Background

The Common Rule creates a presumption that “research” with “human subjects” must undergo IRB review and approval, but then “exempts” certain categories of HSR from the IRB requirement. “Research” is defined under the Common Rule as “a systematic investigation … designed to develop or contribute to generalizable knowledge.”¹ The Common Rule does not define the concept of “generalizability,” but the term is generally understood to refer to the use of information to draw conclusions that apply beyond the specific individuals or groups from whom the information was obtained.² For example, the Belmont Report, a statement of ethical principles that constitutes the intellectual foundation of the Common Rule, explains that the distinction between medical practice and research is that practice seeks “to provide diagnosis, preventive treatment or therapy to particular individuals,” while research is “designed to test an hypothesis [and] permit conclusions to be drawn … expressed, for example, in theories, principles, or statements of relationships.”³

The standard explanation for why HSR is subject to a requirement of prospective ethical oversight is that research participants are exposed to risks and burdens primarily for the potential benefit of others, thereby creating a conflict between protecting participants' welfare and advancing scientific goals.^{Reference Kass, Faden, Goodman, Pronovost, Tunis and Beauchamp4} As will be discussed below, research is not the only activity in which individuals are exposed to risks primarily for the benefit of others. However, the Common Rule was created in a specific historical context in which concerns about ethical abuses in HSR were especially pronounced. Examples include the Public Health Service's infamous study of untreated syphilis in Tuskegee, Alabama, in which effective treatments for syphilis were deliberately withheld from poor African-American men,^{Reference Jones5} and research in which institutionalized children with intellectual disabilities were intentionally infected with hepatitis.^{Reference Rothman and Rothman6} These and other accounts of mistreatment of human research participants led to the enactment of legislation that ultimately resulted in the Common Rule.

The revised Common Rule does not change the definition of research, but in an effort to provide further clarity, it sets forth four specific activities that do not meet the definition: (1) scholarly and journalistic activities “that focus directly on the specific individuals about whom the information is collected;”⁷ (2) public health surveillance activities “necessary to allow a public health authority to identify, monitor, assess, or investigate potential public health signals, onsets of disease outbreaks, or conditions of public health importance;”⁸ (3) certain criminal justice and criminal investigative activities authorized by law or court order;⁹ and (4) authorized operational activities in support of intelligence, homeland security, defense, or other national security missions.¹⁰ This list reinforces the point that the distinguishing characteristic of research is the use of information obtained from some individuals for the potential benefit of others. Thus, activities that provide information relevant only to specific individuals (as in the first example), for identifying an immediate public health problem affecting a particular community (as in the second example), or for carrying out legally-defined government oversight mechanisms (as in the final two examples) are not research because the information will be used only in connection with the individuals or groups directly involved in the activities.

Not all activities that meet the definition of HSR are subject to the Common Rule's requirements. Instead, the Rule identifies certain categories of HSR as “exempt” from the usual requirement of prospective ethics review. The exemptions in the original version of the Common Rule covered most interview and survey research, as well as some types of secondary research with identifiable private information or identifiable biospecimens. The revised Common Rule adds some new exemptions; for example, there is now an exemption for research involving certain “benign behavioral interventions,”¹¹ such as “solving puzzles under different noise conditions.”¹² The revised Rule also expands the applicability of some of the prior Rule's exemptions. For example, under the prior Rule, the exemption for interview and survey research did not apply if identifying information about the subjects would be recorded and disclosure of the information outside the research “could reasonably place the subjects at risk of criminal or civil liability or be damaging to the subjects' financial standing, employability, or reputation.”¹³ Under the revised Rule, the exemption is now available regardless of the potential consequences of disclosing the information, provided the IRB engages in a “limited review” to ensure that “adequate provisions for protecting privacy and maintaining confidentiality” are in place.¹⁴ Similarly, under the prior Rule, the exemption for research with identifiable information or biospecimens applied only if the information or biospecimens already existed at the time the research study was proposed, and, in addition, only if those sources were “publicly available” or the investigators did not record identifying information about the subjects.¹⁵ Under the revised Rule, the exemption is now available even for identifiable information or biospecimens that did not exist at the time the research project was proposed, as well as to projects in which investigators record identifying information from sources that are not publicly available, provided that the activity is regulated under specific federal privacy protections.¹⁶

The Ambiguity of the Generalizability Standard

The first problem with conditioning prospective ethics review on whether an activity meets the definition of research is that the heart of the definition — whether an activity is “designed to develop or contribute to generalizable knowledge” — is inherently ambiguous. As noted above, generalizable knowledge is generally understood to refer to conclusions that can be applied to persons other than the individuals directly involved in the activity, as opposed to knowledge that is relevant only to those individuals themselves. However, all experiences produce information that has implications for other situations. Even a single person's reaction to an intervention provides insight on how other persons might respond. For example, if a patient has an adverse reaction to a drug and no other causal explanations seem plausible, it can be inferred that such a reaction is possible in other patients as well.

