Excerpts from the January 19, 2017 Revised Common Rule Preamble

The Federal Policy for the Protection of Human Subjects (also known as the "Common Rule" and codified for HHS at 45 CFR part 46, subpart A) was originally promulgated in 1991 and amended in 2005.  This version of the Common Rule is referred to as the "pre-2018 Common Rule" or “pre-2018 Requirements”  You can find the pre-2018 Common Rule by reviewing subpart A of 45 CFR part 46 as published in the 2016 edition of the Code of Federal Regulations (CFR).

A comprehensive revision to the Common Rule was published in the Federal Register on January 19, 2017 (82 FR 7149).  The revised Common Rule has been amended twice, in an interim final rule published on January 22, 2018 (83 FR 2885), and in a final rule published on June 19, 2018 (83 FR 28497). The revised Common Rule is referred to as the “2018 Requirements."

About this page:

This page shows excerpts from the January 19, 2017 preamble to the revised Common Rule.  This preamble included summaries of policy proposals from the September 8, 2015 notice of proposed rulemaking (NPRM), summaries of public comments received on the September 8, 2015 NPRM, responses to public comments, and descriptions of the final rule provisions. 

This webpage only includes the responses to public comments and descriptions of the revised Common Rule provisions.  It also shows preamble excerpts in the order that they appear in the official version of the January 19, 2017 revised Common Rule preamble.

Index

§__.101 To What Does This Policy Apply? Scope and Applicability of the Regulations

• §__.101(a) IRBs Not Operated by an Institution Holding a Federalwide Assurance
• Activities Deemed Not to be Research Appear at §__.102(l) and Research Exempt from This Policy Appears at §__.104
• §__.101(c)(d)(i) Department or Agency Discretion in Applying the Policy
• §__.101(f) State and Local Laws that Provide Additional Protections for Human Subjects)
• §__.101(h) Research Covered by This Policy Conducted in Foreign Countries
• §__.101(j) Harmonization of Department and Agency Guidance
• §__.101(l) Compliance Dates and Transition Provisions of the Final Rule
  
• Note: The effective date and general compliance date of the revised Common Rule has been delayed. The revised Common Rule is effective July 19, 2018.
  
• Note that from July 19, 2018 through January 20, 2019 institutions are not permitted to implement the entirety of the revised Common Rule. This is explained in the transition provision (45 CFR 46.101(l), as amended) and in the preamble to the June 19, 2018 final rule delaying the general compliance date of the revised Common Rule.
• §__.101(m) Severability

§__.102 Definitions for Purposes of this Policy

• §46.102(a) Certification
• §46.102(b) Clinical Trial
• §46.102(c), (d), and (f) Department or Agency Head and Federal Department or Agency/Institutions
• §46.102(e) Human Subject
• §46.102(i) Legally Authorized Representative
• §46.102(j) Minimal Risk
• §46.102(k) Public Health Authority
• §46.102(l) Research
  
• §46.102(l)(1) Scholarly and Journalistic Activities (e.g., Oral History, Journalism, Biography, Literary Criticism, Legal Research, and Historical Scholarship)
• §46.102(l)(2) Public Health Surveillance
• §46.102(l)(3) Criminal Justice Activities
• §46.102(l)(4) Authorized Operational Activities in Support of National Security Missions
• §46.102(m) Written or in Writing
  

§__.103 Ensuring Compliance with this Policy

§__.104 Exempt Research

• §__.104(b) Applicability of Exemptions to Subparts B, C, and D
• §__.104(d) Categories of Exempt Research,

• §__.104(d)(1) Research Conducted in Established or Commonly Accepted Educational Settings When It Specifically Involves Normal Educational Practices
• §__.104(d)(2) Research that Includes Only Interactions Involving Educational Tests (Cognitive, Diagnostic, Aptitude, Achievement), Survey Procedures, Interview Procedures, or Observation of Public Behavior (Including Visual or Auditory Recording), if at Least One of Three Criteria is Met
• §__.104(d)(3) Research Involving Benign Behavioral Interventions in Conjunction with the Collection of Information From an Adult Subject
• §__.104(d)(4) Secondary Research Use of Identifiable Private Information and Identifiable Biospecimens for which Consent Is Not Required

• §__.104(d)(4)(i) Research Involving the Collection or Study of Identifiable Private Information or Identifiable Biospecimens That are Publicly Available

• §__.104(d)(4)(ii) Research Involving the Collection or Study of Information (Which May Include Information About Biospecimens) That Has Been or Will Be Collected and is Recorded without Identifiers

• §__.104(d)(4)(iii) The HIPAA [Exemption]

• §__.104(d)(4)(iv) Research Conducted by a Government Agency Using Government Generated or Government Collected Data Obtained for Nonresearch Activities

• §__.104(d)(5) Research and Demonstration Projects Conducted or Supported by a Federal Department or Agency

• §__.104(d)(6) Taste and Food Quality Evaluation and Consumer Acceptance Studies

• §__.104(d)(7) and (8) Secondary Research Use of Identifiable Private Information or Identifiable Biospecimens (or Storage or Maintenance for Such Secondary Research Use) for Which Broad Consent Is Required

• §__.104(d)(7) Exemption for the Storage or Maintenance for Secondary Use of Identifiable Private Information or Identifiable Biospecimens for which Broad Consent is Required

• §__.104(d)(8) Exemption for Research Involving the Use of Identifiable Private Information or Identifiable Biospecimens for which Broad Consent is Required

• Deletion of the Pre-2018 Requirement’s Exemption for Surveys and Interviews of Public Officials (Pre-2018 Requirements at §__.101(b)(3))

§§__.107(a), __.111(a)(3), and __.111(b) IRB Membership and Modification to References to Vulnerability

§__.108 IRB Functions and Operations

§__.109 IRB Review of Research

§__.110 Expedited Review Procedures

§__.111 Criteria for IRB Approval of Research

§__.114 Cooperative Research

§__.115 IRB Records

§__.116 General Requirements for Informed Consent

• §__.116(a) General Requirements for Informed Consent
• §__.116(b) Basic Elements of Informed Consent 
• §__.116(c) Additional Elements of Informed Consent 
• §__.116(d) Elements of Broad Consent for the Storage, Maintenance, and Secondary Research Use of Identifiable Private Information or Identifiable Biospecimens 
• §__.116(e) Waiver or Alteration of Informed Consent Involving Public Benefit and Service Programs 
• §__.116(f) General Waiver or Alteration of Informed Consent 
• §__.116(g) IRB Approval of Research Involving Screening, Recruiting, or Determining Eligibility of Prospective Subjects 
• §__.116(h) Posting of Consent Form

§46.117 Documentation of Informed Consent

§46.118 Applications and Proposals Lacking Definite Plans for Involvement of Human Subjects

§46.119 Research Undertaken Without the Intention of Involving Human Subjects

§46.124 Conditions

Discussion of Several September 8, 2015 NPRM Proposals Not Included in the 2018 Common Rule:

• NPRM Proposal Not Adopted in the Final Rule: Coverage of Clinical Trials
• NPRM Proposal Not Adopted in the Final Rule: Deeming Certain Quality Assurance and Quality Improvement Activities “Not Research”
• NPRM Proposal Not Adopted in the Final Rule: Deeming Certain Program Improvement Activities “Not Research”
• NPRM Proposal Not Adopted in the Final Rule: Exemption Determination
• NPRM Proposal Not Adopted in the Final Rule: Proposal to Exempt Secondary Research Use of Identifiable Private Information Where Notice Was Given
• NPRM Proposal Not Adopted in the Final Rule: Protection of Identifiable Private Information and Identifiable Biospecimens

Additional information provided in the January 19, 2017 revised Common Rule preamble:

• Treatment of newborn dried blood spots under the revised Common Rule
• Treatment of Clinical Data Registries under the revised Common Rule
• Considerations of where clinical trial informed consent forms might be posted

***

§__.101. To What Does This Policy Apply? Scope and Applicability of the Regulations

§__.101(a) IRBs Not Operated by an Institution Holding a Federalwide Assurance

New language at §__.101(a) is adopted that gives Common Rule departments and agencies the authority to enforce compliance directly against IRBs that are not operated by an assured institution. This authority will allow Common Rule departments and agencies to avoid involving other engaged institutions in enforcement activities related to the responsibilities of the designated IRB. It is anticipated that this change will reassure institutions using an IRB that they do not operate because compliance actions could be taken directly against the IRB responsible for the regulatory noncompliance, rather than against the institutions that relied on that review.

[Back to top]

Coverage of Clinical Trials (NPRM proposal not included in the final rule)

The final rule does not adopt the NPRM proposal. Although we continue to maintain the position that increased harmonization of appropriate standards for ethical oversight of human subjects research is an important and desirable endpoint, we agree with the concerns expressed by commenters suggesting that our proposal for extending the Common Rule to currently unregulated clinical trials would benefit from further deliberation.

[Back to top]

Activities Deemed Not to be Research Appear at §__.102(l) and Research Exempt from This Policy Appears at §__.104

In response to the public comments, the NPRM’s general approach of designating various categories of activities as excluded is not included in the final rule. The final rule reverts to the general structure of the pre-2018 rule and integrates some of the categories proposed for exclusion in the NPRM into that structure. Some changes to the categories are also included in the final rule.

In the final rule, some of the proposed exclusions from the requirements of the Common Rule are addressed in the definition of research, which includes a provision identifying “activities that are deemed not to be research” (see Section III [of the revised Common Rule preamble]). In addition, some of the proposed exclusions are included as exemptions in the final rule. Under §__.101(b) of the pre-2018 rule, six categories of research were considered exempt from this policy unless otherwise required by department or agency heads. In the final rule, exempt research is now described at §__.104 and eight categories are included (see Section V [of the revised Common Rule preamble]).

[Back to top]

§__.101(c), (d), and (i) Department or Agency Discretion in Applying the Policy

The final rule adopts the NPRM proposals in §__.101(c). Thus, under §__.101(c), department or agency heads retain final judgment as to whether a particular activity is covered by the Common Rule, and this judgment should be exercised consistent with the ethical principles of the Belmont Report. We note that under the pre-2018 requirements Common Rule departments and agencies retained final authority as to whether a particular human subjects research study conducted or supported by that department or agency is covered by the Common Rule (§__.101(c)) and that authority continues under the final regulations, but with the new limitation that this judgment must be consistent with the ethical principles of the Belmont Report. This discretion provides important flexibility given the varying missions and policies of the many departments and agencies.

Although some commenters were opposed to ever granting departments or agencies the authority permitted by §__.101(c), we believe requiring that these decisions be consistent with the principles of the Belmont Report is an approach that promotes accountability while still giving federal departments and agencies the necessary flexibility to achieve their respective missions.

The final rule in §__.101(d) does not adopt the NPRM proposals, and instead retains the pre-2018 language. The NPRM proposed to modify §__.101(d) to say that department or agency heads could require additional protections to research activities conducted or supported by federal departments or agencies, but that were not otherwise covered by the Common Rule. This language was intended as a clarification to the pre-2018 language. However, we determined that the term “additional protections” could potentially be confusing in that the activities at issue in this provision are those for which no Common Rule protections are required; thus the protections imposed by department or agency heads might be the only protections to which these activities are subject. We also note that departments or agencies conducting or supporting an activity subject to the Common Rule may require additional protections for human subjects.

The final rule also does not incorporate the NPRM proposal in §__.101(d) that advance public notice must be provided when a department or agency head requires that the Common Rule, or part of it, be applied to research activities not otherwise subject to the rule. Upon further assessment, we decided that such a requirement could hinder the ability of a department or agency to move quickly in cases where the department or agency determined that additional protections are warranted.

