Chapter 1
Where the rules of human-subjects research came from, what the principles behind them actually demand, and how WIA-BIO-018 tries to turn those principles into records a machine can check.
Every rule an ethics office enforces today has a history, and most of those histories begin with harm. Consent forms, independent review boards, extra protections for children and prisoners, the insistence that a study be scientifically sound before anyone is enrolled: each was written in response to research that injured people who had not agreed to it, did not understand it, or could not refuse it. This chapter traces that history, sets out the principles that grew out of it, and then shows how the WIA-BIO-018 standard (version 1.0.0, published 2025-12-26) attempts to express those principles as data structures, scores and validation rules.
The chapter is written for three kinds of reader at once. Staff in research-ethics offices will recognise the principles and want to know how faithfully the standard represents them. Engineers building eConsent, clinical-trial management or biobank software will want to know which principle each field and function is meant to serve. Researchers who must demonstrate compliance will want to know where a score can support their case and where only a human committee can decide. The last point runs through the whole book: WIA-BIO-018 offers decision aids, not verdicts.
Modern research ethics is usually dated from 1947. At the end of the so-called Doctors' Trial in Nuremberg, in which Nazi physicians were tried for experiments conducted on concentration-camp prisoners, the judgment set out ten principles for permissible medical experiments. The first of them states that the voluntary consent of the human subject is absolutely essential. The Nuremberg Code also required that experiments be designed to yield results unobtainable by other means, that unnecessary suffering be avoided, and that the subject be free to end participation. It had no enforcement mechanism of its own, but it fixed the idea that consent is the precondition of research rather than a courtesy.
The medical profession answered in its own voice in 1964, when the World Medical Association adopted the Declaration of Helsinki at its General Assembly in Helsinki. Where the Nuremberg Code reads like a legal judgment, the Declaration reads like a professional code: it addresses physicians, distinguishes research that may benefit the participant from research that may not, and introduces the requirement that a research protocol be reviewed by an independent committee before the study begins. The Declaration has been revised many times since; its most recent revision was adopted in October 2024 at the WMA's 75th General Assembly, again held in Helsinki. The WIA-BIO-018 specification cites the 2013 revision, which is now superseded, and this book refers to the 2024 text wherever the difference matters.
Codes of conduct did not prevent abuse in countries that had endorsed them. In the United States, the Public Health Service study of untreated syphilis in Black men in Macon County, Alabama, ran for four decades and continued even after penicillin had become standard treatment; it ended only after press reports in 1972. The public reaction led to the National Research Act of 1974, which created a national commission charged with identifying the basic ethical principles for research involving human subjects. Its answer, the Belmont Report, was published in 1979. Belmont is short, and deliberately so: it does not list rules but names three principles and the practical applications that follow from them. Those principles later underpinned the U.S. federal regulations for human-subjects research (45 CFR 46, the "Common Rule") and the FDA's parallel rules on consent and institutional review boards (21 CFR 50 and 56).
Principles framed in one country had to be adapted for research carried out across many. The Council for International Organizations of Medical Sciences (CIOMS), working with the World Health Organization, has issued international ethical guidelines since the 1980s; the current edition, the International Ethical Guidelines for Health-related Research Involving Humans, was published in 2016 and pays particular attention to research in low-resource settings, community engagement and the fair distribution of benefits. On the regulatory side, the International Council for Harmonisation's Good Clinical Practice guideline (ICH E6) sets the operational expectations for clinical trials; the specification cites E6(R2) from 2016, but the current version is E6(R3), adopted in January 2025.