The ability to draw generalizable conclusions from individual encounters is heightened when information from multiple encounters is aggregated and then analyzed retrospectively. For example, “N-of-1 trials” — multiple crossover trials of different interventions in a single patient^{Reference Kravitz, Duan, Vohra and Li17} — are primarily designed to produce information relevant to the treatment of particular individuals. However, when the results of multiple N-of-1 trials are aggregated, the results can be extrapolated to the population at large.^{Reference Cen, Hussain, Pak, Mitchell, Nikles, Gaudreau, Bazzano and Breault18} Nonetheless, a substantial number of IRBs have policies stating that N-of-1 studies fall outside the Common Rule's definition of research.¹⁹

At the other extreme, just as it is possible to say that all information has potential implications for other situations, it could also be said that true generalizability is ultimately impossible, as every situation is inherently unique. In traditionally-designed clinical trials, the results of a study have direct relevance only for those persons who meet the specific inclusion and exclusion criteria of the study and who receive the interventions according to the precise dictates of the protocol. Extrapolating these results to broader populations is necessarily speculative. Indeed, a frequent problem in clinical research is that the results of carefully-designed studies often cannot be replicated in the messy world of clinical practice, given the greater diversity of patients, background conditions, and treatment methodologies.^{Reference Rothwell20}

Even if we reject these all-or-nothing interpretations of generalizability, the definition of research would remain ambiguous because information can be generalizable to varying degrees.^{Reference Fiscella, Tobin, Carroll, He and Ogedegbe21} For example, suppose a surgeon sometimes performs a difficult operation with Procedure A, and sometimes with Procedure B, each of which involves different risk-benefit profiles. The surgeon decides to randomize her patients between the two procedures to determine which one produces better results, given the surgeon's particular mix of technical skills. On the one hand, the resulting information could be considered generalizable because it will be used to inform the surgeon's treatment of her patients in the future. However, given that every surgeon has her own technical strengths and weaknesses, the results may have little significance for anyone other than this particular surgeon. Under these circumstances, can we really say that the information constitutes a contribution to “generalizable knowledge?”

Similarly, differences in the effectiveness of hospital quality improvement interventions often depend on a variety of institutionally-based “contextual factors,” such as the availability and functionality of information technology systems, the availability of administrative support, workload levels, staff turnover rates, the use of external staff members, composition of teams, and knowledge and attitudes of team members.^{Reference Kringos, Sunol, Wagner, Mannion, Michel, Klazinga and Groene22} In light of these factors, the results of a hospital quality improvement intervention may be generalizable only in the sense that they are relevant to the future delivery of care in that particular institution. It is unclear whether such local-level generalizability is sufficient to satisfy the Common Rule's definition of research.^{Reference Casarett, Karlawish and Sugarman23}

Acknowledging some of these ambiguities, some authorities maintain that the key to understanding the definition of research is to focus on the primary purpose of an activity. For example, the Centers for Disease Control and Prevention (CDC) emphasizes that the definition of research turns not simply on whether an activity is likely to produce generalizable knowledge, but rather whether it was “designed” with the production of generalizable knowledge as the goal. Nonresearch activities may also produce knowledge, and “[i]n some cases, that knowledge might be generalizable,” but those activities do not constitute research if the primary goal “is to prevent or control disease or injury and improve health, or to improve a public health program or service.”²⁴

However, for activities that are highly likely to produce generalizable information, it should make little difference whether those responsible for designing the activities characterize their primary intent as research. In law, intent is typically understood to include not only situations in which an actor has the subjective purpose of achieving a particular outcome, but also those in which she knows that the outcome is substantially certain to occur.²⁵ For example, in the case of Mathias v. Accor Economy Lodging,²⁶ Judge Richard Posner suggested that, if a hotel rents out a room knowing that it is infested with bedbugs and the guests suffer bug bites, the hotel could be held liable for the intentional tort of battery. Regardless of whether the hotel had the subjective purpose of ensuring that its guests would be bitten, its actions would be considered intentional if it knew that it was substantially certain that a bedbug attack would occur.

