Legal Issues in Scientific Research

During the past 2 years, government agencies have issued at least 4 reports that focused on inadequate protections for human subjects, insufficient financial controls at the National Institutes of Health (NIH) and investigator conflicts of interest. In April 2000, the Department of Health and Human Services (DHHS) Office of the Inspector General (OIG)¹ reported that few of the recommendations it made in the wake of a highly critical 1998 report on institutional review boards (IRBs) had been implemented. The following month, the General Accounting Office² found that grant files at the NIH often lack important documentation concerning both scientific progress and unobligated funds. In June 2000, the OIG³ reported that the Food and Drug Administration (FDA) continued to provide only limited oversight of clinical investigators, particularly with respect to human subject protections. In another report released the same month, the OIG⁴ found that IRB officials harbor significant concerns about erosion of the informed consent process, compromised confidentiality, and enrollment of ineligible subjects in industry-sponsored clinical trials. It is no coincidence that a number of important articles^{5 - 14} on the relationship between academia and industry and conflicts of interest in research have recently been published in the academic literature.

In light of all this, there have been important calls for change. In May 2000 and on subsequent occasions, former DHHS Secretary Donna Shalala announced an "aggressive effort" to improve education of clinical investigators, plans to provide clearer guidance on informed consent and conflicts of interest, and a series of other initiatives designed to improve compliance with the rules governing scientific research, particularly research on human subjects.^{15 - 16} In August 2001, the National Bioethics Advisory Commission published recommendations for new federal legislation to enhance protections for patients in both publicly and privately sponsored research.¹⁷

Problems in the research process have also triggered unprecedented scrutiny of research institutions by regulatory and law enforcement authorities charged with ensuring that they do not engage in fraud or abuse. This article reviews 3 activities that these authorities have focused on and that, based on all indications, will continue to be the subject of intense oversight: (1) the process of seeking reimbursement for research costs, (2) the process of performing clinical research, and (3) accepting remuneration from private sources or paying remuneration to patients. To be sure, most researchers and research institutions will never be subject to law enforcement scrutiny. They are, however, subject to the same rules governing fraud and abuse as providers of clinical care, and they are subject to the same type of enforcement activity and sanctions.¹⁸

Recipients of federal research funds, with NIH grants as the prototype, contractually agree (by accepting federal monies subject to the NIH's standard grant application and notice of grant award) to perform certain tasks in exchange for the government's commitment to cover both direct and specific indirect (or facilities and administrative) costs associated with these tasks. Direct costs, including salaries, travel, equipment, and supplies directly benefiting grant-supported projects or activities, are those that "can be identified specifically with a particular sponsored project, an instructional activity, or any other institutional activity."¹⁹ Indirect costs are those that are "incurred for common or joint objectives and therefore cannot be identified readily and specifically with a particular sponsored project, an instructional activity, or any other institutional activity."¹⁹ Examples include depreciation and use allowances, operation and maintenance expenses, and certain administration expenses.¹⁹

In seeking reimbursement for these costs, researchers or their institutions are obligated to certify to the truth and accuracy of various aspects of their claims in much the same manner that hospitals and other providers of clinical care must generally certify to the accuracy of claims for clinical services.²⁰ Thus, for example, recipients of NIH funds are obligated to certify that "all disbursements have been made for the purpose and conditions of the grant"²¹ and that "all outlays and unliquidated obligations are for the purposes set forth in the award documents."²² They also must certify that indirect costs have been calculated in a manner consistent with federal guidelines, that is, they do not contain any unallowable costs such as the costs of advertising, public relations, entertainment, contributions and donations, fines, penalties, or lobbying.²³

As a general rule, the relationship between the government agencies sponsoring research, particularly the NIH, and grantees is based on trust.²⁴ Thus, in stark contrast to the federal health programs, granting agencies, and the NIH in particular, do not routinely review or audit requests for reimbursement. Instead, to ensure integrity and accountability, they require grantees to have adequate internal controls and provide appropriate oversight of individual research projects, and they monitor grantees through reviews of progress reports, financial reports, site visits, and other mechanisms.²⁴

For NIH-sponsored research, concerns about fraud and abuse are generally handled by the Office of Management Assessment. The term fraud refers to intentional acts of deception,²⁵ whereas abuse is generally understood to mean a significant or repeated deviation from acceptable practices.²⁵ The Office of Management Assessment refers serious allegations of civil or criminal fraud to the OIG, which generally works in tandem with the US Attorneys' Offices or the Department of Justice to investigate and prosecute appropriate cases.

