The Final Rule published by the US Department of Health and Human Services on January 18, 2017, largely avoids major modifications to the Common Rule. However, it specifically addresses creation of biospecimen and data repositories and use of those repositories for secondary research. All stakeholders involved in federally funded research should be aware of the Final Rule’s changes and prepare to implement them.

In Depth

On January 18, 2017, the US Department of Health and Human Services (HHS) issued long-awaited amendments (Final Rule) to the Federal Policy for the Protection of Human Subjects (Common Rule). HHS’s stated goals for these changes are to align the Common Rule with the modernization of the research and privacy landscape and to otherwise strengthen the Common Rule while reducing administrative burdens for researchers. All institutions that accept federal funding from HHS or any of the 15 other federal departments and agencies that have now signed on to the Common Rule (Common Rule Agencies), as well as other stakeholders, need to understand and prepare to implement these changes. Affected entities include, among others, investigators; research sites; institutional review board (IRB) administrators and members; independent research organizations; Institutional Officials and staff; and the pharmaceutical, medical device and biotechnology industries.

The Final Rule retreats from several key proposals in HHS’s September 2, 2015, notice of proposed rulemaking (NPRM) that have been the subject of significant debate since HHS issued the advance notice of proposed rulemaking in 2011. Of particular note is HHS’s decision to abandon several controversial proposed changes to the Common Rule that would have materially altered how research—particularly genomic and biospecimen research—is conducted in the United States. In particular, the Final Rule does not include the proposal to consider biospecimens that are unannotated with identifying data as “human subjects” under the Common Rule. HHS’s about-face on this proposal, as well as its retreat from several other controversial proposals, underscores the extent of opposition to such proposals expressed in stakeholders’ reactions to the NPRM. The Final Rule also leaves unresolved the ambiguities that health care providers and researchers have consistently encountered in trying to determine the line between human subject research and quality assurance/quality improvement activities.

Nonetheless, the Final Rule adopts a number of changes that will have a noticeable impact on the Common Rule’s informed consent, waiver and IRB review requirements. While some of these changes may ease the administrative burden on researchers, others (particularly the new informed consent and waiver requirements) may impose new challenges in pursuing secondary research. The particularly notable changes of the Final Rule are as follows:

• While HHS did not adopt the controversial proposal to consider biospecimens that are unannotated with identifying data to be human subjects, the Final Rule requires HHS to periodically assess the Common Rule’s identifiability standards, including whether the presence of genetic material embedded in biospecimens constitutes identifiable information, and permits HHS to update such standards through guidance.

• The Final Rule imposes new informed consent form requirements. These requirements, including the requirement that consent forms disclose certain details regarding secondary use of data and biospecimens, obligate researchers to provide more specific information about the research study and potential future use than under the prior Common Rule.

• The Final Rule also adds specific requirements for researchers who wish to obtain “broad” informed consent from subjects for the storage, maintenance or secondary research use of identifiable private information or identifiable biospecimens. Although HHS’s stated objective for this change is to provide enhanced flexibility to researchers, it is unclear whether it will minimize burden in a significant way compared to existing pathways under both current Common Rule regulations (Pre-2018 Rule) and the Final Rule, such as waiver of informed consent.

• The Final Rule revises and expands the categories of exempt research to include, among others, certain secondary research activities regulated under the Health Insurance Portability and Accountability Act (HIPAA) and certain other secondary research activities. These changes meaningfully lessen the administrative burden researchers will bear when conducting secondary research that is regulated under HIPAA.

• The Final Rule streamlines requirements for study recruitment and screening activities.

• The Final Rule includes revisions to the criteria for waiver or alteration of informed consent that may make it more challenging to obtain waiver or alteration of informed consent.

• The Final Rule eliminates the authority of the Common Rule Agencies to oversee and enforce compliance with the Common Rule with regard to human subjects research that is not federally funded or supported. Institutions may still choose to conduct such research in accordance with the Common Rule; those that do should ensure that their internal oversight and compliance mechanisms align with this new framework. 

