But what purpose is having a review board made up of people who can think for themselves if their behavior is going to be indistinguishable from a program running through a checklist without any care whatsoever for whether or not the checklist makes sense in that context?

Massive inefficiencies in bureaucracy are always hidden behind the fig leaf of consistency and accountability, but it's worthwhile to consider what aim they serve and at what cost.

This problem was largely solved by the development and acceptance of private IRBs. Going with private IRBs that meet 2x weekly, turn forms around quickly, and are willing to pre-qualify your work - at cost, of course - is the road many researchers take now.

If you are asking the question: "How does this private market solution solve the problem of government/education/medical bureaucracy being inefficient," then I guess it does not solve the root cause. But trying to solve IRB problems involving that three-headed hydra is not likely to succeed. Going around the system is a feasible workaround.

I'm more concerned with the author's insistence that he knew the right way to conduct his study ethically. Peer review is a core scientific principle-- we don't allow researchers to make autonomous judgments about the quality of their work.

Not to mention that the questions were already being asked. He just wanted to ask them earlier to compare against the eventual diagnosis. It's not the kind of study that should have been abandoned in frustration after two years, as happened here.

Edit: more important for the scientific process (rather than privacy) than 'data leakage' is 'data sharing', as yread points out below. Anonymised data can be quickly and safely shared, and others can run their analyses on your results. Non-anonymised data can't be shared. If you're interested in publishing a robust scientific paper, why would you be against opening your data for inspection?

> Not to mention that the questions were already being asked. He just wanted to ask them earlier to compare against the eventual diagnosis. It's not the kind of study that should have been abandoned in frustration after two years, as happened here.

Then he could have just asked them and done his own informal study. Nothing is stopping the doctor from saying "are you happy, then sad?" on first meeting a patient. But if you want to do a formal, publishable study, then you should have all your ducks in a row. Make sure your independent variables are properly controlled, make sure any ethical issues have been externally vetted, so on and so forth.

While the IRB certainly had some annoying concerns, so much of this author's frustration just simply wouldn't be there if he understood why those questions were being asked.

Sure, but the complaints of the IRB mentioned (and the auditor) seem to be far beyond ensuring practice is ethical. Instead, they seem to focus on following process only for the sake of process.

Why should the consent form have the title of the study? Why should the consent form contain a list of risks when there are none? What is wrong with having consent forms signed with pencil when pens aren't allowed. Why should the data integrity plan require periodic review (i.e. why should we have a data integrity plan - integrity plan). These are all indicative of a bureaucratic system that places too much emphasis on 'process', losing sight of 'outcome' in the end.

Reminds me of something that Jeff Bezos (of Amazon.com) wrote in his 2016 Letter to Shareholders:

> Resist Proxies

> As companies get larger and more complex, there’s a tendency to manage to proxies. This comes in many shapes and sizes, and it’s dangerous, subtle, and very Day 2.

> A common example is process as proxy. Good process serves you so you can serve customers. But if you’re not watchful, the process can become the thing. This can happen very easily in large organizations. The process becomes the proxy for the result you want. You stop looking at outcomes and just make sure you’re doing the process right. Gulp. It’s not that rare to hear a junior leader defend a bad outcome with something like, “Well, we followed the process.” A more experienced leader will use it as an opportunity to investigate and improve the process. The process is not the thing. It’s always worth asking, do we own the process or does the process own us? In a Day 2 company, you might find it’s the second.

https://www.amazon.com/p/feature/z6o9g6sysxur57t

Sticking to a common set of rules and only deviating when there's very good reason is one way to help protect subjects. What's the 'outcome' here? A doctor wants to do a study. Why is that more important than the rights of the subjects? Yes, everyone who does a study thinks it's going to cure cancer and solve the national debt. They'll promise the moon in order to get their way. These processes are put in place to protect people against poorly-planned studies. And there's no way to know ahead of time that a study is 'trivial' - if you're working on humans, you need to be vetted. "But we already do this to patients anyway" is besides the point; if you let doctors bypass vetting because of that argument, you'd see all sorts of horrific stuff happening. Ethics committees didn't come about because bureaucracy invented them for the sake of it, they came about because people were being unknowingly tested on by medicos who promised that the study was 'beneficial for the common good'.

And what you find distressing is not what other people find distressing. Search for mncharity's comment elsewhere on this page, where people are distressed simply by being asked about viruses. Yeah, sure, that's not typical, but the counterpoint is: is the research beneficial enough to warrant causing distress to people who would otherwise have been left alone?

In short, this 'needless bureaucracy' is there to protect both the institutions and innocent people from researchers going 'rogue'.

