Human Subject Protection: How Research Ethics Rules Came to Be and How They Work Today

Modern medicine, psychology, public health and the social sciences all depend on studying people. New drugs have to be tested in human bodies before doctors can prescribe them. Surveys, interviews and behavioral experiments are the only way to learn how people think and act. Yet the history of research on people includes some of the darkest episodes of the twentieth century, in which researchers treated human beings as material rather than as partners. The system of rules, committees and habits that grew up in response is usually called "human subject protection" (or, increasingly, "human participant protection").

This article explains where that system came from, what its core principles are, how it works in practice, especially in the United States, where the rules are most fully written down, and where it is still argued over. It draws on primary and reference sources listed at the end. Where the record is unclear, we say so.

What "human subject protection" means

Human subject protection is the set of ethical principles, laws, regulations and institutional practices meant to make sure that people who take part in research:

• agree to take part freely and with a real understanding of what is involved;
• are not exposed to risks that are out of proportion to the knowledge expected from the study;
• are chosen fairly, so that the burdens of research do not fall mainly on people who are poor, institutionalized, imprisoned or otherwise easy to use; and
• have their privacy and confidential information protected.

Two features set research apart from ordinary medical care and explain why it needs separate rules. First, the main aim of research is to produce general knowledge, not to benefit the person in front of the researcher. A participant may benefit, but the study is designed to answer a question. Second, the researcher's interests (publishing, funding, career, sometimes money) can conflict with the participant's welfare. Protection systems exist to manage that conflict.

The historical record: why the rules exist

The rules grew directly out of specific scandals. Knowing those cases is the best way to understand why each rule looks the way it does.

Nazi medical experiments and the Doctors' Trial

During the Second World War, physicians in Nazi Germany carried out experiments on concentration camp prisoners without their consent, many of them deadly. After the war, the United States military tribunal at Nuremberg tried a group of physicians and officials in what is known as the Doctors' Trial (formally United States v. Karl Brandt et al.), one of the "Subsequent Nuremberg trials." According to the Wikipedia summary of the case record, the verdict was delivered on 20 August 1947 against Karl Brandt and 22 others. It included a section titled "Permissible Medical Experiments," which became known as the Nuremberg Code.

The Code sets out ten points. In summary, they say that:

1. The voluntary, informed consent of the subject is absolutely essential.
2. The experiment should produce results for the good of society that cannot be obtained by other means.
3. It should be based on animal experiments and knowledge of the disease, so that the expected results justify doing it.
4. It should avoid all unnecessary physical and mental suffering and injury.
5. No experiment should be done where there is reason to believe death or disabling injury will occur.
6. The degree of risk should never exceed the humanitarian importance of the problem.
7. Proper preparations should protect the subject against even remote possibilities of harm.
8. Only scientifically qualified persons should conduct it.
9. The subject should be free to end their participation.
10. The scientist must be ready to stop the experiment if continuing seems likely to cause injury, disability or death.

Who wrote the Code is debated. Judge Harold Sebring has been credited, and so have the prosecution's medical experts, Leo Alexander and Andrew Ivy. Both Ivy and, decades later, Alexander claimed sole authorship. Current scholarship generally treats it as a shared product of the trial.

The Code's legal status is also unusual. No nation or professional body formally adopted it as law or as its official ethics code. Even so, a 1995 U.S. federal court ruling held that it may be applied in federal civil and criminal cases, and it is widely seen as the model for later codes. Its lasting contribution is the first principle: consent comes first.

The Declaration of Helsinki

Because the Nuremberg Code came out of a criminal trial, physicians wanted a code written by and for the medical profession. The World Medical Association (WMA) adopted the Declaration of Helsinki in June 1964 in Helsinki, Finland, at its 18th General Assembly. It started as 11 paragraphs and has grown to 37 in its latest version.

The WMA's own page lists revised versions from 1975, 1983, 1989, 1996, 2000, 2004, 2008 and 2013, with the current official version adopted at the General Assembly in October 2024. That 2024 revision, also held in Helsinki, puts more weight on global inequities in research and states that research misconduct must never occur. (Older summaries, including the draft this article replaces, describe the 2013 text as current. It is not.)

