From laboratory to hospital: rethinking the rules for medical research

Last updated 25 September 2026

NSW Health has been reviewing its policies on ethical and scientific review and site authorisation for research. I made submissions on both directives (↓ Read the submissions).

However, there is more to be said about the broader context in which these reform efforts occur, especially where several layers of rules — many of them not under review — affect what the proposed changes can achieve. This post brings together some of my thoughts on hospital–university research, the Commonwealth regulation of cellular therapies, and how research oversight might adapt to new treatments and technologies.

Having worked on the regulation of cellular therapies, potential cellular treatments, and other novel medicines, including psychedelics, for many years, I am particularly interested in what this review could mean for hospitals and university laboratories working together to develop new treatments. Such collaborations must navigate both state laws and research procedures — including privacy requirements, ethics review and site authorisation — and longstanding Commonwealth rules, such as those governing biological products in the case of cellular therapies.

Could changes to NSW policy make collaborative research easier to organise while preserving rigorous oversight? Where Commonwealth law limits the arrangements available to hospitals and laboratories, should it also change? To illustrate, let’s consider a personalised cancer vaccine — a concrete example of some of the issues at stake.

A vaccine made for one patient’s cancer

Imagine a vaccine designed to help a patient’s immune system recognise and attack their cancer. A tumour removed during surgery could supply material for the vaccine, while immune cells collected from the patient’s blood would be prepared in a university laboratory. The finished vaccine would then travel to the clinical team for administration to that same patient.

In a 2019 study of MyDendrix, researchers at Masaryk University in Brno, Czechia, manufactured personalised cancer vaccines in the Department of Pharmacology’s cleanrooms. They cultured monocytes — a type of white blood cell — and guided them to develop into dendritic cells. They exposed those cells to what is called a tumour lysate: material prepared by breaking down tissue from the patient’s tumour. The aim was to prime the dendritic cells to stimulate an immune response against the cancer.

The vaccine remained experimental: this was an early, non-randomised phase I/II trial.¹

After manufacturing and quality checks, the researchers froze the vaccine doses. On treatment days, a dose was shipped on dry ice, thawed and injected into the patient’s skin. This was an experimental autologous treatment: the tumour material and immune cells came from the same person who would receive the vaccine. The cells grown in the laboratory were the patient’s own immune cells; the method did not require the tumour cells themselves to be grown in culture.

Related work is also underway at UCLA, where researchers manufacture personalised dendritic-cell vaccines for patients with relapsed glioblastoma. Glioblastoma is a form of brain cancer. Both examples connect specialist cell manufacture in laboratories with patient care in hospitals.

How would Australian law apply to this arrangement? Who may authorise each institution’s work, and does manufacture in a separate university laboratory change the regulatory pathway, even though the product is intended for one patient under continuing clinical care?

Commonwealth regulation and the hospital exclusion

In practice, Australian clinical and healthcare activity is regulated at both state and Commonwealth levels. The Commonwealth has no general constitutional power over health care, but it has specific powers relevant to health, including the benefits and services power in s 51(xxiiiA). One Commonwealth law likely relevant to any proposed treatment of this kind is the Therapeutic Goods Act 1989 (Cth). The Act draws on several constitutional powers.² It regulates medicines and other therapeutic goods and is administered by Australia’s Therapeutic Goods Administration (TGA).

Until 2018, item 4(q) of the Excluded Goods Order No 1 of 2011 excluded autologous cell and tissue products made by, or under the supervision of, the patient’s treating medical practitioner, wherever they were made. In 2018 the Commonwealth remade that exclusion. It kept the requirement of clinical care and professional supervision, added a prohibition on advertising to consumers, and confined manufacture to a hospital. In its explanation, the TGA stated that hospital oversight and professional regulation could provide sufficient safeguards in those circumstances, making additional product regulation unnecessarily burdensome. The conditions were amended in 2019 to allow storage and testing outside the hospital under contract with the hospital.

For the vaccine described above, the proposed manufacturing and supply arrangements determine which Commonwealth pathway is available. A product that does not qualify for the exclusion remains subject to the applicable requirements of the Act and Therapeutic Goods Regulations 1990. Researchers using an unapproved product always need a lawful supply pathway.