Section __.101(i) of the final rule adopts a majority of the NPRM proposals. As proposed in the NPRM, §__.101(i) is modified to require that any alternative procedures adopted by departments or agency heads are consistent with the principles of the Belmont Report. Also as proposed in the NPRM, §__.101(i) is modified to state that, unless otherwise required by statute or executive order, notice of these alternative procedures must be forwarded to OHRP (or any successor office), or to the equivalent office within the appropriate federal department or agency. The pre-2018 rule only listed OHRP (or any successor office) as the office to which notices must be sent. This final rule modification is intended to ensure that if a non-HHS department or agency allows for alternative procedures, the appropriate office within that same department or agency receives notification. The final rule retains the pre-2018 requirement for the notice to also be published in the Federal Register or in such other manner provided for in department or agency procedures.

The final rule also adopts in §__.101(i) the NPRM proposal to require that the waiver notice include a statement that identifies the conditions under which the waiver will be applied and a justification as to why the waiver is appropriate for the research, including how the decision is consistent with the principles in the Belmont Report.

Section __.101(i) of the final rule does not include the NPRM proposal that would have required each federal department or agency conducting or supporting the research to establish on a publicly accessible federal website a list of the research for which a waiver has been issued. We decided that the rule’s requirement to publish the waiver notice in the Federal Register, or in such other manner as provided in department or agency procedures, adequately ensures that the waiver notice will be available to the public without also requiring that such notices be listed on a federal website. We note that some departments, such as HHS, currently post such notices on their websites.

The final rule thus formally codifies in §__.101(c) and (i) the general practice that the ethical standards articulated in the Belmont Report are the ethical standards that Common Rule departments or agencies will use in determining whether an activity is covered under this policy or whether to grant a waiver of the applicability of some or all of the provisions (unless otherwise required by law). The addition of the reference to the Belmont Report makes explicit the ethical basis underpinning how waiver decisions have and must be considered.

[Back to top]

§__.101(f) State and Local Laws that Provide Additional Protections for Human Subjects)

Consistent with the pre-2018 rule, this final rule retains the language in §__.101(f)) providing that the Common Rule does not affect any state or local laws or regulations that may otherwise be applicable and that provide additional protections for human subjects. However, the final rule adds clarifying language providing that the referenced state or local laws or regulations include tribal laws passed by the official governing body of an AI/AN tribe. Thus, if the official governing body of a tribe passes a tribal law that provides additional protections for human subjects, the Common Rule does not affect or alter the applicability of such tribal law. (Note that a similar change was also made to §__.116(i) and (j) to provide the same clarification.) In addition, for purposes of the exception to the single IRB review requirement for cooperative research, relating to circumstances where review by more than a single IRB is required by law, §__.114(b)(2)(i) specifies that tribal law is to be considered in assessing whether more than single IRB review is required by law.

[Back to top]

§__.101(h) Research Covered by This Policy Conducted in Foreign Countries

The final rule adopts the NPRM proposal. Although the pre-2018 requirements cited the Declaration of Helsinki as an example of internationally recognized ethical standards that a foreign country might use as its ethical base, we note that providing a specific example of an internationally recognized ethical document is concerning because such a document is subject to change independent of Common Rule department or agency policies, and therefore might be modified in ways that create standards that are inconsistent with U.S. laws and regulations.

[Back to top]

§__.101(j) Harmonization of Department and Agency Guidance

We believe there is a compelling case for as much consistency as is possible regarding guidance on the protections of human subjects. As such, the final rule implements the NPRM proposal at §__.101(j). The final rule creates a requirement that guidance should be issued only after consultation among the Common Rule departments and agencies, while also permitting guidance to be issued without such consultation when it is not feasible. The proposal recognizes that harmonization will not always be possible or desirable given the varied missions of the departments and agencies that oversee the protection of human subjects and differences in their statutory authorities.

We note that some public comments expressed concern about the acceptable degree of variability among departments and agencies and encouraged attention to these concerns when diverging on guidance. The departments and agencies that oversee the protection of human subjects have a variety of missions and functions, including regulatory agencies and agencies that conduct and support research. In addition, in some cases, statutory differences among the departments and agencies have resulted in different regulatory requirements and guidance. They also oversee very different types and phases of research and thus may have reasonable justifications for differences in guidance. However, we agree that efforts should be made to issue collective guidance when possible and feasible and in a timely manner. We do not believe that this provision will result in the issuance of less guidance, because it largely codifies what has been the working practice among Common Rule departments and agencies up to this point.

[Back to top]

§__.101(l) Compliance Dates and Transition Provisions of the Final Rule

[Back to top]

§__.101(m) Severability

A severability clause has been added as §__.101(m), providing that if any provision of this final rule is held to be unenforceable in one set of circumstances, it should be construed to give maximum effect to the provision as applied to other persons or circumstances. Similarly, if a provision is held to be invalid or unenforceable, that provision should be severable from, and have no impact on the application of, the remainder of the rule. This provision reflects our intention regarding the way that this final rule, and the pre-2018 rule, should be construed and interpreted and is meant as a clarification.

[Back to top]

§__.102. Definitions for Purposes of this Policy

The final rule revises and adds new definitions of key terms for the purposes of this policy, as summarized below. Some of the changes are made to clarify new provisions that appear elsewhere in the final rule. In addition, the definitions have been placed in alphabetical order to facilitate searching by the reader. The definitions of institution, IRB, and IRB approval are unchanged but appear in a different place in the regulatory language.

[Back to top]

§__.102(a) Certification

Although “certification” was defined in the pre-2018 requirements, as was proposed in the NPRM, the final rule clarifies that notification by the institution that a proposed research study has been reviewed and approved is made to the supporting “federal” department or agency and that it might be a component of the agency or department that is notified rather than the entity as a whole. This clarification relates to the change included in the final rule at §__.102(d) regarding the definition of “federal department or agency” that clarifies that this phrase refers to the department or agency itself, not its bureaus, offices, or divisions. There were no public comments on this clarification.

[Back to top]

§__.102(b) Clinical Trial

The final rule at §__.102(b) adopts the NPRM definition of “clinical trial,” which is a research study in which one or more human subjects are prospectively assigned to one or more interventions (which may include placebo or other control) to evaluate the effects of the interventions on biomedical or behavioral health-related outcomes. We generally expect that this definition will be applied harmoniously with the definition of clinical trial recently promulgated in the ClinicalTrials.gov final rule.

In response to public concerns about an overly expansive definition of “clinical trial” given the importance of that definition to the proposed extension of the rule to clinical trials previously not covered by the rule, we have eliminated that proposed expansion of coverage in this final rule. As such, the definition that appears in the final rule will only be relevant to the requirement for posting of consent forms for clinical trials conducted or supported by Federal departments or agencies (§__.116(h)). It should be appropriate for that relatively narrow regulatory purpose.

[Back to top]

§__.102(c), (d) and (f) Department or Agency Head and Federal Department or Agency/Institutions

The final rule adopts the NPRM proposals to provide new definitions of “department or agency head” and “federal department or agency,” which appear at §__.102(c) and (d). “Department or agency head” at §__.102(c) refers to the head of any federal department or agency, for example, the Secretary of HHS, and any other officer or employee of any federal department or agency to whom authority has been delegated. To add clarity to the definition found in the pre-2018 regulations, the example of the Secretary of HHS was inserted.

The final rule provides at §__.102(d) a definition of “federal department or agency” in order to avoid confusion as to whether this phrase encompasses federal departments and agencies that do not follow the Common Rule. The definition also clarifies that this phrase refers to the department or agency itself, not its bureaus, offices, or divisions. This is consistent with the historical interpretation of the Common Rule. Related to this, the definition of “institution” was changed at §__.102(f) in the final rule to clarify that departments can be considered institutions for the purposes of this policy. The final rule provides examples of what is intended by this definition: HHS, the Department of Defense, and the Central Intelligence Agency.

[Back to top]

§__.102(e) Human Subject

The final rule does not implement the proposed expansion of the definition of “human subject” to include all biospecimens regardless of identifiability. It is clear from the comments received that the public has significant and appropriate concern about both the need for obtaining consent before using such biospecimens for research, and the potential negative impacts of implementing that proposal on the ability to conduct research. And, while it does not substantially change the definition of “identifiable private information,” the final rule includes a new process by which Common Rule departments and agencies can regularly assess the scientific and technological landscape to determine whether new developments merit reconsideration of how identifiability of either information or biospecimens is interpreted in the context of research. Because the final rule does not implement the NPRM's proposed expansion to the definition of “human subject,” it also does not implement the NPRM proposal to exclude certain research activities involving nonidentified biospecimens.

With regard to changing the definition of “human subject” to include all biospecimens, the majority of commenters who addressed this expansion opposed it for a variety of reasons, as described above. As explained in the NPRM, one of the core reasons for proposing that the rule be broadened to cover all biospecimens, regardless of identifiability, was based on the premise that continuing to allow secondary research with biospecimens collected without consent for research places the publicly funded research enterprise in an increasingly untenable position because it is not consistent with the majority of the public's wishes, which reflect legitimate autonomy interests. However, the public comments on this proposal raise sufficient questions about this premise such that we have determined that the proposal should not be adopted in this final rule.

Further, the current regulatory policy appears to sufficiently protect against the unauthorized research use of identifiable biospecimens. Under the pre-2018 rule, if an investigator funded by a Common Rule department or agency uses nonidentified biospecimens and manages to re-identify them, that investigator would then be conducting human subjects research without IRB approval, in violation of the rules. It should also be noted that the position adopted in the final rule does not eliminate any authority, separate and apart from the Common Rule, that Common Rule departments and agencies have to establish policies with additional requirements related to consent for research involving nonidentifiable biospecimens or nonidentifiable private information, or preclude them from exercising such authority.

Nonetheless, we acknowledge the need to also appropriately respect and promote autonomy interests. Any future proposals aimed at promoting autonomy should jointly evaluate the importance of the autonomy interests at issue, as well as explicitly quantify the potential negative impacts the proposal might have on the ability to conduct research, including such consequences on the representativeness of biospecimens available for research.

In the final rule, we have added requirements to the informed consent process to increase transparency so that potential subjects will have more information about how their biospecimens or private information might be used. Specifically, prospective subjects will be told that identifiers might be removed from their biospecimens or private information and used for future research, if this might be a possibility. Finally, as some public comments addressed the desire to share in any profits that might accrue as a result of research use of their biospecimens, an additional element of consent will require, as appropriate, a statement that the subject’s biospecimens may be used for commercial profit and whether the subject will or will not share in this commercial profit. We believe that this increased attention to transparency in the consent process will allow individuals to make informed choices about whether they want to consent to current or future research uses of their biospecimens. A few clarifying changes are made in the final rule pertaining to the definition of “human subject” and the components within that definition, particularly referring to both information and biospecimens as key determinants of whether a human subject is involved in research.

With respect to the definition of “identifiable private information,” although the pre-2018 definition of “identifiable” did not incorporate a specific process for considering the growing volume of information being generated and shared in research (including from biospecimens), or consider how evolving technology can ease and speed the ability to re-identify information or biospecimens previously considered nonidentifiable, we appreciate that a change in that definition could have collateral implications with respect to imposing unwarranted consent requirements on activities that were not subject to the regulations. We appreciate the commenter requests for more guidance on how they should interpret the definition of identifiable private information. Thus, although the final rule only makes minor changes to the existing definition of “identifiable private information,” it sets in place a process (§__.102(e)(7), discussed below) that will help facilitate any necessary future updates to the understanding of that term.

In the final rule the language at §__.102(e)(1)(i) relating to information obtained through intervention or interaction with an individual was adopted and modified by replacing the reference to data, as proposed in the NPRM, with a reference to information or biospecimens, and by adding the NPRM-proposed language relating to using, studying, or analyzing the information or biospecimens. The explicit reference to biospecimens in this context is intended as a mere clarification of the previous understanding of how the pre-2018 rule operated.

Likewise, the final rule adopts the NPRM-proposed language at §__.102(e)(1)(ii) relating to obtaining identifiable private information, but modifies it by adding an explicit reference to “identifiable biospecimens.” This is also intended as a mere clarification of the previous understanding of how the pre-2018 rule operated as applied to biospecimens. Similarly, the definition of intervention has been modified to clarify that information or biospecimens might be gathered, replacing the former reference only to data. This, too, is merely a clarification of the existing understanding of that concept.

