Federal Register Quietly Publishes Final Changes to the Common Rule
With contributions by: David Babaian, Dominic Chiarelli, and Aarthi Iyer
On January 19, 2017, the U.S. Department of Health and Human Services (HHS) published historic revisions to the Common Rule, the regulation governing federally funded human subject research since 1991.
HHS first indicated its intent to modernize the Common Rule when it published an Advanced Notice of Proposed Rulemaking (ANPRM) in July 2011. In September 2015, just over four years later, the agency published a more modest set of proposed changes via the Notice of Proposed Rulemaking (NPRM). Both the ANPRM and NPRM gave rise to vigorous debate and commentary within the research community. Like the final installment of a blockbuster trilogy, the revised regulation comes after much anticipation and trepidation and is already stirring impassioned analysis and conversation.
The final rule implements many of the changes discussed in the NPRM but also differs in several significant ways. Quorum Review IRB previously prepared summaries of the eight changes identified by HHS as the “most significant.”
How the Final Rule Compares to Proposed Changes
NPRM: The NPRM proposed several changes to the informed consent requirements, including the manner in which information must be presented to participants (e.g. “tiered consent”); posting of the final consent document on a public federal website; new elements of consent, including a statement regarding research involving the collection of identifiable private information; and new elements for broad consent to the storage, maintenance, and secondary research use of all biospecimens (regardless of identifiability) or identifiable private information.
Final Rule: HHS largely adopted the NPRM’s language and framework related to improving the informed consent process and fostering understanding. However, instead of following the NPRM’s mandates regarding the format of the consent document (requiring the use of appendices for information beyond the core elements), the final rule allows for more flexibility in what key information is presented at the beginning of the consent form.The final rule also follows the NPRM requirement that federally funded clinical trials post an IRB-approved informed consent form to a publicly available federal website that will be established as a repository for such forms (with some modifications and clarifications).
The most significant difference between the NPRM and final rule is that HHS decided not to expand the definition of “human subjects” to include all uses of biospecimens (discussed further below). Thus, while the final rule still includes elements of broad consent, these only apply to identifiable biospecimens and identifiable private information. Additionally, where broad consent is allowed, it is presented as merely an alternative to seeking study-specific consent or asking an IRB to waive the requirement to obtain informed consent. Relatedly, the final rule extends the new element of consent for research involving the collection of identifiable private information to identifiable biospecimens.
NPRM: HHS intended to modify the definition of “human subjects” to include all uses of biospecimens by an investigator conducting research. Most future uses of biospecimens would therefore require at least broad informed consent obtained either at the point of collection or prior to the subsequent use. The Secretary of HHS would publish templates for broad consent that, if used as is, would not require IRB review.
Final Rule: The definition of “human subjects” no longer includes all uses of biospecimens. The definition is now significantly narrowed to “identifiable” biospecimens. One word makes all the difference. Under the NPRM, debate over identifiability was moot since biospecimen research was essentially deemed human subject research. Now, the debate over biospecimen identifiability remains incredibly relevant and will remain inherently relevant—the final rule calls for a reexamination of the meaning of “identifiable specimen” within one year and at least every four years thereafter. Considering technology’s constantly improving ability to identify seemingly unidentifiable biospecimens, this reexamination seems necessary. The problem is the infinite uncertainty created by an approach that may redefine “identifiable” one year from now and at a regular cadence after that.
NPRM: The NPRM would exclude certain activities from the Common Rule requirements that should be deemed not to be research, are inherently low risk, or where adequate protections are mandated outside the Common Rule. The determination that an activity is excluded would not require a third party review or assessment.
Final Rule: The concept of “excluded” activities was not adopted, due to commenter concerns regarding complexity. Generally, to retain a more familiar structure, activities proposed to be excluded are now either described as not satisfying the definition of what constitutes research under the regulations or are classified as exempt.
NPRM: Several additional categories of exempt research were proposed along with modifications to existing categories. Certain exempt research would be required to provide privacy safeguards for biospecimens and identifiable private information. Federal departments and agencies would also develop an exemption decision tool that could be relied upon by investigators and institutions as an alternative to an administrative or IRB exempt determination.
Final Rule: The final rule modifies existing exempt categories and establishes new categories of research in hopes that this will allow for more research studies to be eligible for exemption.In creating a category for research involving benign behavioral interventions in adults, the final rule opens up a pathway for efficient review of studies regulators deem as brief in duration, painless, respectful, and overall harmless—such as having subjects playing an online game, or solve puzzles under various noise conditions, and the like.
Additional exempt categories focus on secondary research involving identifiable private information, where some activities may be conducted without consent (provided that they are regulated by HIPAA) or through the use of a broad consent. Theoretically, the goal here is to allow investigators to proceed without needing to obtain specific informed consent for each secondary research study and to reduce unnecessary regulatory burden on IRBs. However, any research classified under these exemption categories would still be required to undergo IRB review to ensure that there are adequate privacy and confidentiality safeguards—standards applied to non-exempt research as well.