| Year | Document | Origin | Lasting contribution |
|---|---|---|---|
| 1947 | Nuremberg Code | Judgment in the Doctors' Trial | Voluntary consent is essential; the subject may withdraw; research must be necessary and avoid needless suffering |
| 1964 | Declaration of Helsinki | World Medical Association | Physician-researcher duties; independent ethics-committee review; distinction between therapeutic and non-therapeutic research |
| 1979 | Belmont Report | U.S. National Commission (created by the National Research Act, 1974) | Three principles (respect for persons, beneficence, justice) and their applications (consent, risk-benefit assessment, subject selection) |
| 2016 | CIOMS International Ethical Guidelines | CIOMS in collaboration with WHO | Guidance for multinational and low-resource research; community engagement; benefit sharing |
| 2024 | Declaration of Helsinki, current revision | WMA 75th General Assembly | Supersedes the 2013 text cited in the specification |
| 2025 | ICH E6(R3) Good Clinical Practice | International Council for Harmonisation | Supersedes E6(R2) (2016) cited in the specification |
None of these documents is new, and WIA-BIO-018 does not claim to add new ethics. Its contribution is a different one: it tries to make the existing principles operational in software. Section 1.2 of the specification lists its scope as ethical principles and frameworks, informed-consent processes, IRB review and approval, protection of vulnerable populations, genetic-data privacy and governance, gene-editing ethical considerations, and compliance and monitoring. For each of these areas the standard defines records (a consent record, a risk-benefit analysis, an IRB submission, an adverse-event report, a gene-editing decision) and, in its TypeScript reference SDK, functions that validate or score them.
The practical value of this approach is auditability. When a regulator, sponsor or internal auditor asks whether a participant's consent was valid, an ethics office that stores only a signed PDF can answer "the form was signed". An office that stores a structured record can answer which version of the form was used, which disclosure elements it contained, how the participant scored on the comprehension check, whether decision-making capacity was assessed, and who witnessed the signature. The standard's job is to define what that structured record contains.
The specification frames its purpose with the phrase 弘益人間 (hongik ingan), usually rendered "benefit all humanity": biotechnology should advance human welfare while protecting individual rights, promoting justice and preserving the integrity of research. The phrase is a statement of intent rather than a technical requirement, but it is a useful reminder that the records defined later in this book exist to protect people, not to generate paperwork.
The Belmont Report is the most direct ancestor of the standard's structure, because it pairs each principle with a practice. Understanding that pairing is the quickest way to understand why the standard's records look the way they do.
Belmont's first principle has two parts: individuals should be treated as autonomous agents, and persons with diminished autonomy are entitled to protection. The two parts pull in different directions. Treating someone as autonomous means accepting their decision even when the researcher disagrees with it; protecting someone with diminished autonomy may mean overriding or supplementing their decision. The practical application Belmont derives from this principle is informed consent, analysed into three elements: information, comprehension and voluntariness.
WIA-BIO-018 takes those three elements and adds a fourth, competence (decision-making capacity), which Belmont treats as a condition of comprehension rather than a separate element. The standard's requirements under this principle are familiar ones: obtain consent before any research intervention, protect those with reduced autonomy such as children and cognitively impaired persons, allow withdrawal at any time without penalty, and respect privacy and confidentiality. In data terms, this principle is the reason the consent record carries not just a signature but a list of disclosure elements, a comprehension score, a capacity assessment and, where needed, a legally authorized representative (LAR) and a witness.
Belmont's second principle is framed as two complementary rules: do not harm, and maximise possible benefits while minimising possible harms. Its application is the systematic assessment of risks and benefits, which Belmont expects to be explicit rather than intuitive: the committee should be able to say what the risks are, how likely and how serious they are, and why the expected benefits justify them. The specification lists four categories of benefit (direct benefit to the participant, generalizable knowledge, societal benefit, scientific advancement) and four of risk (physical, psychological, social, economic). The SDK's RiskCategory type later extends the risk list with privacy and legal risk, which matter especially for genetic data.
The third principle asks who should bear the burdens of research and who should receive its benefits. Belmont's application is the selection of subjects: researchers should not recruit a group simply because it is easily available, compromised in its ability to refuse, or easy to manipulate, and a group that bears the risks of research should be among those who benefit from it. The Tuskegee study is the textbook violation: the burden fell entirely on poor Black men, and the benefit of available treatment was withheld from them. In the standard this principle drives the vulnerable-population rules and the justiceFactor that enters the risk-benefit calculation.