Federal officials can prosecute reimbursement fraud under a variety of statutes, but they most commonly rely on the federal False Claims Act (FCA). The FCA is a Civil War–era statute that prohibits the "knowing" submission of false or fraudulent claims and false statements to the government.²⁶ It thus squarely prohibits both the knowing submission of false claims to granting agencies and the knowing submission of false certifications concerning those claims. Violators of the FCA are subject to treble damages plus penalties of up to $11 000 per false claim.²⁶ The term knowing is statutorily defined to include not only actual knowledge of the truth or falsity of a claim, but also deliberate ignorance or reckless disregard thereof.²⁷ Accordingly, research institutions that deliberately ignore or recklessly disregard the rules governing grant funding, not just those that are intentionally deceptive, may face liability under the statute.

The FCA is primarily enforced by the Department of Justice, but private whistle-blowers, known as qui tam relators, may bring suit on behalf of the United States and, if successful, may collect a bounty of up to 30% of the government's recovery.^{18 ,28} When whistle-blowers bring suit, they file their allegations secretly under seal, and the Justice Department then has an opportunity to investigate them and determine whether to intervene in, and assume responsibility for, the lawsuit. Qui tam whistle-blowers, acting independently of the NIH and OIG, have been a significant source of false claims cases against research institutions in recent years.

Under the terms of the FCA, employers can be held liable for the actions of individual employees.²⁹ Thus, under this doctrine, research institutions may be held liable for misuse of federal monies or false statements made by individual research scientists or administrators even when senior institutional officials are unaware of the misconduct.

The popularity of the FCA as a vehicle for attacking financial improprieties in the grant reimbursement process, such as improperly reported costs, inflated costs, or costs incurred in a manner inconsistent with the grant documents, is demonstrated by the following:

In a number of these cases, the OIG, in conjunction with the settlement, has required research institutions to sign agreements similar to the corporate integrity agreements that it generally requires health care providers to sign in federal health care program fraud cases. Thus, for example, Thomas Jefferson University last year signed a 5-year Institutional Integrity Agreement (unpublished agreement, May 2000), which, among other obligations, requires it to maintain or develop research-specific policies and procedures and research-specific training and annually to review a sample of time and effort reports, salary documentation, direct cost documentation, cost allocation methods, and cost transfer documentation. Violations of the agreement are punishable by stipulated penalties, and a material breach may result in suspension or debarment of the institution (unpublished agreement, May 2000). The Beth Israel Deaconess Medical Center signed a similar agreement in 1999 (unpublished agreement, March 1999).

A number of factors point toward even more FCA cases against researchers and research institutions in the coming years. First, as the bounty provisions of the FCA become more widely known in the research field, it is likely that whistle-blowers increasingly will file qui tam suits rather than simply lodge complaints with the NIH or other regulatory bodies. Second, the OIG has announced that it plans to focus on research reimbursement issues. In its 2002 Annual Work Plan,³⁶ for example, it stated that, among other matters, it plans to investigate whether disclosure statements concerning indirect costs are accurate and comply with relevant standards and principles. Those investigations may lead to recovery actions. Finally, and perhaps most important, the NIH budget has skyrocketed in recent years, from less than $12 billion in 1996 (National Institutes of Health, FY 1996 budget, unpublished) to more than $20 billion in 2001.³⁷ It is difficult to imagine that this increase in funding will not be accompanied by an increase in allegations of fraud and abuse.

Complex legal issues also arise in connection with the actual conduct of scientific research. The federal government heavily regulates both federally funded research and privately funded research on drugs and medical devices. On the federal side, recipients of NIH funds are obligated, and specifically must agree as a condition of receipt of federal funds, to comply with 12 specific sets of regulations, including the common rule, regulations governing conflicts of interest and scientific misconduct, and regulations governing such issues as research on vertebrate animals, lobbying, and discrimination of various sorts.³⁸ The common rule governs the composition and function of IRBs³⁹ and establishes the basic rules, including informed consent, for research on human subjects.⁴⁰ The regulations governing conflicts of interest generally require researchers to disclose "significant financial interests" (including consulting fees and honoraria, equity interests, and intellectual property rights) that would reasonably appear to be affected by their research.⁴¹ They also require research institutions annually to certify that they have identified conflicts of interest and "manage[d], reduce[d] or eliminate[d]" them to protect research from bias.⁴² The scientific misconduct regulations generally require recipient institutions to establish procedures for reviewing, investigating, and reporting allegations of scientific misconduct (eg, fabrication, falsification, and plagiarism)⁴³ and require such institutions to describe annually the nature of each allegation of misconduct.⁴³

