Hacker News Reader

Comment by skwb | Hacker News Reader

I mean tons of retrospective studies are literally "IRB exempt" (and highlighted as such in their methods) where no explicit consent is required or needed. Physicians doing case reviews don't need consent of the patient this work. Doing retrospective analyses for defining clinical phenotypes on patient data that has been aggregated isn't needed either. Collecting clinical MRIs to do deep learning doesn't require an IRB.

IRBs are only REALLY required when you are intervening in patient care or pose some theoretical risk to a human.

Some institutions still want you to submit approval for institutional data, but as a non-lawyer it seems that's much more of a CYA policy.

View on HN

> Collecting clinical MRIs to do deep learning doesn't require an IRB

Yes it does, but typically the IRB will waive consent and waive notification for those sorts of studies if the images can be de-identified. There's also HIPAA involved which may or may not require establishing a BAA depending on what's being done if the images can't be de-identified. This is particularly an issue with brain MRI because it is usually trivial to generate an image that can be compared to full-face photographs (i.e. can be compared to drivers license/passport type photos to reestablish identify).

And longer term you're not getting anything even in the door at the FDA without an IRB and you're not selling anything without FDA approval.

Also please note that MRI is a Class II regulated device that deposits energy in subjects/patients so it doesn't qualify for a lot of the exemptions (early last year the FDA granted IRBs the ability to do things like wave full written consent for minimal risk research for FDA-regulated research).

I've worked in MRI AI both in academic and non-academic centers, including technology that has received 510K clearance.

I admit it sounds pedantic, but I'm not discussing IRB *exemptions* that are sometimes required by an institution nor am I discussing BAAs. I was specifically talking about the specific IRB applications (which I've submitted and signed before) that the blog author was talking about. Yes, HIPAA and other state and local regulations also govern what you can and cannot do with the data, but that's not what I argued.

Sorta off topic but the FDA doesn't care so much about SAR unless you're directly programming the MR machine's pulse sequence. If you're just doing quantification of some brain structure for monitoring a biomarker, they're primarily concerned if your product 1) matches an existing prerequisite and 2) functionality that your product achieves performance that you say it does. That is why the marketing around most of the early DL / AI based radiology startups were focused on language for "study prioritization" rather than more specific claims.

MRI are Class II devices and until last year exemptions for IDE applications and for not obtaining written informed consent specifically excluded devices that by design or intent deposit energy in humans (regardless of overall study risk. Last year the FDA finally extended some power to IRBs to harmonize with HHS research regulations which have allowed IRBs to waive consent for minimal risk studies for a long time. But FDA directing you to an IRB rather than both an IRB and the FDA itself doesn't mean you're not dealing with an IRB.

FDA and human subject protections come from different laws with different legislative authority. The regulations are not the same except to the extent that the agencies themselves work to harmonize things. If you are doing anything covered by FDA you must follow FDA's regulations in addition to any other applicable human subjects research regulations. And because MRI scanners are Class II regulated devices it means that people are being scanned with a doctor's permission, an IRB's permission or the FDA's direct permission.

FDA "doesn't care" about SAR to the extent that they have published guidance that if you operate an approved MRI scanner within normal operating mode (which are settings defined by IEC that do not necessitate medical supervision), then the FDA will not automatically consider use of the scanner itself to elevate a study's risk (in the way that using something like a CT scanner with ionizing radiation would). Risk determination goes beyond whether or not the MRI itself is a risk though. For example a research study that diverts patients to MRI in a way that delays care in an emergent situation (say testing experimental sequences for stroke detection) is unlikely to overall qualify as minimal risk even if the scanner operates in normal mode because of other non-MRI risks associated with the study procedures.

Retrospective use of de-identified or anonymized medical records that already exist are of course a different thing because the risks to the patient are primarily privacy risks.

And you are correct the actual FDA labels of all the AI crap that's coming out are jokes compared to what a lot of sales bullshitters promise. But you better believe all the data submitted to the FDA by the MRI manufacturers support their accelerated acquisitions that use deep learning recons follow FDA's clinical trials regulations.

