IRB Case: Public health practice vs. research

Type of Institution: State Department of Public Health

Type of IRB:              Public Health

Type of Case:           Public Health

Author:                      Chairman of the IRB


From the Editors:

Institutional Review Boards that exist within public health agencies are charged with the task of distinguishing between public health practice and public health research, both of which are regularly conducted by public health authorities but which are governed by differing regulatory paradigms. The line between ‘practice’ and ‘research’ is sometimes indistinct and protocols often come to public health IRB’s that are neither completely public health practice nor research but contain elements of both. This case illustrates the difficulties faced by public health IRBs in distinguishing practice from research, and the importance of doing so in order to apply the correct regulations to the appropriate activities.


Research is defined and codified in DHHS 45 CFR 46.102(d) as “…a systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge.”1 Many organizations, including the CDC, accept this definition to include public health research and focus on

“1. the degree to which information gathering is systematic,

2. the design of the activity and

3. the generalizable nature of knowledge generated by the activity.”2

Others, however, such as the National Bioethics Advisory Commission, suggest it may not be appropriate to apply this definition of research in the public health sphere, since the practice of public health also involves systematic data collection that, by definition of these activities as being public, necessarily produces information generalizable to and from populations.3 The

“…NBAC suggests basing a definition for public health research on the locus of benefits. If the benefits from the activity are focused on the members of the participating population through improvements in the public’s health, the activity is public health practice. If the participants in the activity are not the intended primary beneficiaries, then the activity may be classified as research.”4

Public health practice under the approach advocated by the NBAC,

“…includes epidemiological investigations, surveillance, programmatic evaluations, and clinical care for the population…Underlying many of these activities is… the collection and analysis of identifiable health data by a public health authority for the purpose of protecting the health of a particular community, where the benefits and risks are primarily designed to accrue to the participating community.”5

But public health authorities “…also design and conduct research involving human subjects for the purpose of generating knowledge…” 6 Accordingly,

“a definition of public health research…might be stated as…the collection and analysis of identifiable health data by a public health authority for the purpose of generating knowledge that will primarily benefit those beyond the participating community who bear the risks of participation.”7

Study Design

A proposal was submitted to the Department of Public Health’s (DPH) IRB, the Human Investigations Committee (HIC), by a researcher not employed by the department but who functioned as an agent of the department for surveillance of specific communicable diseases. The researcher wanted access to identifiable health information on cases of a certain disease for the purposes of both enhanced disease surveillance and research. This investigator, by virtue of his position as an agent of the Department of Public Health, was entitled to access certain kinds of identified patient data regarding the disease being studied in this project. The stated goal of the study was to establish a population-based surveillance system for persons newly identified with this infection in one town in Connecticut in order to develop individual and population-based prevention strategies for use across the state. He planned to identify disease cases from laboratory tests identifying individuals as newly diagnosed with the disease of interest. Results of such tests are routinely reported to the local health department and the State Department of Public Health as mandated by state statutes (Connecticut General Statutes Section 19a-2a and Section 19a-36-A2 of the Public Health Code). The Centers for Disease Control and Prevention, the State Department of Public Health and a local health department were all listed as collaborators on this projectFunding for support of this project came from the CDC through the State Department of Public Health.


The project objectives as stated in the protocol were as follows:

  • Describe the demographic and socioeconomic characteristics of persons with the infection
  • Assess stage of illness and the need for medical and personal preventive services (e.g., health insurance status, access to primary and specialty care, need for mental health treatment, history of vaccination, alcohol/drug use)
  • Estimate the burden of chronic disease or a related clinical event among persons newly-identified with the infection (clinical criteria were listed for both of these)
  • Establish a population-based cohort of persons with the infection to follow longitudinally to evaluate the natural history of disease


The investigator planned to recruit subjects for enrollment in the project in the following ways:

  • He requested a Waiver of HIPAA Research Authorization be granted by the HIC to permit him to obtain, from the local health department, identifiers of all local persons with recent positive blood tests for the disease of interest. He wanted their names, addresses, telephone numbers and physicians’ information.
  • Once he was in possession of those individual’s PHI, the investigator planned to contact the physician of record, if available, for permission to contact the patient. If the physician agreed, the researcher would contact prospective subjects first by mail followed by telephone, to invite them to participate in a research project.
  • Prospective subjects would be asked, by telephone, to consent to
    • an interview with completion of a survey instrument either in person or on the telephone,
    • allow the researcher to obtain a new blood sample, and
    • permit review of the subject’s medical records and biopsy slides if available.