Based on the version of the Final Rule as published in the Federal Register, January 19, 2018, is both the effective date of the Final Rule and the compliance date for all provisions except those relating to cooperative research, for which the compliance date is January 20, 2020. The day after the Final Rule’s publication in the Federal Register, President Trump’s chief of staff, Reince Priebus, issued a regulatory freeze that asks regulatory agencies, in part, to postpone by 60 days the effective dates for all regulations that were published in the Federal Register but are not yet effective so that the new administration will have the opportunity to review new regulations. Given that the Final Rule does not become effective until 2018, however, it seems that with or without this freeze, the Trump administration will have ample opportunity to revisit this effective date or, conceivably, other aspects of the Final Rule, if it chooses to do so.

Following is an overview of these and other notable changes to the Common Rule that are implemented by the Final Rule.

Scope and Jurisdiction 

Definition of “Human Subject” and Potential for Future Revision

Departing from one of the NPRM’s most significant and controversial proposals, the Final Rule does not expand the Common Rule’s definition of “human subject” to include all biospecimens whether or not annotated with identifiable information. Rather, HHS retained identifiability as the “North Star” for determining when research uses of data and biospecimens constitute human subjects research and defines an “identifiable biospecimen” as one “for which the identity of the subject is or may readily be ascertained by the investigator or associated with the biospecimen.” HHS conceded that the genetic material embedded in biospecimens is not per se identifiable such that biospecimens will remain “de-identified.”

The Final Rule, however, may not be the final word on this important issue. The Final Rule requires the Common Rule Agencies to periodically consult with experts and assess the research landscape with respect to (1) the meaning of identifiability in the Common Rule context and (2) new technologies and techniques that can generate identifiable private information or identifiable biospecimens. The Final Rule provides a pathway for the Common Rule Agencies to update their interpretation of “identifiable private information” and “identifiable biospecimen” based on these periodic assessments, including through the use of guidance, as appropriate and permitted by law. The Final Rule also contemplates updates to the list of technologies and techniques that generate identifiable private information and identifiable biospecimens as appropriate based on these periodic assessments, but only after notice and an opportunity for public comment. Significantly, technologies and techniques included on this published list may “only be used in instances where the person has provided their consent (broad or study-specific), or where an IRB has waived the requirement for consent.” Finally, the Final Rule does not resolve the question of whether information that constitutes a limited data set under HIPAA would be considered identifiable private information.

Jurisdictional Scope and Federalwide Assurances

HHS did not implement the proposal in the NPRM to extend the Common Rule to any clinical trial, regardless of funding source, that is conducted at a US institution that receives funding for non-excluded, non-exempt human subjects research from a Common Rule Agency. Thus, the scope of the Common Rule with respect to clinical trials will remain unchanged.  

In addition, the Final Rule narrows the scope of Common Rule Agencies’ enforcement authority and the corresponding authority of IRBs. The Final Rule discontinues the authority of the Common Rule Agencies to review, oversee and enforce compliance with the Common Rule with regard to non-federally funded research. Institutions that receive federal funding or support for human subjects research will still have the option to choose to apply the Common Rule requirements and standards to their conduct of non-federally funded human subjects research either because they believe that applying a single set of standards to all of their human subjects research is more efficient and effective, or because they want to demonstrate a comprehensive commitment to the highest ethical standards. However, institutions will now be fully responsible for overseeing adherence to the Common Rule requirements and standards under their internal policies and procedures. Accordingly, the Final Rule eliminates the option for institutions to “check the box” in response to Question 4(b) of the current Federalwide Assurance (FWA) form (commonly known as the 4(b) election). Human subjects research that is not federally funded or supported will no longer be subject to HHS oversight, and institutions that choose to conduct such research in accordance with the Common Rule should ensure that their internal operations align with this new framework, which will require increased reliance on internal oversight and compliance mechanisms.  

HHS went in the opposite direction with respect to applying the Common Rule to IRBs not operated by an FWA-holding institution (Independent IRBs). Previously, other than requiring that IRBs overseeing Common Rule-regulated research register with HHS to provide certain information, including composition of the IRB’s membership, Common Rule Agencies did not have oversight or enforcement authority over Independent IRBs; as a result, institutions relying on Independent IRBs could be held responsible for compliance violations caused by the IRB of record. The Final Rule adopts the NPRM proposal to subject Independent IRBs to direct oversight with respect to Common Rule compliance. This modification will likely reduce researchers’ potential exposure to liability for the actions of third-party IRBs. 