A definition of “identifiable biospecimen” has been added at §__.102(e)(6). This new definition was not added as a result of any substantive change, but rather to enable greater clarity in other provisions of these regulations in explaining when a particular provision relates to either identifiable private information alone (not including biospecimens), or identifiable biospecimens alone, or both. The pre-2018 rule’s concept of “identifiable private information” had encompassed the concept of an identifiable biospecimen, whereas under the final rule that concept has been “cleaved off” from that definition and given its own definition. Note that a biospecimen is deemed to include private information (consistent with the understanding of this concept under the pre-2018 rule), so there is no need to add the adjective “private” in the definition of an “identifiable biospecimen.” In effect, once a biospecimen becomes identifiable (for example, by being tagged with the name or other information that indicates the person from whom the biospecimen was obtained), then an investigator using that biospecimen is already using something to which §__.102(e)(1)(ii) would apply. There is no need to make any additional determination about the “private” aspects of what is taking place.

In addition, the minor clarifying change in the language for the concept of “private information” that was proposed in the NPRM, namely adding the phrase “shared or,” was not adopted. It was decided that because any information that should not be shared would always meet the standard of being information that should not be made public, this change would not actually expand the amount of information that is considered private information.

Although the description of when private information is identifiable was not significantly changed, a new provision has been added at §__.102(e)(7) requiring federal departments and agencies that implement the Common Rule to regularly, upon consultation with appropriate experts, reexamine the meaning of the terms “identifiable private information,” as defined in §__.102(e)(5), and “identifiable biospecimen,” as defined in §__.102(e)(6). Such reexamination shall take place at least every 4 years. This new provision specifically requires that the federal departments and agencies implementing this policy collaborate on this process to avoid a duplication of efforts and in order to have a consistent interpretation of these terms.

This new process responds to the growing volume of information being generated and shared in research (including from biospecimens), and evolving technology that can ease and speed the ability to re-identify information or biospecimens previously considered nonidentifiable. With an increase in the number of exemptions included in this final rule, it will be important to reconsider the potential identifiability of information and biospecimens and facilitate uniform interpretation to ensure adequate privacy and security measures are in place.

Section 102(e)(7) also provides that, after conducting this process, if it is determined to be appropriate and permitted by law, Common Rule departments and agencies could alter the interpretation of identifiable private information or identifiable biospecimens, including through the use of guidance.

In addition, there will occur, also at least every 4 years and as a collaborative process among those federal departments and agencies, upon consultation with appropriate experts, an assessment as to whether there are analytic technologies and techniques that should be considered by investigators to generate identifiable private information or identifiable biospecimens. The ultimate goal is to implement the Common Rule in a way that is aligned with the evolving understanding of the concept of identifiability while protecting subjects and encouraging and facilitating valuable research.

To the extent that this process leads to a determination that particular analytic technologies or techniques, when applied to information or biospecimens that are not identified, do lead to the generation of identifiable private information or identifiable biospecimens, those technologies or techniques will be placed on a list of technologies and techniques satisfying that determination, and recommendations might accordingly be made with regard to relevant issues relating to consent and privacy and data security protections. The result may be that such technologies and techniques could therefore only be used in instances where the person has provided their consent (broad or study-specific) which meets the requirements of the Common Rule, or where an IRB has waived the requirement for consent.

Notice and the opportunity for public comment would take place before a technology or technique could be placed on this list. The expectation is that whole genome sequencing will be one of the first technologies to be evaluated to determine whether it should be placed on this list.

It is important to note that an investigator who possesses information or biospecimens to which such a technology or technique might be applied is not to be considered in possession of identifiable private information or identifiable biospecimens merely as a result of such a circumstance: that would only be true were the investigator to actually apply the technology or technique to generate identifiable private information or identifiable biospecimens.

This new provision is not being added as a result of any pre-conceived determination that there is indeed a need to change, whether by guidance or otherwise, the interpretation of “individually identifiable” as that concept is currently interpreted. Consistent with a core theme underpinning the process that led to this final rule, it would be inappropriate to expand the scope of coverage of the Common Rule with regard to activities that usually involve very little risk absent good reason to think that there is a problem that the added administrative burden will be correcting. The public comments on both the ANPRM and the NPRM do not identify a specific problem, but clarification from the regulatory agencies might be useful. Thus, apart from the consequences of placing technologies and techniques on the new list, the most significant effect of §__.102(e)(7) may be the issuance of guidance from time to time that facilitates understanding of and compliance with existing interpretations.

Finally, with regard to the use of newborn DBS, retaining the pre-2018 approach toward nonidentified biospecimens resolves many of the concerns expressed by commenters who felt that important research involving newborn screening would be halted or inhibited under the NPRM. The Newborn Screening Saves Lives Reauthorization Act of 2014 (Pub. L. 113-240) will no longer be effective following the effective date of this final rule, given that its changes applied only until changes to the Common Rule were promulgated. As a result, under the final rule, secondary research with nonidentified newborn DBS would be treated in the same way as secondary research with any other type of nonidentified biospecimen. Such research would not be considered research with human subjects under the final rule, and thus would not be subject to the rule.

[Back to top]

§__.102(i) Legally Authorized Representative

The definition of legally authorized representative in the final rule at §__.102(i) has been modified to address jurisdictions in which no applicable law authorizes a legally authorized representative to provide consent on behalf of a prospective research subject. In these jurisdictions, an individual recognized by institutional policy as acceptable for providing consent in the nonresearch context to the subject’s participation in the procedures involved in the research, will now be considered a legally authorized representative for purposes of this rule.

The change made from the NPRM discussion that “accepted common practice” could be used to identify a legally authorized representative is in response to objections to the vagueness of these terms and the potential for confusion in implementation, which was expressed by the majority of commenters opposed to the proposal. We agree with the commenters’ suggestion that an institution’s own policies as to surrogate consent may be a better touchstone than “accepted common practice,” as a standard referencing institutional policy will provide additional clarity as to who may serve as a legally authorized representative at that particular institution.

The final rule also differs from the NPRM discussion in that it allows institutional policies applicable to surrogate consent in either the clinical context, or other nonresearch contexts, to authorize a legally authorized representative. We expect that implementation of this aspect of the final rule definition will in large part rely on institutional policies for determining surrogates for clinical decision making. In those instances, there is relatively little risk that this rule will have inappropriate consequences, as far more significant considerations, not related to the Common Rule, play a role in shaping and constraining an institution’s policies relating to surrogate decision making in the clinical context.

However, we recognize that some studies could be taking place that do not relate to the types of decisions that are involved in clinical care, or that do not involve procedures utilized in the clinical context. If the institution has a policy relating to who acts as a surrogate outside of the research context for those types of decisions, then such a policy could be employed in the research context. Similar to our assessment of policies relating to surrogate decision making in the clinical context, we expect that considerations not related to the Common Rule would constrain the institution’s design and implementation of policies in other nonresearch contexts, and thus see relatively little risk that this added regulatory flexibility will have inappropriate consequences.

Maintaining the pre-2018 standard would have continued to allow disparate results in terms of when research can take place in those states that have specific laws governing either surrogate clinical consent or research consent, and those that do not. Accepting that the Common Rule has been interpreted to allow the use of laws governing surrogate consent in the clinical context to be applied to surrogate decision making in the research context, it is difficult to see why there should be different outcomes in terms of what research is allowable based on whether the standards for surrogate consent in the clinical context in a state are based on specific laws or some other accepted regime.

This outcome also appears inconsistent with the Belmont Report principle of justice. Individuals who lack the capacity to consent to research ought not be inappropriately excluded from research participation based solely on these circumstances. Research that an IRB has approved as ethical to conduct with the participation of subjects with impaired decision-making capacity ought not be prohibited in the few states and jurisdictions in which no affirmative law authorizing a legally authorized representative exists, while being allowed to proceed in the vast majority of states and jurisdictions that have laws specifically authorizing consent by a legally authorized representative in the clinical or research context.

Reduced ambiguity in the interpretation of the regulatory requirements will facilitate research that may offer the promise of improved medical treatment for this subject population, thus increasing beneficence. This approach reflects the calls for increased clarity in the regulatory requirements regarding who may serve as a legally authorized representative, which will serve to facilitate the responsible inclusion of subjects who cannot consent on their own behalf to research participation.

[Back to top]

§__.102(j) Minimal Risk

Although this proposal received significant support, several commenters expressed concern that the Secretary’s list was another NPRM deliverable that the public did not have a chance to see and comment on during the NPRM public comment period. These commenters suggested that this proposal be removed from a final rule and developed on a separate track. We agree that this list should be developed as a separate process from the final rule promulgation, and thus this proposal has not been included in the final rule.

Thus, no change is made to the definition of “minimal risk” in the final rule at §__.102(j). We still intend to publish guidance on this issue and could still pursue publication of such a list in the future.

[Back to top]

§__.102(k) Public Health Authority

The pre-2018 rule did not provide a definition of “public health authority.” As proposed in the NPRM, the final rule now defines the term so that references to it in the definition of research are understood. Specifically, because the definition of “research” (§__.102(l)(2)) removes from that definition public health surveillance activities that are conducted, supported, requested, ordered, required, or authorized by a public health authority, this definition of “public health authority” clarifies the scope of the activities removed from the definition of “research” for the purposes of this final rule.

In the final rule, as in the NPRM, the term “public health authority” means an agency or authority of the United States, a state, a territory, a political subdivision of a state or territory, an Indian tribe, or a foreign government, or a person or entity acting under a grant of authority from or contract with such public agency, including the employees or agents of such public agency or its contractors or persons or entities to whom it has granted authority, that is responsible for public health matters as part of its official mandate. We received no public comments on this definition.

[Back to top]

§__.102(l) Research

In response to the public comments, the NPRM’s general approach of designating various categories of activities as excluded has not been adopted. Instead, the final rule reverts to the general structure of the pre-2018 rule and integrates some of the categories proposed for exclusion in the NPRM into that structure, with some changes to the categories.

The final rule retains the wording of the pre-2018 definition of research, and explicitly removes four categories of activities from activities that would meet that definition. These revisions are intended to make the rule simpler, more familiar to readers who are aware of the pre-2018 rule and its definition of research, and easier to understand.

The four categories of activities removed from the definition of research are set out in order to make clear that they are not within the jurisdiction of the rule. The four categories pertain to certain scholarly and journalistic activities, public health surveillance activities, criminal justice activities, and authorized operational activities in support of national security missions. These categories were proposed as exclusions in the NPRM; the final rule retains these categories, with some changes made in the wording for clarity, in response to public comments.

[Back to top]

§__.102(l)(1) Scholarly and Journalistic Activities (e.g., Oral History, Journalism, Biography, Literary Criticism, Legal Research, and Historical Scholarship)

The final rule explicitly removes a category of activities consisting of certain scholarly and journalistic activities from the definition of research and the scope of the regulations. This category of activities concerns certain activities in various fields that focus directly on the specific individuals about whom information are collected. As described above, this category is removed from the definition in order to resolve long-standing debate and uncertainty about whether these activities are considered research in the sense of the regulatory definition. We believe that these activities should not be considered research in the context of the Common Rule, and that making this explicit in the final rule will help to resolve the uncertainty.

In these activities, the ethical requirement is to provide an accurate and evidence-based portrayal of the individuals involved, and not necessarily to protect them from public scrutiny. For example, a biographer might collect and present factual information to support the biographer’s opinion about the character of an individual to show that the individual does not deserve the positive reputation he or she enjoys in society. These fields of research have their own codes of ethics, according to which, for example, consent is obtained for oral histories. We note that this consent standard should address the issue of oral histories of tribal members. For these reasons, we have determined that it is appropriate to remove these activities from the definition of research and from the scope of the Common Rule.