When the hospital exclusion applies

The hospital exclusion appears in item 4A of the Excluded Goods Determination. In broad terms, the cells or tissue must come from a patient under the clinical care of a registered medical or dental practitioner. That practitioner, or someone working under their professional supervision, must manufacture the product in a hospital for that hospital’s patient. Storage and testing may occur outside the hospital under contract with it. Advertising the product directly to consumers disqualifies the practitioner or hospital from relying on the exclusion for that product. If these conditions are satisfied, the product is excluded from the Act altogether.

This means that manufacturers of products qualifying for exclusion do not need to seek TGA assessment for inclusion of the product in the Australian Register of Therapeutic Goods (ARTG). They can supply it for the particular hospital patient whose cells were used. Of course, the exclusion does not authorise supply to an open market.

The TGA’s guidance explains that extensive processing alone does not rule out the exclusion. For an Australian collaboration following this method, a difficulty may arise, however, if an independent university laboratory cultures and prepares the immune cells outside the hospital. That’s because item 4A allows only storage and testing to be done offsite under contract with the hospital. Unless the laboratory legally forms part of the hospital — a question whose limits remain to be tested — another Commonwealth pathway would be needed.

The ‘minimal manipulation’ exemption

A separate exemption, which I will call the ‘minimal manipulation’ exemption, does permit cells to be manufactured outside a hospital and returned there afterwards. Under Schedule 5A, item 13 and Schedule 7, item 21 of the Therapeutic Goods Regulations 1990 (Cth), qualifying autologous products are exempt from specified product and manufacturing requirements. The difficulty for the collaboration described above is that the cells must be only minimally manipulated and put to a ‘homologous use’ in the same patient, for a single indication in a single clinical procedure. Manufacture and use must also be by or under the relevant practitioner’s professional supervision. This is a partial exemption, not a removal from the Act altogether.

Processing the cells and using them

The TGA’s guidance on minimal manipulation, published in 2018, focuses on whether processing alters characteristics or functions relevant to the product’s intended use. Its example of separating cells from fat tissue explains why breaking cell-to-cell contacts can amount to more than minimal manipulation: isolation may change the cells’ activation state or expression of surface molecules, with significant effects on their characteristics or functions. The guidance also identifies cell culture and differentiation in the laboratory as processes usually exceeding the limit. Culturing monocytes and differentiating them into dendritic cells, as in the Masaryk vaccine, would therefore ordinarily prevent reliance on this exemption.

Homologous use asks a different question: will the cells perform the same basic function in the recipient as they performed in the donor? It does not necessarily require use in the same anatomical location. For the immune cells in this example, the relevant functions include recognising and responding to foreign material; dendritic cells present antigens to other immune cells, helping to direct an immune response. Using them to stimulate a response against cancer is therefore not self-evidently non-homologous. That would require a product-specific assessment of the original cells, their intended function and the supporting evidence. The clearer obstacle here is the manufacturing process: even if the use were homologous, the requirement for minimal manipulation would still have to be met.

The limits of comparable regulatory exceptions have also been contested in the United States.³

Other pathways for trials and individual treatment

There are other pathways for supplying unapproved biologicals to patients. Clinical trials can proceed through the Clinical Trial Notification (CTN) or Clinical Trial Approval (CTA) schemes. CTA is generally mandatory for Class 4 biologicals, subject to specified exceptions; CTN is available for other cell therapies where its requirements are met. The Special Access Scheme (SAS) provides access for an individual patient on a case-by-case basis. It is not a substitute for a clinical trial pathway when the purpose is to conduct research; its purpose is clinical care.

The classification of any cellular product — including a cancer vaccine — is also crucial. The TGA expressly distinguishes tumour-antigen-pulsed dendritic cells from Class 4 biologicals where antigen uptake uses the cells’ normal processes and does not artificially introduce a new function. A cultured dendritic-cell vaccine of that kind would generally fall within Class 3 because of its processing, subject to its precise composition and method of manufacture. CTN may therefore be available for the trial we have described, although the sponsor would need to establish the product’s classification and meet the scheme’s requirements.

