCH
PBRN research also presents unique issues related to protection of human participants. Network clinicians may participate both as researchers and as research participants, and may involve their staff and patients in research. As a result, determining who the subjects of the research are and, therefore, who needs to consent may be challenging. In addition, practice-based research may require special attention to protecting confidentiality and minimizing risks within the practice setting.
Who Are the Subjects?
As discussed earlier, the HHS regulations define a human subject as “a living individual about whom an investigator … conducting research obtains (1) data through intervention or interaction with the individual, or (2) identifiable private information.”8
Increasingly, PBRN research involves interventions to change practices and clinician behaviors. Projects may address patient issues, practice issues, or both. Accordingly, determining who the research subject is in PBRN research may be more complicated than doing so in traditional biomedical research. For example, in a study designed to look at physician prescribing practices, the physicians who are asked to fill out a questionnaire may be the only subjects. If the study is designed to conduct chart reviews to validate questionnaire responses, however, both physicians and patients may be considered subjects. Similarly, a study of the effects of a computerized disease management system might focus on the clinician, the practice staff, or both. However, if patient satisfaction is an important outcome, then patients also might be subjects. PBRNs need to think carefully about how clinicians, staff, and patients are involved in each study to determine which groups meet the human subjects definition.
Who Must Consent?
All subjects must voluntarily consent to their participation in research, unless the requirement is waived under the regulations.35 In many cases, PBRNs may rely on medical directors or practice leaders for access to the practice. Their permission may be necessary to approach physicians, staff, or patients, and to implement interventions within the practice. This permission, however, may not meet ethical and legal consent requirements for study participation. In some studies, clinicians and staff may fall within the federal definition of human subjects from whom informed consent is legally and ethically required. For example, a study of the effectiveness of computer reminders in increasing adherence to practice guidelines (eg, ordering of recommended tests) might randomize practices to the intervention or a control condition. Because the investigators obtain data about the clinicians and their staff through an intervention involving them, however, their consent would be required. In other studies, consent may not be required under the regulations. For example, if a study is designed to review medical records to determine how often recommended tests are ordered, without obtaining identifiable information about the physicians, consent may not be required. It would be ethically preferable, however, to inform clinicians and staff about the research, give them an opportunity to ask questions, and, in some cases, allow them to opt out. As a practical matter, informing clinicians and staff about research taking place in the practice may improve implementation of the research project.
When Is Consent Not Required?
Under the HHS regulations, there are 2 circumstances in which informed consent is not required: when the research is exempt from the regulations and when consent may be waived.
Exempt Research
Research involving surveys, interviews, or observation of public behavior, and research using existing records may be exempt from the federal regulations provided that data are recorded in such a way that the human participants cannot be identified either directly or through linked identifiers. Research involving surveys, interviews, or observations of public behavior is not exempt if disclosure of responses “could reasonably place the subjects at risk of criminal or civil liability or be damaging to the subjects’ financial standing, employability, or reputation.”36 Retrospective chart reviews, accordingly, may be conducted without specific patient consent, provided that identifying information about the patients is not recorded, directly or through identifiers linked to the patients. Individual IRBs, however, may be stricter than the regulations and may require IRB review and consent. In addition, IRBs may no longer consider collection of some data (such as dates) as exempt if it includes any of the 18 identifiers specified in the federal privacy regulations mandated by the Health Insurance Portability and Accountability Act (HIPAA). In this supplement, Pace et al37 provide a detailed discussion of the HIPAA regulations and PBRN research. Research that poses minimal risk but does not qualify as exempt may be eligible for review under the expedited process.9,38
Exemption from the regulations does not necessarily mean that there is no IRB oversight. Many IRBs do not allow investigators to determine exempt status themselves, but rather have a formal process for reviewing such determinations. This process tends to be quick and simple. Because journals increasingly are requiring evidence of IRB approval, it would be prudent to consult with IRBs about exempt status, even if they do not require formal review.
Waiver of Consent
Research that is not exempt may be eligible for waiver of consent under the HHS regulations when the IRB finds and documents all of the following:
-
The research involves no more than minimal risk,
-
The waiver will not adversely affect the rights and welfare of participants,
-
The research could not practicably be carried out without the waiver, and
-
The subjects will be provided with additional pertinent information after participation.35
Often IRBs may waive consent for medical record reviews that are not exempt (eg, those that do not yet exist at the time the research is proposed); however, it is for the IRB to decide whether all 4 requirements to waive consent have been met, and IRBs may differ in their application of the waiver requirements.30 If the study involves protected health information, a waiver of HIPAA authorization is also required.37 Some research topics, such as research on substance use, mental health, and reproductive issues, may present more than minimal risk and therefore may not qualify for waiver of consent.
