17.1 Introduction

In this chapter I consider some important implications of adopting rules, principles and supplementary guidance-based approaches to the regulation and governance of health research. This is a topic that has not yet received sufficient attention given how impactful different regulatory approaches can be on health research. I suggest that each approach has strengths and limitations to be factored-in when considering how we shape health research practices. I argue that while principles-based approaches can be well suited to typically complex health research landscapes, additional guidance is often required. I explore why this is so, highlighting in particular the added value of best practice and noting that incorporating additional guidance within regulatory approaches demands its own important considerations, which are laid out in the final section.

17.2 The Significance of Regulatory Approaches

Determining which regulatory/governance approach (RGA)Footnote ¹ to adopt is a recurring predicament spanning the diverse spectrum of health research activities. For example, a key challenge concerning emerging technologies is regulatory lapse – law’s inability to keep up with the fast pace of technological development and adoption.Footnote ² Novel practices/technologies may be subsumed under pre-existing frameworks through processes of commensuration such as legislative analogy. Alternatively, it may be determined that entirely new frameworks are required.Footnote ³ Pre-existing frameworks may be too rigid and restrictive, or conversely, overly flexible and permissive.Footnote ⁴ Content included within RGAs may deviate substantially from what takes place ‘on the ground’, raising problems for those charged with interpreting regulation, leading to theory-practice gaps.Footnote ⁵ Similarly, current approaches may fail to reflect embodied experiences of the subjects affected by regulation.Footnote ⁶

Universally, then, important questions arise relating to what form RGAs should take. Should they manifest as specific prescriptive norms, which often appear in the form of rules? Or would high-level and more abstract norms, such as those typically communicated through principles be more effective? Is additional guidance needed alongside rules and principles? If so, what form should this take? Each approach can have repercussions for the patients, researchers, regulators, developers, manufacturers, technologies and other key actors, subjects and objects constituting health research ecosystems. It is imperative that prior to adopting a particular RGA, the respective benefits and limitations of different potential approaches are granted due regard.

Many spheres of health research are widely populated by rules, principles and supplementary guidance. These manifest in diverse forms including: international instruments, primary and secondary legislation, ethical frameworks, professional guidance, codes of conduct, best practice instantiations, recommendations and standards. Consider, for instance, use of patient health data for research purposes. UK-based researchers wishing to access such data must consider the requirements laid out within (among others) the General Data Protection Regulation (Regulation (EU) 2016/679) (GDPR), the UK Data Protection Act 2018 and the NHS Act 2006. Additionally, they must consider guidance from the Information Commissioner’s Office, and adhere to the Caldicott Principles and applicable professional guidance. Technical standards such as those set out by the International Organization for Standardization (ISO) must also be observed. Researchers may be required to obtain research ethics committee approval, and demonstrate due consideration and mitigation of the risks and privacy impacts of data uses and whether or not such uses carry social value and are in the public interest. Many additional spheres of health research can prove similarly labyrinthine.

Navigating such complex regulatory frameworks and interpreting provisions included within them is challenging. A balance must be sought between offering clear articulations of what is required, permitted and prohibited, while retaining sufficient flexibility to guarantee applicability across a wide array of contexts. This tension between specificity and flexibility is a recurring dilemma for regulation. Regardless of the technologies/activities under consideration, an additional balance must be sought of providing adequate coverage of the range of pre-existing activities associated with a specific type of research and simultaneously avoiding the risk of becoming obsolete when new applications of, or progressions in, those research practices/technologies appear. For example, one of the driving factors for the introduction of the GDPR was the drastic transformations in how data are used today as compared to when its predecessor, the European Directive 95/46/EC, was drafted. Given the challenges of navigating health research regulation, we ought also to consider how best to communicate norms, while supporting decision-makers in the inevitable exercise of discretion. These concerns lead us to engage with two dominant RGA approaches in health research: rules-based and principles-based approaches. The next section considers these, placing an emphasis on principles-based approaches, which, I argue, can be especially helpful for complex regulatory landscapes.