In response to public comments, §__.102(l)(1) refers to more fields and methodological traditions than were proposed in the NPRM. The final rule also explicitly cites those fields and traditions as examples, in order to clarify that the focus is on the specific activities that collect and use information about specific individuals themselves, and not generalizing to other individuals, and that such activities occur in various fields of inquiry and methodological traditions. Literary criticism has been added as an example because while a piece of literary criticism might focus on information about the author(s), it would typically focus on the specific author(s) in view. Legal research has been added as an example because it would often focus on the circumstances of specific plaintiffs or parties involved in a case. It is not the particular field that removes the activity from the definition, but rather the particular activity’s focus on specific individuals.

Activities described in §__.102(l)(1) may sometimes be performed in the fields of anthropology or sociology, but not all activities characteristic of these fields are outside of the rule. Studies using methods such as participant observation and ethnographic studies, in which investigators gather information from individuals in order to understand their beliefs, customs, and practices, and the findings apply to the studied community or group, and not just the individuals from whom the information was obtained, fall within the scope of the definition of research of the final rule.

[Back to top]

§__.102(l)(2) Public Health Surveillance

The final rule adopts the NPRM proposal related to deeming certain public health surveillance activities as explicitly outside of the scope of the Common Rule. Several editorial modifications have been made to this category to improve readability. Additionally, the final rule explicitly specifies that the collection of information is permitted under this category of activities.

The final rule codifies the current interpretation that the definition of research does not include a category of activities that solely involve public health surveillance, including collecting and testing information or biospecimens in activities that are conducted, supported, requested, ordered, required, or authorized by a public health authority and that are limited to those necessary to allow the public health authority to identify, monitor, assess, or investigate potential public health signals, onsets of disease outbreaks, or conditions of public health importance. Such surveillance activities can include collecting information about trends, signals, risk factors, patterns in diseases, or increases in injuries from using consumer products. Such activities include those associated with providing timely situational awareness and priority-setting during the course of an event or crisis that threatens public health, including natural or man-made disasters.

This codification of public health surveillance activities as outside the definition of research is designed to remove uncertainty, but is not intended to change the scope of activities subject to or not subject to the Common Rule. When a public health authority conducts public health surveillance activities to fulfill its legal mandate to protect and maintain the health and welfare of the populations it oversees, the regulatory protections of the Common Rule should not impede that authority’s ability to accomplish its mandated mission of promoting this recognized public good, in keeping with the principle of beneficence. Other protections independent of the Common Rule exist that serve to protect the rights and welfare of individuals participating in such activities, including federal and state policies to protect privacy, confidentiality, and security safeguards for the information collected.

Public health surveillance refers to collecting, analyzing, and using data to target public health and disease prevention. It is the foundation of public health practice. Surveillance uses data from a variety of sources, including mandatory reporting of certain conditions, routine monitoring, vital records, medical billing records, and public health investigations. The line between public health surveillance and epidemiological research can be difficult to draw, as the same epidemiological techniques may be used in both. Generally, the difference between the activities is the purpose or context in which the investigation is being conducted and the role of the public health authority.

The following are examples of public health surveillance activities being codified as outside of the definition of research in this regulation:

• Safety and injury surveillance activities designed to enable a public health authority to identify, monitor, assess, and investigate potential safety signals for a specific product or class of products (for example, the surveillance activities of the FDA’s Adverse Event Reporting System, the Vaccine Adverse Event Reporting System,Manufacturer and User Facility Device Experience database, the Medical Product Safety Network, and the Sentinel Initiative);
• Surveillance activities designed to enable a public health authority to identify unexpected changes in the incidence or prevalence of a certain disease in a defined geographic region where specific public health concerns have been raised (e.g., the U.S. influenza surveillance system, which allows CDC to find out when and where influenza activity is occurring, track influenza-related illness, determine what strains of influenza virus are circulating, detect changes in influenza viruses, and measure the impact influenza is having on hospitalizations and deaths in the United States);
• Surveillance activities designed to enable a public health authority to identify the prevalence of known risk factors associated with a health problem in the context of a domestic or international public health emergency;
• Surveillance activities designed to enable a public health authority to locate the range and source of a disease outbreak or to identify cases of a disease outbreak;
• Surveillance activities designed to enable a public health authority to detect the onset of disease outbreaks or provide timely situational awareness during the course of an event or crisis that threatens the public health, such as a natural or man-made disaster; and,
• Surveillance activities designed to enable a public health authority to identify the prevalence of a condition of public health importance, known risk factors associated with a condition of public health importance, or behaviors or medical practices related to prevalence of a known condition of public health importance (e.g., surveillance of the prevalence of: tobacco use, exposure to secondhand smoke, lung cancer, or use of smoking cessation treatments).

On the other hand, subsequent research using information collected during a public health surveillance activity, for instance, genetic analysis of biospecimens, would not be removed from the definition.

This clarification of current interpretation would not remove the following activities from the definition of “research”: exploratory studies designed to better understand risk factors for chronic diseases, including genetic predisposition, for chronic diseases; exploratory studies designed to elucidate the relationships between biomarkers of exposure and biomarkers of disease; and exploratory studies of potential relationships between behavioral factors (e.g., diet) and indicators of environmental exposures. These types of activities would be considered research because they would not be conducted solely for the purposes described in §__.102(l)(2), and thus would be covered by the Common Rule if they involved human subjects, even if conducted by a federal agency with a public health mandate. Again, they might fall within an exemption, depending on how they are carried out.

We note that this provision does apply to some activities responding to emergencies, and that various department or agency activities, not just those of HHS, will be affected. Research evaluations of public health surveillance activities are not included in this category because the nature of such evaluations is to create generalizable knowledge. We also recognize that in some public health surveillance activities, it may be appropriate to obtain consent from the individuals from whom information or biospecimens are collected.

We recognize the public comments stating that the boundaries of public health surveillance activities being removed from the definition of research are not entirely clear. We recognize that some of the activities in this category are not research, but believe that the inclusion of this provision will help to resolve uncertainty in some circumstances about whether the rule applies. We believe that developing guidance in this area will be useful.

Finally, to clarify what public health surveillance activities are being removed from the definition of research, the final rule contains a new definition of “public health authority” at §__.102(k).

[Back to top]

§__.102(l)(3) Criminal Justice Activities

The final rule clarifies that, consistent with current practice, data collection and analysis that enables the conduct of certain activities carried out as part of the criminal justice system is not research. The scope of these activities is collection and analysis of information, biospecimens, or records by or for a criminal justice agency for activities authorized by law or court order solely for criminal justice or criminal investigative purposes. The activities are necessary for the operation and implementation of the criminal justice system. The final rule changes the wording of the category from that proposed in the NPRM only by substituting the word “information” for “data,” for consistency with other parts of the rule.

The provision essentially codifies current federal interpretation that such activities are not considered to be research under the Common Rule. Revising the regulations to explicitly remove such activities from the scope of research subject to the rule is designed to avoid the imposition of disparate requirements by IRBs with overlapping jurisdictions when information collection or analysis encompasses the development of methods required by law or court order for criminal justice or criminal investigative purposes. For example, the Federal Bureau of Investigation (FBI) is charged by law with setting standards governing the collection and processing of DNA biospecimens and information taken (forcibly if necessary) from certain federal and state criminal suspects or offenders incident to their arrest or conviction for prescribed offenses under the National DNA Identification Act of 1994 and other acts. Similarly, the FBI is charged by law with setting standards governing the collection and processing of fingerprints and related biographical information taken from federal and state criminal suspects or offenders and certain sensitive civil employment applicants. Many criminal law enforcement agencies routinely collect human biospecimens at crime scenes from or relating to victims, suspects, and offenders both known and unknown. Incident to these activities, the FBI is also charged with maintaining, and authenticating through identification processes, the criminal record history of criminal offenders for federal government agencies and for the overwhelming majority of state governments that elect to participate and share information through those systems. We have determined that this category of activities does not meet the definition of research in the final rule, so that these activities can be conducted in accordance with the legitimate goals of the criminal justice system.

We do not believe that this provision contradicts President Clinton’s 1997 memorandum, which addressed the regulatory requirements for certain activities that are considered research under the regulations. This category pertains to activities that are outside of the regulatory requirements.

This category is also not intended to include social and behavioral studies of the causes of criminal behavior. Such studies would be considered research under the final rule.

[Back to top]

§__.102(l)(4) Authorized Operational Activities in Support of National Security Missions

The final rule clarifies current federal practice that the definition of research does not include authorized operational activities (as determined by each agency) in support of intelligence, homeland security, defense, or other national security missions. This clarification codifies the interpretation of the pre-2018 Common Rule.

As described above, the final rule includes a simpler reference to authorized operational activities in support of national security missions not considered to be human subject research, as a response to concern that the NPRM proposal could be interpreted too broadly or too narrowly due to the specific activities listed, such as surveys, interviews, surveillance activities and related analyses, and the collection and use of biospecimens. These authorized operational activities, as determined by each agency, do not include research activities as defined by the Common Rule, nor have they ever in the past been considered regulated by the Common Rule. This category of activity is removed from the definition of research to make explicit that the requirements of the final rule do not apply to authorized operational activities in support of national security missions. This clarification is not intended to narrow the scope of the Common Rule.

We do not believe that this category contradicts President Clinton’s Memorandum of 1997 regarding classified research, because this category is merely clarifying what activities are not considered to meet the definition of research. The Clinton Memorandum calls for a number of requirements to be added to protections for classified research activities, but it does not address activities that are not considered research.

[Back to top]

NPRM Proposal Not Included in the Final Rule: Deeming Certain Quality Assurance and Quality Improvement Activities “Not Research”

The proposed exclusion for QA/QI activities is not included in the final rule. The degree of concern expressed by the public comments on this topic is significant. We recognize that human subject protections would be meaningful and appropriate for some QA/QI research activities, but not for others. However, to avoid increasing confusion and unnecessary obstacles to innovation, the final rule does not single out certain QA/QI activities as meeting or not meeting the definition of research.

[Back to top]

NPRM Proposal Not Included in the Final Rule: Deeming Certain Program Improvement Activities “Not Research”

The proposed exclusion for program improvement activities is not included in the final rule. Based on the public comments it does not seem useful for this category of activities to be singled out as not meeting the definition of research. As with the NPRM proposed exclusion regarding QI/QA activities implementing accepted practices, public commenters raised concerns that this exclusion would have created more misunderstanding and confusion than it would have resolved. As with QI/QA activities, some program improvement activities involve research and deserve the protections of the rule, while others are not research and are not under the rule. We believe that this topic would be better addressed through other means.

[Back to top]

§__.102(m) Written or in Writing

The final rule includes a definition that was not included in the NPRM nor in the pre-2018 rule. The definition of “written or in writing” is included at §__.102(m) to clarify that, in accordance with the longstanding interpretation of the pre-2018 rule, these terms include electronic formats, which are increasingly used to fulfill many of the documentation requirements that appear throughout the rule.

Although public comments did not directly address this issue, we are aware that some in the regulated community are uncertain of whether, for example, consent forms may be in electronic formats. This definition is intended to address this concern. Note that the definition of “written or in writing” does not preclude the possibility that consent forms could be in media other than paper or electronic formats and still meet the requirements of the Common Rule.

[Back to top]

§__.103 Ensuring Compliance with this Policy

As proposed in the NPRM, the final rule eliminates the pre-2018 rule requirement that an institution provide a statement of ethical principles by which an institution will abide as part of the assurance process. We believe this requirement is unnecessary. Further, for international institutions that may receive federal funding for research activities, it creates the impression that these international institutions must modify their internal procedures to comport with the set of principles designated on the FWA for activities conducted at those institutions that receive no federal funding. OHRP has received many questions about the extent to which international institutions must adhere to the ethical principles designated as part of the assurance process for

research activities conducted by the institution that receive no Common Rule department or agency funding. That such measures are not required will be made clear by deletion of this requirement in the final rule.

