Hacker News new | ask | show | jobs
by ak_yo 3220 days ago
The author doesn't seem to take the history of medical research ethics (e.g. the Tuskegee syphilis experiments [1]) seriously. Having a sophisticated understanding of the ethical risks of research is a huge part of doing good science, and this post certainly doesn't communicate a high level of sophistication. If the author thinks that ethics review is "Blindly trusting authority to make our ethical decisions for us", then he clearly doesn't understand what ethics review is or how it works.

IRBs have well-documented flaws (for a more comprehensive look, read Laura Stark's book on IRBs [2]) but "IRBs are bad because they say I can't do whatever I want even though it's obviously the right way to do it" is not one of them.

[1]: https://en.wikipedia.org/wiki/Tuskegee_syphilis_experiment

[2]: http://press.uchicago.edu/ucp/books/book/chicago/B/bo1218257...

9 comments

While I agree that the author is being a little facetious (with the constant Nazi references and such), I don't think he is arguing in favor of removing ethical considerations in research, or even arbitrarily weakening the constraints put on scientific studies.

But what purpose is having a review board made up of people who can think for themselves if their behavior is going to be indistinguishable from a program running through a checklist without any care whatsoever for whether or not the checklist makes sense in that context?

Massive inefficiencies in bureaucracy are always hidden behind the fig leaf of consistency and accountability, but it's worthwhile to consider what aim they serve and at what cost.

>>Massive inefficiencies in bureaucracy are always hidden behind the fig leaf of consistency and accountability, but it's worthwhile to consider what aim they serve and at what cost.

This problem was largely solved by the development and acceptance of private IRBs. Going with private IRBs that meet 2x weekly, turn forms around quickly, and are willing to pre-qualify your work - at cost, of course - is the road many researchers take now.

How is that solving the problem???
....how does it not?

If you are asking the question: "How does this private market solution solve the problem of government/education/medical bureaucracy being inefficient," then I guess it does not solve the root cause. But trying to solve IRB problems involving that three-headed hydra is not likely to succeed. Going around the system is a feasible workaround.

Implementing a terrible process faster at great cost is not the same thing as solving the problem, nor is it the best possible solution short of "fix all bureaucracy".
I wouldn't call my experiences in private IRB to be terrible at all, honestly.
I agree that IRBs are not great -- the book cited above does a great job of unpacking how IRBs fail to live up to their promises, and this covers some good additional examples. I also agree that the author isn't necessarily advocating against ethical review as such.

I'm more concerned with the author's insistence that he knew the right way to conduct his study ethically. Peer review is a core scientific principle-- we don't allow researchers to make autonomous judgments about the quality of their work.

I don't think he's advocating that he should be setting the rules or self-evaluating. He just wants the rules to be sensible and sensibly enforced. He has justification to complain if the modifications they requested violated safety policies, risked patient well-being or defeated the purpose of the study. Policy that doesn't add any benefit deserves to be questioned.

Not to mention that the questions were already being asked. He just wanted to ask them earlier to compare against the eventual diagnosis. It's not the kind of study that should have been abandoned in frustration after two years, as happened here.

I think for his next study he should do one into the mental health of those who interact with Institutional Review Boards. If nothing else, it would have a nice recursive effect on the authors.
So, an example of how the author doesn't understand the point of these requirements is the 'encryption' (anonymisation) process, added to 'the files had to be kept together!'. The anonymisation process isn't about stolen files. It's about data leakage, and keeping identifying data out of result sets. If you're pulling your all-nighter to prep for the big talk tomorrow, for example, you're not going to accidentally include identifying data from your results page if it doesn't exist on your results page in the first place.

Edit: more important for the scientific process (rather than privacy) than 'data leakage' is 'data sharing', as yread points out below. Anonymised data can be quickly and safely shared, and others can run their analyses on your results. Non-anonymised data can't be shared. If you're interested in publishing a robust scientific paper, why would you be against opening your data for inspection?

> Not to mention that the questions were already being asked. He just wanted to ask them earlier to compare against the eventual diagnosis. It's not the kind of study that should have been abandoned in frustration after two years, as happened here.