 Informed Consent and HIPAA Research Authorization

The investigator planned to obtain informed consent from subjects in the following ways:

  • He planned to mail a letter to the prospective subject informing him/her of the study and alerting him/her to expect a phone call from the investigator within the next several days. He intended to attempt to contact each potential subject by telephone up to 20 times before terminating further attempts at subject enrollment.
  • Once the investigator successfully made telephone contact with the prospective subject, he intended to describe all the details of the project and obtain verbal informed consent and HIPAA Research Authorization for participation in all parts of the study at that time. In addition, if the subject agreed, he planned to conduct the interview and completion of the survey instrument at the same time or at a time and date a few days hence. Alternatively, the researcher planned to offer the prospective subject the ability to conduct the interview in person.
  • If the interview were to be conducted in person, the researcher planned to obtain standard written informed consent and HIPAA Research Authorization at that time.

Proposed Data Sources

The researcher intended to obtain detailed socio-demographic, medical, insurance, psychiatric, and drug and alcohol-related information through access to the following sources:

  • Hospital and physician office medical chart reviews: Medical information would be obtained from the physician’s office that ordered the  original positive blood test, the hospital where the individual received his/her care for this and other conditions, or where the subject stated was his/her usual source of care.
  • In-depth telephone or in-person interviews: The purpose of the interview was completion of an extensive survey instrument that consisted of 70 questions eliciting information on the “study” condition, other selected health conditions, selected vaccine history, risk factors for contracting the study condition, demographics, and alcohol, recreational drug and sexual histories.
  • Review of subject’s biopsy if available: The investigator planned to obtain pathology slides of a biopsy performed for clinical indications related to the disease of interest from the institution where the biopsy took place. The slides were to be reviewed by the study pathologist to confirm accuracy of disease diagnosis and stage, although the protocol was scant in its description of how data obtained from slide reviews were to be utilized in either the enhanced surveillance or the research components of the project.
  • New blood sample: The investigator planned to obtain an additional sample of blood from each subject but the protocol did not describe the purpose for obtaining this extra blood specimen.


Ethical/Regulatory/Operational Issues

Several important ethical, regulatory, and operational issues arose during IRB review of this protocol.

  • Was this project public health practice or public health research?

While the protocol defined the project as enhanced public health surveillance with a research component, the HIC had difficulty determining which activity represented practice and which should be considered research. They expressed concerns that the researcher did not clearly differentiate research activities from surveillance work. They also questioned the objectives of two proposed study data sources – biopsy slides and a new blood test – since the researcher did not state a hypothesis justifying access to these sources of patient data, nor describe how he intended to use them. These areas of ambiguity in the protocol clouded the distinction between research and practice, thus raising HIC concerns regarding the planning, conduct and evaluation of the project.

IRB Decision:

Several conversations occurred with the investigator for the purpose of clarifying the objectives for certain study activities. In reviewing his responses given the stated study objectives, the IRB came to the following conclusions.


  • Describe the demographic and socioeconomic characteristics of persons with the infection: These activities supported the researcher’s goal of identifying risk factors for an at-risk population. Data to meet this goal were to be obtained from the patient interviews, completion of the survey instrument, and review of patients’ hospital and physician medical records. Since the information obtained from these activities would be utilized to create disease prevention strategies applicable primarily beyond the local study cohort, this part of the study was deemed by the IRB to constitute public health research and not practice.
  • Assess stage of illness and the need for medical and personal preventive services (e.g., health insurance status, access to primary and specialty care, need for mental health treatment, history of vaccination, alcohol/drug use): These activities related to creation of a disease-specific surveillance system for this town and the cohort of newly identified diseased individuals. Data to meet these goals would come from ongoing surveillance of patients’ hospital and physician medical records and were considered by the IRB to represent public health practice since theoretical benefits would accrue to those local participants with the disease.
  • Estimate the burden of chronic disease or a related clinical event among persons newly-identified with the infection: Activities related to this objective were deemed to represent predominately public health research since enhanced understanding of the burden of chronic disease suffered by members of this study cohort could readily be used to inform not just prevention strategies elsewhere in the state but also aid in service planning for meeting disease-related unmet needs. This work would be accomplished via longitudinal surveillance of the study cohort with regular reviews of their medical records, repeated interviews and completion of additional surveys. 
  • Establish a population-based cohort of persons with the infection to follow longitudinally to evaluate the natural history of disease: Creation of this cohort for the purpose of accomplishing long-term surveillance clearly represents research in this project since it was to be used primarily to facilitate better understanding of the natural history of this disease in order to inform prevention and treatment strategies throughout the state.

Roughly speaking, the HIC considered this project to exhibit elements that met criteria for both public health research as well as public health practice, approximately 60% research and 40% practice.

  • On whose authority did the local health departments release Protected Health Information to the researcher to enable him to directly contact prospective subjects for recruitment?

