American Journal of Law & Medicine

The regulation of MR neuroimaging research: disentangling the Gordian knot.(Brain Imaging and the Law)


In a typical magnetic resonance imaging ("MRI") study of the brain, subjects are screened for contraindications (1) before being placed in the bore of a large machine, the MRI scanner, which contains a powerful magnet. The scanner produces cross-sectional images of brain tissue as the subjects undergo a series of brief electromagnetic pulses, perceptible only as noise and vibration. If the protocol involves functional MRI ("fMRI"), a popular research technique for obtaining indirect measurements of brain activity, equipment might be used to present stimuli (sounds or pictures) during the scan, but generally the study involves no invasive procedures, no physical discomfort, and no ionizing radiation. (2) Upon completion of the scan, MRI data is transferred to an investigator's computer for further analysis, often in combination with behavioral test results and clinical information obtained from subjects or their medical records.

This procedure sounds benign, and usually is. But an MRI scanner is a powerful medical device, capable of causing serious injury or death if operated carelessly. (3) MRI scanning of the brain ("MR neuroimaging") also carries psychological risk, in that it may occasionally reveal information about unsuspected brain abnormalities (e.g., tumors or aneurysms) that could have serious health implications. Moreover, identification as a participant in neuroimaging studies of cognitive impairment, such as research involving Alzheimer's disease or dementia, could, in theory, place a subject at risk for discrimination in insurance or employment. (4)

These various risks are far from unregulated: A potentially bewildering array of federal requirements exists to protect the safety, well-being, and privacy of those who participate in research, including MRI studies. Yet each such regulation is limited in scope; the protections each affords vary, depending upon factors such as the nature of site where the scan is performed, the source of funding for the research, and the purpose of the study. Further, existing protections for human research subjects are insufficient in some respects and inefficiently duplicative in others. As a result, the subjects of MR neuroimaging research may enjoy redundant protection from certain harms, such as breaches of privacy, yet they may lack adequate protection from others, such as physical injury.

In this Article I summarize how human MRI studies are regulated at the federal level, using the complexity and limitations of these various regulatory schemes to illustrate a broader concern that existing, nonintegrated systems of research oversight may serve subjects poorly and impede essential research, including the many studies needed to support the innovative applications of MR neuroimaging technology discussed elsewhere in this Symposium Issue of the Journal. (5)


Like the Gordian knot of Greco-Roman mythology, (6) the regulation of a study involving human subjects and either a drug or medical device (e.g., an MRI scanner) can appear an impenetrable tangle of additive requirements, each imposed by separate federal agencies or entities. To illustrate, the MRI study described in Section I, above, might be subject to one or more of the following regulations: (7)

1. Regulations of the U.S. Food and Drug Administration ("FDA") applicable to investigational medical devices (8);

2. FDA regulations requiring informed consent and Institutional Review Board ("IRB") review in clinical investigations of regulated products; (9)

3. Regulations of the U.S. Department of Health and Human Services ("DHHS"), known in part as the "Common Rule," that govern human subjects research conducted or funded by DHHS; (10)

4. DHHS regulations, known as the HIPAA Privacy Rule and the HIPAA Security Rule, enforced by the DHHS Office for Civil Rights and the Centers for Medicare and Medicaid, respectively, that implement requirements of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") pertaining to health information (with provisions governing the use of identifiable health information in research); (11) and

5. Public Health Service ("PHS") and FDA regulations requiring disclosure and review of certain financial interests in research. (12)

What follows is a brief summary of the scope of each regulation and a discussion of how each might apply to an MRI study.


Because an MRI scanner intended for diagnostic human use is a "medical device" as defined by the Federal Food, Drug, and Cosmetic Act (as amended), (13) both its manufacture and sale for this purpose are governed by FDA regulations. (14) Under certain circumstances, so is the use of an MRI scanner in research.

Within FDA's three-tiered regulatory scheme for medical devices, MRI scanners are considered Class II devices, and as a class, have certain FDA-approved intended uses and conditions of use ("indications"). (15) Manufacturers who wish to promote new intended uses or indications for a device or to modify an MRI scanner in commercial distribution may generally seek FDA's clearance to do so through the premarket notification ([section] 510k) process, whereby the manufacturer must satisfy the FDA that the device as modified or re-labeled with a new use or indication remains substantially equivalent to the approved ("predicate") version of the device. (16) If, however, FDA determines that a manufacturer's proposed modification, new intended use, or new indication raises questions of safety or effectiveness that render the device no longer substantially equivalent to the approved predicate, the device as modified or re-labeled will be ineligible for approval via premarket notification. In this case, the manufacturer must obtain FDA's permission to market the device or change the labeling via the more rigorous premarket approval ("PMA") process. (17)

To receive premarket approval, or, in a few cases, marketing clearance via premarket notification, an applicant must submit to FDA supporting data obtained from clinical investigations involving human subjects. Clinical investigations conducted to support a new intended use, indication, or modifications to an MRI scanner or its computer system components must comply both with FDA's Investigational Device Exemptions regulations and with its human subjects protection regulations. (18) An approved Investigational Device Exemption ("IDE") permits the lawful shipment of a device for use in clinical investigations while exempting the device from requirements that would otherwise apply to the same device in commercial distribution.

