Ethical Conduct of Clinical Research Involving Children (2004)

In addition to regulations aimed explicitly at the protection of human participants in research, other statutes, regulations, policy statements, and guidelines may also contribute to such protection. Regulations on the privacy and confidentiality of personal health information and the disclosure and management of financial conflicts of interest in research are briefly discussed below.

As one of the criteria for institutional review board (IRB) approval of research, Subpart A requires IRBs to determine “when appropriate, [that] there are adequate provisions to protect the privacy of subjects and to maintain the confidentiality of data” (45 CFR 46.111(a)(7)). For research involving only medical records or stored biological samples, the primary issue in protecting research participants involves threats to privacy.

In April 2003, new regulations on privacy went into effect under the

Health Insurance Portability and Accountability Act of 1996 (P.L. 104-191), commonly referred to as HIPAA. The main target of HIPAA was not researchers but health care providers and health insurance plans. In general, the law requires that covered providers and plans

1. notify patients or plan members of their privacy rights and how their protected personal health information can be used without special authorization;

2. obtain authorization from individuals, under certain circumstances, before releasing information for other purposes;

3. secure patient records so that those who should not have access to them do not; and

4. create policies and procedures to implement the law.

Under HIPAA, parents usually act as “personal representatives” of the child for the purposes of receiving the required notice of privacy rights, signing authorization for the release of protection information, and obtaining access to information about the child. HIPAA does not require the provision of any information to children and is generally silent on institutional responsibilities to children.

The law does not require permission from patients for health care providers, health plans, and health care clearinghouses to use information as part of their normal activities of providing health care or administering health benefits. For other purposes, including research, the law requires a specific, written authorization for covered organizations to release personal information that is protected under the law. If information is stripped of elements that would allow an individual to be identified, providers and health plans can provide it without written authorization. Some other exceptions to the authorization requirement are also permitted, for example, for certain activities related to preparations for research (e.g., identifying potential research participants by identifying individuals with relevant diagnoses or other characteristics).

Institutional review boards (IRBs) have been concerned about how the requirements under HIPAA might interact with their responsibilities for considering protections for privacy and confidentiality in research. Some questions involve the relationship between informed consent for research and HIPAA authorization for the release of personal health information. As explained in a National Institutes of Health (NIH) document describing the privacy rule, “an authorization focuses on privacy and states how, why, and to whom the [personal health information] will be used and/or disclosed for research. An informed consent … provides research subjects with a description of the study and of its anticipated risks and/or benefits,

and a description of how the confidentiality of records will be protected” (NIH, 2003b, p. 11, emphasis added).

For research purposes, HIPAA provides that an IRB (or a specially created Privacy Board, usually for institutions that do not have IRBs) may waive the requirement for authorization under certain conditions. Among other conditions, the research must involve no more than minimal risk, include a plan for protecting the information, and be impractical to undertake without the protected information and the waiver of the authorization requirement.

The law requires IRBs to review waiver requests, but it does not require IRBs to review authorizations required under HIPAA. Because the authorization is often part of the consent form for the research, IRBs do review the authorizations that are part of these forms.

Among researchers studying adolescents, there is some concern that parents may have access to information about adolescents that would otherwise be held confidential. The final HIPAA regulations defer to state laws on parental access to the health records of minors. The regulations do not themselves protect the privacy of this information (Nicoletti, 2003).

Independent of HIPAA, NIH has created Certificates of Confidentiality that can be issued to research institutions to cover research projects that collect sensitive information about research participants that might damage them if disclosed (NIH, 2003a). The purpose of the certificates is to protect the privacy of research participants by protecting investigators and institutions from being compelled to release identifying information in any federal, state, or local civil, criminal, administrative, legislative, or other proceeding. (The certificates do allow for the provision of information for DHHS audits and as required by the Federal Food, Drug, and Cosmetic Act.) Projects must have IRB approval and meet other requirements.

A 2002 IOM report on integrity in scientific research defined a conflict of interest in research as existing “when [an investigator] has interests in the outcome of the research that may lead to a personal advantage and that might therefore, in actuality or appearance, compromise the integrity of the research” (IOM/NRC, 2002, p. 38; see also IOM, 2003). As the financial rewards from many kinds of biomedical research have increased and as

investigators and research institutions have increasingly sought to participate in reaping those rewards, policymakers, ethicists, and others have become more concerned that conflicts of interest will compromise science and harm research participants. Although these concerns do not, in general, differ as when they involve adult or pediatric research, they are part of the broad context for considering the strengths and limitations of current regulatory protections for research involving children.

Potential avenues for managing, reducing, or eliminating identified or possible conflicts of interest in research vary depending on the nature and the seriousness of the conflict. Options include public disclosure of significant financial interests, relinquishing by investigators of such interests by investigators, independent monitoring of research, changes in the research plan, or changes in the investigators involved in some or all of the research. Most academic and similar institutions have conflict-of-interest policies that govern a variety of activities, including research. The National Bioethics Advisory Commission has recommended that academic institutions be more actively involved in managing investigators’ and IRB members’ conflicts of interest (NBAC, 2001).