| Belmont principle | Belmont application | BIO-018 mechanism | SDK entry point (TypeScript reference) |
|---|---|---|---|
| Respect for persons | Informed consent | Ten disclosure elements, comprehension ≥ 80%, capacity assessment, LAR and witness rules (spec §3) | validateInformedConsent() |
| Beneficence | Assessment of risks and benefits | Risk and benefit records with probability and severity or magnitude; recommendation thresholds (spec §2.1.2, §8.2.2) | performRiskBenefitAnalysis(), assessEthicalRisk() |
| Justice | Selection of subjects | Vulnerable-population classification with enhanced protections; justice factor in the risk-benefit ratio (spec §2.1.3, §5) | assessEthicalRisk() (population multiplier), justiceFactor argument of performRiskBenefitAnalysis() |
| (Any principle, generic) | — | Evidence-and-concerns assessment of a single principle | assessEthicalPrinciple() |
The mapping is not one-to-one in practice. Risk assessment also serves justice, because the SDK raises the computed risk of any study that targets a population other than general adults; consent validation also serves beneficence, because a participant who does not understand the risks cannot help the investigator minimise them. The table shows where each principle is primarily enforced, which is where an auditor should look first.
Where Belmont names principles, the Declaration of Helsinki states duties. The specification (§2.2) summarises six of them, and each has a direct consequence for how a study is run and recorded.
The Declaration contains further provisions the specification does not summarise, among them strict conditions on the use of placebo when a proven intervention exists, registration of studies in a publicly accessible database before enrolment, and an obligation to publish results, including negative and inconclusive ones. The 2024 revision also shifted its wording from "subjects" to "participants", reflecting a view of the people in research as partners rather than objects of study. Implementers who draw on the Declaration should read the current text directly rather than rely on the specification's summary.
The same year Belmont was published, Tom Beauchamp and James Childress published the first edition of Principles of Biomedical Ethics, which set out four principles that have since become the common vocabulary of clinical ethics: autonomy, beneficence, non-maleficence and justice. Beauchamp had also worked on the Belmont Report, and the two frameworks overlap heavily, but they differ in emphasis. Belmont was written for research; the four pillars were written for medicine as a whole, including ordinary clinical care.
The specification (§2.3) lists what each pillar entails. Autonomy covers informed consent, truth-telling, confidentiality and respect for patient decisions. Beneficence covers providing benefits, promoting well-being, preventing harm and removing harm. Non-maleficence is summarised by primum non nocere ("first, do no harm"): avoid causing harm, minimise unavoidable harm, and keep harm proportionate to benefit. Justice covers fair allocation of resources, equitable access, non-discrimination and respect for rights.
Readers coming from Belmont sometimes ask why non-maleficence needs its own pillar when Belmont folds "do not harm" into beneficence. The distinction is about the kind of duty. Non-maleficence is a negative duty: it tells you what not to do, and it applies to everyone, all the time, whether or not you have any relationship with the person. Beneficence is a positive duty: it tells you to act for someone's good, and its demands depend on roles and relationships. The two duties are also weighed differently. Most ethicists hold that the duty not to injure is generally stricter than the duty to help, so that a researcher may decline to offer a possible benefit but may not impose a serious harm to obtain one.
For a system designer, this distinction explains why the standard treats some conditions as hard stops and others as trade-offs. A risk-benefit ratio is a beneficence calculation: benefits and harms are weighed against each other, and a large enough benefit can justify some risk. A prohibition such as the specification's rejection of germline enhancement is a non-maleficence rule: no amount of claimed benefit changes the outcome. Chapter 5 shows that the SDK's gene-editing decision tree mixes both kinds of rule, and knowing which is which makes the tree easier to audit.
The SDK represents the four pillars as an enumeration, and uses it to tag assessments made against a single principle:
// api/typescript/src/types.ts (excerpt)
export enum EthicalPrinciple {
AUTONOMY = 'autonomy',
BENEFICENCE = 'beneficence',
NON_MALEFICENCE = 'non-maleficence',
JUSTICE = 'justice',
}
export interface PrincipleAssessment {
principle: EthicalPrinciple;
score: number; // 0-1
evidence: string[]; // supporting evidence
concerns?: string[]; // concerns or violations
}
Note that the enumeration follows the four pillars, not Belmont. "Respect for persons" does not appear as a value; it is represented by AUTONOMY, which captures its first half but not the second (protection of those with diminished autonomy). That second half lives elsewhere in the standard, in the capacity and vulnerable-population rules. The function assessEthicalPrinciple(principle, evidence, concerns) fills a PrincipleAssessment by counting: each item of evidence adds 0.25 (capped at 1.0), each concern subtracts 0.2, and the result is clamped to the range 0–1. Because it counts entries rather than evaluating them, one strong piece of evidence scores lower than four weak ones. That is the first appearance of a theme the book returns to in Chapters 5 and 8: the numbers are bookkeeping aids and must be read with that limitation in mind.
