The IRB review process is intended to assure, both in advance and by  periodic review, that appropriate steps are taken to protect the rights and  welfare of humans participating as subjects in the research. Figure 1 below provides a simplified illustration of the IRB  approval process for human subjects research protocols. IRBs also play a central role in the process by which entities apply for  federal funding for human subjects research. To obtain an  assurance, HHS requires an entity to declare to HHS that its activities  related to human subjects are guided by ethical principles and federal  regulations—the Common Rule—and to designate one or more IRBs to  review the research covered by the assurance. The company that sent materials to us was seeking our bogus IRB’s  approval to add one of the company’s clinics as a new test site for ongoing  human trials involving invasive surgery. Our bogus IRB could have  authorized human subjects testing to begin at this new test site—even  though it was a fictitious IRB, with no medical research expertise  whatsoever. Moreover, because this transaction involved a company  conducting private (i.e., not federally funded) research, and did not  involve any FDA-regulated products, our bogus IRB could have approved  the research to begin without needing to register with any federal agency. All IRBs that review federally funded human subjects research are  required to be registered with HHS. As mentioned  above, in evaluating an application to determine whether or not to approve  an assurance, HHS is required to consider the adequacy of any IRB  designated on the application, as the IRB will be responsible for  overseeing the research activities of the entity that submitted the  assurance application. In addition, we used the assurance approval to  boost the credibility of our fictitious medical device company by posting  our assurance number on the fictitious medical device company’s Web  site. Each of these  assurances is a first step for the medical researcher to apply for federal  funding for human subjects research, with this IRB formally designated to  oversee the research. IRBs’ Research Protocol Approval Process

We were able to get an actual IRB to approve a fictitious protocol for  human subjects research, which raises concerns that other IRBs may  conduct protocol reviews without exercising due diligence, thereby  exposing research volunteers to significant risk. For this test, we created a  research protocol for a fictitious medical device with no proven test  history and bogus specifications, and sent the protocol to three actual,  independent IRBs under the guise of the medical device company we  created for obtaining an assurance from HHS in our second test, as  mentioned above. We succeeded in getting our  fictitious protocol approved by an IRB, even though we were a bogus  company with falsified credentials and an unproven medical device. If we  had been a real medical device company, we could have begun testing our  “significant risk” experimental device on actual human subjects. We also  could have used our bogus IRB mentioned above to approve our fictitious  protocol. This shows the potential for unethical manipulation in the IRB  system. For  example, we provided IRB 1 with bogus information that FDA had already  cleared our device for marketing because our device was found to be  substantially equivalent to an existing, legally marketed device. IRB 1’s board meeting  minutes indicate that it believed our device was “probably very safe,” as  shown in figure 2 above. Our contacts with IRB 2 and IRB 3, during  their review of our protocol, were done entirely by e-mail. Briefing with HHS

We briefed HHS officials on the results of our investigation. According to HHS officials,  the department does not review IRB registrations or assurance  applications to assess whether the information submitted is factual. Moreover, although HHS is required by law to  consider the adequacy of IRBs listed on assurance applications when  reviewing applications, the director of OHRP stated that his office would  require more staff to do so. HHS officials stated that the assurance process is not a meaningful  protection against unethical manipulation. For example, representatives from one of the IRBs that rejected  our protocol stated that the HHS assurance number listed on our bogus  medical device company’s Web site gave our company credibility because  it meant that HHS had recognized our company.
Why GAO Did This Study

Millions of Americans enroll in clinical studies of experimental drugs and medical devices each year. Many of these studies are meant to demonstrate that products are safe and effective. The Department of Health and Human Services' (HHS) Office for Human Research Protections (OHRP) and the Food and Drug Administration (FDA) are responsible for overseeing aspects of a system of independent institutional review boards (IRB). IRBs review and monitor human subjects research, with the intended purpose of protecting the rights and welfare of the research subjects. GAO investigated three key aspects of the IRB system: (1) the process for establishing an IRB, (2) the process through which researchers wishing to apply for federal funding assure HHS their human subjects research activities follow ethical principles and federal regulations, and (3) the process that medical research companies follow to get approval for conducting research on human subjects. GAO investigated these three aspects of the IRB system by creating two fictitious companies (one IRB and one medical device company), phony company officials, counterfeit documents, and a fictitious medical device.

What GAO Found

The IRB system is vulnerable to unethical manipulation, which elevates the risk that experimental products are approved for human subject tests without full and appropriate review. GAO investigators created fictitious companies, used counterfeit documents, and invented a fictitious medical device to investigate three key aspects of the IRB system. These are the results: Establishing an IRB. GAO created a Web site for a bogus IRB and advertised the bogus IRB's services in newspapers and online. A real medical research company contacted the bogus IRB to get approval to join ongoing human trials involving invasive surgery--even though GAO's investigators had no medical expertise whatsoever. Since the transaction involved privately funded human subjects research and did not involve any FDA-regulated drugs or devices, GAO's bogus IRB could have authorized this testing to begin without needing to register with any federal agency. Obtaining an HHS-approved assurance. GAO also registered its bogus IRB with HHS, and used this registration to apply for an HHS-approved assurance for GAO's fictitious medical device company. An assurance is a statement by researchers to HHS that their human subjects research will follow ethical principles and federal regulations, which is required before researchers can receive federal funding for the research. On its assurance application, GAO designated its bogus IRB as the IRB that would review the research covered by the assurance. Even though the entire process was done online or by fax--without any human interaction--HHS approved the assurance for GAO's fictitious device company. With an HHS-approved assurance, GAO's device company could have applied for federal funding for human subjects research. Obtaining IRB approval for human testing. GAO succeeded in getting approval from an actual IRB to test a fictitious medical device on human subjects. GAO's fictitious device had fake specifications and matched several examples of "significant risk" devices from FDA guidance. The IRB did not verify the information submitted by GAO, which included false information that FDA had already cleared GAO's device for marketing. Although records from this IRB indicated that it believed GAO's bogus device was "probably very safe," two other IRBs that rejected GAO's protocol cited safety concerns with GAO's device. No human interaction with these IRBs was necessary as the entire process was done through e-mail or fax. GAO's bogus IRB mentioned above also could have approved the fictitious protocol, which shows the potential for unethical manipulation in the IRB system. GAO briefed HHS officials on the results of its investigation. The director of OHRP stated that, when reviewing assurance applications, HHS does not consider whether IRBs listed on the applications are adequate--even though HHS is required to do so by law. In addition, HHS officials stated that the department does not review assurance applications to determine whether the information submitted by applicants is factual.