Core ideas in the Declaration include respect for the individual and their right to make their own decisions, informed consent, the rule that the participant's welfare comes before the interests of science and society, independent ethical review of studies, and a favorable balance of risk and benefit. The Declaration is not legally binding. Its authority comes from the national and regional laws that adopt or borrow from it.

The 1975 revision mattered especially for what came later: according to the Wikipedia article on the Common Rule, U.S. requirements for review committees followed it.

Two long debates inside Helsinki

The Declaration has been at the center of two disputes that show how hard these questions are.

Placebos. If a proven treatment exists, is it ethical to give some trial participants a dummy pill instead? The 1996 revision included language allowing inert placebos where no proven method exists. The 2000 revision restated this firmly and drew strong protest, splitting opinion between those who insisted new treatments be compared against the best existing one ("active-control orthodoxy") and those who argued that placebo comparisons are often needed for sound science ("placebo orthodoxy"). A 2002 clarification allowed placebo use for compelling methodological reasons, or for minor conditions where the risk of serious or irreversible harm is low.

Post-trial access. The 2000 revision said participants should be assured access to the best proven intervention found by the study once it ends. A 2004 clarification softened this into something to be planned in the protocol and reviewed by the ethics committee. The question remains sharp in trials run in low-income countries, where participants may have no other way to get a drug that worked.

Henry Beecher's 1966 exposé

Many people in the 1950s and 1960s believed abuses like the Nazi experiments could not happen in democracies. Henry K. Beecher, a Harvard anesthesiologist, challenged that belief. His 1966 article "Ethics and Clinical Research" in the New England Journal of Medicine described 22 examples of published, mainstream clinical research that had put patients' lives at risk, often without their knowledge. Critics in the medical establishment said he generalized from a handful of cases. But the article, together with later congressional investigations, helped lay the foundation for U.S. federal rules on informed consent. The Bulletin of the World Health Organization republished it in 2001 in its "Public Health Classics" series.

Willowbrook

Willowbrook State School in Staten Island, New York, was an institution for children with intellectual disabilities. From 1956 to 1971, Saul Krugman of New York University, working with Robert W. McCollum of Yale, studied hepatitis there, including the effects of gamma globulin. Pediatrician and author Paul Offit has written that Krugman fed live hepatitis virus to sixty healthy children, all of whom became ill. Krugman's justification was that most children at the crowded institution would catch hepatitis anyway. The work did help scientists tell apart hepatitis spread by blood from hepatitis spread person to person. But bioethicist Arthur Caplan has argued the children stood to gain nothing and only to be harmed. The studies were among the ethically doubtful examples cited in the 1966 review.

In early 1972, WABC-TV reporter Geraldo Rivera's exposé "Willowbrook: The Last Great Disgrace" showed overcrowding, filth and abuse at the school. It won a Peabody Award and was followed by a federal class-action lawsuit filed on 17 March 1972 on behalf of residents. Willowbrook became a lasting example of why children and institutionalized people need extra protection in research.

The Tuskegee syphilis study

The case that most directly reshaped U.S. law was the U.S. Public Health Service study of untreated syphilis in Macon County, Alabama, carried out with Tuskegee Institute. According to the U.S. Centers for Disease Control and Prevention (CDC), the study ran from 1932 to 1972. It enrolled 600 Black men aged 25 or older: 399 who had late latent syphilis and 201 without the disease who served as controls. Researchers did not obtain informed consent and did not offer the men treatment, even after penicillin was widely available. The CDC also notes that no women were enrolled, but some women caught syphilis from participants.

The study ended in 1972 after news reports exposed it and an ad hoc advisory panel recommended stopping it. In 1974, a $10 million out-of-court settlement was reached. The CDC lists the amounts paid: $37,500 to each living man in the syphilis group, $15,000 to the heirs of each who had died, $16,000 to each living control, and $5,000 to heirs of deceased controls. In 1997, President Bill Clinton formally apologized on behalf of the nation. The apology led to the National Center for Bioethics in Research and Health Care at Tuskegee University.