Privately sponsored clinical research on FDA-regulated drugs and medical devices is subject to a different, but partially overlapping, set of rules. Most importantly, human subject research must be conducted in accordance with FDA regulations governing the protection of human subjects, which, like the common rule, require IRB approval and oversight of human subject research and informed consent.^{44 - 46} The FDA also requires investigators either to certify that they do not have any financial conflicts of interest or to "completely and accurately" disclose any such conflict.^{44 - 46}

These various federal regulations are generally enforced by different regulatory bodies. For example, the Office of Human Research Protections (formerly the Office of Protection from Research Risks) oversees government-funded research on human subjects. That office technically has authority to monitor compliance with single and multiple project assurances, in which researchers (or their institutions) assure the government, as a condition of receipt of federal funds, that they will abide by the Common Rule. Among its other powers, the Office of Human Research Protections may restrict the scope of or withdraw approval for an assurance, recommend that an investigator or institution be temporarily or permanently removed from a specific project, or recommend that an investigator or institution be debarred from government contracting (Greg Koski, PhD, MD, DHHS, written communication, December 4, 2000). Other agencies have responsibility for oversight of the other regulatory schemes (such as those governing lobbying and discrimination) with which federally funded researchers must comply. With respect to industry-sponsored studies, the FDA enforces its own rules and has the power to withhold approval of new studies, prohibit enrollment of new subjects, terminate ongoing studies, disqualify an IRB or a parent institution, or, in appropriate circumstances, refer a matter to law enforcement agents.^{47 - 48}

The 2 most prominent regulatory oversight agencies, the Office of Human Research Protections and FDA, have been active during the past several years, following the issuance of a highly critical report by the OIG in June 1998.⁴⁹ Among other findings, that report concluded that the research environment had changed significantly since the advent of IRBs, most notably as a result of increased commercialization, the increase in multicenter trials, and a significant increase in workload. As a result, IRBs faced independence-threatening conflicts of interest, often conducted only minimal continuing review of approved research, and provided little training for IRB members and clinical investigators.⁴⁹ The report concluded that the IRB system was "in jeopardy" and recommended a series of reforms, including strengthening protections for human subjects, enhancing training for IRB members and investigators, and insulating IRB members from conflicts of interest.⁴⁹ It also recommended closer oversight of IRBs by the Office of Protection from Research Risks and FDA.⁴⁹

The final recommendation concerning stricter oversight resulted from evidence that federal overseers were not active, and it is one of the few OIG recommendations that resulted in concrete changes. In the 12 months before the report, the Office of Protection from Research Risks conducted only 1 on-site inspection; through March 2001, that office or its successor conducted 15 additional inspections.⁵⁰ The FDA's inspections of IRBs also increased significantly following the 1998 report, increasing from 210 in 1997 to 353 in 1999 (although they declined to 199 in 2000).⁵¹ On a related note, whistle-blower reports to the FDA concerning protocol noncompliance, poor record keeping, poor adverse event reporting, and noncompliance with informed consent rules also significantly increased during the year following the OIG report, skyrocketing from 10 in 1998 to 101 in 1999.⁵²

This enforcement activity resulted in a notable increase in high-profile sanctions by both agencies. Most significantly, these agencies suspended (or partially suspended) human subject research at approximately 10 institutions,^{53 - 57} including Johns Hopkins, where almost all research involving human subjects was suspended (Patrick McNeilly, PhD, and Michael Carome, MD, written communication to Edward Miller, MD, Gregory Schaffer, MS, and Chi Van Dang, PhD, July 19, 2001; on file with the DHHS Office of the Secretary, Office of Public Health and Science), and Duke University, where all new research on human subjects was temporarily suspended.⁵⁸ The FDA also issued a number of warning letters to research institutions focusing on deficient IRB processes (FDA, written communications to University of Iowa, June 18, 1999; Southern Connecticut State University, November 10, 1999; and Louisiana State University, December 3, 1999).