Then he could have just asked them and done his own informal study. Nothing is stopping the doctor from saying "are you happy, then sad?" on first meeting a patient. But if you want to do a formal, publishable study, then you should have all your ducks in a row. Make sure your independent variables are properly controlled, make sure any ethical issues have been externally vetted, so on and so forth.

While the IRB certainly had some annoying concerns, so much of this author's frustration just simply wouldn't be there if he understood why those questions were being asked.

> make sure any ethical issues have been externally vetted, so on and so forth.

Sure, but the complaints of the IRB mentioned (and the auditor) seem to be far beyond ensuring practice is ethical. Instead, they seem to focus on following process only for the sake of process.

Why should the consent form have the title of the study? Why should the consent form contain a list of risks when there are none? What is wrong with having consent forms signed with pencil when pens aren't allowed. Why should the data integrity plan require periodic review (i.e. why should we have a data integrity plan - integrity plan). These are all indicative of a bureaucratic system that places too much emphasis on 'process', losing sight of 'outcome' in the end.

> These are all indicative of a bureaucratic system that places too much emphasis on 'process', losing sight of 'outcome' in the end.

Reminds me of something that Jeff Bezos (of Amazon.com) wrote in his 2016 Letter to Shareholders:

> Resist Proxies

> As companies get larger and more complex, there’s a tendency to manage to proxies. This comes in many shapes and sizes, and it’s dangerous, subtle, and very Day 2.

> A common example is process as proxy. Good process serves you so you can serve customers. But if you’re not watchful, the process can become the thing. This can happen very easily in large organizations. The process becomes the proxy for the result you want. You stop looking at outcomes and just make sure you’re doing the process right. Gulp. It’s not that rare to hear a junior leader defend a bad outcome with something like, “Well, we followed the process.” A more experienced leader will use it as an opportunity to investigate and improve the process. The process is not the thing. It’s always worth asking, do we own the process or does the process own us? In a Day 2 company, you might find it’s the second.

https://www.amazon.com/p/feature/z6o9g6sysxur57t

Ethics committees are there to protect both the institution and the subjects of the study. One of those protections is avoiding misleading the subjects, unless absolutely necessary and beneficial. How many times have you seen people here on HN bitch about Company X's misleading marketing? It's exactly the same with human studies - people feel used and abused when they find out they were lied to. Similarly, jancsika below points out that the author is working on a patient population with literal paranoid people in it; they're not likely to respond well if they find out a questionnaire was for a different purpose than stated.

Sticking to a common set of rules and only deviating when there's very good reason is one way to help protect subjects. What's the 'outcome' here? A doctor wants to do a study. Why is that more important than the rights of the subjects? Yes, everyone who does a study thinks it's going to cure cancer and solve the national debt. They'll promise the moon in order to get their way. These processes are put in place to protect people against poorly-planned studies. And there's no way to know ahead of time that a study is 'trivial' - if you're working on humans, you need to be vetted. "But we already do this to patients anyway" is besides the point; if you let doctors bypass vetting because of that argument, you'd see all sorts of horrific stuff happening. Ethics committees didn't come about because bureaucracy invented them for the sake of it, they came about because people were being unknowingly tested on by medicos who promised that the study was 'beneficial for the common good'.

And what you find distressing is not what other people find distressing. Search for mncharity's comment elsewhere on this page, where people are distressed simply by being asked about viruses. Yeah, sure, that's not typical, but the counterpoint is: is the research beneficial enough to warrant causing distress to people who would otherwise have been left alone?

In short, this 'needless bureaucracy' is there to protect both the institutions and innocent people from researchers going 'rogue'.

I think it's quite easy to see the benefit of the author's study and their frustration is completely understandable - however, I can't help but feel that much of their frustration was simply because the rules impeded their progress, not that the rules were actually useless.

My major gripe whenever there is a long piece that decries the bureaucracy of various regulatory boards is that the complaints tend to be about how the bureaucracy is a personal inconvenience. Some of the gripes I'll absolutely grant; pen versus pencil and inflexibility for giving potentially violent persons a weapon probably needs some sort of leeway, but I think protectionary measures absolutely should be a brick wall; a surmountable one, sure, but only as a result of you actually trying a bit and demonstrating that your intended actions aren't going to do exactly what the regulation is trying to prevent, and that should be on the researcher using human participants to demonstrate.