In 1995, the NIH and the National Science Foundation (NSF) published policies on investigator financial conflicts of interest involving research funded by these agencies (NIH, 2000).¹ A recent review by NIH of institutional conflict-of-interest policies revealed considerable variation and some deficits, particularly in the clarity of policies for reporting conflicting interests (NIH, 2002). The review did not attempt to assess the implementation of the policies and did not single out any deficits related specifically to pediatric research. FDA rules do not require the disclosure of information until after the research has been completed and a sponsor submits a marketing application (GAO, 2001; see also, draft guidance from the FDA on financial relationships and interests in research [FDA, 2003]). Although federal rules do not require IRBs to assess investigator financial conflict of interest and many institutions lodge all responsibility for such assessments elsewhere, some institutions have adopted policies that require disclosure of such conflicts to IRBs and, less commonly, to research subjects (Lo et al., 2000).

In 2001, the General Accounting Office (GAO) reported that about one-quarter of IRBs consider financial arrangements between investigators

and research sponsors (GAO, 2001). In addition, most major scientific journals require disclosure by authors of financial conflicts of interest as a condition of publication.

An IOM committee recently recommended that reviews of possible conflicts of interest involving investigators, primary research staff, and IRB members should be conducted by a committee specifically created for that purpose. Furthermore, the body should be “shielded from institutional pressures or influence” and should transmit its findings to the IRB. The committee also recommended the establishment of an external body to review potential institutional conflicts of interest in research and report the findings to the IRB (IOM, 2003).

The focus of conflict-of-interest discussions is usually on the individual investigator or on the commercial sponsors of research. Academic institutions may also have conflicts of interest relevant to research undertaken by their members. For example, medical centers and other research institutions are increasingly involved in profitable partnerships with industry and may receive substantial income from patents and royalties resulting from the research.

No federal regulations apply directly to institutional conflicts of interest. In interim guidance on financial relationships in clinical research, the U.S. Department of Health and Human Services has, however, observed that institutions “should not lose sight of the need to manage their own conflicts of interest as well” and that “[t]he financial interest of the institution in the successful outcome of the trial could directly influence the conduct of the trial, including enrollment of subjects, adverse event reporting or evaluation of efficacy data (OHRP, 2001). In the latter case, the guidance suggests that institutions consider having independent investigators conduct a trial if the institution has a financial stake in the outcome.

FDA (Food and Drug Administration). 2003. Draft financial relationships and interests in research involving human subjects: Guidance for human subject protection. Federal Register 68:15456–15460.

GAO (Government Accounting Office). 2001. Biomedical Research: HHS Direction Needed to Address Financial Conflicts of Interest. Report to the Ranking Minority Member, Subcommittee on Public Health, Committee on Health, Education, Labor, and Pensions, U.S. Senate. [Online]. Available: http://www.gao.gov/new.items/d0289.pdf [accessed March 11, 2004].

IOM (Institute of Medicine). 2003. Responsible Research: A Systems Approach to Protecting Research Participants. Washington, DC: The National Academies Press.

IOM/NRC (National Research Council). 2002. Integrity in Scientific Research: Creating an Environment That Promotes Responsible Conduct. Washington, DC: The National Academies Press.

Lo B, Wolf LE, Berkeley A. 2000. Conflict-of-interest policies for investigators in clinical trials. New England Journal of Medicine 343(22):1616–1620.

NBAC (National Bioethics Advisory Committee). 2001. Ethical and Policy Issues in International Research: Clinical Trials in Developing Countries, Volume I. Bethesda, MD: NBAC. [Online]. Available: http://www.georgetown.edu/research/nrcbl/nbac/clinical/Vol1.pdf [accessed January 27, 2004].

Nicoletti A. 2003. Teens, confidentiality, and HIPPA. Journal of Pediatric and Adolescent Gynecology 16(2):113–114.

NIH (National Institutes of Health). 2000. Financial Conflicts of Interest and Research Objectivity: Issues for Investigators and Institutional Review Boards. Bethesda, MD: NIH. [Online]. Available: http://grants.nih.gov/grants/guide/notice-files/NOT-OD-00-040.html [accessed March 11, 2004].

NIH. 2002 (July 18). Financial Conflict of Interest: Objectivity in Research. [Online]. Available: http://grants1.nih.gov/grants/policy/coi/nih_review.htm [accessed March 11, 2004].

NIH. 2003a (July 21). Certificates of Confidentiality: Background Information. [Online]. Available: http://grants1.nih.gov/grants/policy/coc/background.htm [accessed March 11, 2004].

NIH. 2003b. Protecting Personal Health Information in Research: Understanding the HIPAA Privacy Rule. Bethesda, MD: NIH. [Online]. Available: http://privacyruleandresearch.nih.gov/pdf/HIPAA_Privacy_Rule_Booklet.pdf [accessed March 11, 2004].

OHRP (Office for Human Research Protections). 2001. Draft Interim Guidance: Financial Relationships in Clinical Research: Issues for Institutions, Clinical Investigators, and IRBs to Consider When Dealing With Issues or Financial Interest and Human Subject Protection. Washington, DC: U.S. Department of Health and Human Services. [Online]. Available: http://ohrp.osophs.dhhs.gov/humansubjects/finreltn/finguid.htm [accessed March 11, 2004].