These latter pathways do not depend on treating the university laboratory as part of the hospital. They may therefore allow a collaboration to proceed within TGA regulation, provided the applicable supply, manufacturing and other requirements are met. The issue, therefore, is which regulatory pathway fits the work and what each institution must do under it.

Should the hospital exclusion extend to research?

The hospital exclusion is framed around the clinical care of an individual patient. Conducting systematic research under it would appear to fall outside its purpose, although not its terms: item 4A turns on how and where the product is made and for whom, rather than on why it is administered. The 2018 Explanatory Statement describes these products as having sat outside TGA oversight because they were ‘an extension of medical practice’.

In practice the line between clinical care and investigation is porous. The hospital exclusion replaced an earlier version of the same rule, which applied from 2011 to 2018. That earlier exclusion, item 4(q) of the Therapeutic Goods (Excluded Goods) Order No 1 of 2011, covered products made from a patient’s own cells by, or under the supervision of, their treating doctor, wherever the work was done. It had no hospital requirement and no ban on advertising. In the early 2010s, clinics in New South Wales relied on it to supply unproven stem cell procedures as clinical care, marketed commercially and outside any clinical trial. One such clinic processed patients’ fat tissue in its own laboratory and described the procedure in its consent form as ‘innovative or experimental’, citing its own three-year ‘safety survey’. Following the death of one patient in 2013, the Deputy State Coroner found (in 2016) that the procedure ‘could in no way be classified as a clinical trial’ and had ‘some of the troubling hallmarks of “quack” medicine.’ A tribunal later made findings of professional misconduct against the practitioner.

The Coroner recommended that the TGA consider how to regulate such procedures, without noting why it had not already done so. The reason was that the earlier exclusion, like the current one, placed the product outside the Act. In 2014 a group including the same practitioner registered a 64-participant randomised trial of a similar product. The registry records that ethics approval was not obtained and the trial was withdrawn. The treatments themselves had required no such approval. Nor would they now. The 2018 reform followed years of concern about clinics of this kind. It would require such a clinic to be a declared hospital and to stop advertising to consumers, but the procedure would still count as clinical care under the exclusion. Whether the hospital condition adds much is a question I take up below.

The United States draws the line differently. Its same-surgical-procedure exception applies only where tissue is removed from a person and implanted in the same person during the same surgical procedure, in essentially its original form. It was designed for ordinary surgery and premised on the idea that tissue re-implanted in its original form raises no risks beyond those of surgery generally.

Products outside that exception may still qualify for a separate pathway for minimally manipulated products intended for homologous use, subject to further criteria. They remain subject to federal tissue regulation but do not require premarket approval under that pathway. Unlike Australia’s minimal-manipulation exemption, this US pathway does not generally require a single clinical procedure. Products outside both US routes are regulated as drugs, devices or biological products, as applicable. For investigational drugs and biologics, an Investigational New Drug (IND) application must be in effect unless the study is exempt. The Australian hospital exclusion has no express requirement for minimal manipulation, homologous use or a single clinical procedure. A heavily processed product can remain excluded. Whether an Australian court would read item 4A purposively to confine it to clinical care is untested.

In any event, the clinical trial schemes do not overlap with this exclusion. A product that satisfies the exclusion is not a therapeutic good under the Act, so the TGA cannot require a CTN or CTA for a study that uses it. The hospital’s ethics and governance processes remain central, alongside other applicable legal and professional requirements. A team conducting the proposed vaccine trial whose product falls outside the exclusion because a university laboratory makes it must instead meet the requirements of an applicable trial pathway. That gap is a reason to take care in how the exclusion is reformed. My argument below is that the exclusion should extend to manufacture by a partner laboratory under equivalent oversight. The same reform could make clear that the exclusion is for clinical care, and that a systematic study of a product’s safety or efficacy would run through the CTN or CTA schemes, regardless of where the product is made.

Should the hospital boundary determine the rules?