The idea of easily avoidable and mutable regulatory functions seems contradictory - that is, a researcher shouldn't be declaring what should and should not apply to them. This isn't fear that they're Hitler and going to inject people with nastiness, it's fear of the dumb mistakes that every human makes and our often poor ability to predict the outcome of certain actions. I get it - they want to help people and the regulations are inconvenient for them; but having gone through many IRB processes myself, it's not insurmountable in the least bit, much less anything the author listed.

> But what purpose is having a review board made up of people who can think for themselves if their behavior is going to be indistinguishable from a program running through a checklist without any care whatsoever for whether or not the checklist makes sense in that context?

In general, most IRBs are there to help out, not to get in the way. It may feel like getting in the way, at the time, but they mostly are there to help.

For example: the wordings of your consent forms. FDA says that they need to be at an 8th grade level, +/- 0.2 grade levels. You can game MS word to get that to an 8.2 grade level but have it be 140+ pages, and a lot of researchers do that. This is especially prevalent in clinical drug trials where many Pharam companies try to make the consent form a contract filled with legalese. That egregious example is non typical, but highlights the issues with consent forms being readable and an actual consent form a person. This is where a decent IRB would help out and tell you that you need to re-write the consent form to be an something that is not gibberish. (Side-note: Most newspapers are written at a 6th grade level it turns out).

Another example is International research. There was a case I heard of where a group was going to go collect HIV data in Tanzania. They were just going to go out and collect blood samples and sexual health questions alongside. The part of Tanzania they were collecting from is rural and believes in very strange medical practices like eating albino people or having sex with virgins to cure HIV, though I forget exactly what. Balancing the local beliefs with data collection can be tricky in that case. Typically, you would like a local IRB in that region, but there was none. So the US based IRB decided that the researchers needed to go out to the religious and government centers in that part of Tanzania and ask them what to do and what questions they could ask, etc. This added a lot of time and expenses to the study to spend in country before data collection, but the US IRB held firm on that. This was a good idea, as the local peoples had a lot of reservations and wanted to see all the data themselves before it was sent out of country, so as to go off and then kill women that were HIV positive. If the US researchers had found this out beforehand, a lot of deaths may have occurred. They subsequently then left off a lot of questions and data gathering.

Researchers are human too and we forget things all the time and have a lot of pressures on us as well. IRBs should be there to help out and not be a road-block. If the IRB you are working with does turn out to be that, talk to other researchers and find if they have the same issues. If you all do, go to the IRB and explain to them that they are unreasonable, most of them do want to know that they are holding things up unnecessarily. If it persists, go to the hospital/university admin as a group and make the case. These advancements need to be triple checked, but they still need to go through to begin with. IRBs are not evil, sclerotic maybe, but not evil. Work hard to get them to be better, we are all in this together.

So the original study planned on sharing de-anonymized data of who had HIV with the local populace? And the IRB prevented that?
Essentially, yes. The naivete of the team was staggering. They thought, at first, that they local people just wanted to see the data and have a copy of it, for pure curiosity's sake. Nope, murder.
Woah, I assumed I misread that. Just common sense/decency says you don't share who has HIV with anyone who does not need to know. True in the first world, especially true in the third world where stigmas can run even stronger.
Yes, this is why we have IRBs, for the exact reasons like this one. When dealing with health and medical stuff, the stakes are usually not this high, but they can be very easily.
I think you're basically making a bucketing error here. As Scott Alexander points out, the exact same things he wanted to do were already being widely done elsewhere to no ill effect with no such worrying about consent. Why then does it make sense to group it under "research" together with the Tuskegee syphilis experiment and conclude things about it from that experiment, when the two have nothing in common except being research? I think that's a mistake of inference. Like, why should we conclude that we need that sort of consent to administer a questionnaire for experimental purposes (i.e.: gaining generally useful knowledge), but that there are no substantial issues of consent when it’s for diagnostic purposes (i.e.: gaining information about that particular patient) instead? Wouldn't it make more sense to group this case with the case with similar risk profile but a different purpose, rather than a related purpose but an entirely different risk profile? Something being research isn't what causes problems.
> why should we conclude that we need that sort of consent to administer a questionnaire for experimental purposes [...], but that there are no substantial issues of consent when it’s for diagnostic purposes [...] instead?