Certain clinical investigations may be exempt from the IDE regulations. For example, if an MRI scanner is used in research in accordance with its approved labeling, or a scanner modification is tested for purposes other than determining safety or efficacy of the modified device and the testing does not place subjects at risk, the study would be exempt from the IDE requirements. (19) As discussed further below, however, exemption from IDE requirements does not by itself confer exemption from FDA's human subjects protection requirements, namely IRB review and informed consent. (20)

The IDE regulations specify that when a study is not exempt from IDE requirements, the reviewing IRB must classify the study as either "significant risk" or "non-significant risk" ("NSR") according to specific criteria. (21) An NSR MRI study may be initiated upon IRB approval, without prior submission to the FDA, as the IDE for the study will be deemed approved without prospective FDA review. (22) If, however, the IRB (or FDA, upon review of an IRB's prior risk determination) considers a given investigational use of MRI to be of significant risk, the study sponsor must obtain FDA approval prior to initiating the study, and must comply with more detailed IDE regulations pertaining to recordkeeping and reporting. (23)

An important--if confusing--difference exists between the risk terminology used in FDA's IDE regulations and in the agency's human subjects protection regulations. Under the IDE regulations, an NSR study is a non-exempt study that does not meet regulatory criteria for significant risk. (24) A separate analysis is required under the FDA's human subjects protection regulations to determine whether any study, IDE-exempt or not, presents no more than "minimal risk" to human subjects and is therefore eligible for expedited review by the IRB.

The IDE regulations also specify how and when the investigator and the sponsor of a clinical investigation must collect and report information about research problems, including unanticipated adverse events associated with the investigational device, deviations from the investigational plan, and the withdrawal of IRB approval. (25) These reporting requirements differ from those in FDA's human subjects protection regulations and from the reporting requirements for research subject to DHHS regulations (i.e., the regulations that govern most federally-funded biomedical research).

Finally, and notably, FDA's IDE regulations are limited in scope to studies intended to collect data about the device--data that are intended for submission to FDA (e.g., in support of a marketing permit), or data that by law must be held by the sponsor for possible FDA inspection. If, as is common in MR neuroimaging research, the purpose of the study is solely to collect anatomical or physiological data about the subjects, and not to evaluate scanner performance or obtain data for any other FDA-regulated purpose (e.g., clinical diagnosis), then FDA's IDE regulations do not apply, even if the MRI scanner is modified substantially or used outside its approved parameters. (26)


FDA has adopted regulations that specifically provide for the protection of human research subjects. (27) Pursuant to their statements of scope and applicability, these regulations apply only to "clinical investigations regulated by the Food and Drug Administration under sections 505(i) and 520(g) of the Federal Food Drug, and Cosmetic Act, as well as clinical investigations that support applications for research or marketing permits ..." (28) A "clinical investigation" is an experiment involving a regulated product, where the experiment must either meet the requirements for prior submission to FDA (e.g., an IDE must be obtained), or where the results are intended to be submitted to, or held for inspection by, FDA (e.g., the results are intended to support an application for a research or marketing permit). (29) When an MRI scanner is used solely as a research tool (e.g., in a study of brain anatomy or physiology), versus for any diagnostic or clinical purpose, and the data will not be submitted to FDA and need not be held for possible FDA inspection, then FDA has no apparent jurisdiction that would render the study a clinical investigation subject to the agency's human subjects protection requirements. (30)

FDA's human subjects protection regulations set out a process for IRB review of research, specify required elements of informed consent, and parallel in many respects the human subjects protections that apply to research funded or conducted by the DHHS and certain other federal agencies (described below in Section II.C). Like the DHHS regulations, FDA regulations also provide for a process of expedited IRB review for human subjects research deemed "minimal risk." (31)

Unlike DHHS regulations, FDA's human subjects protection regulations do not permit the IRB to waive informed consent for research that is of minimal risk, but do permit research to be conducted without informed consent in a narrow range of specific circumstances. (32) Additionally, although FDA regulations now include special protections for child subjects of research, (33) FDA has not adopted the special protections found in DHHS regulations for pregnant women, fetuses, and neonates who participate in research. (34)

As noted previously, FDA's human subjects protection regulations contain reporting requirements that, although similar to those applicable to DHHS and other federal agency research, differ from the reporting requirements under FDA's own IDE regulations, both in terminology and in application. …

Log in to your account to read this article – and millions more.