There's like 50 wall of text posts in here that don't seem to be understanding that

My major gripe whenever there is a long piece that decries the bureaucracy of various regulatory boards is that the complaints tend to be about how the bureaucracy is a personal inconvenience. Some of the gripes I'll absolutely grant; pen versus pencil and inflexibility for giving potentially violent persons a weapon probably needs some sort of leeway, but I think protectionary measures absolutely should be a brick wall; a surmountable one, sure, but only as a result of you actually trying a bit and demonstrating that your intended actions aren't going to do exactly what the regulation is trying to prevent, and that should be on the researcher using human participants to demonstrate.

The idea of easily avoidable and mutable regulatory functions seems contradictory - that is, a researcher shouldn't be declaring what should and should not apply to them. This isn't fear that they're Hitler and going to inject people with nastiness, it's fear of the dumb mistakes that every human makes and our often poor ability to predict the outcome of certain actions. I get it - they want to help people and the regulations are inconvenient for them; but having gone through many IRB processes myself, it's not insurmountable in the least bit, much less anything the author listed.

In general, most IRBs are there to help out, not to get in the way. It may feel like getting in the way, at the time, but they mostly are there to help.

For example: the wordings of your consent forms. FDA says that they need to be at an 8th grade level, +/- 0.2 grade levels. You can game MS word to get that to an 8.2 grade level but have it be 140+ pages, and a lot of researchers do that. This is especially prevalent in clinical drug trials where many Pharam companies try to make the consent form a contract filled with legalese. That egregious example is non typical, but highlights the issues with consent forms being readable and an actual consent form a person. This is where a decent IRB would help out and tell you that you need to re-write the consent form to be an something that is not gibberish. (Side-note: Most newspapers are written at a 6th grade level it turns out).

Another example is International research. There was a case I heard of where a group was going to go collect HIV data in Tanzania. They were just going to go out and collect blood samples and sexual health questions alongside. The part of Tanzania they were collecting from is rural and believes in very strange medical practices like eating albino people or having sex with virgins to cure HIV, though I forget exactly what. Balancing the local beliefs with data collection can be tricky in that case. Typically, you would like a local IRB in that region, but there was none. So the US based IRB decided that the researchers needed to go out to the religious and government centers in that part of Tanzania and ask them what to do and what questions they could ask, etc. This added a lot of time and expenses to the study to spend in country before data collection, but the US IRB held firm on that. This was a good idea, as the local peoples had a lot of reservations and wanted to see all the data themselves before it was sent out of country, so as to go off and then kill women that were HIV positive. If the US researchers had found this out beforehand, a lot of deaths may have occurred. They subsequently then left off a lot of questions and data gathering.

Researchers are human too and we forget things all the time and have a lot of pressures on us as well. IRBs should be there to help out and not be a road-block. If the IRB you are working with does turn out to be that, talk to other researchers and find if they have the same issues. If you all do, go to the IRB and explain to them that they are unreasonable, most of them do want to know that they are holding things up unnecessarily. If it persists, go to the hospital/university admin as a group and make the case. These advancements need to be triple checked, but they still need to go through to begin with. IRBs are not evil, sclerotic maybe, but not evil. Work hard to get them to be better, we are all in this together.

A patient consenting to being treated doesn't mean they'd consent for that personal information to be used for any other purpose.

From the responses in this thread, it seems HNer's are actually fine with their data being used for secret reasons without their consent, as long as it means less bureaucracy. "How dare you use my data for your own purposes... unless it helps you avoid an inconveniencing committee, then go for it!"

It helps that it's painted as the poor resourceless scientist vs the powerful abusive entity (IRB). Rather than the poor resourceless patient vs the powerful abusive entity (hospital and its staff).

1. Researcher incentives. Data => publications => prestige. If the procedure actually contains some inherent risk (e.g., a surgery) then this mismatch between the priorities of the physician and the priorities of the researcher matters. Even (actually, especially!!!) if the physician and the researcher are the same person.

2. Publication. De-anonymization is a real risk even if you're careful to only talk about patient # N in the publication.

3. Patient preference. Just because I allow my hosting provider to access my servers for the purpose of maintenance doesn't mean I'm OK with them accessing my servers for the purpose of surveillance or to read my personal emails. Purpose matters. Some patients won't want data about them used in the context of a scientific study. Patients should and do have the right to insist on that preference. Frankly, the presumption otherwise is exactly why IRBs exist.

This story sounds stupid because -- aside from de-anonymization or data leaks -- there are actually no substantive risks associated with this study. Change "questionnaire" to "open heart surgery" and all of this process starts to make a lot more sense.

