What Are Human Research Protections in Clinical Research?
Human Research Protections were founded on ethical principles that evolved over time as a result of past atrocities involving humans in research experiments. The Nuremberg Code and the World Medical Association’s Declaration of Helsinki were developed after the World War II Nuremberg trials and established ethical codes such as explicit and voluntary consent from patients and guiding principles for physicians., The Belmont Report was published in 1979 by the National Commission for the Protection of Human Subjects of Biomedical and Behavioral Research and described the basic ethical principles of respect for persons, beneficence, and justice. These principles collectively provided a framework for research ethics that led to today’s regulatory framework designed to protect human research participants.
Today, clinical research requires review by an institutional review board (IRB), which is a committee constituted by a group of individuals that ensures that any proposed research involving human subjects is ethical; adheres to established principles and rules; and has procedures in place to adequately protect the rights, safety, and welfare of humans participating in the research. Informed consent from participants is also a requirement under the regulatory framework. Clinical research is critical to contributing to scientific knowledge and advancing medicine. Over time, clinical research has become more fast-paced and complex as a result of advanced technology and expansion to multiple sites due to increased collaborative research efforts with industry and government agencies.
Healthcare institutions often participate in clinical research due to factors such as ties to research institutes and medical schools, provision of options for patients, and prestige. Institutions may participate in research that is funded internally, by the government, or industry. Externally funded research is governed by contracts and agreements that require adherence to various rules and regulations pertaining to human research protections and other areas of research conduct. Clinical researchers at healthcare institutions are required to navigate through a complex regulatory environment because research regulations add another layer on top of the already highly regulated healthcare environment. Therefore, depending on the complexity and extent of research, appropriate levels of monitoring and oversight of the research should be implemented to ensure compliance with regulations and adequate human subject protections during the research period.
Compliance risks for organizations depend on the nature and scale of the research, institutional oversight and culture, researcher qualifications and experience, populations involved, funding mechanisms, and legal and regulatory requirements that apply. Other factors that may affect human research protections, ethical conduct, or objectivity of the research include those related to academic pressures, researcher or institutional financial conflicts of interest, therapeutic misconception from research participants, community and cultural differences, and adequate resources to support and conduct the research. Thus, it is important to understand compliance risks more holistically when evaluating human research protections and consider both internal and external factors.
Risk Area Governance
Federal regulations that govern human research protections were promulgated by the Department of Health & Human Services (HHS) and apply to research conducted or supported by HHS. The subparts of the regulation include:
The Common Rule;
Additional protections for pregnant women, human fetuses, and neonates;
Additional protections for prisoners; and
Additional protections for children.
The Common Rule, which is the federal policy for human research protections that defines ethical standards in human subject research, was revised in 2017 with compliance dates of January 19, 2018, and January 20, 2020.
The Office for Human Research Protections (OHRP) within the Office of the Secretary of HHS provides regulatory and compliance oversight and develops policies, guidance, and education for human subject protections. Institutions that are required to comply with federal regulations must promptly report to OHRP “(1) Any unanticipated problems involving risks to human subjects or others; (2) any…serious or continuing noncompliance with [the] regulations or the requirements or determinations of the IRB; or (3) any suspension or termination of IRB approval.” Institutions that receive HHS support for research involving human subjects must also have a Federalwide Assurance (FWA) or commitment to comply with federal regulations signed by an institutional official and designate an IRB that is registered with OHRP. Institutions may choose to apply Common Rule requirements to all research or just those that are federally funded.
Institutions that operate an IRB must ensure regulatory requirements are met and establish policies and procedures. This includes an appropriate IRB committee constitution and meeting IRB review and approval criteria under the Common Rule. IRB approval criteria include: ensuring that the risks to participants are minimized and reasonable in relation to anticipated benefits, an equitable selection of subjects, ensuring that informed consent is sought from the prospective participant or their legally authorized representative and documented, ensuring that adequate privacy protections are in place to maintain confidentiality of the data, and monitoring the data to ensure subject safety where appropriate. IRBs must also comply with Food and Drug Administration (FDA) regulations.
There are various FDA regulations that apply to clinical research that involves drugs, devices, and biologics. The following are FDA regulatory subparts that are more applicable to human research protections and IRBs:
21 C.F.R. § 50 (Informed consent)
21 C.F.R. § 54 (Financial disclosure by clinical investigators)
21 C.F.R. § 56 (IRBs) 
21 C.F.R. § 312 (Investigational new drug application)
21 C.F.R. § 812 (Investigational device exemptions)
FDA-regulated clinical trials must also adhere to good clinical practice (GCP), which is an “international ethical and scientific quality standard for designing, conducting, recording and reporting trials that involve the participation of human subjects.” GCP is a set of international standards that were developed by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use (ICH) to ensure that the rights, safety, and well-being of human participants in clinical trials are protected in accordance with ethical principles and the data is credible. There are a variety of ICH GCP guidance documents, and the most relevant one to healthcare institutions conducting clinical research is GCP ICH E6 (R2), which was amended to take into account the modern complexities of clinical research and use of electronic records.
Registration of “applicable clinical trials” on ClinicalTrials.gov, including summary results, is required per the FDA Amendments Act of 2007 and final rule. Registration is required for National Institutes of Health (NIH)-funded clinical trials and posting of a consent form is required for any clinical trial conducted or supported by a Common Rule agency. These requirements are part of efforts to provide the public with greater transparency and access to information about clinical research.
Institutions supported by Public Health Service (PHS) funding must comply with other federal regulations. This includes research misconduct regulations that serve to promote the responsible conduct of research. The Office of Research Integrity oversees PHS research integrity–related activities, and institutions are required to submit reports pertaining to research misconduct when certain criteria are met. Research misconduct is defined as “fabrication, falsification, or plagiarism in proposing, performing, or reviewing research, or in reporting research results,” and any such allegations require prompt review by institutions. Other PHS regulations govern financial conflict of interest (FCOI) and aim to promote objectivity in the design, conduct, and reporting of research. See “Clinical Research: Financial Conflicts of Interest” in this chapter for more information about FCOI regulations.
Other federal regulations that pertain to protecting the privacy and security of information may apply to clinical research. The Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security rules govern privacy and security of protected health information (PHI) for institutions that are considered covered entities. Use and disclosure of PHI for research purposes by covered entities can occur through signed HIPAA authorizations (which may be combined with the research consent form) from research participants or waivers or alterations of HIPAA authorization granted by a privacy board or IRB. Covered entities must also implement appropriate administrative, physical, and technical safeguards to ensure the confidentiality, security, and integrity of electronic PHI. Research participant information may also be protected by researchers that have obtained a certificate of confidentiality (CoC) for research funded by HHS agencies (e.g., NIH) that serves to protect the privacy of research participants by prohibiting the disclosure of identifiable, sensitive research information.
Institutions must be aware of any other applicable federal regulations, state and local laws, or funding agency policies that apply to clinical research activities. This will depend on the type of institution that is conducting the research, nature and type of research, funding source, and contract and agreement terms. Special attention should be paid to high-risk or early-phase trials evaluating safety or research involving vulnerable and critically ill populations. Also, international research will require broader evaluation of other human research and data protection rules and regulations specific to the local and cultural context of the locations and populations.