Updates to Exempt Categories of Research, Including New Secondary Use Pathways

HHS also retreated from the broad structural overhaul of the categories of research subject to the Common Rule. The NPRM had proposed a new category of “excluded” research, which would have been distinguishable from “exempt” research in that it would not be subject to administrative or IRB review. While the Final Rule does not adopt the “excluded” research category itself, it incorporates certain proposed excluded activities elsewhere in the Final Rule.  

The Final Rule revises the categories of exempt research. Significantly, three of the new or revised exempt research categories under the Final Rule relate to secondary research, which the Pre-2018 Rule did not specifically recognize or address:

• Exemption for storage or maintenance of identifiable private information or identifiable biospecimens for secondary research. The Final Rule creates an exemption related to the storage or maintenance of identifiable private information or identifiable biospecimens for secondary research for which the “broad consent” now specifically provided for in the Final Rule (and discussed below) has been obtained for such storage or maintenance. Under this exemption, an IRB must still conduct a limited review and must confirm that broad consent was properly obtained and is appropriately documented (or that documentation was waived), and that there are provisions to protect privacy and confidentiality if there is a change made for research purposes to the manner of storage or maintenance. (See discussion below regarding the new “broad consent” pathway for secondary research.)  

• Exemption for secondary research use of identifiable private information or identifiable biospecimens that requires consent. The Final Rule creates an exemption related to secondary research uses of identifiable private information or identifiable biospecimens contained in a biorepository created through the new “broad consent” pathway if, in addition to complying with the broad consent requirements for storage, maintenance and secondary research use specifically set forth in the Final Rule (and discussed below), investigators (1) obtain limited IRB review and have the IRB confirm that the secondary use project falls within the scope of the broad consent, (2) have documentation of informed consent or waiver of documentation of consent on file, and (3) do not officially include in the study plan the return of individual research results (unless required by law).

  • Note that this exemption for secondary use in a federally funded study requires that researchers have also initially obtained broad consent for the storage or maintenance of the information or biospecimens, which on its face would require consent for the original creation of a biospecimen or data repository in accordance with the Common Rule even if the creation of the repository itself is not federally funded and thus not subject to the Common Rule.

• Exemption for secondary research use of identifiable private information or identifiable biospecimens for which consent is not required. The Final Rule expands an existing exempt category to exempt from all Common Rule requirements, including the consent and IRB review requirements, activities involving secondary research uses of identifiable private information and/or identifiable biospecimens if the study meets one of the following four criteria:

  • The information or biospecimens are publicly available.

  • The investigator records information (including information about biospecimens) in such a way that the investigator or others cannot readily ascertain the identity, directly or through identifiers linked to the subjects, and the investigator does not contact or re-identify the subjects.

  • The research only involves information collection and analysis of health information, when such use is regulated under HIPAA for the purposes of “health care operations,” “research,” or “public health activities and purposes” (as defined in HIPAA).

  • The research is conducted by or for a federal department or agency using government-generated or -collected information obtained originally for non-research purposes, if (1) the research generates identifiable private information that is or will be maintained on IT systems compliant with and subject to 208(b) of the E-Government Act of 2002; (2) all of the identifiable private information collected, used or generated as part of the activity will be maintained in records systems subject to the Privacy Act of 1974; and, if applicable, (3) the information used in the research was collected subject to the Paperwork Reduction Act.

As discussed further below, the Final Rule introduces certain requirements for obtaining broad consent and finalizes restrictions on IRB waivers that, taken together, may discourage some researchers from seeking broad consent from subjects, including to qualify for the above-described exemptions for secondary research. 

Stakeholders should also note that the new exemption category for secondary research regulated as health care operations, research or public health activities under HIPAA perpetuates the notion that HHS considers certain activities that constitute “health care operations” under HIPAA to be “research” under the Common Rule without clarification as to when an activity would fall into the grey area. On the other hand, this new exemption provides substantial new flexibility for secondary research and will almost certainly be welcomed and invoked by researchers and others involved in conducting secondary research. 

