What an IRB actually does: research ethics review, explained

In 1966, a Harvard anesthesiologist named Henry Beecher published a short paper in the New England Journal of Medicine listing twenty-two studies in which patients had been experimented on without their knowledge — hepatitis deliberately given to institutionalized children, live cancer cells injected into elderly patients who were never told what the syringe contained. The studies were not hidden. They had been run at respected institutions and published in major journals.

Six years later, the Associated Press revealed that the US Public Health Service had spent four decades observing Black men in Tuskegee, Alabama as they died of untreated syphilis — long after penicillin had become the standard cure. Congress stopped assuming researchers would police themselves. The committee it required instead is the subject of this post.

Where ethics review came from

An institutional review board — IRB — is an independent committee that must review and approve research involving human subjects before the work begins, and keep reviewing it for as long as it runs. The National Research Act of 1974 made that review a condition of federally supported research and convened a national commission to articulate the principles beneath it. The commission's product, the 1979 Belmont Report, remains the founding document of US research ethics, and its first principle is worth reading in the original:

Respect for persons incorporates at least two ethical convictions: first, that individuals should be treated as autonomous agents, and second, that persons with diminished autonomy are entitled to protection.

Belmont's three principles — respect for persons, beneficence, justice — were translated into regulation as 45 CFR part 46, the Common Rule, adopted across federal agencies in 1991 and substantially revised in 2018. The Office for Human Research Protections at HHS oversees the system, and the FDA maintains parallel IRB regulations for trials of drugs and devices.

The history explains the design. An IRB is not a scientific peer-review panel, and it is not a legal department. It is a structural answer to a specific, repeated failure: researchers, left alone, kept convincing themselves that the importance of the work excused what it did to the people inside it.

What the board actually reviews

The core of IRB review is a judgment call made by outsiders: are the risks to participants minimized and reasonable in relation to the expected benefits, and will participants understand and freely agree to what is being asked of them?

The Common Rule turns that judgment into criteria a board must walk through. Risks minimized by sound design. Risks reasonable against anticipated benefits and the value of the knowledge. Equitable selection of subjects — no quietly recruiting only the poor, the imprisoned, or the convenient. Informed consent sought and documented. Adequate provisions for monitoring data, protecting privacy, and safeguarding anyone whose capacity to refuse is compromised.

Membership is regulated too: at least five members with varying backgrounds, at least one whose primary concerns are scientific, at least one whose are not, and at least one with no affiliation to the institution at all. The intent is friction — a room where the research team's enthusiasm meets people with no stake in the study happening.

In practice, much of a board's time goes to consent documents: whether they are readable, whether they describe what will actually happen, whether a phrase like 'we may share your data with partners' is doing too much quiet work. The distance between consent that is broad and consent that is specific is its own subject — we walk through it in broad consent vs. dynamic consent.

Exempt, expedited, full board

Most research never reaches a convened board meeting. The regulations sort studies into three paths by risk.

Data-only research — the kind that uses records rather than procedures — often travels the exempt or expedited path. Often is not always: identifiable health records can still mean full review, and in the US, HIPAA runs in parallel with its own demands for authorization or waiver, which we cover in HIPAA and research.

Approval is a process, not a stamp

An IRB approval is dated, conditioned, and revocable — closer to a lease than a deed. Changes to the protocol must return to the board before taking effect. Unanticipated problems involving risks to participants must be reported. Many studies undergo continuing review at set intervals, and a board can suspend or terminate its approval outright. The 2018 revision of the Common Rule relaxed continuing review for much minimal-risk research, but the principle held: approval describes a specific protocol at a specific moment, not a permanent license.

What an IRB cannot see

An IRB reviews documents, not running systems. It reads the protocol, the consent form, the data-management plan — and then the study goes off and happens somewhere the board cannot watch. The board will not see query four thousand. It will not notice that a dataset approved for one analysis turned out to be convenient for another. It depends, structurally, on being told.

That is not a flaw in the institution so much as a limit of its medium. Paper supervision supervises paper. The honest conclusion is that ethics review needs a counterpart on the systems side: infrastructure that makes the approved thing the only thing the machinery will do.

Approval as a gate, not a file

That is how we build at Mithras Health. IRB approval on the platform is not a PDF in a folder; it is a precondition checked in the release path itself. A research dataset cannot be provisioned to a study unless the corresponding IRB-approved research-use event exists — and patient participation fees post on exactly those events. No approval, no release, no payment. The same event lands in an append-only audit trail retained for six years, so what the board approved and what the system did stay checkable against each other. Why patients are paid at all is an argument we make in full in should patients be paid when research uses their data?

The pattern generalizes past any one platform: wherever a rule matters, prefer apparatus that fails closed over policy that fails open — the theme of privacy as apparatus.

The IRB was never meant to be the whole of research ethics. It is the conscience convened before the work begins; everything after the meeting adjourns is carried by the people, and increasingly the systems, that run the study. The committee asks the right questions. The machinery should make the wrong answers impossible.