These Commonwealth provisions reveal a tension between the regulatory model and the ambitious direction of health and research policy in NSW. Governments encourage hospitals and universities to combine their expertise in developing new treatments. Yet the hospital exclusion still depends on keeping manufacture within the hospital, apart from storage and testing. If hospital oversight can justify allowing extensive processing to occur there, why should comparable oversight not be possible when a partner laboratory — at a highly regulated institution such as a university — undertakes that work less than a kilometre down the road?

What counts as a hospital?

The TGA’s explanation of hospital manufacture points to the Commonwealth’s declared-hospital system. Its statutory basis lies in s 121–5(5)–(6) of the Private Health Insurance Act 2007 (Cth): a hospital is a facility for which a ministerial declaration is in force. The Department’s declaration process requires state or territory confirmation for public hospitals and a hospital licence for private hospitals, together with accreditation evidence or evidence of an application for accreditation. It does not require overnight beds or an ethics committee.

This category therefore includes day hospitals and specialist clinics as well as large institutions with overnight wards. The Department’s list, dated 28 August 2026, includes Sydney Day Hospital and Sydney Clinic for Gastrointestinal Diseases, both classified as providing hospital treatment for no more than 24 hours. Likewise the Commonwealth’s list for August 2017, the last before the reform, records 326 private same-day facilities, 102 of them in New South Wales, among them cosmetic surgery and dermatology clinics.

Recall that the hospital condition was the principal addition to the older exclusion. Its evident aim was to keep manufacture within institutions that carry clinical governance, accreditation and the other safeguards associated with a hospital. The condition, however, does less than that. A day clinic with a single procedure room and its own laboratory (that is, the model described above) could still make and administer a cell product to its patients under the current item 4A if it were a declared same-day facility and did not advertise to consumers. To that extent, the condition does not address the practice it sought to reform.

However, what the condition has done, perhaps unintentionally, is ensure that a major teaching hospital, with an ethics committee and a research governance office, cannot rely on the exclusion for the same product if a partner university laboratory manufactures it, even under joint oversight. There is an irony in that result. A condition added in response to unsupervised practice seems unlikely to prevent its recurrence, yet it restricts the partnerships best placed to supervise the work.

Of course, neither size nor a university partnership guarantees safety. But the current rule appears better suited to a model in which manufacture and care occur within one institution than to the shared facilities and expertise that current policy promotes. That is a reason to reconsider whether the hospital condition is fit for purpose, and whether the rules should attend instead to oversight of the work — wherever it is done.

Reforming the manufacturing boundary

For a hospital–university collaboration, one question is whether shared manufacturing premises could legally form part of the hospital. Could a research laboratory be brought within the hospital exclusion by calling it a hospital? Proximity, shared branding and a collaboration agreement would presumably not be enough: the institutions would need to establish whether the premises formed part of a declared hospital or required a separate declaration. The better argument is for reform of the exclusion, removing the in-hospital manufacturing requirement where a partner facility can demonstrate equivalent safeguards, including oversight of manufacture and continuing clinical responsibility. The exclusion already requires professional supervision. Reform would allow that supervision to extend across institutional boundaries, as the ‘minimal manipulation’ exemption permits, without confining the work to minimally manipulated products. A NSW umbrella agreement could allocate responsibilities between the institutions involved in collaborative clinical care and research, but it could not change the Commonwealth rule.

How institutions collaborate in Australia and overseas

Several Sydney collaborations bring these issues into immediate view. The Kolling Institute, on the Royal North Shore Hospital campus, is a joint venture between the University of Sydney and Northern Sydney Local Health District. At the Randwick Health & Innovation Precinct, UNSW works with health-sector partners to connect university research with hospital care. The planned Sydney Biomedical Accelerator, spanning the University of Sydney and Royal Prince Alfred Hospital campuses, is another example.

Melbourne offers a comparable example. The Melbourne Biomedical Precinct in Parkville brings the University of Melbourne together with major hospitals and research institutes. The Doherty Institute, for example, is a joint venture between the University and Royal Melbourne Hospital, combining research, teaching, public-health and clinical expertise. These relationships raise similar practical questions about how institutions share work and responsibility, although the NSW procedures discussed here do not govern Victorian institutions.

