Federal Agencies Issue Revised Common Rule

Over the years, the range and scale of research on human subjects has grown to include diverse social and behavioral research, as well as the use of advanced analytical techniques to study biospecimens and large datasets. The revisions to the rule are intended to address this changing landscape by enhancing protections for research participants and decreasing administrative and regulatory burdens for investigators, research institutions and institutional review boards, particularly for low-risk research.

The new rule is scheduled to go into effect on January 19, 2018, except for the requirement for single IRB review, which will take effect January 20, 2020. Studies commenced before the effective date of the new rule can elect to proceed under the current rule or the new one. It is of course possible that the new Administration may take action to amend, defer or repeal the final rule before it goes into effect.

The Proposed Rule

The agencies began the long journey toward revising the common rule in 2011 with an advance notice of proposed rulemaking, and again in 2015 with a massive notice of proposed rulemaking. This included provisions that drew criticism from many in the research community. After reviewing over 2,100 comments, HHS decided not to adopt many of the proposed policies. For example:

• The final rule does not include a controversial proposal to put research involving nonidentified biospecimens, such as blood and tissue samples, under the Common Rule (the result of which would have been to require consent for all future research involving biospecimens).
• The final rule did not adopt the proposed rule’s more stringent criteria for obtaining a waiver of the consent requirements for identifiable biospecimens.
• The final rule does not extend the Common Rule to cover clinical trials that are not federally funded.
• The final rule does not include proposed privacy standards for identifiable information and biospecimens.
• The final rule does not adopt the proposed concept of “excluded” activities. What were previously considered “excluded” activities are now either described as not satisfying the definition of what constitutes research under the regulations or are classified as exempt.

Key Changes in the Final Rule

While the final rule does not adopt all of the proposed policies, it does make important changes to the Common Rule:

Activities Not Research, and Excluded Research. The new rule retains the existing definition of research, but lists four activities that are deemed not to be research, and therefore not covered by the rule:

• Scholarly and journalistic activities.
• Public health surveillance activities.
• Collection of information or biospecimens for criminal justice activities.
• Authorized operational activities in support of national security missions.

In addition, the rule incorporates new exclusions for research that is considered low-risk, or for which there are appropriate safeguards already in place independent of the Common Rule, such as:

• Research on instructional techniques, educational tests, survey and interview procedures, and observation of public behavior.
• Research involving benign behavioral interventions in conjunction with the collection of information from an adult subject through verbal or written responses or audiovisual recording.
• Secondary research use of information that is publicly available.
• Secondary research use of information (including information about biospecimens) recorded without identifiers.
• Secondary use of health information permitted by HIPAA for health care operations, research or public health activities (the agencies believe that HIPAA protections are adequate for these activities, and wish to avoid imposing the burden of additional regulations).

Secondary research means the re-use of  identifiable information and identifiable biospecimens that are collected for some other initial activity. The commentary says that information or biospecimens that are covered by this exemption would generally be found by the investigator in some type of record or tissue repository collected for some other purpose; the exemption does not cover the primary collection of information or biospecimens.

The final rule does not adopt the proposed exclusion for quality assurance and improvement activities, because the formulation of the exception in the proposed rule would have been confusing.  The agencies say that human subject protection would be appropriate for some QA/QI research activities, but not for others. In the result, the final rule does not single out particular QA/QI activities as meeting or not meeting the definition of research.

Secondary Use of Identifiable Private Information and Biospecimens.  In addition, the rule includes two exceptions to the requirement for informed consent where “broad consent” (discussed below) is obtained.  These permit use for secondary research of identifiable private information and biospecimens. The first exception permits storing and maintaining the information and biospecimens, and the second permits using it for secondary research (but, again, not for primary or initial research activities).  The use of these exceptions requires IRB approval.