The Health Insurance Portability and Accountability Act of 1996 (HIPAA), as codified as Standards for Privacy of Individually Identifiable Health Information (45 CFR Parts 160 and 164)8 permits release of Protected Health Information (PHI) to public health authorities as part of standard public health practice:

“Balancing the protection of individual health information with the need to protect public health, the Privacy Rule expressly permits disclosures without individual authorization to public health authorities authorized by law to collect or receive the information for the purpose of preventing or controlling disease, injury, or disability, including but not limited to public health surveillance, investigation, and intervention.

The Privacy Rule recognizes 1) the legitimate need for public health authorities and others responsible for ensuring the public’s health and safety to have access to PHI to conduct their missions; and 2) the importance of public health reporting by covered entities to identify threats to the public and individuals. Accordingly, the rule 1) permits PHI disclosures without a written patient authorization for specified public health purposes to public health authorities legally authorized to collect and receive the information for such purposes, and 2) permits disclosures that are required by state and local public health or other laws.”9

The majority of blood testing for the disease of interest in this project occurs at the many commercial laboratories found throughout the state which are required by state statute to report positive test results for certain diseases to DPH and to the local health departments along with all patient identifiers. There are many reportable diseases in Connecticut including HIV/AIDS, all varieties of hepatitis including A, B and C, many sexually transmitted infections such as gonorrhea, chlamydia, syphilis, herpes simplex, and syphilis, several kinds of vector-borne illnesses including Lyme disease and West Nile Virus, as well as diseases that might represent bioterrorism such as smallpox, botulism and anthrax. These laboratories are considered ‘covered entities’ under HIPAA and are also operating under the regulations promulgated by the Clinical Laboratory Improvement Amendment (CLIA)10 of 1988. While these facilities are mandated to provide identified reports to the appropriate public health authorities, they are forbidden to release PHI to anyone else, other than to the physician who ordered the test. The HIPAA privacy standard excludes tests subject to CLIA from right of access rules meaning that even patients cannot access their own test results directly from CLIA-covered laboratories. Finally, these facilities are not permitted to release PHI to investigators for purposes related to public health research without either a signed research authorization from the study participant or a Waiver of HIPAA Research Authorization granted by the public health IRB overseeing the research, but one which permits the laboratory to release only the amount of PHI necessary for the research to be conducted as specified in the research proposal.

“Some public health activities that are initially public health practice may subsequently evolve into a research activity. When that is the case, the disclosures may be made initially under the public health provision of the Privacy Rule. But when the activity becomes an ongoing research activity, the entity should consider application of the relevant research disclosures provisions to continue to obtain information for this purpose. Moreover, there may be cases where the activity is both research and public health practice. In those cases, disclosures may be made either under the research provisions or the public health provisions, as appropriate – the covered entity need not comply with both sets of requirements.”11

The investigator in this project applied to the HIC for a Waiver of HIPAA Research Authorization in order to directly obtain reports of positive test results from the local health department to be able to directly contact prospective subjects for study recruitment. Since the researcher was acting as an agent of the Department of Public Health for surveillance of this disease, he already had the right to request and receive identified patient information from DPH concerning this disease, making the request for the Waiver unnecessary.

IRB Decision:

The HIC clarified this issue with the investigator and determined that the activities related to this section of the project – contacting individuals newly diagnosed with the disease of interest – constituted public health practice making the Waiver moot.  However, as part of this discussion, the researcher reported to the HIC the existence of a two-week lag between the time the local health department and the state DPH received the lab report creating a delay in contacting individuals early in the course of the disease. The HIC, while denying the need for a Waiver of HIPAA Research Authorization, did grant permission for the local health department to provide the investigator with the positive test reports as soon as they were received, thereby enabling the contact to take place as much as two weeks sooner than would have otherwise occurred. The disclosure of PHI, in this instance, was made under public health practice and not research provisions but only after identification of the project components as practice, with application of the concomitant regulations.   

  • Why was the patient’s physician of record contacted?

The researcher intended to contact the patient’s physician of record for all individuals who tested positive for the disease of interest to obtain permission to contact the patient for possible study recruitment. The committee expressed concerns whether the researcher intended to respect the wishes of the physician and refrain from contacting the individual if a provider denied the researcher that right. This approach to recruitment suggested that the activities in this part of the project were research and not public health practice since it would not be appropriate in the latter activity to refrain from contacting individuals diagnosed with the disease of interest for such a reason. It is customary, however, in some types of research to permit the prospective subject’s physician to permit or deny the right of the investigator to contact the patient.

IRB Decision:

The IRB confirmed the intent of the researcher to accede to the wishes of the physician and refrain from contacting patients denied contact by the provider.

  • IRB’s routinely weigh the potential benefits that may accrue to study participants or the society at large from the successful implementation of the research against the potential harm that might result to subjects from study participation. How did the HIC accomplish this balance? What changes were made to the project at the request of the HIC in order to arrive at the ‘correct’ balance?