The draft this article replaces gave a specific death toll for the study. The CDC's overview page does not give one, so we have left it out rather than repeat a number we could not confirm.

Tuskegee's legacy goes beyond regulation. It is regularly cited as a source of lasting distrust of medical research among Black Americans, which is one reason modern rules stress fair selection of participants and community engagement.

The U.S. response: the National Research Act and the Belmont Report

Public anger over Tuskegee pushed Congress to act. The National Research Act was signed into law on 12 July 1974. It created the National Commission for the Protection of Human Subjects of Biomedical and Behavioral Research, which worked from 1974 to 1978. The Commission had 11 members, including the obstetrician Kenneth John Ryan, the civil rights leader Dorothy I. Height, the ethicist Albert R. Jonsen and the law professor Patricia A. King.

One of the Commission's tasks was to identify the basic ethical principles behind research on people. In February 1976 it held four days of discussions at the Belmont Conference Center in Elkridge, Maryland, which gave the resulting document its name. The Belmont Report was released on 30 September 1978 and published in the Federal Register on 18 April 1979.

The three principles

The Belmont Report is short, but it remains the clearest statement of the ideas behind U.S. research ethics. It names three principles:

Respect for persons. People should be treated as autonomous agents who can decide for themselves, and people whose autonomy is reduced (children, some people with cognitive impairments, prisoners) are entitled to extra protection.

Beneficence. Researchers should not harm people, and should maximize possible benefits while minimizing possible harms.

Justice. The benefits and burdens of research should be distributed fairly. The report's authors had cases like Tuskegee in mind, in which poor and powerless people bore the risk of research whose results helped others.

The three applications

Each principle maps onto a practical requirement:

• Respect for persons leads to informed consent.
• Beneficence leads to a systematic assessment of risks and benefits.
• Justice leads to fair selection of subjects.

This mapping is still how many research ethics committees structure their review. A reviewer asks: Is the consent process adequate? Are the risks reasonable given the expected benefits? Is the group being studied chosen for good scientific reasons, rather than because they are convenient or vulnerable?

The Common Rule: turning principles into regulation

Principles need rules to enforce them. In the United States, the main rule is the Federal Policy for the Protection of Human Subjects, known as the Common Rule. It dates from 1991 and is called "common" because many federal departments and agencies adopted the same text. According to the Wikipedia article, 20 agencies and departments have signed on, including the Department of Agriculture, the Department of Defense and NASA. The Department of Health and Human Services (HHS) version is codified in Title 45 of the Code of Federal Regulations, Part 46 (45 CFR 46).

What the rule covers

The Common Rule applies to research conducted or funded by the agencies that have signed it. Research on products regulated by the Food and Drug Administration, such as drugs and medical devices, falls under the FDA's own similar regulations. Many universities and hospitals apply the same standards to all their research regardless of funding, as a matter of institutional policy, and some states, including California and Maryland, have broader laws of their own.

45 CFR 46 is divided into subparts:

• Subpart A is the Common Rule itself: requirements for institutions, informed consent, and review committees.
• Subpart B adds protections for pregnant women, fetuses and research involving in vitro fertilization.
• Subpart C adds protections for prisoners.
• Subpart D adds protections for children.

The extra subparts are a direct legacy of cases like Willowbrook: groups with less power to say no get extra safeguards.

The 2018 revisions

The Common Rule was overhauled for the first time in decades. HHS and fifteen other federal departments and agencies announced the revisions on 19 January 2017. The University of California, Berkeley's human-subjects office summarizes the timeline: the revised ("2018") requirements took effect on 21 January 2019, and the requirement for a single review board in multi-site studies took effect on 20 January 2020. The National Institutes of Health had already introduced its own single-board policy for multi-site NIH-funded studies on 25 January 2018.