17.3 Rules and Principles-Based Approaches

To understand what rules-based and principle-based approaches are, we should briefly define rules and principles. It may be more meaningful to talk of ‘rule and principle-type features’ than attempt to provide hard and fast definitions of rules and principles. These mean different things to different people in different contextsFootnote ⁷ and grey areas exist where differentiation based on any sole ‘typical’ characteristic is unhelpful. For instance, reliance upon high specificity of language as the identifying feature of rules is problematic because rules can be articulated in general terms. Conversely, principles are not always communicated through abstract language, despite frequently being described as such. Consider the Nuremberg Code 1947, the norms included within it, referred to as principles, are articulated through prescriptive language: ‘The experiment should be conducted only by scientifically qualified persons. The highest degree of skill and care should be required through all stages of the experiment of those who conduct or engage in the experiment’.Footnote ⁸ Another example is the CIOMS International Ethical Guidelines for Health-related Research Involving Humans, its content being collectively referred to as ‘rules and principles’. Upon closer inspection, it is unclear which of the guidelines are rules and which principles.Footnote ⁹ Given these definitional challenges, reference is made here to typical but not unequivocal features of rule and principle-like norms.

Rules are typically specific, prescriptive and fixed iterations of what to do.Footnote ¹⁰ They may be conceptualised in terms of rigidity, enforceability and whether they carry legal obligations. They can be characterised according to their pedigree or the manner in which they were adopted or developed.Footnote ¹¹ Examples include rules contained within the GDPR and the UK Data Protection Act 2018. According to legal theorist Alexy, ‘rules are norms which are always either fulfilled or not. If a rule validly applies, then the requirement is to do exactly what it says, neither more nor less. In this way rules contain fixed points in the field of the factually and legally possible’.Footnote ¹² Rules can be considered as norms that are applicable in an all-or-nothing fashion, i.e. barring an exception to a rule, they either apply to a scenario or they do not.Footnote ¹³ A rule-based approach (RBA) to regulation is dominated by such rule-like norms.

In contrast, principles are frequently characterised as high-level, general and abstract norms.Footnote ¹⁴ These may be ethical and/or legal, conceptualised as broad iterations of individual or sets of ethical values, such as those included within Beauchamp and Childress’ Four Principles (Principlism).Footnote ¹⁵ Accordingly, respect for beneficence and non-maleficence implies that health research should aim to provide benefit and to minimise foreseeable harm. The Four Principles are considered prima facie in nature, implying that they must be satisfied barring conflict between the principles. Within legal theory, it has been suggested that principles are optimisation requirements, i.e. norms that can be satisfied to varying degreesFootnote ¹⁶ as opposed to the ‘valid or not’ quality of rule-like norms. Principles can be articulated in more general and less legally enforceable terms but equally, breach of principles can lead to legal repercussions. For example, infringement of any of the seven principles included within the GDPR renders organisations subject to fines of up to €20 million or 4 per cent total worldwide annual turnover. Regardless of whether enshrined within legislative provisions or guidance documents, principles have the potential to shape behaviour within the health research setting, given the various commitments – legal, moral, political and other – to which they can give rise. A principle-based approach (PBA) is dominated by such principle-like norms.

Choosing to adopt a PBA dominant path in preference to RBA or vice versa carries important repercussions for health research landscapes and actors navigating them. The specific question of RBA v PBA received attention within the context of financial market regulation during the shift from RBA to PBA in the 1990s.Footnote ¹⁷ Different categories of PBA were identified, including full, polycentric,Footnote ¹⁸ formal and substantive.Footnote ¹⁹ Their commonality lies in a preference towards broad principle-like standards over detailed prescriptive and specific rules for setting standards of behaviour.Footnote ²⁰ In contrast, discussions within bioethics have centred on: (1) specific content of particular rules/principles; (2) how principles ought to be balanced against each other when conflict arises – including whether certain principles ought to take priority over others; (3) which particular rules/principles ought to be in/excluded from ethical frameworks; and (4) how to extract action-guiding content from abstract principles.Footnote ²¹

Within health research regulation more specifically, consideration of PBA in contrast to RBA has been more limited. Some contributions exist in the contexts of regulating the use of stem cellsFootnote ²² and health dataFootnote ²³ in health research. In those arenas, PBA has been preferred over RBA in recognition of the value of principles and limitations of rules but without concluding that approaches dominated by principles obviate the need for rules. Rules play pivotal roles in delineating ‘boundaries beyond which research ought not to stray and therefore over which society requires closer regulatory oversight’.Footnote ²⁴ Rule-like norms may provide certainty to decision-makers given their typically detailed and prescriptive nature. The value of hard and fast rules, particularly manifested via legislation is not under dispute. Rather, as will become apparent, I suggest that their rigidity can leave RBA-dominated frameworks ill-suited to the demands of complex regulatory landscapes, especially rapidly-evolving health research terrains. In contrast, PBA affords the flexibility fast-paced technological change often necessitates. Principles can create and leave space for interpretation and the exercise of discretion, essential when dealing with difficult decisions and ensuring applicability across a variety of contexts.Footnote ²⁵ The remainder of this section therefore focuses on PBA and, through exploration of several key functions principles can perform (often in contrast to rules), explains how they may be especially useful to health research regulation.

