I spent 10 years in the medical research world. Not having IRB approval is such a basic error. IRBs are set up to ensure that all research conducted on humans is safe and ethical. If this was not Theranos and someone was say giving high level of radiation as part of an experiment I doubt you would be as forgiving. Or maybe PII gets published as part of a study on STDs and people are publicly identified. IRBs exist to protect patients and prevent researchers from harming them, either intentionally or unintentionally.