The main changes, as summarized by Berkeley and other institutional guides, were:

• Key information first. Consent forms must begin with a concise summary of the information most likely to help a person decide whether to join, such as the fact that participation is voluntary, what will happen, and the main risks and benefits. This responded to the common complaint that consent forms had become long legal documents that few people read.
• Broad consent. A new, optional form of consent lets people agree in advance to future, unspecified research using their stored identifiable data or biospecimens. Its use requires a "limited IRB review."
• Identifiable biospecimens. Research using identifiable biological samples clearly counts as human subjects research.
• New and clarified exemptions. Some exempt categories were further defined, and new ones were added, so that very low-risk research spends less time in review.
• Less continuing review. Annual re-review is no longer required for many minimal-risk studies, or for studies that are only analyzing data or doing routine follow-up, though a review board can still require it.
• Single IRB for cooperative research. Federally funded, non-exempt studies at multiple U.S. sites generally must use one review board instead of a separate board at every institution.
• Electronic consent. "Written" consent can be in electronic form.
• Updated vulnerability language. The approval criteria now refer to people with impaired decision-making capacity and people who are economically or educationally disadvantaged, while pregnant women and people with disabilities are no longer listed as vulnerable in that section.
• Tribal law. Where relevant, the laws of American Indian and Alaska Native tribes apply.

Institutional Review Boards: the day-to-day machinery

The core of U.S. human subject protection is the Institutional Review Board (IRB). Outside the United States, similar bodies are called research ethics committees, independent ethics committees or research ethics boards. Their basic job is the same: before a study starts, an independent group looks at the plan and decides whether it is ethical.

Who sits on an IRB

U.S. regulations require at least five members. They must include at least one person whose main concerns are scientific and at least one whose main concerns are non-scientific, so that the board is not just researchers judging other researchers.

Levels of review

Not every study gets the same scrutiny. In general there are three tracks:

• Exempt. Some research carries so little risk that it is exempt from most of the rule's requirements. Examples include certain studies of normal educational practices, analysis of existing data where individuals cannot be identified, and taste and food quality evaluations. Even then, an institutional representative, not the researcher, should decide that a study is exempt.
• Expedited. Minimal-risk research, and minor changes to approved studies, can be reviewed by the chair or a designated member rather than the full board. An expedited reviewer can approve or request changes, but cannot disapprove a study; that requires the full board.
• Full board. Studies with more than minimal risk go to a convened meeting. A majority of members must be present, including at least one non-scientist, and approval requires a majority of those present.

What reviewers look for

Following the Belmont structure, an IRB asks whether risks are minimized and reasonable given the expected benefits, whether participants are selected fairly, whether consent will be sought and documented properly, whether there are adequate provisions to monitor data for safety, and whether privacy and confidentiality are protected. Approved studies are watched over time through reports of problems, amendments and, where required, continuing review.

For clinical trials, international Good Clinical Practice guidelines developed by the International Council for Harmonisation (ICH) add expectations for how trials are run and monitored.

Informed consent in practice

Informed consent is often described as a form, but ethicists stress that it is a process. A signed document is evidence that the conversation happened, not a substitute for it.

The elements

Under the Belmont framework, consent has three parts: information (what the study is, why it is being done, what will happen, the risks and benefits, alternatives, and that people may withdraw), comprehension (the information must be presented in a way the person can actually understand), and voluntariness (the decision must be free of coercion and undue influence). The Nuremberg Code's ninth point, that a participant may stop at any time, survives in every modern consent form.

When full consent is not possible

Some research cannot practically get individual consent, such as studies of large existing records. The Common Rule lets an IRB waive or alter consent under specific conditions, generally when the research is minimal risk and could not practicably be done otherwise. The 2018 revisions also allow screening and recruitment activities without consent in specific circumstances.

Children and others who cannot consent for themselves

For children, the usual pattern is permission from a parent or guardian plus the child's own agreement ("assent") where the child is old enough to give it. Similar arrangements, using a legally authorized representative, apply to adults who lack the capacity to decide.

The case of Henrietta Lacks: tissues, data and consent

Some of the hardest modern questions are not about physical risk at all, but about what happens to people's tissue and information.