Additionally, as proposed in the NPRM, the final rule eliminates the requirement that appeared in the pre-2018 rule that an up-to-date list of the IRB members and their qualifications be included in an institution’s assurance. Instead, §§__.108(a)(2) and __.115(a)(5) in the final rule require that an IRB or the institution prepare and maintain a current list of IRB members. This eliminates the previous requirement that changes in IRB membership be reported to the department or agency head, or to OHRP when the existence of an assurance approved by HHS for federal-wide use is accepted. Of note, SACHRP recommended in March, 2008 that OHRP pursue harmonizing the Common Rule with FDA’s human subjects protection regulations by eliminating the requirement to submit IRB membership lists.

The final rule, as proposed in the NPRM, also eliminates the requirement that appeared in the pre-2018 rule that an institution designate one or more IRBs on its FWA. Federal departments or agencies retain the ability to ask for information about which IRBs review research conducted at an institution as part of the assurance process, even if that requirement is not explicitly mandated in the regulations.

An additional, a nonregulatory change that was described in the NPRM will be made to the assurance mechanism. The prior option that enabled institutions with an active FWA to "check the box" (described in section IV.A [of the final rule preamble]) is being eliminated. Importantly, institutions could, if they so desire, continue for purposes of their own internal rules to voluntarily extend the   regulations to all research conducted by the institution, but this voluntary extension will no longer be part of the assurance process and such research will not be subject to OHRP oversight. We expect this change to have the beneficial effect of encouraging some institutions to explore a variety of flexible approaches to overseeing low-risk research that is not funded by a Common Rule department or agency, without reducing protection of human subjects, thus furthering the goal to decrease inappropriate administrative burdens.

In addition, as proposed in the NPRM, the final rule removes the provision found in the pre-2018 rule that a department or agency head’s evaluation of an assurance will take into consideration the adequacy of the proposed IRB(s) designated under the assurance in light of the anticipated scope of the institution’s activities and the types of subject populations likely to be involved, the appropriateness of the proposed initial and continuing review procedures in light of the probable risks, and the size and complexity of the institution. We believe this deletion aligns the regulations with changes made in December 2000 to OHRP’s implementation of the FWA process. Those changes streamlined and simplified the assurance process and eliminated OHRP’s institution-specific evaluation of the adequacy of each IRB designated under the assurance. 

Each FWA-holding institution continues to have responsibility for ensuring that the IRBs on which it relies are registered with OHRP and are appropriately constituted to review and approve the institution’s human subjects research, as required under §§__.107 and __.108 of the final rule.

The final rule contains language at §__.103(e) requiring that for nonexempt research involving human subjects (or exempt research that requires limited IRB review) that takes place at an institution for which an IRB not operated by that institution exercises oversight, the institution and the organization operating the IRB must document the institution’s reliance on the IRB for its research oversight. The final rule also requires that this documentation include the responsibilities of each entity to ensure compliance with the requirements of the rule.

The requirement included in the final rule for documenting an institution’s reliance on an IRB that it does not operate is more flexible than what was proposed in the NPRM. The final rule only requires that the reliance agreement between the institution and the organization operating the IRB be documented. It does not include the NPRM proposal that the institution and the organization operating the IRB establish and follow procedures for documenting the institution’s reliance on the IRB for oversight of the research and delineating the responsibilities that each entity would assume to ensure compliance with the requirements of the rule.

In considering the public comments, we determined that it was unnecessary to require that such reliance relationships be described in institutional procedures. Under the final rule, compliance with this provision could be achieved in a variety of flexible ways, for example, through a written agreement between the institution and a specific IRB, through language contained in a protocol of a multi-institutional study, or more broadly, by implementation of an institution-wide policy directive providing the allocation of responsibilities between the institution and all IRBs that are not operated by the institution. Documenting the responsibilities of the institution and the IRB is already a requirement under the terms of an FWA, but is now a regulatory requirement. An additional requirement has been added at §__.115(a)(9) that such documentation be part of the IRB records.

We acknowledge that the new requirement could increase administrative burden for some institutions, but believe that the examples cited above reflecting the various options an institution may use to document reliance on an IRB not operated by that institution are generally already standard practice in the regulated community.

Finally, the final rule eliminates the requirement in the pre-2018 rule at §__.103(f) that grant applications undergo IRB review and approval for the purposes of certification. The grant application is often outdated by the time the research study is submitted for IRB review and contains detailed information about the costs of a study, personnel, and administrative issues that go beyond the mission of the IRB to protect human subjects. Therefore, experience suggests that review and approval of the grant application is not a productive use of IRB time.

[Back to top]

§__.104. Exempt Research

§__.104(b) Applicability of Exemptions to Subparts B, C, and D

The NPRM proposal regarding how the proposed exemptions may be applied to the subparts is largely unchanged in the final rule. The language at §__.104(b)(2) regarding subpart C has been modified slightly to reduce ambiguity and potential administrative burden, and in response to public comment, to narrow the scope of exemption application. The final rule does not adopt the 2003 epidemiological waiver language due to concerns from public comments that such language would be ambiguous and difficult to interpret.

The final rule section__.104(b)(1) states that all of the exemptions at §__.104 may be applied to research conducted under subpart B if the conditions of the exemption are met. Language at §__.104(b)(2) states that none of the §__.104 exemptions may be applied to research conducted under subpart C, except for research aimed at involving a broader subject population that only incidentally includes prisoners. This is a modification of the NPRM language, which proposed that the exemptions could apply if research consisted “mostly of nonprisoners and only incidentally” included some number of prisoners. The language was changed in order to avoid the implied need (“mostly”) for institutions to project and track the percentage of prisoners participating in nonexempt research. The revision also more clearly describes and limits the circumstances in which exempt research may include prisoners. The language at §__.104(b)(3) relevant to subpart D has been modified to reflect the revised structure of the final rule, and now states that the exemptions at paragraphs (d)(1), and (d)(4)-(8) of this section may be applied to research that is subject to subpart D if the conditions of the exemption are met. Paragraphs (d)(2)(i) and (ii) of this section may apply only to research activities that are subject to subpart D involving educational tests or the observation of public behavior when the investigator(s) do not participate in the activities being observed. Paragraph (d)(2)(iii) of this section may not be applied to research that is subject to subpart D, because protections, including IRB review and parental permission, are appropriate for research involving children and educational tests, surveys or interview procedures, or observation of public behavior when the information collected may be individually identified and sensitive in nature.

The final rule does not make revisions to the HHS regulations at 45 CFR part 46, subparts B, C, and D. Throughout this rulemaking process, the intent has been to revise subpart A, and to address revisions to subparts B, C, and D at a later time. However, particular consideration has been given to the specific issue of whether the proposed exemption categories should apply in the context of research that is aimed at a broad population and only incidentally includes prisoners. We concur with the comments expressing support for this change.

In such instances, the specific protections required by subpart C are frequently not relevant to the research subjects. The permitted inclusion of this subset of prisoners under the exemptions at §__.104 is intended to allow an appropriate reduction in IRB administrative burden while preventing IRBs from necessarily prohibiting the participation of this group in exempt research activities, assuming the conditions of the exemptions are fully satisfied.

We believe this subpart C change is narrow in scope, affecting only a small subset of subjects who are prisoners. This change will permit, for example, the exempt secondary research use of information or biospecimens from subjects who are prisoners, if that analysis is not seeking to examine prisoners as a population and only incidentally includes prisoners in the broader study. Such inclusion would previously have required IRB review under subpart C, including review by an IRB prisoner representative, followed by certification to and authorization by OHRP. In addition, if the research did not fit into a §46.306(a)(2) subpart C category of permissible

research, prisoners could not be included as subjects in the study, thereby causing problems involving identifying and removing these subjects from the analysis of repositories and databases.

Similarly, the narrow expansion would allow a subject to continue participation in exempt research if he or she became a prisoner during the course of an exempt study, assuming the study was aimed at a broad nonprisoner population, without the need for subpart C IRB review and certification to OHRP. For example, an exempt study that recruited subjects from a local community center to participate in a comparison of HIV educational materials would continue to be exempt, and would not trigger the need for review under subpart C, even if some of the subjects became prisoners after enrollment. On the other hand, a study that recruited subjects from a jail or prison to participate in a comparison of HIV educational materials would continue to be nonexempt under the final rule and require both subpart A and subpart C review, including certification to OHRP.

[Back to top]

NPRM Proposal Not Adopted in the Final Rule: Exemption Determination

The final rule does not adopt the NPRM proposal at this time. Therefore, the final rule does not require that exemption determinations be documented, as had been proposed in the NPRM, and continues to permit flexibility in how exemption determinations are made. We recognize it was difficult to provide detailed feedback in the absence of an exemption decision tool to evaluate. However, we continue to believe that a well-designed, tested, and validated exemption decision tool could offer an expedient mechanism for determining whether research studies are exempt. Thus, we will continue to explore development of an exemption decision tool. If and when an exemption decision tool is developed, we would issue a subsequent (separate) Federal Register notice for public comment. The notice would also give the public the opportunity to comment on whether the use of the tool would be appropriate in making exemption determinations under this final rule. Thus, members of the public would be afforded a sufficient opportunity to provide meaningful comments on such a proposed decision tool.

[Back to top]

§__.104(d) Categories of Exempt Research

All exemption categories, of which there are eight, appear at §__.104 in the final rule. Four of the exemption categories were proposed as exclusions under the NPRM. In addition, the proposed exclusion concerning certain research involving educational tests, survey or interview procedures, or observation of public behavior has been combined with the exemption regarding additional research activities using the same research methods. The rule includes four exemptions for research involving normal educational practices, research involving benign behavioral interventions, research involving public benefit or service programs, and research involving taste and food quality, all of which were also proposed in the NPRM.

[Back to top]

§__.104(d)(1) Research Conducted in Established or Commonly Accepted Educational Settings When It Specifically Involves Normal Educational Practices

The final rule includes an exemption at §__.104(d)(1) for research conducted in established or commonly accepted educational settings that specifically involves normal educational practices, so long as the research is not likely to adversely affect students’ opportunity to learn required educational content or the assessment of educators who provide instruction. This includes most research on regular and special education instructional strategies, and research on the effectiveness of, or the comparison among, instructional techniques, curricula, or classroom management methods.

This exemption is a revised version of the first exemption in the pre-2018 rule and a modified version of the exemption as proposed in the NPRM. This change is based on concerns about whether the conduct of some research projects of this type might draw enough time and attention away from the delivery of the regular educational curriculum that they could have a detrimental effect on student achievement. The wording of the exemption has been modified to include a condition that the research is not likely to have these adverse impacts. This was the original intent of the NPRM proposal, and it is an important qualification that should apply to any research activity that is exempt under this provision. It also drops the phrase “in that educational setting,” because that phrase is redundant.

The exemption is retained to allow for the conduct of education research that may contribute to the important public good of improving education, consistent with the principle of beneficence. The exemption retains the condition that the research activity takes place in established or commonly accepted educational settings, because otherwise IRB review would be warranted for such research activities being conducted in unconventional settings.

We recognize that providing notice for this type of research could involve a significant administrative burden and that it is not always appropriate, and therefore have decided not to include it as a regulatory requirement at this time. We note that making these activities exempt does not mean that there ought not to be tribal consultation about the research activities, and that such consultation may lead to a notice requirement. Where appropriate or mandated by tribal law, tribal consultation should take place irrespective of whether the activity has to meet the requirements of this final rule. Such consultation would represent a free-standing legal obligation, as is referred to in §__.101(f).When appropriate, investigators may provide notice in a manner that is appropriate to the research activity and the cultural context in which it occurs.

This exemption is largely unchanged from the pre-2018 rule, and does not add requirements for safeguarding privacy at this time.