I don't disagree with anything you're saying necessarily, but a lot of people are conflating my statement of IRB exemption with having an explicit IRB authorization. I guess more to my point is people seem to be failing to understand the role of retrospective research (and I will easily concede that different institutions have different legal interpretations) and how it's an important part of research. Don't get me wrong, you absolutely still have regulations about what you can and cannot do with that data, but saying you need an IRB for everything doesn't match the reality that I've seen first hand.

That said, there's plenty of buying and selling of radiological images for industry development on the second hand market. Now where the line of "research" vs. "industrial" work is, well that's something I would leave to legal council. But as you said any sort of "altering" of clinical outcomes is a clear IRB is required zone like DL based recon.

This is correct. IRB will be simple is not the same as not needing one.

I have published multiple papers in peer review journals where we were not covered by IRBs. That is not to say other research ethics standards don't exist, but that IRBs are simply one portion of the healthcare research regulations.

Sure, there are also cases where it is not needed. But some called out in GP were not typically correct. And often it is opaque to the researchers only because someone did an IRB in an earlier step with usage that covers sharing it with you.

I’m a radiologist, and I’ve worked on these sorts of research studies before. You absolutely do need an IRB to do deep learning on clinical MRIs. I’ve had to write IRBs just to collect retrospective MRIs. Even for studies that are potentially IRB exempt, going through the exemption request takes hours of work on my part and weeks to months before the IRB grants the exception.

As other commenters mention, the “theoretical risk to a human” encompasses nearly all research. For what I do, any imaging studies that aren’t de-identified pose a theoretical risk to patient privacy. If you try to de-identify images, you learn that this is nearly impossible. Sure, you can try your best to scrub DICOM headers, but these headers are mis-used by vendors, so identifying information can appear almost anywhere. You could delete the headers entirely, but then you lose a lot of metadata that you may need to properly display the images. Further, people contend that you can identify individual peoples’ faces if you 3D-reconstruct CT/MR images, so then you have to expend resources to delete faces from all head/neck/brain imaging. Confirming that this was done properly requires manual review and limits the size of your dataset.

Edit: I think the disagreements here are partly due to institutional differences in IRB requirements and partly due to conflating “IRB exemptions” with the idea of not having to interact with the IRB at all. You always have to interact with the IRB—even just to obtain an exemption. While obtaining IRB approval is a cumbersome process, obtaining IRB exemption is only slightly less cumbersome. I’m sure this varies across institutions, but I’ve been at three different large urban academic centers, and obtaining exemptions has been a multi-month process at all three.

>IRBs are only REALLY required when you are intervening in patient care or pose some theoretical risk to a human.

In practice, sure, but that's not what the spaghetti of rules that one is compelled by law to follow state. This disconnect is the whole point of the article.

I just pointed out the numerous exemptions to IRBs for research. People can literally make a research career and never touch IRBs.

The point I'm trying to make is that the blog is so narrowly defined that it doesn't match the reality of clinical research.

>IRBs are only REALLY required when you are intervening in patient care or pose some theoretical risk to a human.

Theoretical risk is a very broad category. IRB approval is required to download de-identified human genome sequences, in part because the genome sequence can be used to identify the individual. Drawing blood from an individual, or using blood that has been drawn for other purposes, requires IRB approval. And IRB approval is required for many sociology studies (or surveys), in part because publishing an individuals answers to a survey might put the subject at risk.

So the "theoretical risk" threshold can be very low. It's theoretical after all, so the harm need only be imaginable.

No, even IRB exempt studies need to be approved as IRB-exempt by the IRB. Funny isn't it? A lot of other things in your comment are wrong too btw.

I am in a lab that does EEG research and have recently been doing research using self-supervised learning on EEG. We had to get approval for "secondary use of data" to use open datasets from https://openneuro.org/ and we had to jump through a bunch of hoops with our IRB. It was harder to get it approved than the EEG experiments we run ourselves for some reason.

Reply on news.ycombinator.com