Header graphic for print
Focus on Regulation

HHS Overhauls the Common Rule to Enhance Protection for Human Subjects in Research

On January 18, 2017, as one of the last actions of the outgoing Obama administration, the U.S. Department of Health and Human Services (HHS) and fifteen other federal agencies (the “Agencies”) issued a final rule overhauling the regulations (82 Fed. Reg. 7149, Jan. 19, 2017) intended to safeguard individuals participating in research, often referred to as the “Common Rule.” The rule aims to enhance protections to participants and to modernize the oversight system. This rule has been a long time coming, as the current regulations have been in place since 1991, an advance notice of proposed rulemaking (ANPRM) issued in July 2011, and a notice of proposed rulemaking (NPRM) issued in September 2015. We have written about changes to the Common Rule in previous client alerts (here) and (here).

The Common Rule applies to all human subjects research that is funded, conducted, or supported by the Agencies. Notably, FDA has its own set of human subject protections. The final rule attempts to harmonize guidance by requiring consultation among the Agencies before issuing guidance on the Common Rule, unless such consultation is not feasible. To this end, the 21st Century Cures Act approved by Congress in December 2016, requires harmonizing human subject research protections and informed consent requirements across the Agencies, so that FDA’s human subject regulations are more in line with those issued by HHS.

Over the past two decades, the volume and landscape of human subjects research has changed significantly, including 1) expansion in the number and types of clinical trials, observational studies, and cohort studies, 2) diversification of the types of social and behavioral studies used in research, 3) increased use of sophisticated analytic techniques to study human biospecimens, and 4) growing use of electronic health data and other digital records.  These and other developments prompted the Agencies to modernize and strengthen the Common Rule.

Researchers, patient advocates, scientists, and investigators submitted more than 2,100 public comments in response to the NPRM, and many of them raised strong objection to several controversial policies, asserting unnecessary regulatory burdens on research institutions and sponsors. These included, among others, objections to the cumbersome informed consent requirements and new rules for research using biospecimens. The final rule includes several new requirements for conducting human subject research, but differs significantly from what was first proposed, based on the groundswell of public feedback. Important distinctions from the NPRM and the critical changes to the Common Rule are discussed below.

These new regulations are scheduled to become effective on January 19, 2018, except for the single-IRB review requirement, which will take effect on January 20, 2020. While it is critical for stakeholders to plan for implementation well before the effective date, at the same time current laws and legislation that recently passed the House (i.e., the Congressional Review Act, the Midnight Rules Act, and the Regulations from the Executive in Need of Scrutiny (REINS) Act) could affect implementation depending on the policies and priorities of the new Presidential Administration. That said, the final rule does not appear to be impacted by any Executive Orders or policy statements issued from the Administration to date relating to the effectiveness of recent regulatory action. It is essential for stakeholders to stay tuned. 

Research Involving Nonidentifiable Biospecimens

Most notably, the final rule does not adopt the proposal to expand the Common Rule to cover research involving nonidentified biospecimens (e.g., leftover portions of tissue or blood samples). The proposed rule included a revised definition of “human subject” that incorporated research in which investigators obtain, use, study, or analyze biospecimens, regardless of identifiability, thereby subjecting all such research—including that of nonidentifiable data and nonidentifiable biospecimens—to the Common Rule’s informed consent, waiver of consent, and exemption requirements. Under the final rule, researchers generally can continue to use non-identifiable biospecimens as they are currently using them.

The final decision to exclude the expanded definition of “human subjects” comes as a relief to many in the research community. In fact, half of all commenters who submitted comments on the proposed rule touched upon this issue, and the vast majority were opposed to the change. Patients and researchers raised concerns about the implications for use of biospecimens collected as part of clinical care, fearing that the proposed revisions would result in a decline in patient participation. In addition, numerous research institutions were concerned with the administrative time and cost needed to track and retain personal information for billions of nonidentifiable human specimens.

HHS had stated that concern over the individual autonomy was a driving reason for the NPRM proposal. But, in the final rule the Agencies reasoned that the current regulatory policy adequately protects against the unauthorized use of identifiable biospecimens, i.e., if, in the course of research investigators manage to re-identify nonidentifiable biospecimens, the investigator would then be conducting human subjects research that requires IRB approval.

Consent Forms and Process

The final rule adopts new requirements to improve informed consent forms and the consent process itself. The requirements are an attempt to address concerns that consent forms are too long and difficult to understand, and are prepared to protect the legal interests of the institutions instead of the participants engaged in research.