A patient consenting to being treated doesn't mean they'd consent for that personal information to be used for any other purpose.

The interesting thing is that HN is usually a place where people are usually quite militant about their data not being used for purposes other than intended.

From the responses in this thread, it seems HNer's are actually fine with their data being used for secret reasons without their consent, as long as it means less bureaucracy. "How dare you use my data for your own purposes... unless it helps you avoid an inconveniencing committee, then go for it!"

Maybe it's simply a matter of from whose point of view the story is being told. "They used my data without asking" vs "they won't let me use this data that I already have anyway".

It helps that it's painted as the poor resourceless scientist vs the powerful abusive entity (IRB). Rather than the poor resourceless patient vs the powerful abusive entity (hospital and its staff).

> Like, why should we conclude that we need that sort of consent to administer a questionnaire for experimental purposes (i.e.: gaining generally useful knowledge), but that there are no substantial issues of consent when it’s for diagnostic purposes (i.e.: gaining information about that particular patient) instead?

1. Researcher incentives. Data => publications => prestige. If the procedure actually contains some inherent risk (e.g., a surgery) then this mismatch between the priorities of the physician and the priorities of the researcher matters. Even (actually, especially!!!) if the physician and the researcher are the same person.

2. Publication. De-anonymization is a real risk even if you're careful to only talk about patient # N in the publication.

3. Patient preference. Just because I allow my hosting provider to access my servers for the purpose of maintenance doesn't mean I'm OK with them accessing my servers for the purpose of surveillance or to read my personal emails. Purpose matters. Some patients won't want data about them used in the context of a scientific study. Patients should and do have the right to insist on that preference. Frankly, the presumption otherwise is exactly why IRBs exist.

This story sounds stupid because -- aside from de-anonymization or data leaks -- there are actually no substantive risks associated with this study. Change "questionnaire" to "open heart surgery" and all of this process starts to make a lot more sense.

FWIW I'm not saying IRB's aren't completely overbearing when it comes to benign studies. They totally are. But that doesn't mean these processes aren't well-justified in other circumstances.

(Also, a lot of this pain is completely avoidable if you learn and follow the rules, which isn't actually nearly as hard as this post makes it out to be IME.)

"The author doesn't seem to take the history of medical research ethics (e.g. the Tuskegee syphilis experiments [1]) seriously."

This is the same dynamic that happened in, say, the 1950s with Communism. At that time, the Soviet Union was legitimately scary. They had the world's largest army, an arsenal of nuclear weapons, and were led by a power-mad dictator. It was certainly a wise move to defend against them. But eventually, Communism became a catch-all justification that could be used for any rule or policy, no matter how silly it was. Why, for example, did we need the words "under God" in the Pledge of Allegiance? Because of communism, even though it didn't help the Western military position at all. Likewise, any challenge to these policies could be dismissed as "naive", "uninformed", or "not taking the threat seriously".

The best thing about this is that we recreated this mentality when dealing with terrorism. The current brown scare that we are living through is almost exactly the same as the red scare of the 1950s.
The IRB process he described did not have a sophisticated understanding of the ethical risks of research. It imposed arbitrary and useless rules on an experiment with few if any risks.
IRB review procedures are flawed, I agree. But ethical review by a third party is enormously important for research with human subjects. I'm alarmed by the notion of researchers deciding unilaterally that a study has only "nonexistent risks" -- that's a recipe for disastrously unethical scientific conduct.
The point is that the decision should not have been unilateral - the author and his colleague had a very good case for their position, based on the fact that they were not asking anything that was not being asked anyway, and not recording anything that was not being recorded anyway. It was mindless dogma on the part of the IRB that made it unilateral. Meanwhile, a practice with a real potential for risk went unstudied.

