1. Proposal Applies to U.S. Cooperative Research. The single IRB proposal generally applies to all multi-site research covered by the Common Rule (defined as “cooperative research” in the regulations) that is conducted in the U.S. by institutions located within the U.S. (See discussion of limited exceptions below.) Multi-site projects conducted abroad by U.S. institutions would not need to be reviewed by a single IRB because of concerns that an IRB in the U.S. may not be able to provide adequate evaluation of local conditions in foreign countries that may impact the ethical review. However, a project involving both U.S. and international sites would be subject to the requirement with respect to the U.S. sites. The proposal is not limited to research requiring full review; research eligible for expedited review would also be subject to the requirement. (§ __.114(b)(1).)

2. Exceptions Would Be Limited. Institutions would not have discretion to choose which projects would be subject to single IRB review. There would be only two exceptions from the application of the requirement in the U.S. One exception would be for research that requires additional (i.e., local) IRB review pursuant to other laws. The main example referenced in the NPRM is an FDA-regulated device trial; with narrow exceptions, the Federal Food, Drug, and Cosmetic Act currently requires review and oversight of device investigations by an IRB local to the site conducting the investigation. The second exception would be for projects with respect to which the federal funding agency (when there is one) determines and documents that use of a single IRB is not appropriate for the research. The NPRM does not elaborate on what criteria agencies would or should use to assess appropriateness. (§ __.114(b)(2).)

In the absence of either of these two circumstances, an institution would not be able to opt out of single IRB review for a project in the U.S. (except by voting with its feet and deciding not to participate in the project). The commentary in the NPRM notes that nothing in the proposal would prevent an institution from conducting its own additional (i.e., local) IRB review of a project; however, the commentary also makes clear that the local IRB would have no regulatory authority and its review would have no regulatory standing in such instance. Specifically, the local IRB’s review would not be binding on its institution under the regulations, and, importantly, OHRP would not enforce its terms. See 80 Fed. Reg. 53933, 53984 (Sep. 8, 2015). Presumably, an institution could opt, by policy, to continue to vest decision-making authority in its local IRB. However, doing so would present challenges in the event that the local IRB’s requirements conflicted with those of the single IRB (if the single IRB could not approve the local requirements the institution could not participate in the project). And it is, at best, unclear whether OHRP would recognize any authority of a local IRB that was granted by institutional policy.

Of note, whether or not the proposal for single IRB review is incorporated in any final rule, NIH has already indicated its intent to move forward with its Draft NIH Policy on the Use of a Single Institutional Review Board for Multi-Site Research issued in December 2014, which will generally require reliance on a single IRB as a condition for receipt of NIH funding.

3. The Funding Agency or Lead Site Would Choose the IRB. The default rule is that the federal funding agency would select the reviewing IRB for federally funded research. The agency could seek input from the sites in the selection process but would not be required to do so. For research not funded by a federal agency, the lead institution conducting the research would select the reviewing IRB. The NPRM does not provide or suggest criteria for assessing possible IRB candidates or for selecting among them. Rather, comment is requested as to how the selection process could work in practice. (§ __.114(b)(1).)

4. IRBs Would Be Directly Accountable for Compliance. To address liability and regulatory enforcement concerns expressed by some commentators in response to the single IRB proposal in the ANPRM (and in response to previous call for public comment on cooperative review arrangements), and to foster trust in a single IRB system, the proposal would make IRBs reviewing research subject to the Common Rule directly responsible for complying with the requirements of the regulations pertaining to IRB review. Under the current Common Rule, OHRP’s practice is to enforce compliance with the regulations through the institution engaged in the research, even when a regulatory violation is related to the IRB’s review responsibilities. The NPRM would give Common Rule agencies the authority to enforce such responsibilities directly against the reviewing IRB. (§ __.101(a).)
As discussed further below, though the proposed regulatory text does not distinguish between different types of reviewing IRBs, much of the stated focus of the commentary in the NPRM is on increasing comfort with reliance on IRBs that are not affiliated with or operated by any FWA-holding institution (i.e., independent IRBs or IRB organizations). The commentary does not specifically discuss reliance arrangements involving an IRB affiliated with an assured institution and how regulatory enforcement would work in the context of such arrangements, or what incentives explicit liability for such an IRB might create (would such IRBs in fact be discouraged from serving as the single IRB based on concerns about liability or adequacy of existing institutional liability insurance coverage, or motivated to be selected as the single IRB with the potential for increased visibility, experience, and control?).