The NSW Government’s materials on Tech Central, which extends into Camperdown, show its commitment to this kind of collaboration. In announcing the district’s Economic Development Strategy in September 2025, the Government placed collaboration between industry, universities and government at the centre of its plans. It also committed an initial $5 million to investment attraction and establishing a governance structure for the district. Discussions of research and investment, the public interest and economic prosperity should also attend to the regulatory hurdles these collaborations face. NSW Health’s review offers an opportunity to examine state research procedures alongside Commonwealth laws that already accommodate clinical care and innovation, and to identify where reform of either may be needed.

Overseas laboratory–hospital partnerships

UCLA’s Center for Advanced Biotherapies, whose vaccine work was mentioned earlier, provides another example. Its manufacturing facilities sit close to the university’s hospitals and clinics, allowing some products to reach patients on the day they are released. The advantage of proximity is practical: the work can move between specialists and facilities without a long journey. It does not eliminate the need to establish responsibility at each handover.

Other overseas institutions have organised comparable collaborations in different ways. The Karolinska ATMP Center brings Karolinska Institutet and Karolinska University Hospital together to develop, manufacture and use cell, gene and tissue therapies. Its Vecura facility supports small-scale manufacture for clinical trials. London’s Francis Crick Institute, a partnership of six research organisations, offers another example of institutions organising discovery research together. We can learn from these arrangements without assuming that their premises or products would qualify for the Australian hospital exclusion, or that their approval rules are equivalent to ours.

For a hospital and a university laboratory to work together, they need more than connected databases. Hospital staff must be able to read the laboratory’s manufacturing record, understand what has been checked and identify who may authorise the next step. The clinical team needs to know exactly what the participant will receive.

Two permissions for hospital research

Who, then, gives permission for the research? An ethics committee assesses the study’s scientific and ethical merits. Through site authorisation, the hospital decides whether it can provide the staff and facilities and accept responsibility for its part in the work. A favourable ethics review does not, by itself, commit the hospital to taking part.

NSW Health has been consulting on reforms to the two policy directives that govern these processes: PD2010_055, on ethical and scientific review, and PD2010_056, on site authorisation. Both date from 2010. The site-authorisation directive still refers to an earlier online forms system and the 2007 National Statement, although researchers now use the Research Ethics and Governance Information System (REGIS) and a new version of the National Statement published in 2025. Researchers must read the old directive alongside the new guidance, which is not unusual.

But the changes extend beyond forms and references. Hospitals now assess research using methods that were new, or had not been developed, when the directives were written. Researchers first reported human induced pluripotent stem cells (iPSCs) in 2007. In 2012, researchers demonstrated programmable CRISPR-Cas9 DNA cutting, helping establish a new approach to genome editing. To investigate treatments based on these technologies, a hospital may need to collect cells, a specialist laboratory to process them, and a clinical team to care for the patient as the work moves between institutions.

What does an ethics committee do?

A Human Research Ethics Committee, or HREC (called an Institutional Review Board, or IRB, in the United States) examines how researchers have designed a study, what risks and possible benefits participants face, how participants will consent, and what will happen to their information. In Australia, the National Statement on Ethical Conduct in Human Research, published in its latest edition in 2025, guides the committee, which must be satisfied that the study justifies involving people and that the researchers will protect them.

A poorly designed study may expose participants to risk or inconvenience without a reasonable prospect of producing useful knowledge. Scientific quality is therefore part of the ethical judgment.

The need for independent scrutiny

The need for independent scrutiny is evident in the Nazi experiments prosecuted at Nuremberg, the withholding of treatment at Tuskegee, and the treatment of women with cervical abnormalities at Auckland’s National Women’s Hospital, condemned by the 1988 Cartwright Report. Australia’s Chelmsford scandal concerned harmful clinical care rather than a conventional research trial, but reinforces the same point: patients need protection beyond a doctor’s own judgment.