Mandating Single IRBs for Cooperative Research.  Currently, each institution engaged in a cooperative research study is required to obtain IRB approval of the study.  Although separate approval by a local IRB is not required, this frequently occurs, with resulting delays in the initiation of studies and the recruitment of subjects. The rule will require all institutions located in the U.S. that are engaged in cooperative research to use a single IRB for research conducted in the U.S., unless more than one IRB is required by law, or a supporting federal agency determines that the use of a single IRB is not appropriate.  This requirement has a separate 3-year compliance deadline to allow institutions time to develop the necessary policies and procedures.

Application to IRBs.  Currently, independent IRBs – those not operated by an institution holding a Federalwide Assurance (FWA) – are not required to comply with the common rule and are therefore not accountable to the agencies for violations. Instead, the practice of HHS’s Office for Human Research Protection has been to hold the institution engaged in research responsible for compliance violations, even if the violation is directly related to the responsibilities of the IRB.  Understandably, this has made institutions reluctant to rely on IRBs that they do not operate themselves, creating an impediment to cooperative research that relies on another institution’s IRB.  The new rule applies directly to IRBs engaged reviewing research that is subject to the rule.  This change is intended to reassure institutions using an independent IRB because compliance can now be enforced directly against the IRB, rather than against the institutions that relied on its review.

Use of Unidentified Biospecimens.  The proposed rule would have revised the definition of “human subject” to include unidentified biospecimens.  The final rule does not adopt this proposal.  It does, however, add requirements to the informed consent process to give prospective subjects more information about how their biospecimens or private information might be used. Under the new rule, researchers must tell prospective subjects that identifiers might be removed from their biospecimens or private information and used for future research, if that is a possibility. If the subject’s biospecimens may be used for commercial profit, the consent must contain a statement to that effect, and it must tell the subject whether or not he or she will share in the profit.

Informed Consent.  The new rule contains major revisions to the informed consent requirements, both in organization and in substance, and it introduces a new approach – “broad consent” – which may be obtained instead of informed consent for the storage, maintenance and secondary use of identifiable private information or biospecimens.

Under the new rule, informed consent must  begin with a concise and focused presentation of the key information that is most likely to assist a prospective subject in understanding why one might or might not want to participate in the research. This part of the informed consent must be organized and presented in a way that facilitates comprehension.  Informed consent as a whole must present  information in sufficient detail relating to the research, and must be organized and presented in a way that does not merely provide lists of isolated facts, but rather facilitates the prospective subject’s understanding of the reasons why one might or might not want to participate. The informed consent may not include any exculpatory language through which the subject is made to waive any legal rights, or release the investigator, the sponsor or the institution from liability for negligence.

The commentary says that the introductory part should be a concise explanation of the following:

• The fact that consent is being sought for research and that participation is voluntary.
• The purposes of the research, the expected duration of the prospective subject’s participation, and the procedures to be followed in the research.
• The reasonably foreseeable risks or discomforts to the prospective subject.
• The benefits to the prospective subject or to others that may reasonably be expected from the research.
• Appropriate alternative procedures or courses of treatment, if any, that might be advantageous to the prospective subject.

The commentary expects that this description would be no more than a few pages long, and would provide key information and describe major risks; by contrast, a 10-page description of potential risks accompanied by lengthy and complex charts and graphs would not satisfy the requirement.

There follow specific requirements for informed consent, to which are added now the following:

• One of the following statements about any research that involves the collection of identifiable private information or identifiable biospecimens:
• A statement that identifiers might be removed from the identifiable private information or identifiable biospecimens and that, after such removal, the information or biospecimens could be used for future research studies or distributed to another investigator for future research studies without additional informed consent from the subject or the legally authorized representative, if this might be a possibility; or
• A statement that the subject’s information or biospecimens collected as part of the research, even if identifiers are removed, will not be used or distributed for future research studies.
• A statement that the subject’s biospecimens (even if identifiers are removed) may be used for commercial profit, and whether the subject will or will not share in this commercial profit.
• A statement regarding whether clinically relevant research results, including individual research results, will be disclosed to subjects, and if so, under what conditions.

The regulation permits electronic informed consent.

Broad Consent. The new rule introduces broad consent, which is intended to allow the storage and use of identifiable private information and biospecimens for unspecified future use. This follows a similar modification in 2013 of the HIPAA requirement for authorization for future research.