FWIW I'm not saying IRB's aren't completely overbearing when it comes to benign studies. They totally are. But that doesn't mean these processes aren't well-justified in other circumstances.

(Also, a lot of this pain is completely avoidable if you learn and follow the rules, which isn't actually nearly as hard as this post makes it out to be IME.)

This is the same dynamic that happened in, say, the 1950s with Communism. At that time, the Soviet Union was legitimately scary. They had the world's largest army, an arsenal of nuclear weapons, and were led by a power-mad dictator. It was certainly a wise move to defend against them. But eventually, Communism became a catch-all justification that could be used for any rule or policy, no matter how silly it was. Why, for example, did we need the words "under God" in the Pledge of Allegiance? Because of communism, even though it didn't help the Western military position at all. Likewise, any challenge to these policies could be dismissed as "naive", "uninformed", or "not taking the threat seriously".

You might argue that there was risk to the patients in the one part of the procedure that was different than what they would experience anyway - the actual asking for consent - but if so, what would you propose doing about it?

You have made a straw man out of this one case, and are defending it with all the dogma displayed by this IRB.

I disagree. Even the one that he makes sound the most ludicrous ("IRB required pens, be we were only allowed to use pencils") can be rephrased as: "Your hospital had reasons to be concerned that patients might stab themselves or someone else with a pen, yet you don't even think of giving them pencils as any sort of risk".

And you say this is the most ludicrous requirement, but it's actually the least. After all it's not entirely the IRB's fault, they didn't ban pens in the hospital.

But it demonstrates exactly what is wrong with bureaucracy. Maybe one bureaucracy with one set of arbitrary rules could be tolerated. But once you have two interacting they can create contradicting and incompatible rules. One bureaucracy bans pens, the other bans pencils, and you end up with a world with no writing implements at all.

I'm sure the regulation sounded entirely reasonable at the time. Someone had to put together a set of rules on how to get consent. And they think pens are supposed to be the proper way of writing a signature, because banks require you to sign checks in pen. Because long ago people would erase checks written in pencil and commit check fraud. At no point did they ever consider the history of that rule or that it doesn't make much sense applied to consent forms. At no point did they ever consider that there might be a hospital somewhere that bans pens for whatever reason.

And I can't blame them, why would they? You can't anticipate every possible edge case. This is a website made up of programmers, we should know that better than anyone. And yet at no point did anyone with common sense come along and make an exemption for that rule. When rules become fixed and inflexible they do things that weren't intended by the rule writers.

And every single thing in the article is like that. Some rule that might not be so bad or make sense in isolation. But combine it with 10,000 other rules, and total weight becomes overwhelming. And as a result you get a bunch of people misdiagnosed with bipolar disorder, and god knows what else since doctors can't do the research necessary to find out.

Or maybe they did?

> At no point did they ever consider that there might be a hospital somewhere that bans pens for whatever reason.

IRBs are part of each research institution. The unspoken implication in OP's story is that the psychiatry department of his hospital had never conducted research with humans before him. At least not any research that required consent. If they had, they would have faced the need for pens. "Requiring IRB review and a consent form" is almost the opposite of an edge case for a research institution.

> Some rule that might not be so bad or make sense in isolation. But combine it with 10,000 other rules, and total weight becomes overwhelming.

I can't really feel that steps like being forced to blind your data, or to store that data somewhere it can't be read by random people, are overwhelming, nor ludicrous, nor indefensible. I understand that learning by hitting walls is frustrating, but those things are proper experimental procedure. Maybe his professors should have had a lecture about them (mine did). Or maybe it was the purpose of that video that he thought was a waste of his time because he's not a Nazi.

> Even the IRB failed to complain or notice this "danger". They never complained that pencils were too dangerous

If I'm reviewing that application and on the risks section I see "paper cuts lol", and the applicant then asks me to allow pencil signatures because pens at his department are a risk, I would conclude he's not taking any of it seriously enough.

I'm pretty sure that it's not any harder to forge a signature when it's made using pen or pencil. It's just a mark that says "I agree." It's not a bank form where the validity of the amount tendered could be called into question.

"Oops, I forgot about presenting my subjects with the consent form and now I've got 100 results collected during a whole year of work.

I definitely don't want to throw all of that work away... But if I contact them and make them sign the form now using pencil, I could erase the date and change it to each subject's day of experiment. Nobody would notice."

Pen raising that barrier. I agree that against an adversary fully committed to fraud it doesn't matter. But that threat model is exceptionally rare, and an IRB can do little about it anyway (e.g. the whole application could be made up, the experiment consisting of something completely different). The realistic threat they fight against is experimenters that don't know better, and think there'd be no harm in their actions.