Even when consent is not legally required, it may be ethically desirable to get patients’ permission to use their information in research. Patients may not be aware that their information may be used in research, and some may object to such use. Notifying patients that their medical records may be used in research alleviates some of this problem. For example, one PBRN has physicians display a certificate to inform patients about research that is taking place in the practice.39 However, it may be more respectful of patients’ interests to obtain explicit consent to share their information within the PBRN. For example, practices might ask patients to consent to all records research conducted within the PBRN when they enter the practice and annually thereafter. If practices choose simply to notify patients of research within the practice, they should perhaps consider having a procedure for patients to opt out.
Voluntary Consent
PBRNs also should consider how to ensure that consent is voluntary. The personal and professional relationships within the practice may influence the consent process. For example, staff may feel that they cannot refuse their employers’ request to participate in a research project. Similarly, patients may be reluctant to refuse their physicians’ request to participate in research. In questionnaire studies, wherein the risk is minimal and the respondent could turn in a blank questionnaire, this concern may not be an important one; however, in other types of studies, PBRNs should consider steps to protect voluntary choice. In recruiting staff for focus groups, for example, PBRNs could use indirect recruitment means, such as flyers, letters, or e-mails, rather than having the staff members’ supervisors approach them. Similarly, someone in the practice who is not the treating physician could approach patients to recruit them for intervention studies.
Confidentiality in PBRN Research
PBRNs should also consider how the research setting may affect risks to confidentiality. For example, office staff conducting chart reviews may be more likely to know patients personally.5 In addition, some research about the practice could present risks to staff. For example, a study of medical records or an interview study could reveal a failure to follow practice guidelines. The risk may be greatest when staff members’ supervising physicians are participating as researchers and have access to the study data. Patient or practice characteristics may make it difficult to protect respondent identities in this context. PBRNs need to develop strategies for protecting participants’ confidentiality in these settings. In some cases, it may be enough to keep raw data from participating physicians and researchers, and code the research sites so that they cannot be identified. In other cases, it may be appropriate to restrict practices from participating if their physician is participating as a researcher.
RESEARCH DATABASES AND PBRN RESEARCH
The full potential of a PBRN may be realized by combining information across practices within the network.40 But combining research and medical data across time and across the network raises ethical issues.
The primary ethical issues raised by PBRN research databases are how to respect the wishes of participants when combining data and how to maintain confidentiality of data. For example, some participants may have placed limits on the use of their data by researchers outside the practice or outside the network. Procedures need to be in place to ensure that data are used only in ways authorized by the participants. In addition, the PBRN must take steps to maintain the confidentiality of the data. This measure typically requires sophisticated programming support, which may not be available within the network. Programming support is especially necessary to preserve confidentiality of patient information within a central database that will be updated with new clinical information. Even if it is possible to de-identify data when providing them to researchers, some identifiers will need to be retained to permit the updating. In addition, for some research questions, it may not be possible to work with de-identified data. To protect against unauthorized access, the PBRN may want to isolate the computer from the Internet except when transferring data. If the computer is connected to the Internet, it should be protected by a fire wall and its antivirus software must be updated regularly. If data are transferred through the Internet, this transfer should only be through a secured connection and data should be encrypted. All data should be protected with strict passwords—ones that are not obvious, are not shared, and are changed regularly. To further protect confidentiality of the database, PBRNs should consider obtaining a federal Certificate of Confidentiality to protect against compelled disclosure of identifiable information through a subpoena.41 PBRNs may additionally wish to ask researchers and their staff with access to the database to affirm that they will maintain its confidentiality and not seek to reidentify individuals whose records are contained within it. As Pace et al37 describe in their accompanying article, PBRNs need to carefully consider what information will be shared with whom to determine what their obligations are under the privacy regulations. In addition to reading that article, PBRN researchers may want to consult the HHS guidance on the HIPAA Privacy Rule for the research community, which is available online (http://privacyrule-andresearch.nih.gov). Because the privacy regulations are complicated and new, IRBs at different institutions may apply these regulations differently.
CONCLUSIONS
PBRN research makes unique contributions to the clinical evidence base by collecting data in community settings where most clinical care is provided. PBRN research thus provides information on the effectiveness of interventions in actual practice. The NIH Roadmap embraces this concept of clinical research and calls for the expansion of community-based research and research networks.42 Such research, however, also presents unique challenges to regulatory compliance and human subject protections. Addressing these challenges is necessary to maintain public trust in and support for PBRN research and to collect information on the outcomes in actual clinical practice. In addition, failure to do so may jeopardize publication of research results. With careful planning, these ethical and regulatory challenges can be overcome.
Disclaimer
The views represented here are those of the authors and are not intended to represent those of the Department of Health and Human Services.
Footnotes
-
Conflicts of interest: none reported
- Received for publication May 26, 2004.
- Revision received January 5, 2005.
- Accepted for publication January 17, 2005.
- © 2005 Annals of Family Medicine, Inc.