The official history of Australia’s research ethics committee system shows that it arose not as a consequence of any particular scandal but as part of the global movement to ethical research. In 1966, the National Health and Medical Research Council issued a Statement on Human Experimentation that drew on the World Medical Association’s Declaration of Helsinki, adopted two years earlier. In 1976, NHMRC made review by an institutional ethics committee an express requirement. In 1985, it made institutional compliance a condition of eligibility for research funding. As NHMRC’s history explains, the prospect of losing access to funding encouraged institutions to establish committees.

How much ethics review is needed?

The extent of review should depend on what participants are being asked to do. A short, anonymous questionnaire about a routine service may warrant a different process from a trial of a new treatment. For suitable lower risk projects, institutions can authorise review outside the full HREC. The NSW directive calls its lower risk pathway ‘expedited review’; the current application guide also describes review outside the full committee system.

Even a questionnaire can raise serious concerns if the questions are sensitive or people feel obliged to answer them. Some research, however, may be exempt from ethics review. The 2010 directive gives the example of research using existing, non-identifiable records where any foreseeable burden amounts to no more than inconvenience. Researchers must consult the HREC Executive Officer to confirm an exemption. Calling a project a ‘questionnaire’ or ‘records study’ does not determine which process applies.

Sometimes researchers first need to establish whether their work counts as human research at all. In a recent article, Cameron Stewart, George Tomossy, Ian Kerridge and I argued that an expansive reading of the rules should not bring the analysis of publicly available legal materials within HREC review. Our concern was that extending review to this work would take the committee system beyond its proper purpose.

What is SSA, and how is it different?

A ‘site specific assessment’, or SSA, helps an institution decide whether it can support a project at a particular site. Does the site have the staff, facilities, departmental support and funding? Are the contracts and insurance in place? A Research Governance Officer assesses the application, and the organisation’s Chief Executive or a documented delegate authorises the work. If the hospital will only help an outside team gain access to participants, tissue or information, a separate ‘access request’ may be appropriate. NSW Health explains these arrangements here. The choice depends on the hospital’s role in the project.

NSW separated the two decisions to reduce duplication. Its 2007 policies paired a single ethical and scientific review of multicentre research with an assessment at each site. Writing in the NSW Public Health Bulletin in 2008, Geoffrey Bloom and Deborah Frew explained the division: a lead HREC would review the ethics, while an officer accountable to the host institution would examine local resources, policies and researchers’ capabilities. The 2010 procedures continued that division of responsibility. Repeating the lead committee’s assessment at each site would undermine its purpose.

Applying for ethics and site approval together

Researchers use REGIS to register a study, submit applications, answer requests for changes and, later, lodge amendments and reports. NSW Health’s project roadmap explains the steps. Registering a study starts the process; it does not give permission to begin the research.

Researchers can already submit their ethics and governance applications in parallel. The NSW Health guidance does not require them to finish ethics review before submitting an SSA application. For work requiring HREC approval, however, they must obtain both that approval and written site authorisation before starting. Making better use of parallel applications is one improvement available under the existing arrangements.

What happens when the research crosses an institutional boundary?

Consider the sample travelling from the hospital to the university laboratory. Before the clinical team sends it, the institutions need to agree who may receive it, what the laboratory may do with it, what patient information may accompany it, and who will be responsible if something goes wrong. The research continues across that handover; responsibility for each step must be clear.

A material transfer agreement can set the terms on which the laboratory receives and uses the cells or tissue, including limits on further transfer and what happens to unused material. A data transfer agreement, sometimes called a data-sharing agreement, can address the accompanying patient information and research data: who may access them, for what purposes, how they will be secured and when they must be returned or destroyed, subject to retention requirements. The University of Sydney’s research data management procedures expressly contemplate contracts of this kind. The relevant terms may also sit within a broader collaboration agreement.