Henrietta Lacks was a Black woman treated for cervical cancer at Johns Hopkins Hospital in Baltimore. She died on 4 October 1951, aged 31. During her treatment, two tissue samples were taken from her cervix without her knowledge or permission. Researcher George Otto Gey used the cancerous sample to grow the HeLa cell line. At the time, consent for such use was neither required nor customarily sought. Her family did not learn the cell line existed until 1975.

In 2013, the family and the National Institutes of Health reached an agreement that gave the family a voice in access to HeLa genome data: two family members sit on a six-member committee that reviews requests. The agreement does not provide any share of commercial proceeds. In October 2021, Lacks's estate sued Thermo Fisher Scientific over its profits from HeLa cells, and the two sides settled on 31 July 2023 on undisclosed terms.

The Lacks case is one reason the revised Common Rule treats identifiable biospecimens as human subjects research and created the broad consent option. It also shows the limits of a system that focuses on the moment of consent: once samples and data exist, questions about ownership, benefit and family privacy can continue for generations.

When protections fail: the death of Jesse Gelsinger

Rules on paper do not guarantee protection. The death of Jesse Gelsinger in 1999 is the most cited modern American example.

Gelsinger had a mild form of ornithine transcarbamylase (OTC) deficiency, a genetic liver disorder that affects the body's ability to clear ammonia. He managed it with diet and medicine. At 18, he joined a University of Pennsylvania gene therapy trial whose ultimate aim was to help infants with the severe form of the disease. On 13 September 1999 he received an adenovirus carrying a corrective gene. He died four days later, on 17 September, apparently from a massive immune reaction that led to multiple organ failure.

An FDA investigation found that the trial team had broken several rules. Gelsinger was enrolled despite ammonia levels that should have excluded him. Serious side effects in earlier patients had not been reported as required. The consent documents did not mention monkey deaths from a similar treatment. The lead scientist and the university reportedly had financial interests in the research. The university and Children's National Medical Center each paid the government more than $500,000, gene therapy trials across the U.S. were halted for a time, and the case set the field back for years. Penn published a rebuttal disputing the FDA's conclusions.

The case taught several lessons that now run through human subject protection: adverse events must be reported promptly, consent forms must disclose what is known about risks even when it is uncomfortable, and financial conflicts of interest need to be disclosed and managed.

International guidance beyond Helsinki

Beyond the Declaration of Helsinki, the most influential international guidance comes from the Council for International Organizations of Medical Sciences (CIOMS), which has worked with the World Health Organization on research ethics since the late 1970s. Its International Ethical Guidelines for Health-related Research Involving Humans appeared in revisions in 1993 and 2002, and the current fourth edition was published in Geneva in 2016. The 2016 edition stresses that research must have both scientific and social value, and it includes guidance for research in low-resource settings, for vulnerable groups, and for the use of biological samples and health data.

Many countries have their own laws and national committees that build on these documents. The details vary, but nearly all share the basic structure: independent prior review, informed consent, a risk-benefit judgment, and extra protection for those least able to protect themselves.

Ongoing debates and criticisms

The protection system is widely accepted in principle, but its workings are criticized from several directions.

Too little oversight. Critics point to conflicts of interest, especially at commercial IRBs that are paid by the sponsors whose studies they review. In a 2009 undercover test by the U.S. Government Accountability Office, one IRB approved a study of a fictitious product, a result often cited as evidence that review can be superficial.

Too much bureaucracy. From the other side, researchers argue that review has become slow, repetitive and focused on paperwork rather than real risk, particularly for low-risk social science. Some writers go further and argue that delays in medical research cost lives, a claim that others dispute. The 2018 changes to exemptions, continuing review and single IRB review were partly an attempt to answer this criticism.

Consent that people don't read. Long consent forms can protect institutions more than participants. The "key information" requirement is an attempt to fix this, but whether it works depends on how institutions write the summary.

Data and biospecimens. Large databases, genetic sequencing and the ability to combine datasets make "anonymous" data harder to guarantee. Broad consent, data governance committees like the one created for HeLa data, and stronger privacy safeguards are partial answers, not settled solutions.