You might argue that there was risk to the patients in the one part of the procedure that was different than what they would experience anyway - the actual asking for consent - but if so, what would you propose doing about it?

You have made a straw man out of this one case, and are defending it with all the dogma displayed by this IRB.

I don't think the author was proposing getting rid of oversight completely, just that said oversight should, you know, make sense.
I don't think the author is in any way arguing that research should be completely without oversight. Just that current oversight is uselessly burdensome.
I'm deeply disturbed to see comments here defending this. The top comment no less! At every single step the things the author went through were absolutely ludicrous and indefensible. Actual real people are getting hurt by the IRB. This study alone could have saved thousands of people from getting misdiagnosed as bipolar. God knows how many tens of thousands of other similar studies have been stopped by this bureaucracy.
> At every single step the things the author went through were absolutely ludicrous and indefensible.

I disagree. Even the one that he makes sound the most ludicrous ("IRB required pens, be we were only allowed to use pencils") can be rephrased as: "Your hospital had reasons to be concerned that patients might stab themselves or someone else with a pen, yet you don't even think of giving them pencils as any sort of risk".

The hospital allowed them to have pencils and apparently had no issue with it. Presumably patients fill out forms with pencils all the time. Even the IRB failed to complain or notice this "danger". They never complained that pencils were too dangerous, just that it didn't meet the arbitrary signature requirement that it be a pen.

And you say this is the most ludicrous requirement, but it's actually the least. After all it's not entirely the IRB's fault, they didn't ban pens in the hospital.

But it demonstrates exactly what is wrong with bureaucracy. Maybe one bureaucracy with one set of arbitrary rules could be tolerated. But once you have two interacting they can create contradicting and incompatible rules. One bureaucracy bans pens, the other bans pencils, and you end up with a world with no writing implements at all.

I'm sure the regulation sounded entirely reasonable at the time. Someone had to put together a set of rules on how to get consent. And they think pens are supposed to be the proper way of writing a signature, because banks require you to sign checks in pen. Because long ago people would erase checks written in pencil and commit check fraud. At no point did they ever consider the history of that rule or that it doesn't make much sense applied to consent forms. At no point did they ever consider that there might be a hospital somewhere that bans pens for whatever reason.

And I can't blame them, why would they? You can't anticipate every possible edge case. This is a website made up of programmers, we should know that better than anyone. And yet at no point did anyone with common sense come along and make an exemption for that rule. When rules become fixed and inflexible they do things that weren't intended by the rule writers.

And every single thing in the article is like that. Some rule that might not be so bad or make sense in isolation. But combine it with 10,000 other rules, and total weight becomes overwhelming. And as a result you get a bunch of people misdiagnosed with bipolar disorder, and god knows what else since doctors can't do the research necessary to find out.

> At no point did they ever consider the history of that rule or that it doesn't make much sense applied to consent forms.

Or maybe they did?

> At no point did they ever consider that there might be a hospital somewhere that bans pens for whatever reason.

IRBs are part of each research institution. The unspoken implication in OP's story is that the psychiatry department of his hospital had never conducted research with humans before him. At least not any research that required consent. If they had, they would have faced the need for pens. "Requiring IRB review and a consent form" is almost the opposite of an edge case for a research institution.

> Some rule that might not be so bad or make sense in isolation. But combine it with 10,000 other rules, and total weight becomes overwhelming.

I can't really feel that steps like being forced to blind your data, or to store that data somewhere it can't be read by random people, are overwhelming, nor ludicrous, nor indefensible. I understand that learning by hitting walls is frustrating, but those things are proper experimental procedure. Maybe his professors should have had a lecture about them (mine did). Or maybe it was the purpose of that video that he thought was a waste of his time because he's not a Nazi.

> Even the IRB failed to complain or notice this "danger". They never complained that pencils were too dangerous

If I'm reviewing that application and on the risks section I see "paper cuts lol", and the applicant then asks me to allow pencil signatures because pens at his department are a risk, I would conclude he's not taking any of it seriously enough.

