Is it possible to get IRB approval after the fact?

Question

Generally speaking, peer reviewed journals will not publish research on human subjects that did not receive IRB approval.

If a study was done without the proper IRB approval, but the study itself was ethical and clearly would have passed IRB approval if it had been properly submitted, is it generally possible to get a post-facto IRB approval that is sufficient to publish in most journals, or is the work forever "tainted"? Is the fact that post-facto IRB approval is not often considered an option because it literally isn't allowed, or because research conducted without IRB approval almost always contains ethical infirmities that would have prevented IRB approval from the start? In other words, is the requirement to obtain IRB approval truly a "You absolutely must have prior IRB approval", or is it really more like "You absolutely must not conduct research unethically, and obtaining prior IRB approval is part of Best Practices in accomplishing this, because nearly all proposals that you or I might come up with are actually unethical and we need the wisdom of the IRB to show us the light and put us on the right path. If you forgo prior approval, you are wading in crocodile-infested waters, and you will have no one to blame but yourself, not the IRB, not your mom, not your advisor, but only you yourself, if you get your leg bitten off"?

To be clear, I'm not asking whether it is possible to "whitewash" unethical research to make it look like no one was harmed when in fact people were harmed, but about institutional procedural violations in otherwise ethical research. I am well aware that one of the primary reasons for seeking prior IRB approval (other than because journals expect it) is to avoid committing unethical acts, so for the purpose of this question, assume that the researchers either just get lucky or are just so competent in ethical practice that their actual research demonstrates sublime virtue (just without IRB approval).

Clarification: Some people have seen fit to warn me that I am in danger of losing my job. I am not currently facing this issue. I'm simply curious as to what would happen or what typically happens in cases like these - that is, whether there are Best Practices on how to mitigate the fallout or even how serious it truly is - whether this is more of a "Calm down, it happens all the time, all you have to do is write an apology letter, sit through a five hour 'naughty, naughty bad boy, sit in the corner' lecture, be ritually spanked on the rear by your department head or the Dean, accept a 5% penalty pay cut for six months, and go through a retrospective IRB review." or a "Your career is doomed, don't dream of ever teaching or doing research ever again, you will be lucky if you ever find work cleaning floors."

Answer 1

The human research ethics committee is in place to ensure that human research is undertaken in a way that safeguards the dignity, rights, health, safety and privacy of those involved. This assessment is difficult to make by the investigator because he or she has a vested interest in proceeding. Thus, an independent body is required.

In the institutions in which I've been involved, conducting human research without ethical review is, quite simply, research misconduct and subject to investigations and disciplinary actions. A priori ethical review is required. Regulations are in place that specifically disallow approval of research that has already been conducted.

I've been a member of institutional review boards and have chaired three -- one based in a hospital and two in research-intensive universities. I've been involved in these investigations in the past. As the original poster implies, most are found at the point in which the journal requires evidence from the IRB and the author quickly shoot an email to the office requesting one. In these investigations, it is often the case that there is a lack of training in the expectations and regulations of human research and offenders usually fall in three categories:

• inexperienced researchers, including students (often poorly supervised) or practitioners with no research training
• researchers trained "elsewhere", including those from countries with little to no requirements for ethical review
• researchers from fields that don't usually involve human subjects

My worst case was a person from an electrical engineering background who collected data on body image for an app he was developing. During these sessions, the person gave advice that drove one participant to self harm. During the investigation, the offender did not think that ethical review was necessary because the questions were "innocuous (his term)".

As I said, in most cases the consequences are far less severe than this. For example, a common scenario is a young doctor who collects information from patient files, performs a few statistical tests and write up the results of this audit and sends the publication to a journal that then requests evidence of IRB approval. In cases like this, IRB approval is not provided and the doctor is placed under supervision.

Answer 2

As StrongBad has noted, publication is the least of one's worries in that particular context - you're talking about the kind of thing that people get fired for.

There's really no mechanism for "Oh, we totally would have approved this" post-hoc IRB approval. Indeed, there's an argument to be made that conducting the research without an IRB approval is inherently ethically suspect - in the same way that driving without a seatbelt on isn't only dangerous if you get in a car wreck. You are skipping the step meant to protect study subjects. That alone is a risk.

At this point in your scenario, the only real option is to seek the guidance of the IRB, and see what paths are available. This is absolutely one of those "This gets worse the longer it goes" situations.

Answer 3

This could possibly happen when data collected for internal use is repurposed as part of a research study.

Institutional Review Boards are supposed to oversee research involving human subjects. Per 45 CFR §46.102, the relevant regulation in the US, defines research as:

(l) Research means a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge

The "generalizable" part means that organizations can collect data that might otherwise be covered if it's part of their regular operations. For example, a hospital might track post-operative infections by operating theatre for quality control. They could use this data to determine if staff need to be retrained, or if a specific operating room might be colonized with some bacteria. The critical point is that this information is specific to a particular place, surgical team, etc.