Global fairness. The placebo and post-trial access debates within the Declaration of Helsinki reflect a wider worry: that trials are run where costs are low and rules are weak, while the benefits go to wealthier countries. The 2024 revision's attention to global inequities shows the issue is still open.

Frequently asked questions

Is the Nuremberg Code a law? No. No nation or professional association formally adopted it as law. It has, however, influenced later regulations, and a 1995 U.S. federal court ruling held that it may be applied in federal civil and criminal cases.

What is the difference between the Belmont Report and the Common Rule? The Belmont Report (1978, published in the Federal Register in 1979) states ethical principles: respect for persons, beneficence and justice. The Common Rule (1991, revised effective 2019) is the binding regulation that applies those principles to federally funded or conducted research.

Does every study need IRB approval? In the United States, federally conducted or funded research involving people and research on FDA-regulated products generally needs IRB review unless it qualifies as exempt. Many institutions require review of all research on people regardless of funding.

Can I quit a study after I've signed up? Yes. The right to withdraw goes back to the Nuremberg Code and is a standard element of informed consent.

Is the current Declaration of Helsinki the 2013 version? No. The WMA adopted a revised version at its General Assembly in October 2024, which is now the official text.

Why do children and prisoners get extra protections? Because they have less ability to refuse freely. Subparts C and D of the U.S. regulations add extra safeguards for prisoners and for children, reflecting cases like Willowbrook, where institutionalized children were used in research.

What is broad consent? An option created by the revised Common Rule that lets people agree in advance to future, unspecified research using their identifiable stored data or biospecimens, subject to limited IRB review.

Conclusion

Human subject protection did not come from a single theory. It was built piece by piece, usually after something went badly wrong: the Nazi experiments led to the Nuremberg Code, Beecher's exposé and Willowbrook revealed that abuse happened in ordinary hospitals and institutions, Tuskegee led to the National Research Act and the Belmont Report, and the death of Jesse Gelsinger exposed gaps in reporting and conflict-of-interest management. Each layer added a safeguard: consent, independent review, risk-benefit analysis, fair selection and extra protection for the vulnerable.

The system's central promise is simple, even if carrying it out is not. People who make knowledge possible by lending their bodies, time and information to research should be treated as partners, told the truth, allowed to say no, and not used up for someone else's benefit.

Sources and further reading

• U.S. Centers for Disease Control and Prevention, "About the Untreated Syphilis Study at Tuskegee": https://www.cdc.gov/tuskegee/about/index.html
• World Medical Association, Declaration of Helsinki: https://www.wma.net/what-we-do/medical-ethics/declaration-of-helsinki/
• Wikipedia, "Declaration of Helsinki": https://en.wikipedia.org/wiki/Declaration_of_Helsinki
• Wikipedia, "Nuremberg Code": https://en.wikipedia.org/wiki/Nuremberg_Code
• Wikipedia, "Belmont Report": https://en.wikipedia.org/wiki/Belmont_Report
• Wikipedia, "Common Rule": https://en.wikipedia.org/wiki/Common_Rule
• University of California, Berkeley, Committee for Protection of Human Subjects, "Revised Common Rule": https://cphs.berkeley.edu/guide/commonrule.html
• Wikipedia, "Institutional review board": https://en.wikipedia.org/wiki/Institutional_review_board
• Wikipedia, "Henry K. Beecher": https://en.wikipedia.org/wiki/Henry_K._Beecher
• Wikipedia, "Willowbrook State School": https://en.wikipedia.org/wiki/Willowbrook_State_School
• Wikipedia, "Henrietta Lacks": https://en.wikipedia.org/wiki/Henrietta_Lacks
• Wikipedia, "Jesse Gelsinger": https://en.wikipedia.org/wiki/Jesse_Gelsinger
• CIOMS, International Ethical Guidelines for Health-related Research Involving Humans (2016): https://cioms.ch/publications/product/international-ethical-guidelines-for-health-related-research-involving-humans/