[Back to top]

§__.104(d)(2) Research that Includes Only Interactions Involving Educational Tests (Cognitive, Diagnostic, Aptitude, Achievement), Survey Procedures, Interview Procedures, or Observation of Public Behavior (Including Visual or Auditory Recording), if at Least One of Three Criteria is Met

The final rule includes an exemption at §__.104(d)(2) that is a revised version of an exemption in the pre-2018 rule. The exemption applies to research that only includes interactions involving educational tests (cognitive, diagnostic, aptitude, achievement), survey procedures, interview procedures, or observation of public behavior (including visual or auditory recording) uninfluenced by the investigator if at least one of three criteria is met:

• The information obtained is recorded by the investigator in such a manner that the identity of the human subject cannot readily be ascertained, directly or through identifiers linked to the subjects;
• Any disclosure of the human subjects’ responses outside the research would not reasonably place the subjects at risk of criminal or civil liability or be damaging to the subjects’ financial standing, employability, educational advancement, or reputation; or
• The information obtained is recorded by the investigator in such a manner that the identity of human subjects can readily be ascertained, directly or through identifiers linked to the subjects, and an IRB conducts a limited IRB review to make the determination required by §__.111(a)(7) (which relate to there being adequate provisions for protecting privacy and maintaining confidentiality).

The final rule does not include the language proposed in the NPRM that offered as one prong of the exemption (proposed as an exclusion) that the research be subject to the Privacy Act, the Paperwork Reduction Act, or the E-Government Act of 2002. The final rule simply includes §__.104(d)(2)(iii), which requires limited IRB review as described at §__.111(a)(7) if identifiable private information will be obtained and recorded in such a way that the identity of human subjects can readily be ascertained, either directly or through identifiers linked to the subject.

This exemption is based on the assumption that the potential risks raised by this category are largely informational and that subjects are aware of them, and thus the most important role that an IRB might play with respect to reducing potential harms is to ensure the application of privacy safeguards. Under this assumption, the exemption is consistent with the principle of respect for persons and the preservation of autonomy. In the case of observation of public behavior, even if the subject does not know that an investigator is watching his or her actions, the subject’s behavior is public and could be observed by others, and thus the research observation is not inappropriately intrusive.

The term “survey” as used here refers to information collected about individuals through questionnaires or similar procedures (e.g., the Current Population Survey conducted by the U.S. Census). “Human subjects” do not include organizations or businesses. “Survey,” as used here, does not include the collection of biospecimens. Thus, an activity that included the collection of a biospecimen (e.g., a cheek swab), in addition to collecting verbal or written responses to questions, could not qualify for this exemption.

This exemption includes the research activities that appeared at §__.101(b)(2) in the pre-2018 rule, as well as some additional information collection research activities using the same methods. As in the pre-2018 rule, this exemption includes research studies whose methods consist of the use of educational tests, survey or interview procedures, or observation of public behavior that does not involve an intervention, if the data are recorded anonymously, or the information is recorded with identifiers, but is not sensitive such that its disclosure could result in harm to the subjects. The exemption provides a list of the specific harms that must be considered, as did the pre-2018 rule, with the addition of the specific harm of potential damage to the subjects’ educational advancement. This potential harm has been added because of the obvious relevance to the effects of the disclosure of responses in research involving educational tests.

This exemption has been expanded to include research using the same methods involving identifiable private information that might be sensitive or potentially harmful if disclosed, so long as the investigators adhere to the limited IRB requirements outlined in §__.111(a)(7), and the research is not subject to Subpart D. The limited IRB review requirements are designed to provide privacy safeguards to reduce the chances that the disclosure of identifiable private information will occur and lead to harm.

The wording of the exemption is clarified to indicate (consistent with the interpretation of §__.101(b)(2) in the pre-2018 rule) that the research cannot include interventions in addition to the educational tests, survey or interview procedures, or observation of public behavior. Research involving interventions that are distinct from those information collection methods allowable under this exemption do not satisfy the conditions of this exemption. For example, if a research study were to randomly assign students to take an educational test in a quiet room or in a room with a moderate level of noise, or to consume a snack (or not) before taking the test, this research would not be exempt under this exemption. It should be noted, however, that educational tests may include exposing test takers to certain materials as part of the test, and that such materials do not constitute interventions distinct from the test. For example, reading comprehension tests may direct test takers to read a passage, and a geography test may present test takers with a map, and ask them to draw information from that map. Likewise, survey procedures may contain some information that the respondents are asked questions about, which would not be considered distinct interventions. However, research in which the purpose of the research is to see whether respondents answer survey questions differently depending on the gender of the interviewer would not satisfy the conditions of the exemption, because the manipulation of the interviewer would be a distinct intervention. Research involving observation of public behavior does not qualify for this exemption if the investigator intervenes with subjects, for example, by offering them an ostensibly lost wallet to see if they will accept it.

Part of the rationale for exempting the research activities at §__.104(d)(2) from the Common Rule, even when the research is not otherwise subject to additional federal controls, is that for education tests, survey or interview procedures, agreement to participate is inherent in participation and that for much of this research the risks most likely to be experienced by subjects are related to disclosure of anonymous, nonsensitive information and are thus categorized as “low.” In general, it is reasonable to expect that individuals, including vulnerable populations (other than children), would understand that actively providing responses to educational tests, surveys, or interview procedures constitutes agreement to participate and that the risks associated with such participation would be related to disclosure of the information they provided. The exemption of this type of activity rests in large part on the idea that all individuals, regardless of the setting or context in which the activity will take place, are generally familiar with common forms of educational tests and survey and interview procedures that they experience in their daily lives, and do not need additional measures to protect themselves and their privacy from investigators who seek their involvement in research activities involving these procedures. They can decline to participate, or to answer some questions. In addition, if the information collected is both identifiable and sensitive or potentially harmful, the safeguards offered by the limited IRB review requirements at §__.111(a)(7) apply. This is accomplished through the added provision at §__.104(d)(2)(iii).

Concerns have also been raised about psychological risks of participating in surveys or interviews, and of situational risks where the simple awareness that someone was surveyed or interviewed poses a risk. We recognize that this is possible, but believe that this is rare enough that it does not warrant adding additional conditions to the exemption category.

With respect to applying this exemption to research with children, two subcategories of this exemption - concerning information recorded so that subjects cannot be identified (§__.104(d)(2)(i)), and concerning disclosures of the subjects’ responses that would not place them at certain kinds of risk or create certain kinds of damage (§__.104(d)(2)(ii)) may apply to research involving children under subpart D if the research involves educational tests or observation of public behavior and the investigator does not participate in the activities being observed. The final subcategory of this exemption (§__.104(d)(2)(iii)), which allows for obtaining and recording identifiable private information, may not be applied to research involving children under subpart D.

[Back to top]

§__.104(d)(3) Research Involving Benign Behavioral Interventions in Conjunction with the Collection of Information From an Adult Subject

This exemption at §__.104(d)(3) was not in the pre-2018 rule, but was proposed in the NPRM. In response to public comments that expressed concern over the need to further clarify the term “benign interventions,” the word “behavioral” has been inserted to modify the type of intervention which may be included. The intent of this change is to exclude the use of medical interventions (including medical tests, procedures and devices). The exemption being finalized is specifically for research involving benign “behavioral” interventions in conjunction with the collection of information from an adult subject through verbal or written responses (including data entry) or audiovisual recording if the subject prospectively agrees to the intervention and information collection and at least one of the following is met:

• The information obtained is recorded by the investigator in such a manner that the identity of the human subjects cannot readily be ascertained directly or through identifiers linked to the subjects;
• Any disclosure of the human subjects’ responses outside the research would not reasonably place the subjects at risk of criminal or civil liability or be damaging to the subjects’ financial standing, employability, educational advancement, or reputation; or
• The information obtained is recorded by the investigator in such a manner that the identity of the human subjects can readily be ascertained, directly or through identifiers linked to the subject, and an IRB conducts a limited IRB review to make the determination required by §__.111(a)(7).

For the purpose of this provision, the exemption describes benign behavioral interventions as being brief in duration, harmless, painless, not physically invasive, not likely to have a significant adverse lasting impact on the subjects, and the investigator has no reason to think the subjects will find the interventions offensive or embarrassing. Provided all such criteria are met, examples of such benign behavioral interventions include having the subjects play an online game, solve puzzles under various noise conditions, or decide how to allocate a nominal amount of received cash between themselves and someone else.

Unlike the exemption at §__.104(d)(2), this exemption allows for the intervention to be distinct from the data collection method; for example, a research study comparing test performance of test takers in quiet or noisy surroundings would qualify for this exemption. Also subjects could be asked to perform cognitive tasks, and audiovisual recording could be used to collect the data, without any educational test, survey or interview procedure occurring, and this research would qualify for this exemption.

If the research involves deceiving the subjects about the nature or purposes of the research, this exemption would not be applicable unless the subject authorizes the deception. For the purpose of this provision, authorized deception would be prospective agreement by the subject to participate in research where the subject is informed that he or she will be unaware of or misled regarding the nature or purposes of the research. The final rule allows this type of research to occur without the requirements of informed consent because the intervention is not likely to result in harm or offense to the subject, and the subject must prospectively agree to the intervention and the data collection.

Subjects must be adults, but the provision does not specify that they must be competent, and therefore tests of competency are not necessary. However, the presumption is that, in keeping with the principle of respect for persons, such subjects will not be exploited.

This new exemption category is added because respect for persons is accomplished through the prospective subject’s forthcoming agreement or authorization to participate, the research activities pose little risk to subjects, and the use of this exemption for many social or behavioral studies will enable IRBs to devote more time and attention to research studies involving greater risks or ethical challenges. We note that the requirement for the agreement of the subject effectively serves as a kind of notice, because the subject is asked to agree to participate in the research, and the request will be tailored to the nature of the specific research study.

The final rule includes another condition that was not included in the NPRM, which broadens the type of research that may meet this exemption. The final rule at §__.104(d)(3)(i)(C) permits

investigators to obtain and record information in such a manner that the identity of the human subjects can readily be ascertained, directly or through identifiers linked to the subject, provided the research has undergone limited IRB review in accord with §__.111(a)(7). This alternative condition was added to the final rule for reasons similar to the exemption at §__.104(d)(2), as a way of providing additional protections when investigators obtain and record information in such a manner that human subjects can be identified directly or through identifiers linked to the subject. Because the risk associated with enabling investigators to obtain and record identifiable private information can be addressed by requiring adherence to the privacy safeguards provided through limited IRB review, we believe it is appropriate to allow such research to be exempt.

In addition, the final rule permits the collection of data through audiovisual recording, not just video recording, as was proposed in the NPRM. We believe that broadening the exemption in this way provides more flexibility to the permissible data collection methods without creating greater risk of harm to research subjects.

We acknowledge that guidance may be useful for interpreting some of the terms in this exemption, and that some cases will be debatable. However, we also believe that a substantial number of research activities will plainly fit this exemption, and should be allowed to proceed without IRB review. We agree that investigator education is often desirable, but that the provisions of the exemption are not difficult to understand. We believe that Milgram’s obedience experiments and the Stanford Prison Experiment would obviously not qualify for this exemption, because investigators had reason to think some subjects would find the interventions offensive or embarrassing. We acknowledge that in this exemption the word “deception” is used to include withholding the purpose of the research, which is consistent with how the term is often used in this context.

[Back to top]

§__.104(d)(4) Secondary Research Use of Identifiable Private Information and Identifiable Biospecimens for which Consent Is Not Required

This exemption at §__.104(d)(4) is for secondary research uses of identifiable private information or identifiable biospecimens when consent is not required, if at least one of the following criteria is met:

• The identifiable private information or identifiable biospecimens are publicly available;
• Information, which may include information about the biospecimens, is recorded by the investigator in such a manner that the identity of human subjects cannot readily be ascertained directly or through identifiers linked to the subjects, the investigator does not contact the subjects, and the investigator will not re-identify subjects;
• The research involves only information collection and analysis involving the investigator’s use of identifiable health information when that use is regulated under 45 CFR parts 160 and 164, subparts A and E, for the purposes of “health care operations” or “research” as those terms are defined at 45 CFR 164.501 or for “public health activities and purposes” as described under 45 CFR 164.512(b); or
• The research is conducted by, or on behalf of, a federal department or agency using government-generated or government-collected information obtained for nonresearch activities, if the research generates identifiable private information that is or will be maintained on information technology that is subject to and in compliance with section 208(b) of the E-Government Act of 2002, 44 U.S.C. 3501 note, if all of the identifiable private information collected, used, or generated as part of the activity will be maintained in systems of records subject to the Privacy Act of 1974, 5 U.S.C. 552a, and, if applicable, the information used in the research was collected subject to the Paperwork Reduction Act of 1995, 44 U.S.C. 3501 et seq.