The most distinctive feature of WIA-BIO-018 is its attempt to attach a formula to each Belmont principle. This section presents the three formulas in the specification, corrects the one that is mathematically broken, and works through an example. The formulas are the standard's own design choices. They are not established measures in the bioethics literature, and none of them replaces the deliberation of an ethics committee.
Section 2.1.1 of the specification defines an Autonomy Score from four factors, each rated from 0 to 1: Voluntary (free from coercion or undue influence), Information (adequate disclosure), Comprehension (understanding of what was disclosed) and Competence (capacity to decide). As printed, the formula is:
Autonomy Score = (Voluntary × Information × Comprehension × Competence) / 4 // as printed in §2.1.1 — defectiveThis formula cannot be used as written. The product of four numbers between 0 and 1 is itself at most 1, so dividing by 4 caps the score at 0.25. A participant who is perfectly informed, fully competent, completely free and understands everything would score 0.25, and no threshold on the usual 0–1 scale could ever be met. The division by 4 appears to have been carried over from an arithmetic mean. There are two coherent ways to repair it, and they express different ethical views:
V × I × C × Comp. A zero in any factor makes the score zero. This matches the traditional view that consent is invalid if any one element is missing: a perfectly informed but coerced participant has not consented.(V + I + C + Comp) / 4. A weak factor can be offset by strong ones. This is easier to interpret but allows a coerced participant to score well if the other factors are high.This book recommends the product form, because it reflects how consent actually works in law and ethics, and pairs it with minimum values for each factor rather than relying on a single aggregate. The specification already sets per-factor thresholds of this kind elsewhere: comprehension of at least 80% (§3.1.2), a voluntariness score of at least 0.95 (§3.1.3) and a capacity score of at least 0.75 for autonomous consent (§3.1.4). These, too, are thresholds chosen by the standard, not clinical or legal cut-offs.
For example, take a participant with V = 0.9, I = 0.9, C = 0.8 and Comp = 1.0. The printed formula gives 0.9 × 0.9 × 0.8 × 1.0 / 4 = 0.162, which is meaningless. The product form gives 0.648 and the mean gives 0.90. The gap between those two corrected readings is itself instructive: under the product form, several modest weaknesses compound, which is the behaviour one would want from a measure meant to signal when consent needs more attention.
Section 2.1.2 defines a benefit-risk ratio as expected benefits divided by the sum of potential risks and an "uncertainty factor". The specification does not define the uncertainty factor, so the formula cannot be computed as written. The SDK's performRiskBenefitAnalysis() implements a concrete version: it sums the scores of the benefit records, sums the scores of the risk records, divides the first by the second (using 0.1 as a floor for the denominator so that a study with no listed risks does not divide by zero), and multiplies the result by a justice factor between 0 and 1. Chapter 5 details the thresholds it applies to the adjusted ratio.
The project README gives a different formula, "(Expected Benefits − Potential Risks) × Justice Factor", which subtracts rather than divides. The two forms can disagree about whether a study is acceptable, and they have different units. This book follows the SDK's ratio form because it is the one that software built on the standard actually computes. The README's form should be treated as an informal description, not a second definition.
Section 2.1.3 defines the simplest of the three formulas:
Justice Score = 1 - |Population Risk Share - Population Benefit Share|For a given population, the risk share is the fraction of the study's burden it carries and the benefit share is the fraction of the expected benefit it will receive. When the two are equal the score is 1; the further apart they are, the lower the score, regardless of the direction of the imbalance. The specification does not say how to compute the shares or how to combine scores for several populations. The worked example below uses participant counts as a proxy for risk share and the expected proportion of future patients as a proxy for benefit share, and takes the minimum across populations so that one badly treated group cannot be averaged away. These choices are the book's illustration, not rules in the standard.
