Despite the (r)evolution in clinical research in the United States since 1991 — growth from fewer than 4,000 clinical trials to more than 235,000 currently underway, including observational and cohort studies, social and behavioral research, and precision medicine trials using biospecimens and microarrays — the common set of regulations governing the protection of human subjects in federally conducted and supported research (the “Common Rule”) have remained effectively static since their promulgation that year.

On September 8, 2015, the 16 federal departments and agencies to which the Common Rule Applies (the “Agencies”) issued a Notice of Proposed Rulemaking (NPRM) to update the Common Rule with the goal of reducing the burden, delay, and ambiguity for clinical research investigators and modernizing the research oversight process while still protecting human research subjects. More than 2,100 comments were received and reviewed by the Agencies in response to the NPRM. Then, on January 19, 2017, more than a quarter century after its implementation, the Agencies issued a final rule updating and modernizing the Common Rule (the “Final Rule”). The Final Rule will take effect on January 19, 2018.

Below are key takeaways from the Final Rule, followed by a more detailed summary of its significant changes, as well as a discussion of some of the proposals from the NPRM that were not included in the Final Rule.

Key Takeaways

• Non-identified biospecimens are not considered “human subjects.” Researchers do not need to obtain informed consent from patients to use non-identified biospecimens in secondary research.

• Informed consent forms must contain key information (risks, benefits, alternative treatments) that a person would want to know at the beginning of the document. Institutions should update template informed consent forms to meet this requirement.

• Research studies involving multiple institutions generally should be overseen by a single institutional review board.

• Researchers may obtain broad consent from participants to conduct future research on stored identifiable data and identifiable biospecimens.

• Researchers involved in low-risk studies may be exempt from institutional review board oversight. For example, the Final Rule expands the list of exemptions to include most non-clinical research, benign behavioral interventions, consumer preference surveys and research involving identifiable private information on subjects otherwise protected by HIPAA.

• Continued institutional review board oversight is not required when enrolled subjects are no longer at risk (e.g., the data analysis and standard of care follow-up stages).

• Consent forms for some federally funded clinical trials must be posted on a public website.

Applicability of the Common Rule: To What Does It Apply?

Proposed Change. Generally, only human subject research that is conducted or funded by a federal department or agency is subject to the Common Rule. The NPRM proposed expanding the Common Rule to clinical trials that are not federally funded if certain conditions were met.

Final Rule. In the Final Rule, the Agencies declined to expand the Common Rule to clinical trials that are not federally funded.

Definition of "Human Subject"

Proposed Change. The NPRM proposed to revise the definition of “human subject” to include research in which an investigator obtains, uses, studies, or analyzes biospecimens, regardless of the identifiability of those specimens. This would have necessitated substantial security measures and obtaining informed consent from the originating human source for the retention and future use of biospecimens, unless an IRB waived the informed consent requirement under very strict parameters.

Final Rule. The Agencies did not adopt this more expansive definition of “human subject” in the Final Rule, instead, the Agencies determined that “the current regulatory policy appears to sufficiently protect against the unauthorized research use of identifiable biospecimens.” In particular, the Agencies observed that researchers who re-identify nonidentified biospecimens could do so only with consent or IRB approval.

Activities Excluded from Research

Proposed Changes. The NPRM proposed categories of research that would have been excluded from Common Rule oversight. These included social science, historical and journalistic inquiries; activities related to inherently governmental functions, such as criminal investigations, public health surveillance, and national security; and activities that were inherently low-risk, such as surveys, interviews, or information collected for non-research purposes.

Final Rule. In the Final Rule, the Agencies created just four exemptions: (1) certain educational tests, survey or interview procedures, or observation of public behavior; (2) secondary research use of non-identified biospecimens; (3) secondary research use of identifiable information collected by the federal government for other purposes and subject to privacy laws; and (4) secondary research use of identifiable information covered by HIPAA protections. These activities will not be considered “research” to which the Common Rule applies.

Protecting Identifiable Private Information and Identifiable Biospecimens

Proposed Changes. The NPRM proposed requiring investigators and institutions conducting research subject to the Common Rule to implement reasonable safeguards for protecting against risks to the security or information of biospecimens or identifiable private information.

Final Rule. Ultimately, the Agencies did not adopt this proposal. Instead, they retained the existing requirement that IRBs establish and oversee appropriate privacy safeguards relevant to the specific research study. The Agencies will issue subregulatory guidance to assist IRBs in assessing what should be included in adequate and appropriate privacy safeguards.

Requirements for Informed Consent

Proposed Changes. The NPRM proposed to require certain mandatory information be presented at the beginning of an informed consent form, including any essential information that a reasonable person would want to know before consenting to participate in the research. The Agencies suggested relegating extraneous technical information to appendices.

Final Rule. In the Final Rule, the Agencies allowed more freedom in the drafting of informed consent forms. Information must be organized and presented with sufficient detail and in such a way as to facilitate the prospective subject’s understanding of why he or she may or may not want to participate. Institutions and investigators retain flexibility in preparing informed consent forms that best suit their specific research and patient population needs. However, informed consent forms must still contain the following eight required elements and six situational elements; and the Final Rule added four additional requirements regarding the retention and future use of biospecimens.

Required Elements:

1. An explanation of the research, its duration, procedures involved, and identification of those procedures considered experimental;

2. Reasonably foreseeable risks;

3. Potential benefits;

4. Appropriate alternative treatments or procedures;

5. Information regarding the confidentiality of patient records, compensation, and whether treatment for injuries will be provided;

6. An explanation regarding compensation or treatment in the event of a research injury;

7. Relevant contact information; and

8. A statement that participation is voluntary and that the participant may withdraw without penalty or loss of benefits.