The criteria for this exemption were proposed in the NPRM as three exclusions. The final rule modifies the NPRM proposal to allow this exemption to apply to secondary research involving identifiable biospecimens, provided that the exemption’s conditions are met. Note that because the NPRM proposal to alter the definition of a human subject to extend to research involving nonidentified biospecimens was not adopted, an exemption for research with such biospecimens is not needed. Accordingly, this exemption is only relevant to secondary research use of identifiable biospecimens.

The goal of the exemption at §__.104(d)(4) is to facilitate secondary research using identifiable private information or identifiable biospecimens that have been or will be collected or generated for nonresearch purposes or from research studies other than the proposed research study. Unlike two other new exemptions that also relate to secondary research (the ones at §__.104(d)(7) and §__.104(d)(8), discussed below), this exemption does not depend on any consent requirements imposed by the Common Rule being met.

The first two provisions of this exemption (§__.104(d)(4)(i) and (ii)) are a modified version of the fourth exemption under the pre-2018 rule. The modified provisions allow the exemption to include research with information and biospecimens that do not yet exist when the research study is proposed for exemption (i.e., that could be collected, for purposes not related to the proposed research study, in the future).

The third and fourth provisions of the exemption have no precursors in the pre-2018 rule. The third provision applies the exemption to secondary research using identifiable private information covered under HIPAA, and the fourth provision applies the exemption to secondary research using identifiable private information collected for nonresearch purposes by the Federal Government, if compliant with the three cited federal statutes. These new rules will allow investigators to see identifiable private information, and also allow them to retain and record that information (including the identifiers) as part of their research records.

We also note that, according to new language at §__.104(b)(2) adopted as part of this final rule, this exemption permits the secondary research use of identifiable private information or identifiable biospecimens obtained from subjects who are prisoners, if the research is not designed in a way that seeks to recruit prisoners as a population but rather only incidentally (i.e., not intentionally) includes prisoners.

[Back to top]

§__.104(d)(4)(i) Research Involving the Collection or Study of Identifiable Private Information or Identifiable Biospecimens That are Publicly Available

The exemption criterion at §__.104(d)(4)(i) is for secondary research if the identifiable private information or identifiable biospecimens are publicly available. This would apply to secondary research use of archives in a public library, for example, or to government or other institutional records where public access is provided on request, or from a commercial entity if the information is provided to members of the public on request or if the only requirement for obtaining the information is paying a user fee, registering or signing in as a visitor to an archive. It would also apply if a commercial entity made identifiable biospecimens publicly available to anyone on request or for a fee. This exemption effectively acknowledges that for secondary research with publicly available information or biospecimens, IRB review would not reduce the risk.

[Back to top]

§__.104(d)(4)(ii) Research Involving the Collection or Study of Information (Which May Include Information About Biospecimens) That Has Been or Will Be Collected and is Recorded without Identifiers

The provision at §__.104(d)(4)(ii) exempts research involving identifiable private information, which may include information about biospecimens, if information is recorded by the investigator in such a manner that the identity of human subjects cannot readily be ascertained directly or through identifiers linked to the subjects, the investigator does not contact the subjects, and the investigator will not re-identify subjects. As with the provision at §__.104(d)(4)(i), this provision is related to an exemption that existed in the pre-2018 rule. In this instance, that prior exemption is being extended to now also cover research with information for which identifiers have been removed when the original collection of information or biospecimens occurs in the future.

[Back to top]

§__.104(d)(4)(iii) The HIPAA [Exemption]

The provision at §__.104(d)(4)(iii) permits the secondary research use of identifiable private information or identifiable biospecimens when the research involves only information collection and analysis involving the investigator’s use of identifiable health information when that use is regulated under 45 CFR parts 160 and 164 (the HIPAA Privacy Rule), subparts A and E, for the purposes of “health care operations” or “research” as those terms are defined at 45 CFR 164.501, or for “public health activities” as described under 45 CFR 164.512(b)

With regard to the criterion at §__.104(d)(4)(iii), HIPAA also provides protections in the research context for the information that would be subject to this exemption (e.g., clinical records), such that additional Common Rule requirements for consent should be unnecessary in those contexts. Under HIPAA, these protections include, where appropriate, requirements to

obtain the individual’s authorization for future, secondary research uses of protected health information, or waiver of that authorization by an IRB or HIPAA Privacy Board. This provision introduces a clearer distinction between when the Common Rule and the HIPAA Privacy Rule apply to research in order to avoid duplication of regulatory burden. We believe that the HIPAA protections are adequate for this type of research, and that it is unduly burdensome and confusing to require applying the protections of both HIPAA and an additional set of protections.

This provision was not part of the pre-2018 rule, and was proposed as an exclusion in the NPRM. It is included as a component of an exemption in the final rule, consistent with public comments supporting the proposal.

[Back to top]

§__.104(d)(4)(iv) Research Conducted by a Government Agency Using Government Generated or Government Collected Data Obtained for Nonresearch Activities

The provision at §__.104(d)(4)(iv) did not exist in the pre-2018 rule and was proposed as an exclusion in the NPRM. It appears as a component of an exemption in the final rule. The exemption permits the use of identifiable private information or identifiable biospecimens for secondary research conducted by, or on behalf of, a federal department or agency using government-generated or government-collected information obtained for nonresearch activities, if the information originally involved a collection that adheres to the federal standards for safeguarding privacy as described in this part of the exemption.

We believe that the privacy protections are adequate for this type of research, and that it is unduly burdensome and confusing to require these protections and an additional set of protections. This provision has been modified to apply the federal statutory privacy safeguards identified in the exemption provision to both the original collection of the information, and to the secondary research use of the information to which the exemption applies.

[Back to top]

§__.104(d)(5) Research and Demonstration Projects Conducted or Supported by a Federal Department or Agency

The final rule includes this exemption as a modified version of an exemption proposed in the NPRM. The exemption at §__.104(d)(5) in the final rule applies to research and demonstration projects involving public benefit or service programs, and is a slightly revised version of the exemption in the pre-2018 rule. This revision is designed to clarify the scope of the exemption so that more research studies would be eligible, and to make the exemption easier to apply. It is also designed to allow the Federal Government to carry out important evaluations of its public benefit and service programs to ensure that those programs are cost effective and provide the intended benefits or services, consistent with the principle of beneficence. The wording of the exemption has added “improve” to the purposes of these activities, to make more explicit the idea that the Federal Government conducts these activities in order to enable them to make the public benefit and service programs better, and not just to gauge their current quality.

This exemption is for research and demonstration projects that are conducted or supported by a federal department or agency, or otherwise subject to the approval of department or agency heads. It applies to activities that are designed to study, evaluate, improve, or otherwise examine public benefit or service programs, including, but not limited to: procedures for obtaining benefits or services under those programs; possible changes in or alternatives to those programs or procedures; or possible changes in methods or levels of payment for benefits or services under those programs.

In addition, the final rule clarifies the language of the exemption to conform to OHRP’s previous interpretation of public benefit and service programs that are being evaluated as part of the research. This interpretation includes public benefit or service programs that a Common Rule department or agency does not itself administer or conduct through its own employees or agents, but rather supports through a grant or contract program. Therefore, the exemption applies to research and demonstration projects supported through, for example, federal grants or cooperative agreements. These changes would bring the regulatory language into conformance with other provisions of the rule that refer to research “conducted or supported” by federal departments and agencies. These methods of administration are, of course, always subject to department or agency head approval, either directly or by delegation. In addition, some of these research and demonstration projects are conducted through waivers, interagency agreements, or other methods that also require agency head approval. Accordingly, both the previous and revised language allow for the full panoply of methods by which research and demonstration projects on public benefit or service programs can be carried out.

The wording of the exemption also is clarified to specifically include projects involving waivers of otherwise mandatory requirements using authorities such as sections 1115 and 1115A of the Social Security Act, in order to make it plain that such research projects on public benefit or service programs qualify for the exemption. The relevant sections of the Social Security Act were also cited when this exemption was published in 1983.

In the interest of transparency, as was proposed in the NPRM, the final rule requires that each federal department or agency conducting or supporting the research and demonstration projects must establish, on a publicly accessible federal website or in such other manner as the department or agency head may determine, a list of the research and demonstration projects the federal department or agency conducts or supports under this provision. The research or demonstration project must be published on this list before beginning the research involving human subjects. The department or agency head can determine what sort of information will be included on this list and maintains its oversight. Departments and agencies that already publish research and demonstration projects on a publicly accessible website could satisfy this proposed requirement if the existing website includes a statement indicating which of the studies were determined to meet this exemption.

The goal of this proposed requirement is to promote transparency of federally conducted or supported activities affecting the public that are not subject to oversight under the Common Rule. It should not cause any delay to the research. HHS will develop a resource that all Common Rule departments and agencies may use to satisfy the requirement at §__.104(d)(5)(i). Alternatively, an agency can create or modify its own website for this purpose.

The exemption is not modified to require notice, to apply only to minimal risk research activities, or to require the privacy safeguards, for reasons reflected in the public comments. We agree with the public comments that argued that in many cases notice would be difficult or impossible to achieve effectively, and that this exemption enables the Federal Government to conduct important evaluations of its own programs that provide significant benefits to the public. In addition, federal departments and agencies are already subject to other laws and policies that protect the interests of research subjects (e.g., the Privacy Act).

[Back to top]

§__.104(d)(6) Taste and Food Quality Evaluation and Consumer Acceptance Studies

The final rule retains the exemption from the pre-2018 rule, which was proposed in the NPRM without any change, for taste and food quality evaluation and consumer acceptance studies. This exemption applies if wholesome foods without additives are consumed, or if a food is consumed that contains a food ingredient at or below the level and for a use found to be safe, or agricultural, chemical or environmental contaminant at or below the level found to be safe by FDA or approved by the Environmental Protection Agency or the Food Safety and Inspection Service of the U.S. Department of Agriculture. This exemption is retained unchanged from the pre-2018 rule.

[Back to top]

§__.104(d)(7) and (8) Secondary Research Use of Identifiable Private Information or Identifiable Biospecimens (or Storage or Maintenance for Such Secondary Research Use) for Which Broad Consent Is Required

The final rule includes two exemptions related to the secondary research use (including storage or maintenance for such use) of identifiable private information and identifiable biospecimens that require a subject’s broad consent.

The first of these exemptions is in the final rule at §__.104(d)(7), and applies to storing and maintaining identifiable private information or identifiable biospecimens for secondary research use.

The second of these exemptions is in the final rule at §__.104(d)(8) and applies to the secondary research use of identifiable private information and identifiable biospecimens for specific secondary research studies. Secondary research under this exemption would generally be conducted with the information or biospecimens stored and maintained under the exemption at §__.104(d)(7).

Both of these exemptions for the secondary use of identifiable private information and identifiable biospecimens require broad consent and are discussed in detail below. As with the

secondary use exemptions that do not require the subject’s broad consent (discussed above in Section V.3.d. of the [final rule] preamble), the two exemptions at §__.104(d)(7) and (8) are also limited to “secondary research.” These exemptions pertain only to research that involves re-using information or biospecimens that were or will be collected for some other “primary” or “initial” activity distinct from using them in secondary research. These exemptions do not cover any primary collections of either information or biospecimens. In other words, if an investigator wants to collect information directly from research subjects, for example, by asking them to complete a questionnaire, that would not be covered by these exemptions. Or if an investigator wants to collect biospecimens by having subjects swab their cheeks, that collection would similarly not be covered by these exemptions. On the other hand, an investigator who wants to use information that is in some databank, or to use biospecimens that are in a pathology laboratory, could use these exemptions, assuming all of the relevant conditions of the exemptions were met.