Privacy obligations across institutions

Privacy law places separate limits on those arrangements. In NSW, the Health Records and Information Privacy Act 2002 regulates the handling of health information. Its Health Privacy Principles limit use and disclosure and impose additional conditions on transfers outside NSW. The Commonwealth Privacy Act 1988 and Australian Privacy Principles may also apply, depending on the organisation. Each institution must establish a lawful basis for the proposed handling of information, whether consent or another applicable ground. Research exceptions have conditions; an HREC’s approval is not, by itself, permission to disregard privacy law. Nor can a transfer agreement authorise a disclosure that the law prohibits.

Under clause 3.4.3 of PD2010_056, each research site needs a separate SSA application, even if two sites belong to the same public health organisation. A university laboratory also has responsibilities for the work it undertakes.

These separate assessments need to inform one another. A hospital should know what the laboratory has checked, and the laboratory should know which decisions remain with the clinical team. Otherwise, repeated review may coexist with gaps in oversight.

How much time does approval take?

Researchers can spend considerable time obtaining these assessments. In 2019, Matilda Haas and colleagues reported that site reviews for the Australian Genomics initiative had repeated scientific and ethical assessments already completed by an HREC. Across 28 established recruitment sites, the median time from SSA application to approval was 59 days, with a range of 4 to 221 days. Obtaining ethics and site approvals required an estimated 3.2 full-time-equivalent staff and cost $831,850. These figures describe one national program in 2016–2018, so they provide historical context rather than a measure of current NSW performance.

More recent NSW figures describe a different period and group of applications. In its report for the final quarter of 2025, the Office for Health and Medical Research recorded 456 authorised SSA applications involving greater than low risk research. Table 6 gives an average elapsed time of 35 calendar days, with 88% meeting the report’s under-60-day benchmark. The SLHD–RPA entry records 56 authorisations, all within that benchmark, and an average of 26 days. The 60-day measure is a performance benchmark, not a period hospitals must wait before authorising research.⁴

Ethics review follows a separate timetable. RPA’s 2026 clinical-trials schedule lists submission closing dates and subcommittee meetings, after which applications go to the full HREC. An application lodged by 28 September, for example, is scheduled for the 6 October subcommittee meeting. The eight-day interval is to the subcommittee meeting, with further review still to follow.

A 2023 study in a NSW local health district suggests that hospitals can shorten processing without adding staff. The district removed steps the authors considered added neither value nor protection, and its average SSA processing time fell from 29 to five days. That result warrants examining which procedural steps protect participants or improve decisions, and which merely add time.

What could institutions do together?

I propose greater reliance on assessments already completed by a collaborating institution. A laboratory should not have to establish the same facts about its facilities and procedures for every new collaborator. The receiving institution could check that an assessment is current and covers the proposed work, then use the relevant findings. If the project changes, reviewers could focus on the consequences of that change—for example, what would follow from sending samples to a different recipient.

Established collaborators could settle recurring questions in advance. An ‘umbrella’ agreement might set common material-transfer and data-transfer terms across several projects, while leaving projects outside those terms for separate consideration. Each transfer would still need to comply with privacy law and the relevant consent and approval conditions. I also propose an optional form of standing authorisation. An institution would authorise a defined class of activities, then check and record whether each project meets the conditions. Standing authorisation would require changes to the present rules. Institutions could improve ordinary applications while those changes were considered.

Making expertise easier to obtain

An HREC cannot be expected to contain an expert in every emerging field. It needs access to specialist advice, without having to send each unfamiliar proposal through another complete review.

My submission on ethical review supports shared access to specialist advice and additional specialist committees where demand warrants them. When deciding whether to accept another committee’s review, institutions should consider its demonstrated expertise and the risks of the study. A committee’s location alone cannot establish that its review is suitable.

Applying the National Statement to AI

AI and emerging technologies were expressly part of the NSW review. The discussion paper identified inconsistent expectations for documentation and increased review burden as problems, and sought views on a risk-proportionate approach. Researchers should explain what they want a system to do, which information it can access, where that information will go and who will check the result. Under the National Statement, the level of review should be proportionate to risk (ch 2.1). In my view, requests for technical detail should help reviewers resolve a relevant ethical or scientific question, rather than become an additional hurdle simply because AI is involved. Some uses will warrant close examination; others should be resolved through a brief explanation. The aim should be sound, timely review.