A number of other exclusion categories proposed in the NPRM were not incorporated into the Final Rule. The proposed exemption for certain secondary research involving identifiable information where notice was given to subjects, which related to a requirement to clarify the applicability of the Common Rule to clinical data registries under the Medicare Access and CHIP Reauthorization Act of 2015 (MACRA), was not finalized. Other notable omissions include the proposed exclusions for quality assurance/quality improvement activities and for internal monitoring and program improvement purposes, despite HHS’s acknowledgement that these proposals were supported by a majority of NPRM commenters. HHS’s failure to include these activities in the Final Rule, alongside its affirmative statements that certain quality assurance/quality improvement and internal monitoring activities “involve research and deserve the protections” of the Common Rule, contributes to the ambiguity regarding the overlap between research and activities that are regulated as health care operations under HIPAA.  

Informed Consent 

Basic Informed Consent: New Content and Organization Requirements 

The Final Rule articulates a number of new requirements for the organization and content of informed consent forms, including that such forms must begin with a “concise and focused presentation of the key information” that is most likely to help a potential subject or authorized representative to understand why he or she may or may not want to participate in the research. The Final Rule notes that HHS may issue future guidance to provide further clarity on the information that must be included in the beginning section of a consent form. Consent forms must also include a number of new elements that are relevant to the conduct of secondary research: 

• With respect to research involving the collection of identifiable private information or identifiable biospecimens, one of the following statements, as applicable:

  • That identifiers may be removed from the information or biospecimens, and thereafter, information or biospecimens may be used for future research without additional informed consent

  • That the information or biospecimens collected will not be used or distributed for future research, even if de-identified

• A statement that biospecimens, even if de-identified, may be used for commercial profit, and a statement indicating whether the subject will be able to share in such profit 

• A statement describing whether and under what conditions clinically relevant results will be shared with subjects, including their own results 

• To the extent the research involves biospecimens, a statement indicating whether the research will or might include whole genome sequencing 

These additional requirements are aimed at increasing transparency for prospective subjects about the nature of the research in which they are being asked to participate. Institutions should note the organizational changes and additional level of detail that informed consent forms must reflect under the Final Rule. 

Broad Informed Consent for Secondary Research Using Identifiable Information or Biospecimens  

The Final Rule includes provisions for obtaining a one-time, upfront broad consent to cover the storage, maintenance and secondary research use of identifiable biospecimens and identifiable private information. Although the Pre-2018 Rule already allows researchers to obtain informed consent for future research use of identifiable private information and identifiable biospecimens, the Final Rule articulates specific requirements that would apply in the event researchers opt to pursue this new broad consent pathway. More importantly perhaps, a study that meets these broad consent requirements may qualify for treatment as exempt from certain requirements under the Common Rule.

These new broad consent requirements include, but are not limited to, the following:

• A description of the types of research that may be conducted with the information or biospecimens used that satisfies a “reasonable person” standard. Researchers are expected to provide more detail when there is reason to believe the research may be considered controversial or when specific future research studies are contemplated. 

• A description of the information or biospecimens that might be used, whether the information or biospecimens might be shared, and what kinds of investigators or institutions might use the information or biospecimens. 

• A description of how long information or biospecimens may be stored, maintained or used, even if indefinite. 

• When appropriate, a statement informing subjects that information that has been de-identified might not be traceable and that, as a result, it may not be possible for them to withdraw their consent in the future. 

• A statement that clinically relevant research results may not be disclosed, unless it is known that they always will be disclosed.  

• As appropriate, a statement as to whether research involving biospecimens will or might include whole genome sequencing. 

• Unless researchers will provide the subject with “details about specific research studies” in connection with satisfying the above elements for broad consent, an affirmative statement that the subject will not be informed of the details of any specific research studies that the researcher might conduct using the subject’s identifiable private information or identifiable biospecimens, and that the subject might not have chosen to provide consent for some of these specific research studies.  

The Final Rule does not adopt the NPRM’s proposal to limit the scope of the broad consent to information or biospecimens existing or collected within a certain time period, or the proposal to provide templates for broad consent. Thus, researchers who wish to use the broad consent pathway will need to develop their own broad consent forms, subject to appropriate IRB approvals.