  • The final rule modifies the definition of “clinical trial,” which is a research study in which one or more human subjects are prospectively assigned to one or more interventions (which may include placebo or other control) to evaluate the effects of the interventions on biomedical or behavioral health-related outcomes. The final rule did not adopt the NPRM’s more expansive definition, but indicates that the new definition is relevant to the requirement for posting consent forms for clinical trials conducted or supported by federal departments or agencies.
  • The prospective participant must be given information that a “reasonable person” would want to have in order to make an informed decision about participation.
  • The information must provide sufficient detail regarding the research and the consent form must be organized in a manner to facilitate a participant’s understanding why one may want or not want to participate in the research.
  • The consent form must begin with a concise and focused presentation of the key information that will most likely assist someone in making a decision about participation.
  • Researchers must post online one version of a consent form used to enroll participants in federally funded clinical trials.

In addition, the new requirements expand the language required for research involving the collection of identifiable private information or identifiable biospecimens. They include, where applicable:

  • A statement that identifiers might be removed and the information or biospecimens could be used for future research or distributed to another investigator for future research after such removal.
  • A statement that the biospecimens (even if identifiers are removed) may be used for commercial profit, and whether the subject will or will not share in the profit.
  • A statement whether clinical research results will be disclosed to participants.
  • A statement whether the research will (if known) or might include whole genome sequencing.

Broad Consent for Secondary Research

The Common Rule continues to protect identifiable data and biospecimens with stringent consent requirements, but investigators who contemplate using such data and information have been given additional flexibility in this process. The final rule provides that for studies using stored identifiable data or identifiable biospecimens, researchers will have the option of relying on broad consent obtained for secondary research, i.e., seeking prospective consent to unspecified future research from a participant for storage, maintenance, and secondary research use of identifiable private information and identifiable biospecimens. This will allow for such information, originally obtained for other purposes such as clinical care, to be used in future research. The broad consent is an alternative to seeking IRB approval to waive the consent requirement.

In addition to satisfying the general informed consent requirements, broad consent must include the following elements:

  • A general description of the types of research that may be conducted with identifiable private information or identifiable biospecimens. The final rule requires some care in preparing this description, which must be sufficient to allow a reasonable person to expect that the broad consent would permit the types of research conducted. In addition, for research involving biospecimens, the broad consent must indicate whether the research will (if known) or might include whole genome sequencing.
  • Unless the subject or legally authorized representative will be provided details about specific research studies, a statement that subjects will not be informed about specific research studies that could use their identifiable private information or identifiable biospecimens, including the purposes of the research and that they might have chosen not to consent to some of those specific research studies. The final rule notes that certain types of research (i.e., that which may be controversial or objectionable to some subjects) will require a more robust description to meet the “reasonable person” standard.
  • Descriptions of any reasonably foreseeable risks or discomforts to the subject, and any benefits to the subject or to others that may reasonably be expected from the research. The broad consent must also include a statement that participation is voluntary, including the statement that refusal to participate or to discontinue participation will involve no penalty or loss of benefits to which the subject is otherwise entitled.
  • A statement describing the extent, if any, to which confidentiality of records identifying the subject will be maintained.
  • A description of the identifiable private information or identifiable biospecimens that might be used in research, whether sharing of such information or biospecimens might occur, and the types of institutions or investigators that might conduct research with such information or biospecimens. To the extent the subject’s biospecimens (even if identifiers are removed) may be used for commercial profit, the broad consent must include a statement to this effect, including discussion of whether the subject will or will not share in the commercial profit.
  • A description of the period of time allowed that the identifiable private information or identifiable biospecimens may be stored and maintained, and a description of the period of time that such information or biospecimens may be used for research purposes. Both of these time periods can be indefinite.
  • A statement that clinically relevant research results, including individual research results, may not be disclosed to the subject, unless it is known that such results will be disclosed in all circumstances. Broad consent must also include a point of contact for questions about the storage and use of the subject’s identifiable private information or identifiable biospecimens, and a point of contact in the event of a research-related harm.

IRB Oversight

The final rule adopts other enhancements that aim to ease regulatory burdens and enhance protections for research participants. The enhancements address concerns that participants engaged in research could be better protected if less time were devoted to oversight of low-risk studies, thereby allowing IRBs, administrators, and investigators to focus on ensuring adequate protection in higher-risk studies.