Just playing devil's advocate, what is the possible danger of accepting a consent form with a signature in pencil? Is someone going to erase a signature from the consent form? (And how exactly is that a potential risk or danger?)

I'm pretty sure that it's not any harder to forge a signature when it's made using pen or pencil. It's just a mark that says "I agree." It's not a bank form where the validity of the amount tendered could be called into question.

I could imagine this:

"Oops, I forgot about presenting my subjects with the consent form and now I've got 100 results collected during a whole year of work.

I definitely don't want to throw all of that work away... But if I contact them and make them sign the form now using pencil, I could erase the date and change it to each subject's day of experiment. Nobody would notice."

Pen raising that barrier. I agree that against an adversary fully committed to fraud it doesn't matter. But that threat model is exceptionally rare, and an IRB can do little about it anyway (e.g. the whole application could be made up, the experiment consisting of something completely different). The realistic threat they fight against is experimenters that don't know better, and think there'd be no harm in their actions.

And this is just me coming up with a possibility in a few minutes. Reality tends to be richer than a single person's imagination.

That was not the IRB's objection. I don't know where you're getting that (except as a devil's advocate position you thought of?). They were objecting to him using something other than pen (even though pencils were in common use for these very patients at that hospital with no IRB objection), not insisting that he use something safer than both pens and pencils.
I didn't say it was their objection.
>>>Even the one that he makes sound the most ludicrous ("IRB required pens, be we were only allowed to use pencils") can be rephrased as:

It looked like you were giving an alternate phrasing of the IRB's actual argument, not a separate one that also argues in favor of disallowing pencils (as well as the pens they had no problem with).

Ah, I see how I worded it confusingly.
>I'm deeply disturbed to see comments here defending this

Think about the about experiences and opinions that are common to the people on HN.

Bureaucracies that have lots of rules to cover every eventuality and interpret those rules as if they're a computer executing code isn't an intolerable concept to a group that can be generalized as "tech workers in CA."

Did you read the post? There were multiple ridiculously stupid things the IRB insisted on that had no impact on safety and were pure bureaucratic BS, the insistence on blinding patient's names with the blinding instrument right next to the blinded data, the signing in pen only, the person in the Research office having to do the course when they did not do research. All of this for a study that involved taking notes on things the doctors were going to be doing anyway, which posed no risks to anyone.
> the insistence on blinding patient's names with the blinding instrument right next to the blinded data

The requirement wasn't that the code should be next to the data, if I understood it correctly; rather that it be blinded and stored safely. Storing them together was the least-effort way he found of passing the requirement, partially defeating its purpose.

So if anything that's an argument for adding even more requirements to the IRB process in his hospital. Because grad students that feel sufficiently aggravated will do things like that.

He most likely has sufficient training and knowledge about the ethics given his profession. Curious what credentials you have that might make you more qualified to speak on the ethics of medical research, but in any case I think the point he makes is that it's possible to get so caught up in the letter of the law that you run roughshod over the spirit of protecting people that brought about the laws in the first place. This seems to often be the case with concerns about data sharing and personal privacy. If you read his whole piece he discusses this and you can extrapolate that as the result of the irb stonewalling, as well intentioned as it presumably was, many patients are still suffering from not only violations of the privacy that the irb was concerned about, but those same patients may also have erroneous and stigmatizing diagnoses being included in the information that's being freely shared. The IRB in this case is doing damage by preventing research that might address this. Pinker's made some worthwhile comments on this if you're interested in this topic.

You probably will get downvoted because you come across as being entirely dismissive of expertise or thinking that is not your own. I think you general point about the importance of oversight isn't lost on anyone.

> He most likely has sufficient training and knowledge about the ethics given his profession.

Sure but the mockery in that post suggests he either doesn't care about them or thinks they're stupid.

Also do we really have to point out that just because someone is a doctor doesn't mean they have any authority when it comes to medical ethics? I mean, there's hundreds of cases amply demonstrating this even just this decade.