5. Reliance Agreements or Alternate Documentation Would Be Required. The current Common Rule does not reference or require that IRB reliance arrangements be documented in writing. Rather, reference to written IRB reliance agreements is currently found only in the Terms of Federalwide Assurance, Term # 6. The NPRM would require, as a matter of regulation, written reliance agreements or alternate documentation of the reliance relationship and specifically of the respective compliance responsibilities of the reviewing IRB and the relying institution. The proposed regulation would permit this documentation to take the form of a written agreement or an institutional policy. (Though note that, as discussed further below, the proposed regulatory text is somewhat internally inconsistent on the type of documentation that is required, and is also not consistent with the commentary to the NPRM.) The NPRM (also as discussed further below) does not offer commentary on the appropriate division of compliance responsibilities between institutions and IRBs. (§ __.103(e); § __.115(a)(10).)

6. Institutions Would Have Three Years To Get Ready. In recognition of the significant new relationships, systems, policies and processes that institutions would have to develop to comply with a single IRB review mandate, the NPRM would give institutions three years from publication of any final rule to comply. (80 Fed. Reg. 53933, 53984 (Sep. 8, 2015).)

A Few Comments on Comments

As with the ANPRM, the NPRM’s proposed requirement for single IRB review of domestic cooperative research will likely be a significant focus of institutions’ comments to HHS. Many institutions may continue to view a mandate to be premature or may take issue with HHS’s assessment of the anticipated burdens and benefits of single IRB review, especially as implemented across multiple different multi-site projects. In addition to commenting on these issues, institutions may wish to consider commenting or requesting clarification on the following areas:

When Is Reliance Not Appropriate?

The clear intent of the NPRM is that the majority of U.S. multi-site research studies conducted under the Common Rule would come under the oversight of single IRBs. However, the NPRM reserves an exception, in the discretion of the federal funding agency, to determine that single IRB review is not appropriate for a particular project. The NPRM does not indicate what factors would be assessed by the agencies in making such a determination. Presumably, the central issue would be whether adequate ethical review of the particular project could be provided by a non-local IRB, though the commentary in the NPRM appears to assert that such question would rarely arise (“The evaluation of a study’s social value, scientific validity, and risks and benefits, and the adequacy of the informed consent form and process generally do not require the unique perspective of a local IRB.” 80 Fed. Reg. 53933, 53984 (Sep. 8, 2015).). Institutions may wish to propose specific factors for consideration that could, in their view, render single IRB review inappropriate for a project, such as the nature and type of the study (e.g., focus on a unique subject population or local health problem), the overall size of the study relative to site IRB resources (perhaps weighing in favor of having several regional reviewing IRBs rather than a true single IRB), or the collection of sensitive identifying information regarding participants (such that the possibility of needing to share such information with a non-local IRB as in the event of a compliance problem may raise unacceptable or unnecessary privacy risks).

The Chosen Ones

If reliance on a single IRB will be mandatory for many studies, selection of the reviewing IRB will become of paramount importance. One possible effect of the NPRM proposal is a growth in the accreditation industry around IRBs. Institutions may wish to consider whether it would be beneficial to suggest agency development (such as in guidance) of key criteria or factors for the federal funding agency or lead institution (where applicable) to use in making this choice. In particular, the use of objective criteria may help manage concerns about favoritism or selection based on perceived chances of ‘an easy approval,’ and may help ensure that sufficient resources exist or can be put into place at a selected IRB to responsibly manage oversight of human subject protections on behalf of additional institutions. These criteria or factors might include, for example, substantive experience of the IRB with the particular type of research to be reviewed or the particular subject population, the geographical location of the IRB relative to the relying institutions (with favorable weight placed on IRBs that are within the same jurisdiction as the majority of sites), the IRB’s ability to serve as the HIPAA Privacy Board for relying institutions that are HIPAA covered entities, the home institution of the lead principal investigator, the location of any data or clinical coordinating center for the project, and the availability of IRB staff and technology to manage information and communications from multiple sites. On the other hand, institutions may conclude that any selection criteria (even if limited to guidance) would unnecessarily limit flexibility of lead study sites when they have the ability to choose the IRB, and that the agencies should not put forth specific materials on this issue.

