Most internal medicine physicians assume that when they sit for a board examination, their answers determine one thing: whether they pass. Few realize that their exam performance has been linked to federal Medicare claims data and used in research, without their knowledge or consent.
The American Board of Internal Medicine (ABIM) has published studies linking board scores to clinical outcomes derived from Medicare claims. ABIM presents these analyses as quality research demonstrating the value of certification. The research question may be legitimate. The regulatory structure supporting it is not.
Two issues demand scrutiny: the erosion of independent oversight and the improper reliance on waiver of informed consent under the Common Rule.
When the investigator, funder, and promoter are the same
ABIM occupies multiple roles at once. It administers the examination. It controls the performance data. It funds and conducts the research. It promotes the findings publicly. And it attests that the research complies with federal regulations.
I raised concerns about this structure with the Advarra Institutional Review Board. The IRB responded by deferring to the investigators’ attestation that the research met the Common Rule criteria for waiver of informed consent.
That response reveals the governance problem.
Institutional Review Boards exist to provide independent oversight. They evaluate risk, practicability, and subject protections. When oversight relies primarily on investigator assurances, especially in research that advances the institution’s own product, independence becomes procedural rather than substantive.
History demonstrates why independence matters. In the Tuskegee Syphilis Study, investigators rationalized unacceptable risk. In the Willowbrook hepatitis experiments, institutional structures failed to protect vulnerable children. Decades later, controversy surrounding the SUPPORT trial centered on whether foreseeable risks were adequately disclosed.
These cases differ profoundly in magnitude from ABIM’s research. The lesson is structural, not comparative. Institutions tend to underestimate risk when their mission or reputation intertwines with the research itself. That is precisely why oversight must interrogate, not defer.
The ethical issues: autonomy, risk, and power imbalance
ABIM’s examination research raises three core ethical concerns.
Autonomy. Physicians were not asked for consent before ABIM linked their examination performance to Medicare claims data for research. Respect for persons requires informed consent unless specific regulatory criteria justify a waiver. Physicians remain human subjects when their identifiable professional data are repurposed for research. Professional status does not eliminate the right to autonomy.
Risk. Board performance is not trivial. Certification status influences credentialing, employment, payer participation, and public perception. ABIM communications describe a “straight line” between examination scores and patient outcomes, suggesting that 50 percent of internists fall below the median in hospital mortality outcomes. When research stratifies physicians by performance and correlates scores with outcomes, it creates foreseeable reputational and professional consequences, even if individuals are not publicly named. Minimal risk cannot be presumed simply because the subjects are physicians.
Power imbalance. Board certification functions as a practical necessity in many clinical settings. When the certifying body conducts research using diplomates’ data without consent, participation cannot be meaningfully voluntary. The structural relationship matters when evaluating whether subjects’ rights and welfare are affected.
Why this research does not qualify as exempt
The Common Rule permits certain educational testing research to qualify as exempt if investigators record data so that subjects cannot be identified, directly or through linked identifiers.
That exemption is narrow.
When ABIM combines examination performance with National Provider Identifier (NPI) data and links those data to Medicare claims from the Centers for Medicare & Medicaid Services, the research involves identifiable information. The dataset necessarily allows linkage at the individual physician level, even if publications report aggregate findings.
Once identifiable performance data are combined with external datasets, the educational testing exemption no longer applies. This becomes human subjects research involving identifiable secondary data.
If this is secondary data analysis, waiver is not justified
If ABIM characterizes the work as secondary analysis of existing data, it must satisfy all four criteria for waiver of informed consent under the Common Rule:
- The research involves no more than minimal risk;
- The waiver does not adversely affect subjects’ rights and welfare;
- The research could not practicably be carried out without the waiver; and
- When appropriate, subjects receive additional pertinent information.
The most problematic criterion here is practicability.
ABIM requires diplomates to maintain active engagement through a secure online portal for certification status and fees. Contacting physicians electronically is routine. A portal notification explaining the research, risks, and an opportunity to opt out would be straightforward.
Waiver exists for circumstances in which contacting subjects is genuinely infeasible, such as decades-old datasets without viable contact mechanisms. Waiver does not exist to avoid administrative inconvenience or to preserve statistical completeness.
Moreover, physicians did not receive direct notification after ABIM used their data, nor were they given a meaningful opportunity to withdraw. Respect for persons does not disappear in secondary data research. When consent is feasible, regulators do not intend waiver to replace it.
Why this matters
Certification organizations hold significant power in medicine. Their legitimacy depends on trust. Linking examination performance to outcomes research may be a valid scholarly endeavor. But method matters as much as question.
When the same organization acts as data steward, researcher, promoter, and attestor of compliance, and when oversight defers to investigator assurance, the appearance of independence weakens. Regulatory standards exist to prevent precisely this type of structural conflict.
Research ethics evolved because institutions historically misjudged risk when evaluating their own work. The Common Rule reflects those lessons. Waiver of informed consent is an exception, not a convenience. Exemptions are narrow by design.
Physicians ask patients to trust research every day. Our professional institutions should meet the same regulatory and ethical standard.
Independence is not a technicality. It is the foundation of trust.
Actions internal medicine physicians and subspecialists can take
Contact ABIM and request removal of your data from its research database. Recent experience suggests this process may take several weeks and requires persistence.
Contact the Advarra IRB Office of Research Subject Protection and request review of the waiver of informed consent determination.
Engage colleagues and professional societies in discussion about physician autonomy and regulatory compliance in certification-related research.
Collective engagement may encourage ABIM to align its research practices with both the letter and the spirit of federal human subjects protections.
James Rudolph is a geriatrician.