And this is just me coming up with a possibility in a few minutes. Reality tends to be richer than a single person's imagination.

The fact that I actually agree with you, and think this might work in fact inside of any hospital in the US, says more about the byzantine complexity and scary state of our medical system than anything else.

Because I could totally see 100 people being told they have to sign a thing, while in a hospital, with absolutely no good reason given, ... and all 100 just signing it after some variable x*N amount of huffing, then get on with their day.

It looked like you were giving an alternate phrasing of the IRB's actual argument, not a separate one that also argues in favor of disallowing pencils (as well as the pens they had no problem with).

Think about the about experiences and opinions that are common to the people on HN.

Bureaucracies that have lots of rules to cover every eventuality and interpret those rules as if they're a computer executing code isn't an intolerable concept to a group that can be generalized as "tech workers in CA."

The requirement wasn't that the code should be next to the data, if I understood it correctly; rather that it be blinded and stored safely. Storing them together was the least-effort way he found of passing the requirement, partially defeating its purpose.

So if anything that's an argument for adding even more requirements to the IRB process in his hospital. Because grad students that feel sufficiently aggravated will do things like that.

You probably will get downvoted because you come across as being entirely dismissive of expertise or thinking that is not your own. I think you general point about the importance of oversight isn't lost on anyone.

Sure but the mockery in that post suggests he either doesn't care about them or thinks they're stupid.

Also do we really have to point out that just because someone is a doctor doesn't mean they have any authority when it comes to medical ethics? I mean, there's hundreds of cases amply demonstrating this even just this decade.

You definitely should be since I have made precisely zero of those claims on this website or any other.

What is the basis for this statement? The author states that there is no oversight or governing body for the IRB. Is this incorrect (and if so, who is it)? If not, then the author's criticism seems apt.

You're not trusting them blindly because any and every ethical protection you decide your procedure needs, will be there. In addition to the ones the IRB thinks need to be there too.

When you implement a workplace safety policy in your company, making it comply with OSHA regulations isn't "blindly trusting authority to decide what is safe". If you think a practice is unsafe, yet OSHA thinks it's safe enough, they're not gonna prevent you from taking more precautions.

Same deal with code reviews. You aren't blindly trusting your colleague to decide what is bad or good code. You're adding their polish to yours.

I don't understand how a medical doctor can write such a simplistic post. Of course your consent forms need to mention that you will access medical data if you look at diagnosis even though they are your patients! You have access to all kinds of data for treating the patient (so called primary use), but you should have the absolute minimal set of attributes for research (secondary use). Who judges whether these attributes are really needed? IRB!

Of course you need to have you paperwork in order. This is not only your paperwork but also the hospital's! If you fuck up the newspapers are gonna carry headlines: doctors in this hospital leaked patients data. Do you think patients will want to come to that hospital?

Of course your investigators need to go through training on research ethics! In fact you should've put them through more training so that they fill in the damn consent forms properly!

Of course you need to separate personally identifiable information from the actual research and encode patient identifiers. Ever heard of publishing your data next to your research? When someone asks for the data from your study and you would forget to scrub it you would leak data. Encoding it and having it in two separate folders in one cabinet makes data sharing simpler. It protects you from making a stupid error.

Of course they can be next to each other in the cabinet. That cabinet is fucking locked! And it's in a hospital next to other private data. The risk is with publishing it!

Of course you need to fill in New Study Application, describe your study design and consent. IRB judges research studies, how would they do it if they didn't have that? You need to describe that stuff when asking for a grant and most studies are funded by grants so for most people it's no extra work.

Of course you need a monitoring plan and study meeting monitoring problems. If you had one you would notice that the newbies were doing a shitty job! Them doing a shitty job is not only bad for you but much more importantly it wastes patient's time! Patient's didn't come to hospital to improve your credentials!

The fact that there is some less than ideal stuff already used doesn't mean that your new study can be shit. That's like being angry about your pull request not getting accepted cause your indentation is all over the place and saying "but your indentation is already inconsistent". If there are style guidelines that's the way to do it. New code needs to follow them. Old stuff might get fixed or not but new stuff should be done according to guidelines.

The people suing you would be the participants, because you would have already harmed them. Not getting sued by them is just a derived benefit of the primary goal of protecting them from you. And the protections extend well beyond what a patient might bother suing you for: it's an ethical committee after all.

> at what cost to less well equipped researchers and at what cost to science itself?

Completely secondary considerations, for very good reasons. Nazis weren't the only ones to harm patients; also well-intentioned scientists that thought of the greater good for science itself, and grad students that lacked resources or equipment.