Principles can protect against over/under-inclusiveness of activities or subjects of regulation, in contrast to rules. Where specific and prescriptive rules are employed, there is a risk that by virtue of their rigidity, rules either fail to capture relevant activities within them, or are applied to activities that ought not to fall under their purview. It is impossible to legislate for every eventuality, particularly at the cutting edge of scientific research. Consider the proliferation of data-driven technologies that revealed the European Data Protection Directive 95/46/EC was no longer fit for purpose. Its replacement, the GDPR, seeks to better reflect the status quo viz potential data use and applications, albeit that ongoing and rapid developments in Artificial Intelligence (AI), computing and analytics are generating new regulatory concerns.Footnote ²⁶ The GDPR is, however, underpinned by seven high-level ‘principles’ to be factored-in to all interpretations of activities falling within its scope. These may have more longevity and reach than prescriptive rules because principles are less likely to be as detailed and technology-specific as rules tend to be. Of course, principles may also necessitate revision, for example to reflect changes in consensus around what the overarching principles ought to be, but they are more likely to outlast the technological changes that can frequently make prescriptively drafted rules obsolete.

A further strength of principles is their interpretive/guiding function, in communicating the spirit with which more specific norms – including rules – ought to be applied, especially where tensions exist within law, e.g. simultaneously restricting, banning and promoting behaviour. This function can be observed in the approach of the UK Human Fertilisation and Embryology Authority (HFEA). It includes within its Code of Practice a series of regulatory principles to be adhered to when licensed activities are carried out under the Human Fertilisation and Embryology Act 1990, as per S8(1(ca). For example, the first principle states licensed centres must ‘treat prospective and current patients and donors fairly, and ensure that all licensed activities are conducted in a non-discriminatory way’.Footnote ²⁷ Such overarching principles can guide and assist decision-makers in all of their related activities.

The paramountcy of stakeholder engagement is a strong theme within this volume.Footnote ²⁸ High-level principles can provide an effective dialogical tool for engagement with different stakeholders, enabling ongoing moral debate, and identifying interests and values at stake. As I argue elsewhere, PBA are more conducive to fostering meaningful dialogue because they avoid prescribing specifically (as rules often do), what ought to be done. Further, they ‘promote reflection precisely on this point … and in particular, they offer us the opportunity to lay out the core values which matter to us in the specific context. Rules, in contrast, can do the opposite, they can either prohibit something that might not be problematic or … grant licence where there is little’.Footnote ²⁹ The UK care.data debacle illustrates the danger of overreliance on rules and failure to effectively engage in discussion of core principles of concern to stakeholders.Footnote ³⁰

Relatedly, the legitimacy of RGAs that are not co-produced alongside individuals/groups affected by them is problematic. For example, dominant policy framings can tend to portray innovation per se in a positive light,Footnote ³¹ but some innovation is high risk. Appropriate frameworks must be developed as simultaneously responsive to potential value and dangers of innovation.Footnote ³² Key to this is explicit acknowledgement from the outset of the imperative to shape the trajectory of research and innovation alongside and for society. Lipworth and Rexler call for development of a bioethics of innovation, which necessitates dialogue and engagement with stakeholders. The framework for Responsible Research and InnovationFootnote ³³ advanced by Stilgoe and colleagues contains four ‘dimensions’ (anticipation, reflexivity, inclusion and responsiveness) that are akin to high-level principles and can serve as a helpful framing device through which to engage in dialogue. Indeed, as Devaney notes, PBA may have the capacity and potential to reflect, encompass and be facilitative of the process of innovation itself.Footnote ³⁴

In this section, I have laid out some key strengths of PBA, illustrating why they may be better suited to complex health research landscapes than RBA. The discussion now advances to consider an equally important aspect of developing appropriate RGAs: the need for additional tools to support decision-making.