The initial proposal submitted by the investigator requested access to patients’ biopsy specimens for review as well as permission to obtain additional blood from each subject. However, the researcher did not clearly indicate the specific practice or research utility associated with access to these patient specimens.

IRB Decision:

While the actual risks to subjects associated with review of a biopsy specimen or from obtaining an additional blood sample were considered minimal, the HIC denied the researcher access to these specimens absent some appropriate justification for their use.

  • While it is often important in a public health research project to enroll the maximum number of subjects possible, recruitment efforts must be weighed against the need to avoid aggressive or coercive approaches. The investigator in this project planned to first send a letter to prospective subjects describing the study followed by a telephone call to formally invite study enrollment. He stated his intent to cease recruitment efforts only after 20 unsuccessful telephone attempts. Finally, given the investigator’s role as an agent of DPH for surveillance of this disease, it was not unreasonable to assume that prospective subjects might feel threatened or coerced into participating by virtue of the researcher’s official position. They might also express concern regarding how and why this researcher had access to their identified medical information.

IRB Decision:

The HIC denied the investigator the ability to send a letter to the prospective subjects’ addresses given the sensitive nature of the test result. This was done to prevent inadvertent disclosure of the individuals’ disease status to someone else at that address inappropriately opening confidential mail addressed to the prospective subject. Second, the HIC changed the total number of telephone recruitment attempts from 20 to 3 meaning the researcher could only leave 3 separate voicemail messages requesting a return call. Finally, the HIC mandated language describing that the investigator had been provided with the potential subjects’ identity by the local health department with permission from the State DPH as part of a disease surveillance and research project, but making it clear that the individual was free to decline study participation.

  • The researcher had requested a Waiver of Written Informed Consent in order to obtain full consent for study participation and disclosure authorization via the telephone. For the subjects with whom he planned to meet in order to conduct the interview and complete the survey, they would be able to complete the standard written informed consent and HIPAA Research Authorization forms. The HIC raised several concerns over this approach to obtaining informed consent.
  • The consent process was complex given the variety of activities to be performed during the study. This made it reasonably likely prospective subjects might not understand or remember all they were agreeing to through a telephone consent process.
  • Some subjects would be completely consented verbally on the telephone while others would complete the standard written forms, thereby creating two different classes of participants.
  • Verbal telephone-based consent would likely not be sufficient for hospitals and physicians’ offices to be willing to release PHI to the investigator.
  • The language of the consent was written at greater than an 8th grade level.

IRB Decision:

The request for a Waiver of Written Informed Consent was denied. The investigator was permitted to contact prospective subjects by telephone, describe the study to them, and invite study participation. If they agreed to participate, the researcher planned to mail them a packet of information including a written informed consent and HIPAA Research Authorization, both of which would need to be signed and returned for formal study procedures to commence. The consent was re-written at a level less than the 8th grade. The researcher was still permitted to obtain verbal telephone consent to conduct the interview by telephone but not for any other study activities.

  • The HIC expressed concerns over the perceived intrusiveness of the survey instrument as they felt it asked too many highly personal and detailed questions about the subjects’ sexual history, mental health history and drug and alcohol behaviors. They criticized the survey as going far beyond what was reasonably required for both the enhanced surveillance and research components of the project. Accordingly, the committee requested the investigator justify use of this particular survey instrument and determine the validity of the instrument as well as inquire about its uses in other states or in other studies.

IRB Decision:

The researcher informed the HIC that this specific questionnaire had been tested and validated and was being put into use at a study site in Oregon. The investigator and his CDC partners planned to expand the project to other states and intended to use this same survey at all sites across the country. Once this information was presented to the HIC, they voted to permit use of this survey instrument without revision.

1. 45 CFR Part 46: The ‘Common Rule.’ Department of Health and Human Services.

2. Council of State and Territorial Epidemiologists. Public Health Practice vs. Research: A Report for Public Health Practitioners Including Cases and Guidance for Making Decisions.  Hodge JG, Gostin LO. 2004, May 24.

3. National Bioethics Advisory Commission. Ethical and Policy Issues in Research Involving Human Participants. Bethesda, MD;2001.

4. Hodge, ibid..

5. Hodge, ibid.

6. Hodge, ibid.

7. Hodge, ibid.

8. 45 CFR Parts 160 and 164, Department of Health and Human Services.

9. 45 CFR Parts 160 and 164. Department of Health and Human Services.

10. Clinical Laboratory Improvement Amendment of 1988.

11. MMWR April 11, 2003/ 52; 1-12. HIPAA Privacy Rule and Public Health. Guidance from CDC and the US Department of Health and Human Services.

Comment 1: Lines unclear, community key

Comment 2: Is a new context coming? Who benefits?

Comment 3: Is it research or practice?