Division of Responsibilities: Unanswered Questions

The NPRM notes that the proposed single IRB review requirement would not eliminate the relying institutions’ responsibility to comply with other aspects of the Common Rule apart from IRB review activities. However, the NPRM does not resolve—or even substantively address—long-standing questions about the appropriate division of regulatory responsibilities between the reviewing IRB and relying institution(s) within an IRB reliance arrangement. In its 2009 Advanced Notice of Proposed Rulemaking and Request for Comments on IRB accountability, OHRP recognized that introducing direct accountability of, and enforcement authority over, IRBs necessitates clarity with respect to which regulatory tasks are the responsibility of the IRB and which ones are the responsibility of the assured institution. OHRP indicated that it had begun classifying the regulatory requirements of the current Common Rule as either unique to IRBs, unique to institutions, or eligible to be fulfilled by either IRBs or institutions. The agency suggested that a reliance agreement could assign definitive responsibility for those tasks that could be performed by either the IRB or the institution. For example, the IRB must review and approve, disapprove, or require modifications to proposed human subject research, while the institution must establish that the IRB has such authority. Either the IRB or institution may develop procedures for reporting of unanticipated problems or serious/continuing non-compliance. OHRP requested public comment on the appropriate division of responsibilities. The absence of substantive discussion and resolution of these issues in the NPRM is somewhat surprising and results in continued ambiguity about how to best apportion responsibilities in certain areas. Institutions may want to request that OHRP address the open questions raised in the 2009 Advanced Notice on IRB accountability as part of adopting any final rule directly regulating IRBs or mandating single IRB review.

Among the unanswered questions, a particularly murky area has been responsibility for ensuring knowledge by the IRB of the ‘local research context.’ Institutions often use this term to refer to a variety or combination of local considerations, such as aspects of the subject population, cultural norms, institutional policies and ancillary review processes, and state and local laws and regulations. A reasonable interpretation of the Common Rule to date, supported by archived OHRP guidance, is that it is the FWA-holding institution that will be engaged in the research that must ensure that its reviewing IRB has sufficient knowledge of the local research context to meaningfully review the proposed research in accordance with the regulatory review and approval criteria. In the context of reliance arrangements, that has often meant that the relying institution is designated as responsible, under the governing reliance agreement, for informing and educating the reviewing IRB about its local population, norms, and rules, and for interpreting how those norms and rules should by applied by the reviewing IRB to particular ceded studies. It is unclear whether the proposals in the NPRM are intended to alter this common allocation of responsibility for addressing local issues, and if so, how HHS envisions that the reviewing IRB will, as a practical matter, attend to such responsibility.

With respect to compliance with state and local laws, in particular, it is difficult to envision how a relying institution can, vis-à-vis its state and local enforcement authorities, take the position that it has delegated responsibility for such compliance to an out-of-state IRB. Even if OHRP would hold the reviewing IRB responsible for identifying and applying state laws in reviewing and determining the approvability of a project, the state and local enforcement authorities would focus on the relying institution that is subject to those laws. The potential risks for the relying institution cannot be entirely regulated away by HHS, or entirely contracted away by the relying institution, even with a robust indemnification commitment from the reviewing IRB. Thus, it is unlikely that a relying institution (or its local IRB) can, responsibly, always completely remove itself from review of research projects that are under the oversight of a single IRB. Institutions may wish to pose specific scenarios to OHRP for comment and analysis as to how OHRP envisions these issues being handled in a single IRB arrangement, especially one that spans institutions in multiple states. Again, these issues are not new, but the NPRM proposal to require reliance brings them once again to the fore and will require institutions to address them in connection with any future implementation of such a requirement.