HRECs need access to people with practical experience of applying AI in the relevant research or an adjacent field. In my view, those who build, test and investigate comparable systems are particularly well placed to explain how a proposed use could affect the study or its participants. That experience should complement the committee’s scientific, clinical and ethical expertise. The National Statement already provides for access to expertise outside a review body’s membership where necessary (para 5.1.38).

The adviser’s task should be to help the HREC apply that framework to questions of research validity, consent, privacy, and foreseeable harms and their management.

How the system finds and checks information

Suppose researchers want an AI assistant to compare a study application with approved documents. A chatbot might work from documents supplied by the user. An agent might find files by matching their names (globbing), search their contents with tools such as grep, and use regular expressions, or regex, to match patterns such as identifiers or dates. Anthropic describes the use of glob and grep in Claude Code. A system using retrieval-augmented generation, or RAG, retrieves source material to inform its answer, often from an index of document passages. These approaches can be combined; RAG is not confined to vector search, and an agent can use several retrieval methods.

Evidence from testing the system on the proposed task should help reviewers assess its reliability. Where it handles research records, the application should identify who will check consequential outputs against the source records, including any patient identifiers, measurements or units.

Accurate retrieval still leaves the question of whether the source itself is sound. A system can faithfully repeat an outdated protocol or a flawed study. An agentic workflow can assist independent scientific review, but cannot substitute for it.

Where patient information goes

Keeping the original records on a hospital server does not prevent excerpts from being sent to a remote model or retained in logs elsewhere. Researchers should identify which organisations receive the information and whether it is processed overseas. The Australian privacy regulator’s guidance on commercially available AI helps frame those questions. If a project requires information to remain within an approved environment, the team must establish that the system meets that requirement before using it.

Clearer rules, with room to improve

Researchers who receive a request for changes should be able to understand the reviewer’s concern and what would resolve it. They should also be able to find guidance that explains the current national standards and applicable law without having to reconcile an old NSW procedure with newer instructions. That would help researchers prepare applications and respond to decisions about their work.

My proposals draw on legal research and collaboration with biomedical scientists. I have not administered hospital research governance. The details need to be worked out with the researchers, reviewers and health services who would use the revised procedures.

For the team developing the cancer vaccine discussed above, the work already crosses institutional boundaries. The rules should help the hospital and laboratory establish which assessments they can rely on, which decisions remain to be made and who is responsible for making them. Reform should make those responsibilities clearer to the people doing the work and to the patient whose cells they are using.

Submissions

Both submissions were lodged on 13 September 2026, in my personal capacity and without a request for confidentiality:

• Ethical and scientific review — PD2010_055 (PDF)
• Site authorisation and site specific assessment — PD2010_056 (PDF)

Notes

1. The 2019 paper describes an academic trial in children, adolescents and young adults with high-risk tumours. Its methods section reports approval by the local ethics committee and Czechia’s State Institute for Drug Control; the separate ethics statement names the University Hospital Brno committee. The paper also reports informed consent and manufacture under Good Manufacturing Practice. ↩︎
2. The Act draws on several constitutional powers, including the corporations power in s 51(xx) and the trade and commerce power in s 51(i), as reflected in its operation provision (s 6). ↩︎
3. On 28 August 2026, the US District Court for the Central District of California issued a permanent injunction in United States v California Stem Cell Treatment Center, addressing the defendants’ fat-derived cell products. This followed the Ninth Circuit’s September 2024 decision that their stromal vascular fraction was a drug and did not fall within the US ‘same surgical procedure’ exception. The appeal turned on the difference between the fat tissue removed and the processed cellular mixture returned to the patient. Neither decision should be read as newly defining both minimal manipulation and homologous use, still less as determining the scope of the Australian exemption. ↩︎
4. The report counts the time from receipt of an SSA application to the final decision without deducting pauses. That includes time when the application is with researchers or other institutional decision-makers, as well as time with the research office. The figures exclude preparation before submission and applications still awaiting a decision at the quarter’s end. See the OHMR report for the final quarter of 2025. ↩︎