Whether researchers will find significant advantages to this new specific pathway for obtaining broad consent remains to be seen. As noted above, the ability to obtain informed consent for secondary use of identifiable private information or identifiable biospecimens existed under the Pre-2018 Rule. In addition, the requirements under the Pre-2018 Rule for obtaining consent for such secondary research use arguably are more general and less prescriptive than those articulated under the Final Rule for broad consent. Moreover, the HIPAA privacy standards (Privacy Rule) for obtaining authorization for future research gives researchers considerable discretion in satisfying the requirement that a valid authorization describe each “purpose” of a requested use or disclosure, including for future research activities. The HHS Office for Civil Rights has indicated that it will not require researchers to specify each future study for which protected health information (PHI) may be used; rather, the “purpose” requirement would be considered satisfied if “it would be reasonable for the individual to expect that his or her [PHI] could be used or disclosed for the future research purpose.” Accordingly, the Pre-2018 Rule and the Privacy Rule can be and have been interpreted to permit a consent to secondary use that is broader than the broad consent concept established by the Final Rule. The much more specific requirements under the Final Rule’s new broad consent provisions have the potential to create disharmony between the HIPAA authorization and the Common Rule informed consent forms used for secondary research activities. 

A key advantage of the new specific pathway for obtaining broad consent appears to be the ability of researchers to avail themselves of the exemption pathways discussed above that allow researchers to conduct certain secondary research with limited initial IRB review and without the need for continuing review. Researchers should note, however, that the Final Rule prohibits IRBs from omitting or altering any of the elements of broad consent specified under the Final Rule “if a broad consent procedure is used.”  

HHS describes this broad consent pathway as a “new alternative” for researchers, noting that researchers who choose not to obtain broad consent may still seek study-specific informed consent or a waiver of informed consent to use identifiable private information and identifiable biospecimens. Some researchers may find (1) the nature and extent of the required elements of the broad consent to result in increased time and effort devoted to the consent process, (2) the process for obtaining the broad consent to be more rigid, and (3) an increased reluctance by subjects to sign the consent. As a result, some researchers may choose the study-specific consent pathway, to seek waiver of informed consent altogether, or to conduct research using de-identified or coded information or biospecimens. The disadvantage of the study-specific consent option and the waiver option, however, is that the study would not qualify for the exemption pathways discussed above that require only limited IRB review and no continuing IRB review. Further, use of only de-identified or coded information will be infeasible for some research studies. 

Waiver or Alteration of Consent

The Final Rule includes some, but not all, of the NPRM’s proposals to limit the circumstances under which an IRB may waive or alter informed consent. In particular, the Final Rule added a specific criterion requiring an investigator seeking a waiver for research using identifiable private information or identifiable biospecimens to demonstrate that the research “could not practicably be carried out without using such information or biospecimens in an identifiable format.” HHS notes that the requirement embodies the principle that “nonidentified information should be used whenever possible in order to respect subjects’ interests in protecting the confidentiality of their data and biospecimens.” This specific waiver provision related to secondary research is essentially the same as the Pre-2018 Common Rule requirements to demonstrate “minimal risk” and that “the research could not be practicably carried out without the waiver or alteration itself,” and is the same as the corresponding criterion for waiver of authorization under the HIPAA Privacy Rule. However, this more specific waiver requirement is yet another acknowledgement of the increased prevalence and prominence of secondary research arising out of the prevalence of electronic sharing of private information in the health care delivery and research context. 

The Final Rule also prohibits IRBs from waiving consent for the storage, maintenance or secondary research use of identifiable private information or identifiable specimens if an individual was asked and declined to provide broad consent for such research. This requirement may create a disincentive for investigators to seek the new broad consent set forth in the Final Rule and prompt them instead to pursue other pathways, such as seeking an upfront waiver of informed consent or using de-identified or coded information or specimens (which may be less useful for their research needs).