In light of this principle, consider the CDC's example of a national diabetes surveillance system in which data “are used to describe the burden of diabetes and its complications on a national and state level.” The CDC maintains that such a program would not constitute research because its purpose is simply “to provide information for the development and improvement of national and state public health programs and services for the prevention and control of diabetes.”²⁷ Yet, if the designers of the program are aware that the information collected will also be used to draw generalized conclusions about the prevalence of diabetes and its complications, the production of generalizable knowledge could also be considered one of the “intended” outcomes of the activity. As in the Mathias case, whether those who designed the activity subjectively desired to contribute to generalizable knowledge is irrelevant, as long as they knew that generalized knowledge was substantially certain to result.

The Over-Inclusiveness of the Generalizability Standard

A second problem with conditioning the requirement for prospective ethics review on the definition of research is that the definition sweeps too broadly. Many, perhaps most, activities “designed to develop or contribute to generalizable knowledge” are relatively innocuous. In these situations, the requirement for obtaining prospective authorization adds significant administrative burdens without providing research participants with any meaningful protection.

The Common Rule's strategy for dealing with the overbreadth problem is to exempt specific categories of low-risk research from the regulatory requirements. However, relying on exemptions as a means of avoiding over-regulation is an incomplete solution. First, while the Common Rule does not specify any particular process for making exemption determinations, the Office for Human Research Protections (OHRP) has recommended that, “because of the potential for conflict of interest, investigators not be given the authority to make an independent determination that human subjects research is exempt.”²⁸ Consistent with this guidance, in many institutions, proposals for exempt research must be submitted to the IRB, so that someone associated with the IRB (often a member of the administrative staff) can determine if the exemption criteria have been satisfied.^{Reference Loe, Jonathan, Winkelman and Robertson29} Many institutions seek to make this process as simple as possible, but according to one survey, “a significant minority of institutions require investigators to complete full IRB applications when applying to begin exempt research,” leading to “an average of another 13 pages of paperwork and answering 68 additional questions.”³⁰

The Notice of Proposed Rulemaking (NPRM) that preceded the issuance of the final revised Common Rule proposed a mechanism that would have gone a long way toward reducing the burdens of making exemption determinations, but, unfortunately, the proposal was ultimately abandoned. Under the proposal, federal departments and agencies would have created an online exemption determination tool “designed in such a way that if the person using the tool inputs accurate information about the study, the tool would produce a determination of whether the study is exempt.”³¹ Institutions would not have been required to use the tool, but if they chose to do so it would have operated as a “safe harbor” against enforcement actions. The preamble to the final rule suggested that the proposal was abandoned because the details of how the tool would work had not been fully developed in time to allow the public to comment on it, but it also suggested that the idea might be resurrected in the future.³² Creating such a tool would help reduce the administrative burdens associated with the exemption determination process.

However, even if such a tool were developed, the exemption process would still not resolve the over-inclusiveness problem because the exemption categories do not capture all types of low-risk research for which prospective ethics review is not warranted. The primary exemption categories apply only to studies that involve only verbal interactions (e.g., educational tests, surveys, and interviews), observation of public behavior, review of identifiable data or biospeci-mens, or “benign behavioral interventions.” If a study involves a medical procedure, none of these categories applies. This is true even in observational studies, where participants receive whatever interventions they would normally receive as part of their ordinary medical care, with researchers observing what happens and recording the results.^{Reference Berger, Dreyer, Anderson, Towse, Sedrakyan and Normand33} In these studies, the treatment provided is exactly the same as it would be in the absence of research; the only difference is that data are systematically collected so that conclusions can be drawn. OHRP has indicated that, in studies such as these, “the risks of the standards of care are the same risks that the subject would have been exposed to without participating in the research study,” and that “[t]he only risks of the study are those associated with the research data collection and analyses.”³⁴ Yet, even when the risks associated with data collection and analyses are minimal or nonexistent, some observational studies constitute non-exempt HSR and therefore require IRB review.