If you had a lot of this data, you might try to make more general statements. For example, you might want to build a regression model that predicts surgical outcomes so that you could argue that this type of surgical team, or that cleaning procedure should be used more wildly. This crosses the line into a research activity and needs IRB approval. Likewise, if the data isn't already being collected, you'll need IRB approval to start collecting it.

Nevertheless, you can request IRB approval to examine any existing records. This can be done after the records have already been collected for their non-research purpose, but should be done before starting the research part of the project.

This is the only example I can think of where an IRB retroactively "blesses" the use of previously collected. There are also some categories of "Exempt Research" per 45 CFR §46.104. However, our IRB--and I think this is pretty standard--claims that the IRB itself needs to determine that a proposed project matches one of those categories; you can't just opt yourself out.

Answer 4

The main purpose of an IRB is to protect human research subjects. If you are doing research, even a seemingly harmless questionnaire needs approval. If you are not doing research, you can give humans that same questionnaire (and a lot worse). IRBs do not have a role in the use of humans in improving "process".

If you want to make your students happy, a department can give a questionnaire, swap out the water cooler with coffee and sugar and heavy metal music, repeat the questionnaire, then swap out with decaf coffee, artificial sweeteners, and classical music, and repeat the questionnaire again. This is a lot like a research project with key differences often being the lack of a randomized control group.

Under the guise of improved process, you can get away with a lot of things as long as you do not violate any laws or OSHA regulations. Companies do in house marketing studies all the time (do people like red or green or sweet or savory food, is this device too loud/quiet). As it is not research, it does not fall under the remit of an IRB.

Sometimes the data collected during this process evaluation look publishable. You might be able to publish them straight up, sometimes a journal will ask for IRB approval. In this case an IRB might grant you approval for a retrospective study. If the data however are deidentified, do not include any PHI/PII or biological, it might not be considered human use, and therefore the IRB would not have a role to play. The IRB might also decide that your process evaluation was in fact research. At that point they may decide you engaged in research misconduct. If that is the case, you could be in for a world of hurt.

Answer 5

There is a lot of misinformation in the answers and comments on this page, so I would advise the OP and other readers to be cautious about accepting anything on the page (including my own answer) as accurate. Ask an IRB or research ethics professional. An honest one will direct you to a specific federal regulation, OHRP or SACHRP guidance document, or principle from an accepted code of ethics (Belmont Principles, Declaration of Helsinki, etc.) OR admit not knowing or not being sure of the specific citation. For example, one commenter states, "Announced 2018, and phasing in by early 2019, the rules were changed by HHS so that PIs can self determine for certain exemptions." This is patently false. HHS made no such change.

Federal regulations did not before the revisions to the Common Rule, and do not now,

specify who at an institution may determine that research is exempt under 45 CFR 46.101(b). However, OHRP recommends that, because of the potential for conflict of interest, investigators not be given the authority to make an independent determination that human subjects research is exempt.

Specifying who has authority to make such determinations is thus left up to institutions. The vast majority of IRBs do not allow investigators to make this determination.

Similarly, the regulations do not provide an exhaustive list of what penalties to impose for a failure to submit a protocol to the IRB before conducting human subjects research. I'm not sure they provide any list at all (and it's difficult to provide a citation for what doesn't exist), though, if memory serves, for research conducted or supported by a federal department, they do have reporting requirements (to that department and/or the OHRP) for serious or continuing noncompliance and in some circumstances this topic falls under that category. Again, the specific corrections and penalties are left to the discretion of the institution (except in cases in which reporting to the OHRP is required and the OHRP requires suspension or cessation of research activity). Institutions commonly employ a number of sanctions, varying in severity, e.g., requiring re-consenting or re-contacting to get consent, blocking funding, requiring remedial training for the protection of human subjects, suspension of that research or all research by that PI, refusing to accept theses or dissertations (for students) based on that research, etc.

Again, don't rely on my answer, check my citations and check with an IRB or research ethics professional, preferably one at your institution. You might also try looking for answers on IRB Forum or SBER Network, two discussion communities on PRIM&R's website. They require registration on the site, but I believe they are free. Many of the posters are experienced professionals.

Answer 6

Many US journals demand a statement to the effect of "This research was conducted under the ethical principles of the Belmont Report", and European journals would ask for adherence to the Declaration of Helsinki. At the very least, Journals often ask for the name of the IRB, and IRB's hold to Belmont or Helsinki standards for medical research.

My understanding is that both guidelines require outside review before you "do stuff" to human subjects, and that if the outside review was not conducted, you don't meet the guidelines. You can't just go to the IRB for a do-over -- the violation has already happened.

I recommend a conversation with your IRB. There will be grey areas. I know one facility that required IRB review for beta testing software (!!!!!) but most IRBs would scoff at the idea.