Liberalization of Requirements for Screening, Recruitment and Eligibility Determination Activities

With minor modifications, HHS finalized its proposal to allow IRBs to approve proposals involving obtaining identifiable private information or stored identifiable biospecimens without informed consent to screen, recruit or determine the eligibility of prospective subjects. HHS explains that the Pre-2018 Rule required researchers to obtain informed consent or IRB waiver thereof for such use of identifiable private information or identifiable biospecimens, which created a lack of harmonization between the Common Rule and US Food and Drug Administration (FDA) regulations (which do not require consent or waiver thereof for such activities). That Pre-2018 Rule requirement was also inconsistent with HIPAA where the HIPAA “reviews preparatory to research” pathway was available. Note, however, that this amendment does not eliminate the requirement to obtain IRB review of the screening or recruitment activity, and does not clearly extend to other “research development” activities that would be considered “reviews preparatory to research” under HIPAA, such as the use of identifiable private information for protocol development.

Publication of Informed Consent Forms 

Despite opposition from a majority of commenters to the NPRM, HHS finalized the requirement that investigators post on a publicly available federal website an IRB-approved informed consent form for each clinical trial that is conducted or supported by a Common Rule Agency. Notably, the posted form need not be the “final” or last amended version of the form; rather, it merely needs to be a form that was used for enrollment and approved by an IRB. The Common Rule Agency supporting or conducting the trial may permit or require redactions to the extent it determines that certain information should not be publicly available. Although the Final Rule softens the NPRM’s proposed approach, institutions and investigators involved in Common Rule-regulated clinical trials should be mindful that their informed consent forms for federally funded clinical trials will now have a much broader potential audience.

IRB Review 

Single IRB for Cooperative Research

Central IRB review is optional under the Pre-2018 Rule but mandatory under the Final Rule for cooperative research studies. The Final Rule adopts the NPRM proposal to require all US institutions engaged in a cooperative research study to rely on a single central IRB for that study, except where (1) more than a single IRB review is required by law (e.g., FDA-regulated device studies), or (2) the Common Rule Agency supporting the research determines that use of a single IRB is not appropriate. Lead institutions will have the ability to propose which IRB should be used, although the applicable Common Rule Agency will make the final decision. Although this new requirement may bring certain efficiencies and streamlining to research in the long term, the short-term transition may be a challenging one. Therefore, the Final Rule delays the deadline for compliance with this provision until January 2020.

Expedited and Continuing Review

The Final Rule eases IRB requirements for research involving certain types of minimal risk activities. Under the Pre-2018 Rule, research activities are eligible for expedited review if they fall within an expedited review category on the list published and maintained by the Secretary of HHS and are found by an IRB to pose no more than minimal risk to research subjects. Under the Final Rule, such activities will no longer require a minimal risk determination from an IRB and will instead be presumed eligible for expedited review by default. However, if in the course of conducting its expedited review, the IRB determines that such research involves more than minimal risk, the research would be required to undergo full IRB review. 

The Final Rule also made changes to the continuing review process. Expedited research on the list published by HHS will no longer be required to undergo continuing review, unless the reviewer requires otherwise. In addition, the following types of research and activities, among others, will be exempt from continuing review: 

• Research that has reached the point at which it only involves data analysis and/or accessing follow-up clinical data 

• Research that has satisfied the exemption for storage or maintenance of identifiable private information or identifiable biospecimens for secondary research use for which broad consent was obtained 

• Research that has satisfied the exemption for secondary research using identifiable private information or identifiable biospecimens for which broad consent was obtained

Privacy and Security 

The Final Rule does not adopt the NPRM’s proposals regarding privacy and security safeguards, including but not limited to the proposal that HHS publish a set of uniform, specific measures that investigators could implement to satisfy its proposed requirements regarding security and privacy. HHS cited commenters’ significant concerns about adhering to new requirements when the safeguards had yet to be proposed (or even developed) as contributing to this decision. The Final Rule does, however, maintain the requirement that IRBs review the quality of privacy and security measures protecting research subjects in each study. It also includes a new requirement that the Secretary of HHS issue guidance to assist IRBs in assessing privacy and confidentiality protections.

Conclusion

The Final Rule largely avoids major modifications to the Common Rule. However, it specifically addresses creation of biospecimen and data repositories and use of those repositories for secondary research. It also implements new provisions that are relevant and should be noted by all stakeholders involved in federally funded research, including, without limitation, investigators; research sites; IRB administrators and members; Institutional Officials and staff; and the pharmaceutical, medical device and biotechnology industry. Click here to view the full text of the Final Rule, most of which goes into effect January 18, 2018.