| Population | Share of enrolled participants (risk share) | Share of expected future patients (benefit share) | |difference| | Justice Score |
|---|---|---|---|---|
| Group A: recruited through a free clinic in a low-income district | 0.60 | 0.20 | 0.40 | 0.60 |
| Group B: recruited through private hospitals | 0.40 | 0.80 | 0.40 | 0.60 |
| Study-level score (minimum across populations) | 0.60 | |||
| Revised design: Group A | 0.35 | 0.30 | 0.05 | 0.95 |
| Revised design: Group B | 0.65 | 0.70 | 0.05 | 0.95 |
| Revised study-level score | 0.95 | |||
In the original design, the group recruited through the free clinic carries 60% of the burden but can expect only 20% of the benefit, perhaps because the drug under study is expected to be priced beyond its reach. The score of 0.60 flags exactly the pattern Belmont warned about: recruiting a population because it is convenient, not because the research concerns it. The revision rebalances recruitment and, in a real protocol, would also add a post-trial access plan, raising the score to 0.95.
The specification does not connect the Justice Score to the SDK's justiceFactor, but the two are plainly meant to express the same idea. A reasonable practice, and the one this book adopts in later examples, is to record the Justice Score computed as above and pass it as the justiceFactor argument. Because performRiskBenefitAnalysis() requires a justice factor of at least 0.8 before it will return an approving recommendation, the original design in Table 1-3 would be held back however favourable its risk-benefit ratio. Whether that is the right result is a judgment for the committee; the score's job is to make sure the question is asked.
Every number in this section depends on choices someone made: how to rate "voluntariness" on a 0–1 scale, which risks to list, what counts as a population's share of benefit. Two careful analysts can produce different scores for the same protocol. The scores are useful because they force those choices to be written down and make them comparable between protocols and over time. They are dangerous when they are treated as the decision itself. A BIO-018 system should always record the human decision separately from the computed score, and record the reason whenever the two differ.
Section 1.4 of the specification defines a short list of terms that recur throughout the standard. The definitions below expand them with the context an implementer needs; later chapters add terms as they arise.
The book follows the structure of the specification but reorders it for practitioners: first the ethics, then the data model and software, then the processes and systems built on them. The table below shows which part of the standard each chapter covers.
| Chapter | Topic | Main sources in WIA-BIO-018 | What the reader can do afterwards |
|---|---|---|---|
| 1 | Foundations of bioethics: principles and history | Spec §1, §2, §10.1 | Explain which principle each BIO-018 mechanism serves and interpret the principle scores critically |
| 2 | Consent, review and vulnerable populations | Spec §3–§5 | Apply the consent elements, capacity bands, IRB review levels and population-specific protections |
| 3 | Ethics of genomic data and gene editing | Spec §6, §7, Appendix A.1 | Classify data protection levels, handle incidental findings, and reason through somatic and germline proposals |
| 4 | The WIA-BIO-018 data model | Spec §8.3; types.ts | Model a consent record and the related risk, genomic and safety records |
| 5 | The SDK and CLI: API reference | Spec §8.2, §8.4; index.ts; CLI | Call the validation and scoring functions, handle error codes E001–E010, and work around known SDK defects |
| 6 | The ethics review protocol | Spec §3.2, §4.3–§4.5, §9 | Route a protocol to the right review level and run consent, adverse-event and continuing-review processes |
| 7 | Implementing and integrating a BIO-018 system | Spec §8.1, §6.1, §10.2–§10.3 | Design the six required components, an audit trail, and mappings to regulations and other systems |
| 8 | Conformance, audit and the future of bioethics | Spec §8.1, §9, Appendix A.2 | Test a system for conformance, conduct audits, and recognise where human judgment must take over |
Two conventions apply throughout. First, code identifiers such as validateInformedConsent, full-board or E001 are given exactly as they appear in the reference implementation, so that readers can search for them. Second, where the specification, its README and the SDK disagree, the book says so, explains which source it follows and why, and flags any number that is a design choice of the standard rather than an established regulatory or scientific value. Readers who implement the standard should expect to make the same kind of judgment calls, and to document them.
Key points of this chapter
validateInformedConsent(), performRiskBenefitAnalysis() and assessEthicalRisk().