With insightful consideration of public comments, the final rule does recognize that IRBs may not always be equipped with the expertise needed to evaluate risks to privacy and confidentiality (e.g. reviewing increasingly sophisticated IT security schemas), and requires that the Secretary of HHS, in consultation with other federal partners, issue guidance to assist IRBs in assessing what provisions are adequate to protect privacy of subjects and to maintain the confidentiality of data.
Lastly, while the final rule does not include the use of decision tools for making exemption determinations at this time, commentary does suggest that development of a well-designed, validated, and standardized exemption tool remains in sight.
Revised Requirements for Waiver of Consent
NPRM: HHS proposed revisions to the conditions and requirements for waiver or alteration of consent such that waiver of consent for research involving biospecimens (regardless of identifiability) will occur only in very rare circumstances.
Final Rule: Waiver criteria remain mostly unchanged in the final rule with the exception of two revisions that have been adopted from the NPRM. The final rule now mandates that for research involving access to or use of identifiable private information or identifiable biospecimens, the requirements of informed consent can be waived only if the research could not practicably be carried out without using such information or biospecimens in an identifiable format.
Similar to the original version of rule, researchers and IRBs are still left without valuable guidance concerning the proper interpretation of ‘practicably’ in the context of waivers, with the explanation instead deferring that the requirements for waiver appropriately honor respect for persons and balance this with other ethical principles.
Additionally, the final rule prohibits IRBs from waiving informed consent if individuals were asked and declined to provide broad consent to the storage and maintenance for secondary research use of identifiable private information or identifiable biospecimens. While this language honors autonomy of individuals and furthers the Belmont Report principle of respect for persons, researchers may face a significant and ongoing administrative obligation to develop systematic record keeping and reporting of such refusals when seeking downstream waivers for secondary research use.
Of note, the final rule does not adopt the NPRM language calling for more stringent criteria for obtaining a waiver of consent for identifiable biospecimens because the NPRM’s proposal that the Common Rule extend to all biospecimens has not been adopted.
NPRM: The NPRM would require that only one IRB act as the IRB of record for U.S. sites participating in a multi-site study (except when additional IRB review is required by law or when a federal funding agency determines the use of a single IRB is not appropriate for a particular study).
Final Rule: The final rule largely adopts the NPRM’s proposal to mandate use of a single IRB for cooperative research.The only significant revision is to provide the grantee or lead institution with the ability to recommend an IRB to oversee the research, which is in accordance with the NIH’s recent mandate for the use of single IRBs.
The effect of the final rule’s single IRB mandate is different than the previous proposal due to the decision to not extend the Common Rule’s scope. The result is that the regulated research community largely ends up where they already were—use of a single IRB for federally funded research only.
Interestingly, despite the NIH single IRB mandate having essentially a one-year compliance grace period, the final rule retains a three-year compliance grace period to allow institutions the “time and flexibility” to adjust to the new model for cooperative research projects.
Revised Continuing Review Requirements
NPRM: HHS intended to eliminate continuing review for minimal risks studies qualifying for expedited review; other studies where the only remaining activities include data analysis and/or accessing follow-up data related to standard of care procedures; and certain secondary research using identifiable private information and biospecimens.
Final Rule: The circumstances in which continuing review is to be eliminated, absent explicit justification, have been essentially retained. Notably, the final rule does not include the requirement that investigators provide annual confirmation that the research proceeds unchanged, though institutions do have the flexibility to require such an accounting.
Extending the Scope of the Common Rule
NPRM: The NPRM would extend the Common Rule to any clinical trial conducted at an institution that receives federal support for human subject research, regardless of the funding for the particular study. Clinical trials already subject to FDA regulations would not be subject to the Common Rule (if no federal funding).
Final Rule: The Common Rule will not be expanded to cover clinical trials that are not federally funded. In the final rule preamble, HHS acknowledged concerns by commentators that the NPRM proposal would increase administrative burden (such as federal reporting requirements) without a corresponding increase in meaningful protection of human subjects.Additionally, while HHS’s intention was to cover certain types of higher risk research not currently subject to the federal policy, the NPRM’s definition of “clinical trial” could apply to some low-risk social, behavioral, or educational research and to quality improvement or quality assurance activities. HHS therefore determined that its proposal would benefit from further deliberation. Importantly, the definition of “clinical trial” is maintained in the final rule for the narrow purpose of determining which studies must post consent forms to a public federal website. (See above discussion on the revisions to the requirement for informed consent.)
Expectations for IRBs and Researchers
The general compliance date for the revised regulation is January 19, 2018. The requirements for cooperative research will not take effect for three years from publication of the final rule—January 20, 2020.
However, for over a decade the research community has been following procedures and policies based on the previous version of the Common Rule. Overhauling and establishing revised policies and processes will constitute a major undertaking for most IRBs and institutions, and will likely present considerable administrative challenges, including significant outreach and education efforts.
In the coming weeks, we will publish additional analysis and commentary on the final rule and its impact on the research community. Join our mailing list so you don’t miss a beat.
Update: Many articles have been published on the new Common Rule since its release. For an overview of resources and coverage of the Revised Common Rule, we recommend visiting the Public Responsibility in Medicine & Research (PRIM&R) website.