We have discussed before that consequences for not getting irb approval might include: (1) not be able to publish in a reputable journal, and (2) getting sanctioned or fired by your employer. But I am wondering: what other consequences could you face in really serious cases? Could you lose your eligibility for federal funding? Could you go to jail? Personal liability for any harm? The HHS "common rule" doesn't seem to lay down any possible penalties.
To make this more concrete, here is an example. Bob is a computer engineer who has no real training in human subjects research. He gets a federally-funded grant about using machine learning to detect tumors in a publicly-available dataset. On the grant proposal, he correctly says that no human subjects research is anticipated. But his initial results show that (say) a certain ratio of potassium and chocolate kills brain tumors. So, Bob gets very excited and gets a bunch of people he knows to take potassium + chocolate in various doses and then draws their blood. He has clearly crossed the line here: among other problems, he is storing human blood and PII. What kind of consequences could Bob face?