Elements to be included when applicable

1. A statement that the procedure or treatment may involve currently unforeseeable risks to the subject or to an embryo or fetus;

2. Circumstances where the participant’s enrollment may be terminated by the investigator;

3. Costs to the participant that may arise during research;

4. Consequences for withdrawing and procedures for terminating a subject’s participation;

5. A statement that significant findings may arise that may affect a subject’s willingness to continue participating and that such findings will be provided to the subject; and

6. The approximate number of study participants.

Notably, the Final Rule adds the following additional elements that must also be included in informed consent forms:

• Whether biospecimens collected as part of research will be used or distributed for future research, even if identifiers are removed;

• Whether specific technology determined to be capable of generating identifiable private information or identifiable biospecimens will be used;

• A statement that subjects’ biospecimens may be used for commercial profit and whether the subject will share in this profit; and

• A statement regarding whether clinically relevant research results will be disclosed to subjects.

Broad Consent for Storing, Maintaining, and Secondary Research Use of Identifiable Private Information or Identifiable Biospecimens

Proposed Changes. The NPRM proposed to allow research subjects to grant broad consent for future storage, maintenance, and secondary research use of their identifiable private information or identifiable biospecimens. The broad consent would be limited to information and biospecimens in existence at the time consent was granted or collected for up to 10 years thereafter (or up to the age of consent for minors). Subjects would be informed that they could withdraw consent at any time without penalty or loss of benefits.

Final Rule. In the Final Rule, the Agencies permit researchers to obtain broad consent to store, maintain, and use identifiable private information and biospecimens with some changes from the NPRM. As discussed above, nonidentified biospecimens are not considered “human subjects” under the Common Rule, so they do not require consent – broad or specific – for secondary research use. Secondary research on identifiable information requires participants to receive a description with sufficient information to allow a reasonable person to understand the types of secondary research that may be conducted. If subjects will not be told about a specific future study’s details, subjects must be told that their specimens may be used for research to which they may not have consented. Furthermore, if the proposed secondary research is controversial or objectionable, investigators should include a more robust description to meet the “reasonable person” standard. The broad consent also must include a description of the information and biospecimens that might be used and the types of institutions and individuals that might perform the research. More specifically, a broad consent must contain the following elements:

• Reasonably foreseeable risks;

• Potential benefits to the subject or others;

• The extent to which confidentiality of records identifying the subject will be maintained;

• A statement that participation is voluntary and refusing to participate will carry no penalty or loss of benefits;

• A statement that biospecimens may be used for commercial profit and whether the subject will share in that profit;

• Whether research involving biospecimens will or might include whole genome sequencing;

• A general description of the types of research that may be conducted with sufficient detail to allow a reasonable person to made a decision;

• A description of the identifiable private information or identifiable biospecimens that might be used, whether that information or biospecimen may be shared with other researchers, and the types of institutions or investigators who may be using the information or biospecimen;

• The duration with which the information or biospecimens will be stored, used, and maintained, which may be indefinite;

• If applicable, a statement that subjects will not be informed of specific research studies using the information or biospecimens, including a statement that they may not have chosen to participate had they known the eventual use;

• If applicable, a statement that clinically relevant results will not be shared with subjects; and

• An explanation of whom to contact for answers to questions about subjects’ rights or research-related harms.

Continued IRB Review of Research

Proposed Changes. The NRPM proposed to eliminate the requirement that IRBs continue to review minimal risk studies that qualify for expedited review, unless the reviewer documents why such continued review should take place.

Final Rule. The Final Rule eliminates continuing review for all studies undergoing expedited review, unless the researcher requests or the IRB mandates continuing review. Studies in their data analysis or clinical follow-up stages also will not be subject to continued review. Institutions may require researchers to attest that their research continues to meet these requirements, but such attestation will not be required under the Common Rule.

Cooperative Research

Proposed Changes. The NPRM proposed to mandate that all institutions located in the United States and engaged in cooperative research (e.g., multi-institution studies) rely on a single IRB for that study, unless otherwise required by law or the terms of the federal research protocol. The IRB of record would be selected by the funding agency or the institution conducting the cooperative group study. Institutions would be free to conduct additional IRB or administrative reviews, though such reviews would not be sufficient for Common Rule compliance.

Final Rule. The Final Rule adopts the NPRM proposal with minor changes. Cooperative research must be overseen by a single IRB unless multiple IRB review is required by law. However, in recognition of the time needed to adjust institutional structures and policies, this requirement will not be effective until January 19, 2020.

Public Posting of Consent Forms

Proposed Changes. The NPRM proposed to require the posting of consent forms used to enroll participants in federally funded clinical trials on a publicly available federal website.

Final Rule. Despite overwhelming criticism, the Final Rule adopts the NPRM proposal. As a result, clinical trials conducted or supported by Common Rule Agencies must upload the IRB-approved consent form used to enroll subjects to a yet-to-be-created federal website no later than 60 days after the last study visit by any subject.

The Final Rule’s effective date and general compliance date is January 19, 2018. Institutions are encouraged to revise forms, documents, and practices to comply with the Final Rule’s provisions by that time. Clinical trials and research approved or determined to be exempt by an IRB prior to January 19, 2018, will not be required to comply with the Final Rule. Institutions that choose to convert approved, waived, or exempted research to the new requirements may do so upon making a formal determination with the IRB overseeing that research that the Final Rule would apply.

Institutions participating in collaborative research will have until January 19, 2020, to comply with the Final Rule’s requirement to use a single IRB to oversee such research.