The agencies directly responsible for oversight of the numerous regulations governing the conduct of research are not the only entities that can enforce these rules. Increasingly, both whistle-blowers and the Department of Justice are asserting that violations of regulations with which researchers have promised to comply as a condition of receipt of federal funds are actionable under the FCA; as such, the FCA has become a vehicle for attacking not just financial improprieties but regulatory violations as well. The basic legal theory underlying such actions, that knowing noncompliance with a condition of payment renders claims for payment false, is relatively well established outside the research context^{59 - 60} and has also been advanced in several research cases. In United States ex rel Chandler v Hektoen Institute for Medical Research et al,⁶¹ for example, the plaintiff/whistle-blower alleged that the defendant violated the FCA by, among other things, failing properly to obtain informed consent from subjects participating in a study funded by the National Institute on Drug Abuse. In United States ex rel Zissler v Regents of the University of Minnesota,⁶² the government alleged, among other things, that the university had violated the FCA by virtue of the fact that its IRB had approved several studies on a drug under conditions other than those set forth in the relevant Investigational New Drug Application, approved inadequate consent forms, and failed to obtain required information from the researchers. That case ultimately was settled by the university.³⁰

Relying on a similar legal theory, at least 1 whistle-blower has sought to link conflicts of interest with the submission of false claims.⁶³ In that case, a University of Pittsburgh researcher accused a colleague of failing to report private funding in connection with an NIH grant. The district court originally dismissed the case before trial, but the Third Circuit Court of Appeals reversed, finding that there was sufficient evidence for the case to proceed. In so doing, the court made clear its view of the significance of full disclosure of conflicts of interest to the integrity of the scientific process, stating that "[g]iven the greater public trust in the results of government-funded research, and the undeniable risk of bias, the government clearly has a strong interest in ensuring that it acts as an impartial investigator."⁶³ The court went on to hold that the defendant/researcher could "reasonably be expected to know of the government's heightened interest in avoiding bias. As a scientist, he must be fully aware that rooting out potential sources of bias in our interpretations of empirical data is central to the scientific inquiry."⁶³ The case did not specifically rely on current conflict of interest rules, which were adopted following the filing of the lawsuit, but the same lawsuit brought today could have been based on the argument that the defendant's actions violated those regulations.

Finally, a number of cases have sought to link scientific misconduct with the submission of false claims. As part of its $2.6 million settlement, for example, Thomas Jefferson University settled allegations that it sought funds from the National Institute of Allergy and Infectious Diseases based on false or fabricated data and that it submitted applications for continuation of its grant and progress reports that were not supported by available data (unpublished settlement agreement, May 2000). Several years earlier, the University of California and the University of Utah agreed to pay $625 000 and $950 000, respectively, to resolve similar allegations that they accepted federal grant funds knowing that the underlying research was based on false statements by a researcher.⁶⁴ In several other cases involving allegations of false statements about the conduct of scientific research, however, the courts have been reluctant to allow the whistle-blower provisions of the FCA to be used as a vehicle for adjudicating disputes that have the flavor of purely scientific disputes. Thus, for example, a federal district court dismissed a case against the University of California and others in which the plaintiff claimed that data submitted by the defendants in support of a grant were false because one of the defendants "employed practices that irreconcilably deviated from those that are commonly accepted within the scientific community" and that the results were reported in an intentionally misleading manner.⁶⁵ The court dismissed the case on the ground that "[a]t most, [it] presented . . . a legitimate scientific dispute, not a fraud case. Disagreements over scientific methodology do not give rise to False Claims Act liability."⁶⁵ In another case under the FCA, a federal appeals court threw out allegations that, among other things, the University of Alabama failed to credit properly a researcher's work and "submerged" her work in progress reports.⁶⁶ In that case, the court reversed a jury verdict, holding that there was insufficient evidence on which the jury could have found for the plaintiff.⁶⁶

Although cases seeking remedies under the FCA for violations of the regulations that govern the conduct of scientific research have thus far been relatively rare, the implications of such lawsuits are startling. In theory, a systemic regulatory violation, such as a serious flaw in the operation of an IRB, could threaten funding for all grants approved by that IRB. Under the penalty provisions of the FCA, such a violation could expose a large institution to tens if not hundreds of millions of dollars in damages and penalties.