Broad consent is an alternative to informed consent for secondary research only. It requires the following elements of informed consent, and some additional disclosures:

• A description of the risks and benefits of the research;
• A description of the extent to which confidentiality of records identifying the subject will be maintained, if at all;
• A statement that participation is voluntary, and may discontinued at any time;
• If applicable, a statement that the subject’s biospecimens (even if identifiers are removed) may be used for commercial profit and whether the subject will or will not share in this commercial profit; and
• For research involving biospecimens, whether the research will or might include whole genome sequencing.

The additional disclosures are:

• A general description of the types of research that may be conducted with the identifiable private information or identifiable biospecimens. This description must include sufficient information such that a reasonable person would expect that the broad consent would permit the types of research conducted.
• A description of the identifiable private information or identifiable biospecimens that might be used in research, whether sharing of identifiable private information or identifiable biospecimens might occur, and the types of institutions or researchers that might conduct research with the identifiable private information or identifiable biospecimens.
• A description of the period of time that the identifiable private information or identifiable biospecimens may be stored and maintained (which period of time could be indefinite), and a description of the period of time that the identifiable private information or identifiable biospecimens may be used for research purposes (which period of time could be indefinite).
• Unless the subject or legally authorized representative will be provided details about specific research studies, a statement that they will not be informed of the details of any specific research studies that might be conducted using the subject’s identifiable private information or identifiable biospecimens, including the purposes of the research, and that they might have chosen not to consent to some of those specific research studies.
• Unless it is known that clinically relevant research results, including individual research results, will be disclosed to the subject in all circumstances, a statement that such results may not be disclosed to the subject.
• An explanation of whom to contact for answers to questions about the subject’s rights and about storage and use of `the subject’s identifiable private information or identifiable biospecimens, and whom to contact in the event of a research-related harm.

Waiver of Informed Consent. The rule currently allows an IRB to waive informed consent or alter the requirements for it if the research involves no more than minimal risk to the subjects; the waiver or alteration will not adversely affect the rights and welfare of the subjects; the research could not practicably be carried out without the waiver or alteration; and whenever appropriate, the subjects will be provided with additional pertinent information after participation. The new rule mandates that for research involving identifiable private information or identifiable biospecimens, the requirements of informed consent can be waived or altered only if the research could not practicably be carried out without using such information or biospecimens in an identifiable format.

IRBs are also now prohibited from waiving informed consent for an individual who was asked to provide broad consent for the secondary use of identifiable private information or biospecimens, and declined to provide it.

Screening and Recruiting. The final rule authorizes an IRB to approve a research proposal in which an investigator will obtain information or biospecimens for the purpose of screening, recruiting, or determining the eligibility of prospective subjects without the informed consent of the prospective subject, if either of the following conditions are met:

• The investigator will obtain information through oral or written communication with the prospective subject, or
• The investigator will obtain identifiable private information or identifiable biospecimens by accessing records or stored identifiable biospecimens.

Posting of Clinical Trial Consent Forms. A new provision in the final rule requires investigators conducting clinical trials supported by a federal department or agency to post an IRB-approved informed consent form used to enroll subjects on a publicly available federal website that is to be established by HHS as a repository for these forms. By making consent forms public, HHS intended to invite more public scrutiny and incentivize efforts to improve the clarity and completeness of forms – though this may of course attract attention from government regulators or plaintiffs’ attorneys.

Health care providers, research institutions, and IRBs that are affected by the changes should review their forms and practices for compliance with the new requirements, and understand how the rule interacts with other areas of regulation, such as HIPAA.

Hooper, Lundy & Bookman provides assistance to health care providers and IRBs in research and privacy compliance. For assistance, please contact Paul Smith, Katrina Pagonis or Andrea Frey in San Francisco at 415.875.8500; Sandi Krul or Stacie Neroni in Los Angeles at 310.551.8111; Bob Roth or Kelly Carroll in Washington, D.C. at 202.580.7700; or Amy Joseph in Boston at 617.532.2702.