LEGAL ISSUES IN HUMAN RESEARCH

1. LEGAL ISSUES IN HUMAN RESEARCH Major Mark Peterson, USAF USU Associate General Counsel

2. Agenda • Governing Regulations • The Institutional Review Board • Proper Research Recruiting/Vulnerable Groups • Ethical Considerations in Compensation • Informed Consent • Privacy/Security Breaches

3. Governing REGULATIONS • 45 CFR 46—COMMON RULE • 21 CFR 50, 56, 312 and 812—FDA research • DODI 3216.02 (20 Oct 2011) • Service and facility specific instruction/regulations

4. Role of the IRB The primary purpose of such review is to assure the protection of the rights and welfare of the human subjects At least 5 members Varying backgrounds to review research commonly conducted by the institution Qualified through experience, expertise, and diversity to promote respect for its advice and counsel in safeguarding the rights and welfare of human subjects.

5. Ethical Principles of the Belmont Report • Principle 1: Respect for Person • Treat individuals as autonomous agents • Protect persons with diminished autonomy • Principle 2: Beneficence • Do no harm • Maximize possible benefits and minimize possible harms • Principle 3: Justice • Equality in distributing potential benefits and risks among potential research participants

6. PROPER RESEARCH RECRUITING/Vulnerable Populations • 45 CFR 46, Subparts B-D, 21 CFR 50, Subpart D • Pregnant Women, Human Fetuses and Newborns • Prisoners • Children • DODI 3216.02 • DoD Personnel • Military • Civilian employees

7. Additional Protections for Vulnerable PopulationsDOD Personnel • DODI 3216.02, Enclosure 3, Paragraph 7e: • For Military Personnel: – Prior authorization from the local commander – DoD IRBs may require PI to confirm CO support – Superiors may not influence – Chain of Command may not be present at recruitment or informed consent sessions

8. Additional Protections for Vulnerable Human SubjectsDOD Personnel as Subjects • For DoD Civilians: – Recruitment must follow local policies – Supervisors in the chain of command may not: -- Influence recruitment -- Be present at recruitment or informed consent

9. Ethical Considerations in Compensation • Compensation vs. Reimbursement • IRB considerations: • Undue Influence violates principle of respect for person • Improper inducements can affect voluntariness • Vulnerable populations, social-economic considerations • Violation of principle of Justice • Lotteries

10. Compensation Factors • There are 3 KEY factors for determining whether subjects may be compensated for participating in research: • 1) Federal or non-federal employee? • 2) If Federal, on-duty or off-duty? • 3) Source of funds, fed or non-fed money?

11. Compensation to Federal Employees • When subjects are federal personnel (active duty and civilian) On Duty: -- Limited to $50 per blood draw -- Supervisor approval Off Duty: -- Federal source: only $50 for blood draw -- Non-Federal source: No restrictions other than IRB approval as reasonable -- Supervisor approval as outside activity (off-duty employment) Contractor sourced funds: “payment from a Federal contractor or other non-Federal source is permissible” DODI 3216.02, Enclosure 3

12. INFORMED CONSENT • Informed consent must be legally effective and prospectively obtained: (1) Enough info to make an informed decision; (2) Understood; and (3) Voluntarily given • Documentation….ALWAYS…but how…. • Waivers by IRB • Required elements

13. INFORMED CONSENT WAIVERS • Exempt Research: 45 CFR 46.101(b), based on the type of research conducted exempt from General Rule, (i.e., educational surveys, publicly available information, taste tests, etc.) • Waivers: 45 CFR 46.116(c) and (d), 45 CFR 46.117(c), as well as broad discretion under 45 CFR 46.101(i) • Usually only involves NMTMR research with no adverse affects • Subjects usually provided with information • ASK IRB FOR PERMISSION, NOT FORGIVENESS

14. Elements of Informed Consent • Required elements in 45 CFR 46.116 • Statement that the study involves research • Statement that participation is voluntary • Duration of subject’s participation • Complete description of procedures • Risks and benefits • Alternate courses of treatment • Confidentiality protections and procedures • Compensation • Point of contact

15. Informed Consent Document (ICD) • Documentation requirements--45 CFR 46.117 • Embody the elements of 45 CFR 46.116 • Signature of subject or authorized representative • Date • Signed copy provided • Short/long form and oral presentation options • Read or orally presented, witnesses, time to consider

16. Informed Consent Issues • Consent versus Assent (documentation and timing) • Special considerations for vulnerable populations (i.e., children, pregnant women, prisoners, service members, etc.) • Witnesses? Best COA is to build in discretionary IRB flexibility for sensitive studies (i.e. HIV/AIDS, STDs, PTSD, Suicide, etc.) • Terminology and length, keep it simple, no higher than an 8th grade level for adults, lower for children

17. Privacy in Research • The Privacy Act of 1974, PL 93-579, 5 USC 5529, governs collection, maintenance, use, and dissemination of personally identifiable information (PII) about individuals that is maintained in systems of records by federal agencies • Health Insurance Portability and Accountability Act of 1996 (HIPAA), PL 104-191, 45 CFR 164.501, establishes the conditions under which protected health information (PHI) may be used or disclosed by covered entities for research purposes

18. Security Breaches • 45 CFR 46.103(b)(5) • Institutions/IRBs must have written SOPs for ensuring prompt reporting to IRB, appropriate institutional officials, and the department or agency head and OHRP of (i) any unanticipated problems (UPs) involving risks to subjects or others…; and (ii) any suspension or termination of IRB approval.

19. Data Breaches are considered UPs • Three characteristics: • Unexpected; • Related to participation in research; and • Places subjects or others at a greater risk of harm that was previously known or recognized

20. HITECH Act • Health Information Technology for Economic and Clinical Health Act (HITECH) Act, 42 USC 17930 • Passed in February 2009 as part of the American Recovery and Reinvestment Act (ARRA) • Goal: Expand electronic medical record systems across the country • In parallel: Expanded privacy and security requirements and created new federal breach reporting requirement

21. HITECH ActReporting Analysis • Did incident involve PHI? • Was the PHI unsecured? • Was there an impermissible use or disclosure? • Does an exception apply? • Is the “significant risk of harm” threshold met?

22. HITECH ActNotification Requirements • Notify affected individuals • Notify HHS of a breach if 500 individuals, or more, are affected • Notify the media of a breach if it affects greater than 500 individuals in a state or jurisdiction

23. Corrective Actions • Implementation of additional procedures for data security • Suspension of enrollment of new subjects • Notify subjects of breach • Offer subjects credit protection services if social security number or other financial data compromised

24. Privacy/Security Breach Issues • Bad news does not get better with age, report ASAP to IRB/USU IG • Mobile devices/laptops must be secure • Encryption of data when static and transmitted • Protection against theft • Cost of subject notification is extremely expensive

25. Questions? Major Mark Peterson, USAF mark.peterson@usuhs.edu 301-295-3028