Yet another set of legal rules may be implicated by an entirely different set of research-related activities—accepting research funding from commercial entities such as drug or device manufacturers or remunerating research subjects. The federal Anti-Kickback statute,⁶⁷ which has analogues in most states,²⁰ makes it a felony, punishable by heavy fines and up to 5 years of imprisonment, for a manufacturer or any provider of clinical care knowingly and willfully to offer or pay remuneration, which is defined as anything of value whether in cash or in kind, to induce the purchase of items (such as drugs or devices) or the referral of patients covered by Medicare, Medicaid, or other federal health programs.⁶⁷ The statute likewise makes it a felony for any person to improperly solicit or receive remuneration in exchange for a commitment to purchase products reimbursed by the federal health programs or to refer program beneficiaries to a health care provider.⁶⁷ The statute has numerous exceptions⁶⁷ and safe harbors,⁶⁸ which permit certain financial relationships, such as consulting arrangements, under specified circumstances. Most courts to address the issue have held that the statute is violated if "one purpose" of a transaction is impermissible.^{69 - 71}

In the research context, the Anti-Kickback statute is potentially implicated in all circumstances in which a researcher or research institution receives research funds, which are within the definition of remuneration, from a manufacturer that also sells products reimbursable by the federal health programs to the researcher or institution. In that circumstance, the statute could be violated if the researcher or institution solicited the funding, even in part, as a quid pro quo for purchasing additional products or if the manufacturer offered the funding to induce the researcher or institution to buy more products. The purpose of a research grant is inferred from the facts and circumstances surrounding it. The statute, therefore, is not violated in cases in which, as in most instances, manufacturers support bona fide research efforts.

The OIG, however, has on several occasions identified research arrangements that could violate the statute. In 1994, for example, it warned that it considered "suspect" a research grant program in which physicians were given substantial payments for de minimis record-keeping tasks.⁷² Under the program at issue, physicians received payments from a manufacturer for making brief notes about treatment outcomes after administering a product to each patient.⁷² More recently, in defining "commercially reasonable business purpose" to establish the scope of certain safe harbor protections, the OIG specifically noted that "we are aware of abusive arrangements involving . . . research projects where the . . . research to be performed ha[s] no value to the entity paying for [it] and [is] merely [a] pretext for payment[s] for referrals. Such [an] arrangement[s] do[es] not comply with [any] safe harbor and [is] highly suspect under the Anti-Kickback statute."⁷³

The Anti-Kickback statute also can be implicated by remuneration other than research funds themselves. Gifts of equipment from a manufacturer to a researcher may implicate the statute. Similarly, the statute may be implicated by free travel, highly remunerative consulting arrangements, or other personal services arrangements.

The provisions of the Anti-Kickback statute, which prohibit providers from knowingly and willfully paying for the referral of patients covered by the federal health care programs, and the provisions of a related statute, which generally prohibit the payment of remuneration to beneficiaries of the federal health programs,⁷⁴ also may be implicated in the research context by the provision of remuneration to patients. Until recently, this issue was of minor significance, because little research-related care was covered by the federal health programs. That situation changed, however, when the Clinton Administration issued a National Coverage Decision in September 2000 extending Medicare coverage for an array of items and services to patients in certain clinical trials, including those funded by the NIH and those under an Investigational New Drug Application.⁷⁵

Improper remuneration of research subjects could take any number of forms, including the waiver of copayments or deductibles. Indeed, in an advisory opinion issued in July 2000, the OIG specifically opined that waivers of Medicare copayments and deductibles in clinical studies "would potentially generate prohibited remuneration under the Anti-Kickback statute if the requisite intent-to-induce referrals were present."⁷⁶ The OIG stated, however, that the parties requesting the advisory opinion (clinics and physicians involved in the National Emphysema Treatment Trial sponsored by the Health Care Financing Administration and the National Heart, Lung, and Blood Institute) would not be subject to sanctions because the particular arrangement at issue "reasonably accommodate[d] the needs of an important scientific study sponsored by the Health Care Financing Administration without posing a significant risk of fraud and abuse of the Medicare program."⁷⁶ The OIG was abundantly clear, however, that its opinion addressed "unique circumstances" and that "[n]othing in this opinion should be taken to permit or protect waivers of Part A or Part B copayments and deductibles provided in the context of clinical studies generally."⁷⁶ Although this advisory opinion suggests that reasonable compensation, in the form of the waiver of co-payments or deductibles or otherwise, paid to government health program beneficiaries who participate in clinical trials will not be considered illegal remuneration, it also suggests that each case will be evaluated on its own merits.

Institutions conducting research, particularly clinical research, must comply with a myriad of legal rules. Until relatively recently, these rules generally were laxly enforced. In recent years, however, regulatory officials, law enforcement officials, and private whistle-blowers have become increasingly active, and it is highly likely that their enforcement efforts will continue, at an even greater level, in years to come. Institutions that fail to take appropriate prophylactic measures to ensure compliance will do so at their own risk.