If you don't think irb's are fitting targets for such mockery I'm inclined to be strongly suspicious of your claims to have had sufficient dealings with them. They are the DMV and IRS of research rolled into one. I've never met anyone who disagreed with that, even amongst those who served on them, critically important though they may be.
> strongly suspicious of your claims to have had sufficient dealings with them

You definitely should be since I have made precisely zero of those claims on this website or any other.

> If the author thinks that ethics review is "Blindly trusting authority to make our ethical decisions for us", then he clearly doesn't understand what ethics review is or how it works.

What is the basis for this statement? The author states that there is no oversight or governing body for the IRB. Is this incorrect (and if so, who is it)? If not, then the author's criticism seems apt.

Not the parent, but I reached that same conclusion.

You're not trusting them blindly because any and every ethical protection you decide your procedure needs, will be there. In addition to the ones the IRB thinks need to be there too.

When you implement a workplace safety policy in your company, making it comply with OSHA regulations isn't "blindly trusting authority to decide what is safe". If you think a practice is unsafe, yet OSHA thinks it's safe enough, they're not gonna prevent you from taking more precautions.

Same deal with code reviews. You aren't blindly trusting your colleague to decide what is bad or good code. You're adding their polish to yours.

Exactly! As someone working in medical research data sharing I am sometimes stopped from doing things the simple way by our IRB but I much prefer them being there and saying this is ok and this isn't versus just doing it the best way I can only to miss a detail and then be sued/charged with mishandling information.

I don't understand how a medical doctor can write such a simplistic post. Of course your consent forms need to mention that you will access medical data if you look at diagnosis even though they are your patients! You have access to all kinds of data for treating the patient (so called primary use), but you should have the absolute minimal set of attributes for research (secondary use). Who judges whether these attributes are really needed? IRB!

Of course you need to have you paperwork in order. This is not only your paperwork but also the hospital's! If you fuck up the newspapers are gonna carry headlines: doctors in this hospital leaked patients data. Do you think patients will want to come to that hospital?

Of course your investigators need to go through training on research ethics! In fact you should've put them through more training so that they fill in the damn consent forms properly!

Of course you need to separate personally identifiable information from the actual research and encode patient identifiers. Ever heard of publishing your data next to your research? When someone asks for the data from your study and you would forget to scrub it you would leak data. Encoding it and having it in two separate folders in one cabinet makes data sharing simpler. It protects you from making a stupid error.

Of course they can be next to each other in the cabinet. That cabinet is fucking locked! And it's in a hospital next to other private data. The risk is with publishing it!

Of course you need to fill in New Study Application, describe your study design and consent. IRB judges research studies, how would they do it if they didn't have that? You need to describe that stuff when asking for a grant and most studies are funded by grants so for most people it's no extra work.

Of course you need a monitoring plan and study meeting monitoring problems. If you had one you would notice that the newbies were doing a shitty job! Them doing a shitty job is not only bad for you but much more importantly it wastes patient's time! Patient's didn't come to hospital to improve your credentials!

The fact that there is some less than ideal stuff already used doesn't mean that your new study can be shit. That's like being angry about your pull request not getting accepted cause your indentation is all over the place and saying "but your indentation is already inconsistent". If there are style guidelines that's the way to do it. New code needs to follow them. Old stuff might get fixed or not but new stuff should be done according to guidelines.

I think you make his point. You work in medical research, all of these hoops to jump through are a real benefit to you. They keep you from being sued and act as moats that protect your livelyhood from external disruption. Do the hoops protect the participants in the research? Of course. But at what cost to the participants and at what cost to less well equipped researchers and at what cost to science itself? It's good that you won't be sued, and your training in filling in the various forms is commendable but maybe there's another side to things you're too inculcated to see clearly.
> They keep you from being sued [but] at what cost to the participants [...]?

The people suing you would be the participants, because you would have already harmed them. Not getting sued by them is just a derived benefit of the primary goal of protecting them from you. And the protections extend well beyond what a patient might bother suing you for: it's an ethical committee after all.

> at what cost to less well equipped researchers and at what cost to science itself?

Completely secondary considerations, for very good reasons. Nazis weren't the only ones to harm patients; also well-intentioned scientists that thought of the greater good for science itself, and grad students that lacked resources or equipment.