  • The final rule establishes new exempt categories of research based on their risk profile. In some cases, the exempt research will require limited IRB review to ensure that there are adequate privacy safeguards for identifiable private information and identifiable biospecimens. In response to public comments, the final rule does not adopt the NPRM’s designation of various categories of activities excluded; instead, the activities to be excluded are generally either described as not satisfying the definition of what constitutes research, or are exempt.
  • Consistent with the NIH policy published in June 2016 (discussed in our previous client alert), the final rule adopts a single IRB requirement for U.S.-based institutions engaged in multisite research. These institutions are required to use a single IRB for portions of the research that take place within the United States, with certain exceptions. In response to public concern, the new rule provides that any federal agency supporting or conducting research may determine that the use of a single IRB is not appropriate for a particular context – this is in slight contrast to the NPRM’s proposal to require that such determinations be made on a study-by-study basis.
  • Previously, the decision to have cooperative, multisite research reviewed by a single IRB was voluntary and, for federally funded research, many institutions were reluctant to replace review by their own IRB with review by a single IRB not operated by that institution. The Agencies acknowledged the large number of comments contending that single IRB review should be encouraged rather than mandated, but the Agencies believe that “[T]his incentivized approach would ultimately fail to yield substantive positive change in the system. Rather, systematic efficiencies have the best chance of occurring if single IRB review is required for all review in domestic research involving more than one institution.” The Agencies acknowledge that further single IRB guidance needs to be developed. The final rule adopts a 3-year compliance date for this requirement to afford affected institutions sufficient time to prepare for and implement it (e.g., developing institutional policies and procedures).
  • The final rule removes the requirement to conduct continuing review of ongoing research for studies that undergo expedited review and for studies that have completed study interventions and are only analyzing data or involve only observational follow-up in conjunction with standard clinical care. Prior to the final rule, IRBs were required to conduct continuing review for covered research at intervals appropriate to the degree of risk, but at least once per year. The final rule does not require investigators to provide annual confirmation to the IRB that such research is ongoing and that no changes have been made that would require the IRB to conduct continuing review. Institutions that require some form of accounting for ongoing research (not subject to continuing review) have flexibility to implement their own requirements.
  • Single and central IRBs are now subject to direct compliance enforcement. This new requirement may provide comfort to relying institutions and reinforce responsibilities of the single/central IRB.
  • IRBs have new documentation responsibilities. IRBs will be required to document their rationale when overriding the presumption that studies on HHS’s expedited review list involve greater than minimal risk. In addition, IRBs must document decisions to require continuing review or full IRB review in circumstances when such research otherwise would not require continuing review.
  • The final rule does not require that exemption determination be documented, as was proposed in the NPRM. This allows for greater flexibility in how the IRB makes these determinations.
  • The final rule eliminates the requirement for grant applications to undergo IRB review and approval for the purposes of certification in the grant application/proposal.

Other Highlights in the Final Rule

The final rule includes additional important differences from the NPRM.

  • The final rule does not expand the policy to cover clinical trials that are not federally funded.
  • The final rule does not include the proposed standardized privacy safeguards for identifiable private information and identifiable biospecimens, instead retaining the current approach to privacy standards. According to the Office for Human Research Protections (OHRP), such protections will be issued as guidance rather than as regulatory requirements.
  • The final rule declined to incorporate a new identifiability standard, opting not to replace “identifiable private information” with “personally identifiable information” (or “PII,” a term used frequently across the Federal government) or another term that would increase the scope of what is subject to the Common Rule.
  • The final rule does not adopt the most restrictive proposed criteria for obtaining a waiver of the consent requirements relating to research with identifiable biospecimens.

Stakeholders should be aware of additional highlights included in the final rule.

  • The final rule eliminates the “check the box” option on the Federalwide Assurance (FWA) to voluntarily extend the Common Rule to all research conducted by the institution. The rule also eliminates the requirement to designate one or more IRBs on the FWA. Institutions are no longer required to submit changes in the IRB roster to the Agency.
  • The final rule applies to research conducted outside the U.S. and maintains an Agency’s ability to approve the substitution of certain foreign procedures. As in the past, such procedures may be substituted in lieu of the procedural requirements provided in the Common Rule where the Agency determines that the procedures prescribed by the foreign institution afford protections that are at least equivalent to those provided in the Common Rule. (Agencies rarely if ever make such determinations.) The final rule commentary clarifies that foreign institutions are not expected to apply the Common Rule more broadly to their activities that receive no federal funding.
  • Ongoing research studies that were initially approved by an IRB, waived pursuant to a Secretarial waiver, or determined to be exempt before January 19, 2018, are not required to comply with the changes in the Final Rule.

If you have any questions about the changes to the Common Rule and how they may affect your business or organization, please contact one of the authors of this alert or the Hogan Lovells attorney with whom you regularly work.