Requiring prospective ethical oversight for these kind of studies is inconsistent with the Institute of Medicine's recommendation for the creation of “learning health care systems,” defined as organizations in which “science, informatics, incentives, and culture are aligned for continuous improvement and innovation,” with best practices “seamlessly embedded in the care process” and new knowledge “captured as an integral byproduct of the care experience.”³⁵ Learning health care systems promise to improve the quality of care for both current and future patients, in many cases without exposing participants to any additional risk.^{Reference Kass, Faden and Tunis36} Yet, because many of the activities embedded within these systems would fall under the Common Rule's definition of research, institutions may be disincentivized from adopting them because of the greater administrative burdens involved.^{Reference Kupersmith37}

The Under-Inclusiveness of the Generalizability Standard

In addition to being over-inclusive, linking the requirement for prospective ethics review to the definition of research is under-inclusive because it excludes a variety of non-research activities for which prospective review might be appropriate. As noted above, the standard justification for subjecting HSR to heightened regulatory scrutiny is that research exposes some individuals to risk for the potential benefit of others. That conflict is not, however, unique to research; it arises in many other activities that are not subject to any requirement of prospective ethics review.

For example, consider the area of public health surveillance, one of the activities expressly excluded from the definition of research in the revised Common Rule. Surveillance falls outside the definition of research because its purpose is to provide immediate benefits to a particular community, rather than to produce generalizable knowledge for potential application to others in the future. Thus, public health surveillance falls on the “practice” side of the Belmont Report's distinction between research and practice, except that instead of seeking “to provide diagnosis, preventive treatment or therapy to particular individuals,” surveillance seeks to prevent and control health conditions for the benefit of a larger community.³⁸

Yet, the fact that surveillance is designed to benefit a particular community does not mean that all individuals within the community will benefit equally, nor does it mean that everyone will be exposed to equivalent levels of risk. In some cases, a few individuals subject to surveillance bear the majority of the risks while receiving few, if any, of the benefits. For example, one technique used during public health outbreaks is the creation of “spot maps,” which identify the specific locations in a community in which individuals known to have been infected with the disease in question live.^{Reference Rathi, Narendra, Sathiya, Kini, Kumar, Sana, Rohini and Kamath39} These maps can be a useful tool for identifying patterns of transmission and developing interventions, but at the same time they expose individuals living in the identified areas to potential stigmatization and other negative consequences (e.g., economic boycotts or violent attacks). From the perspective of individuals who have already been infected, the creation of spot maps involves risks that are not offset by any potential direct benefits; it is only the uninfected members of the community who stand to benefit from the information that results.

A similar mismatch between risks and benefits exists in other activities that fall outside the definition of research. For example, another example of non-research in the revised Common Rule is scholarly and journalistic activities “that focus directly on the specific individuals about whom the information is collected.” As the preamble to the final version of the Common Rule explains, these activities are not research because they focus on the specific persons about whom information is collected, without “generalizing to other individuals.”⁴⁰ Yet, from the perspective of an individual who is the subject of a scholarly or journalistic investigation, the fact that the information will not be generalized in no way diminishes the potential for harms such as privacy violations or stigmatization. Moreover, while some of these activities offer direct benefits to their subjects (e.g., an authorized biography that results in flattering publicity), others are unwanted intrusions that are primarily intended to produce information for the public at large.

To be sure, there are important differences between the activities described above and HSR. For example, public health surveillance is a core governmental function undertaken to prevent and respond to immediate threats to the public. In many cases, participation in public health surveillance is mandatory; for example, individuals typically cannot opt out of mandatory reporting of infectious disease.^{Reference Lee, Heilig and White41} By contrast, research is generally considered a useful but optional activity,^{Reference Jonas42} and, with a few narrow exceptions, individuals cannot be enrolled in research without their informed consent.⁴³

However, if the rationale for prospective ethical oversight is to provide a check on activities that expose some individuals to risk for the potential benefit of others — i.e., to avoid the exploitation of persons^{Reference Miller and Brody44} — it makes little sense to exclude entire spheres of activities that pose precisely this kind of risk. This does not mean that prospective ethics review should be required for all public health surveillance or all scholarly and journalistic activities involving investigations of persons. Just like HSR, most of these activities pose minimal risks and do not warrant the considerable administrative burdens that prospective oversight involves. What it does suggest, however, is that, the trigger for prospective ethics oversight should not depend on an ethically irrelevant criterion like the generalizable knowledge standard. Instead, it should be based on the underlying ethical conflict — exposing some individuals to greater-than-minimal risk for the potential benefit of others. When such a conflict exists, and the activity is conducted or supported by federal agencies, a process of prospective ethical review is warranted, with the specifics of the review process tailored to the particular nature of the activity.