17.4 Rules and Principles: Necessary but Not Sufficient

PBA and RBA have limitations and additional tools are necessary to guide decision-makers. For instance, resolving conflict between principles is challenging. Balancing, whereby each principle is assigned a weight, is a methodology through which it is suggested competing principles may be prioritised. However, balancing implies commensurability (that each principle can be assigned a weight),Footnote ³⁵ which is obviously problematic at a practical level. Further, balancing can give rise to subjectivism, decisionism and intuitionism where decision-makers justify weighting according to preconceived prejudices.Footnote ³⁶ For instance, Principlism has been criticised for prioritising respect for autonomy over other principles. Balancing is also a challenge for RBA: inter-rule conflict may equally arise as ‘[r]ules look more certain when they stand alone; uncertainty is crafted in the juxtaposition with other rules’.Footnote ³⁷ Conflict between competing norms may be inevitable and balancing requires both judgement and justification. Opting for one interpretation/resolution to a decision is only legitimate if it comes with well-reasoned and justifiable bases. Nonetheless, decision-makers require support in determining how to approach balancing. Likewise, concrete examples are required to elucidate how conflict between principles and rules ought to be addressed in practice.

Another criticism of high-level norms is that their abstract nature leaves too much interpretative space; extracting meaningful, action-guiding content becomes challenging. For instance, the Declaration of Helsinki states: ‘Groups that are underrepresented in medical research should be provided appropriate access to participation in research’.Footnote ³⁸ This does not suggest what ‘appropriate access’ entails. Even rules, – particularly when articulated broadly – are open to challenges of interpretative uncertainty, given the ‘open texture’ of language.Footnote ³⁹ Content included within rules/principles may be interpreted overly-cautiously in fear of potential regulatory repercussions, stifling important research which may actually be legally and ethically permissible, as has been the case in some data sharing contexts.Footnote ⁴⁰ Alternatively, interpretative latitude can leave room for creative compliance and exploitation of excessively abstract norms. Further, any potential certainty derived by RBA or PBA articulated in prescriptive language still necessitates shared understandings of the content – especially key terminology – of rules/principles and the overall objectives to be pursued, again suggesting the need for supplementary guidance to aid interpretation.

Theory-practice gaps and the need for context-sensitivity are also significant. Failure to adequately reflect the practical realities of conducting research ‘on the ground’ risks rendering norms ineffective. For instance, health research activities during global health emergencies have revealed disparities between what regulations demand and what is practically feasible or context-appropriate. Requirements to obtain timely ethical approval and adhere to randomised control trial protocols are not always possible/appropriate in time-sensitive settings and where proven therapeutics are lacking. Traditional distinctions between medical care/practice/treatment and research/innovation activities are blurred.Footnote ⁴¹ Discerning between practices primarily seeking to benefit the individual patient (treatment) and those aimed towards generating generalisable knowledge (research) is difficult, particularly regarding ‘innovative’ practices.

It is apparent from this discussion that rules and principles, while indispensable as regulatory tools, possess weaknesses that can limit their effectiveness in decision-making. As considered next, more is often required to support decision-makers, particularly in interpreting relevant norms, offering context-sensitivity and reflecting practical realities.

17.5 Supplementary Guidance and the Added Value of Best Practice

Additional supplementary guidance alongside RBA and PBA exists across many health research domains. This appears in myriad forms including: standards; guidelines; codes of practice; good practice; and, as will receive special attention below, best practice.

Clinical guidance in the form of guidelines proliferated from the 1970s onwards in the UK to achieve technical, procedural and administrative standardisation in medical practice and to maintain professional autonomy.Footnote ⁴² Good Clinical Practice Guidelines and evidence-based guidance from the National Institute for Health and Care Excellence are UK-based examples. Internationally, the World Health Organization (WHO) continually issues and updates guidelines on a variety of health topics, each designed to ensure the appropriate use of evidence in health policies and interventions, in accordance with the standards set out for guideline development.Footnote ⁴³

The role of guidance and its role in shaping health research practices also necessitates attention. Numerous international guidance documents exist, including the CIOMS Guidelines, which are supported by a ‘commentary’. Likewise, the fourteen guidelines included within WHO Guidance for Managing Ethical Issues in Infectious Disease Outbreaks are each accompanied by questions illustrating the scope of ethical issues and ‘a more detailed discussion that articulates the rights and obligations of relevant stakeholders’.Footnote ⁴⁴

Given that regulatory landscapes are frequently complex and pre-saturated with rules and principles (in their various forms), it is paramount that the introduction of supplementary guidance is approached with caution. Arguably, more guidance alone could suffer from the same criticisms as PBR and RBR; simply more norms requiring interpretation. Important considerations must be factored-in to the design and implementation of guidance to ensure its effectiveness. For example, the legitimacy of guidance is interlinked with the sources from which it has been generated and we must ask who this gives power to. As mentioned above, guidance may represent a means for actors to preserve autonomy and freedom from external interference/control. This raises questions of fairness, justice and transparency. Consider legal and ethical issues associated with current/anticipated uses of data and AI within health research. Concerns have been raised of technology firms developing their own guidance, facilitating creative compliance and self-regulation.Footnote ⁴⁵ Even where guidance is drafted by independent committees, diverse interests must be balanced. For example, in the contexts of Big Data and AI, trade-offs are apparent in the UK between protection of privacy rights of individual citizens and national ambitions of economic growth, international competitiveness and participation in the fourth industrial revolution.