Compliance and Enforcement

The NPRM’s commentary regarding the proposal to directly regulate IRBs focuses heavily—arguably exclusively—on independent IRBs or IRB organizations not affiliated with an assured institution. The commentary notes that institutions have been reluctant to rely on such independent IRBs out of concern that the institution will be the target of regulatory compliance and enforcement activities even with respect to regulatory violations that clearly stem from IRB review tasks. The commentary addresses this concern by suggesting that OHRP would exercise new enforcement authority against such independent IRBs. See 80 Fed. Reg. 53933, 53983 (Sep. 8, 2015). In contrast, the 2009 Advanced Notice on IRB accountability contains a more balanced articulation of the liability concern in connection with any external IRB (including both independent IRBs and IRBs affiliated with other assured institutions). That document also frames the solution as expanding OHRP’s authority to take administrative actions against any external IRB. See 74 Fed. Reg. 53933, 9579-80 (Sep. 8, 2015). The apparent narrower focus on independent IRBs in the commentary to the NPRM is somewhat puzzling. There is no substantive reason to treat independent IRBs differently, from a compliance and enforcement perspective, than external IRBs based at another assured institution. Although reliance on independent IRBs has increased in the years since the 2009 Advanced Notice, so has reliance on institution-based IRBs. Presumably, OHRP does not intend to apply the proposed IRB compliance responsibilities or agency enforcement authorities differently based on the type of external IRB that is involved. The logical conclusion based on the proposals is that in a reliance arrangement where the external IRB was affiliated with an assured institution, OHRP would not exercise enforcement authority for IRB review-related violations against the institution relying on the review. However, institutions may wish to request OHRP’s confirmation of this presumption in light of the language in the commentary to the NPRM appearing to exceptionalize the liability concerns to independent IRBs. In addition, even if this presumption is correct, it is unclear, when the reviewing IRB is based at an assured institution, whether OHRP would direct enforcement at the IRB itself, or at the assured institution at which the IRB is based, and how such a distinction would be made in practice. The IRB in such case is not a legal entity, but rather is a body or board of the institution. Would enforcement against the IRB, then, mean enforcement against individual IRB members? Clarification from HHS on these questions is important to a full understanding of the single IRB review proposal.

Drive Toward Independent IRBs?

Not only is the NPRM commentary explicitly focused on removing concerns about reliance on independent IRBs, but the actual effect of the proposal for single IRB review may be to drive institutions disproportionally toward the independent IRBs. As commenting institutions will likely point out, the notion of ‘single IRB review’ is something of a misnomer, in that the selected reviewing IRB would differ by project, and institutions that participate in many multi-site studies would actually have to establish relationships with multiple different IRBs over time. Each relationship may require the institution to develop a new system for interacting with the reviewing IRB, to train its staff and investigators on the new system, and to build up trust with a new organization and individuals. Moreover, each reviewing IRB would have varying levels of experience with IRB reliance arrangements, varying resources to address local issues, and varying familiarity with HIPAA requirements applicable to the research. The potential for these and other variances may incentivize institutions to identify a few reviewing IRBs with which they can develop sustained relationships and which are likely to be eligible to be selected as the reviewing IRB for the broadest range of multi-site studies (including industry-funded research). These may be independent IRBs. In turn, the funding agencies may be incentivized to select these independent IRBs as the reviewing IRBs for their research. To the extent that IRBs based at assured institutions may be discouraged from serving as the reviewing IRB by liability or liability insurance-related concerns as mentioned above, these IRBs may self-select out of the running for designation as the single IRB. Institutions may wish to provide views on this outcome and whether academic or other institution-based IRBs would be disadvantaged by the proposed mandate.

Inconsistency re: Required Documentation

As noted, one of the proposed changes would formalize in regulation a requirement for documentation of IRB reliance relationships that lays out the respective responsibilities of the reviewing IRB and relying institution. The commentary in the NPRM indicates that the form of documentation must be a reliance agreement between the parties. See 80 Fed. Reg. 53933, 53984 (Sep. 8, 2015) (“written procedures identifying the compliance responsibilities of each entity . . . should be set forth in an agreement between the institution and the IRB specifying the responsibilities of each entity” (emphasis added)). The proposed regulatory text, which arguably would trump, refers more broadly to an obligation to “establish and follow procedures for documenting the institution’s reliance on the IRB for oversight of the research and the responsibilities that each entity will undertake to ensure compliance with the requirements of this policy (e.g., in a written agreement between the institution and the IRB, or by implementation of an institution-wide policy directiveproviding the allocation of responsibilities between the institution and an IRB that is not affiliated with the institution)” (emphasis added)). (§ __.103(e).) However, the regulatory text is not itself entirely consistent; a different section of the proposed regulation (§ __.115(a)(10)), related to IRB recordkeeping, refers solely to the “written agreement between an institution and an organization operating an IRB specifying the responsibilities that each entity will undertake to ensure compliance with the requirements of this policy, as described in § __.103(e)” (emphasis added). An institutional policy outlining the intended division of responsibilities when the institution relies on an external IRB would not, by itself, be enforceable by the institution against the external IRB (unless incorporated by reference in an actual contract with the IRB). Thus, it is not clear why an institution would forgo reliance agreements in favor of a policy. We would expect that most institutions would use reliance agreements, or perhaps have a policy in addition to reliance agreements. At minimum, however, institutions should request that OHRP clarify the intent regarding the required documentation and ensure that all references to such in any final regulation are consistent.