Additionally, the form guidance takes carries important ramifications for legitimacy and uptake. Distinct categories of guidance exist, at times operating at different levels. Guidance comprises a broad category ranging from anecdotal to evidence-based guidelines. At the time of writing, COVID-19 is causing a global pandemic. As health systems around the world struggle to treat patients, a plethora of new guidance documents are emerging from multiple sources, based on varying degrees of evidence. These include guidelines to support decision-making around public health responses to containment and guidance to support frontline health workers in resource allocation. Where guidance diverges across different sources, challenges arise as to which guidance to follow and why. Due regard must be given to how guidelines interact with pre-existing regulation. Another important consideration is what the repercussions, if any, might be for non-observation of, or derogation from guidance.

Relatedly, this generates considerations around how compliance with guidance is to be measured, incentivised or even enforced. It also follows that fundamental questions arise around the processes involved in drafting, endorsing, disseminating and implementing guidance. Central to these, is the question of where public voices are in each of these processes, as considered elsewhere in this volume.Footnote ⁴⁶

I have argued previously that best practice (BP), a form of supplementary guidance, can be particularly helpful for decision-makers within health researchFootnote ⁴⁷ and in ways that are distinct from other forms of guidance. For example, BP, as co-produced through inclusive and consultative processes, can provide a platform for inclusion of public(s) and additional stakeholder perspectives.Footnote ⁴⁸

One example of such an approach can be viewed again in the context of AI. In recognition of the widespread development and adoption of AI applications, the European Commission has developed Guidelines for Trustworthy AI. The Commission has taken a phased approach to piloting these, including wide consultation with various stakeholders. It is notable that alongside the guidelines, explanatory notes are offered and the Commission has established a Community of Best Practices for Trustworthy AI.Footnote ⁴⁹ Through the European AI Alliance, registered participants could share their own best practices on achieving trustworthy AI.

Further, a recent report on the regulation and governance of health research lamented the ‘disconnect between those making high-level decisions on how regulations should be applied and those implementing them on the ground’.Footnote ⁵⁰ BP instantiations also offer concrete examples of principles or rules ‘in action’, based on lessons learned from those experienced in interpreting and applying the relevant norms. BP can thus serve an important function of helping to bridge such problematic policy-practice divides.

BP instantiations can also support decision-makers in interpreting relevant legislative provisions and/or ethical frameworks and related obligations. They provide more detailed explanatory notes on the legislative or normative intent behind overarching principles/rules. They provide a mechanism through which to make explicit to intended users of guidance what the status of such guidance is, and how it relates to pre-existing rules, principles and additionally relevant guidance. BP also guides decision-makers in approaching resolution of conflicting principles or rules, which I identified earlier as a key challenge for PBA and RBA.

Finally, I noted earlier that rules can close down conversations. BP also carries such risks; reference to BP may decontextualise and thwart discussion/use of other practices. Arguably, use of the term ‘best practice’ or ‘good practice’ suggests a superlative and that derogations from BP interpretations are suboptimal. But best practices (as construed here) are subject to constant review and revision, thus by definition, always seeking what is ‘best’ in a given context. In turn, in order to remain fit for purpose, best practices require us to constantly revisit the underlying rules/principles to which they correspond. In this regard they drive a symbiotic relationship between all of the norms in play towards an optimal system of regulatory and governance approaches.

17.6 Conclusion

In this chapter I have outlined key considerations in adopting rules, principles and supplementary guidance-based approaches to health research regulation. In particular, I have laid out the suitability of principles for guiding decision-makers across complex regulatory landscapes. I suggested that the introduction of supplementary guidance could tend to limitations of PBA and RBA. But, in turn, I stressed that generating new guidance must be approached with caution and due regard to additional concerns. Finally, I highlighted the added value that best practice – to be distinguished from other forms of supplementary guidance – can bring to complex regulatory landscapes.