[Back to top]

§__.104(d)(7) Exemption for the Storage or Maintenance for Secondary Use of Identifiable Private Information or Identifiable Biospecimens for which Broad Consent is Required

Section __.104(d)(7) is an exemption for the storage or maintenance for secondary research use of identifiable private information or identifiable biospecimens. It requires that an IRB conduct limited IRB review to make the following determinations (required by §__.111(a)(8)):

• Broad consent for storage, maintenance, and secondary research use of identifiable private information or identifiable biospecimens is obtained in accordance with the requirements of §__.116(a)(1)-(4), and (a)(6), and (d);
• Broad consent is appropriately documented or waiver of documentation is appropriate, in accordance with §__.117; and
• If a change is made for research purposes in the way the identifiable private information or identifiable biospecimens are stored or maintained, adequate provisions must be in place to protect the privacy of subjects and to maintain the confidentiality of data.

This exemption is similar to the exemption proposed in the NPRM at §__.104(f)(1), but it has been modified in some respects, and the operation of this exemption is also affected by other changes in the final rule that are different from the NPRM. Namely, the exemption has been modified to apply only to storage or maintenance for secondary research use of identifiable private information or identifiable biospecimens, because the final rule does not incorporate the NPRM proposal to alter the definition of a human subject to extend to research involving biospecimens regardless of their identifiability. This exemption was also modified given the decision not to adopt the privacy safeguards proposed in the NPRM at §__.105.

In addition, the Secretary’s template for broad consent is not being finalized for this exemption. Instead, institutions will have the flexibility to create their own consent forms that satisfy requirements at §__.116(a)(1)-(4), (a)(6) and (d) (see Section XIV [of the final rule preamble]). The consent form may be electronic.

Given these changes from the NPRM proposal, the limited IRB review requirement for this exemption provided at §__.111(a)(8) has been expanded in the final rule to require that the IRB make the following determinations, some of which are similar to those proposed in the NPRM.

The final rule requires that for the exemption to apply, the IRB must determine that broad consent for storage, maintenance, and secondary research use of identifiable private information or identifiable biospecimens is obtained in accordance with the requirements of §__.116(a)(1)-(4), (a)(6), and (d); This includes the requirement proposed in the NPRM that there be IRB review of the process through which broad consent will be obtained.

Also, given that we are not finalizing the proposed requirement to use the Secretary’s template for broad consent, the final rule includes in this requirement that an IRB determine that the broad consent includes the requirements and elements of consent in accordance with §__.116(a)(1)-(4), (a)(6), and (d).

The final rule also requires that the IRB determine that broad consent is appropriately documented or waived in accordance with §__.117. Although written broad consent generally will be required for this exemption to apply, the final rule also permits the exemption to apply when broad consent is obtained and an IRB has waived the documentation requirement for written informed consent under §__.117(c)(1).

And because the proposed privacy safeguards proposed in the NPRM at §__.105 are not included in the final rule, if a change will be made for research purposes in the way the identifiable private information or identifiable biospecimens are stored or maintained, the IRB must determine that when appropriate, adequate provisions are in place to protect the privacy of subjects and to maintain the confidentiality of data. This is the same IRB determination related to privacy and confidentiality that is required for nonexempt research. Importantly, this IRB determination is required only when a change is made for research purposes in the way the identifiable private information or identifiable biospecimens are stored or maintained, and only pertains to the aspects of storage and maintenance that are changed for research purposes. In this circumstance, the investigators are assuming responsibility for the manner in which the information and biospecimens are stored and maintained, and the IRB should be required to ensure that appropriate protections for the subjects are place with regard to the aspects of storage or maintenance that were changed for research purposes.

If, on the other hand, no changes are being made for research purposes to the storage or maintenance, then this IRB determination does not apply. The institution storing and maintaining the information or biospecimens of course still has its responsibility to determine what protections distinct from those required by the Common Rule are appropriate, which may include other legal or regulatory safeguards or institutional policies. In light of application of such additional safeguards, it appears unnecessary to require additional protections through a requirement of this final rule simply because the individuals providing broad consent have agreed that their biospecimens or information could be used for research at some point in the future. And of course this provision regarding changes made for research purposes applies only when a Common Rule department or agency supports or conducts the research activity.

Note that in many instances the only change that results from a person having signed a broad consent form for research relating to storing and maintaining that person’s biospecimens or information is that the institution that is already holding the biospecimens or information (for clinical purposes, for example) merely creates a record indicating that this person has signed such a consent form. The biospecimens and information could remain stored in whatever way (and for whatever period of time) that the institution had previously been storing them, based on the legitimate nonresearch or research-related reasons that the institution has used for initially collecting and storing those biospecimens and information. Any privacy and security protections (outside of the Common Rule) that already may apply to the institution’s information record-keeping or biospecimen preservation activities would continue to apply. The Common Rule’s protections would not apply before a change in storage or maintenance occurs for research purposes, but rather the institution would continue to operate in accordance with its pre-existing legitimate reasons for having and storing the biospecimens and information. The fact that the broad consent form has been signed does not by itself mean that there needs to be any alteration of what the institution is already doing with the biospecimens or information.

Examples of changed aspects of storage or maintenance for research purposes that would require the IRB to find, before those changes go into effect, whether there are adequate provisions to protect the privacy of subjects and maintain the confidentiality of data include the following: if information or biospecimens are moved from one electronic or physical storage location to another due to considerations related to research plans; if information or biospecimens will be stored for longer than they otherwise would have been for the original purpose; if information or biospecimens are placed in a research registry or repository created to serve as a resource for investigators; or investigators are given electronic or physical access to the information or biospecimens. The relevant changes do not necessarily involve moving information or biospecimens from one location to another. Rather, the relevant changes include any change for research purposes that introduces or alters risks to the privacy or security of the stored information or biospecimens, including giving access to or transferring information or biospecimens for research purposes to someone who otherwise would not have access.

The rationale for this exemption is that with the requirement for limited IRB review and the specified required IRB determinations, including subjects’ broad consent, this exemption respects subjects’ autonomy and provides appropriate privacy safeguards. More specifically, we believe that broad consent provides some measure of autonomy for individuals to decide whether to allow the research use of their identifiable private information or identifiable biospecimens, without imposing the kind of burden on investigators that would result from a requirement for specific informed consent for each secondary research study. We believe that it is appropriate to create a mechanism for broad consent for secondary research use, even if it involves the potential risk of having identifiers associated with the identifiable private information or identifiable biospecimens. We believe the administrative burden is also acceptable in order to allow for broad consent for secondary research use.

[Back to top]

§__.104(d)(8) Exemption for Research Involving the Use of Identifiable Private Information or Identifiable Biospecimens for which Broad Consent is Required

Section __.104(d)(8) is an exemption that also requires that broad consent has been obtained, and is for research involving the use of identifiable private information or identifiable biospecimens. This exemption will frequently be paired with the exemption at §__.104(d)(7), which permits the storage and maintenance of identifiable private information and identifiable biospecimens for secondary research use. The exemption at §__.104(d)(8) would apply to a specific secondary research study, provided that the following criteria are met:

• Broad consent for the storage, maintenance, and secondary research use of the identifiable private information or identifiable biospecimens was obtained in accordance with §__.116(a)(1)-(4), (a)(6), and (d);
• Documentation of informed consent or waiver of documentation of consent was obtained in accordance with §__.117;
• An IRB conducts a limited IRB review to make the determination required by §__.111(a)(7), and to make the determination that the research to be conducted is within the scope of the broad consent; and
• The investigator does not include returning individual research results to subjects as part of the study plan. However, it is permissible under this exemption to return individual research results when required by law regardless of whether or not such return is described in the study plan.

This exemption could also apply if the investigator obtains appropriate broad consent from the subject in addition to the consent to an original specific study, and then proceeds to use the information or biospecimen in a secondary study.

The exemption at §__.104(d)(8) is similar to the exemption proposed in the NPRM , but it has been modified in some respects. As with the exemption at §__.104(d)(7), the operation of the exemption at §__.104(d)(8) is also affected by other provisions in the final rule that are different from what was proposed in the NPRM. Namely, the exemption has been modified to apply only to storage or maintenance for secondary research use of identifiable private information or identifiable biospecimens because the final rule does not incorporate the NPRM proposal to alter the definition of a human subject to extend to research involving biospecimens regardless of their identifiability.

Due to the decision not to adopt the proposed privacy and security safeguards proposed in the NPRM at §__.105, this exemption was also modified to require that limited IRB review include an IRB determination that, when appropriate, adequate provisions are in place to protect the privacy of subjects and the confidentiality of data (§__.111(a)(7)). This is the same IRB approval criteria related to privacy and confidentiality that is required for nonexempt human subjects research.

In addition, because the final rule does not include a broad consent template when a specific study has been proposed, it is required that the study be reviewed by an IRB to determine whether the proposed secondary analysis fits within the parameters of the broad consent that was obtained for secondary research use.

We believe that the final rule’s requirement for limited IRB review of the privacy and confidentiality protections and the adequacy of the broad consent is responsive to commenters who believe that IRB oversight should be retained for the secondary research use of identifiable private information and identifiable biospecimens.

We recognize commenters’ point that this exemption does not provide an incentive to investigators to provide individual research results to subjects, but we believe that the challenges of how and when to return such results warrant consultation with the IRB. We note that with the other revisions to the NPRM proposals, other options for research involving identifiable private information and identifiable biospecimens exist, which would be consistent with having plans for returning individual results. Although broad consent may include a statement that clinically relevant research results might be returned to subjects, we believe that when specific secondary studies include such a plan to return research results, it would almost always be appropriate for the study to be reviewed by an IRB, in part to better ensure that research results are disclosed to subjects in an appropriate manner. The only exceptions would be if the research qualified for another exemption, an IRB waived informed consent under §__.116(e) or (f), or the research was carried out under a Secretarial waiver at §__.101(i). We expect that as part of the IRB’s review, the IRB would consider what subjects were told in the broad consent regarding the return of research results.

It should be noted that the two exemptions in the final rule at §__.104(d)(7) and (8) create additional options for investigators to conduct secondary research studies with identifiable private information. The final rule retains, largely unchanged, the options previously available to investigators in the pre-2018 rule. For instance, the final rule retains the pre-2018 criteria for requesting a waiver of consent in order to carry out those studies without obtaining consent. Moreover, secondary research using nonidentified biospecimens would not have to meet these requirements, because the final rule does not finalize the NPRM proposal to alter the definition of a human subject to include research involving nonidentified biospecimens under the rule.

[Back to top]

Deletion of the Pre-2018 Rule’s Exemption for Surveys and Interviews of Public Officials

The NPRM proposed to delete language found in the pre-2018 rule that exempted surveys and interviews with public officials. Approximately 100 comments discussed this proposed deletion and it was almost universally opposed. Political science professors, students, researchers, and academics from other disciplines generally addressed this deletion.

Comments argued that this deletion would have a chilling effect on political science research and might make political science researchers more vulnerable to law suits. Other comments noted that public officials are generally treated differently in numerous laws, and it is in fact appropriate for the Common Rule to have a different standard for surveys and interviews with public officials. Comments also suggested that this deletion could negatively affect the public’s ability to hold public officials accountable for their actions. One commenter suggested that instead of deleting this exemption, a final rule might consider explicitly limiting this exemption to studies that relate to the public officials in their official capacity.

The final rule removes the exemption category in the pre-2018 rule at §__.101(b)(3)(i), which pertained to research involving the use of educational tests, survey procedures, interview procedures, or observation of public behavior, if the human subjects are elected or appointed public officials or candidates for public office, or if federal statute requires without exception that the confidentiality of the personally identifiable information will be maintained throughout the research and thereafter. We note that many of the public comment concerns are addressed by other provisions in the final rule. Almost all of the research activities in this category would already be exempted under the final rule at §__.104(d)(2), without needing to single out elected or appointed officials as being treated differently in this way. If the research is designed to provide sensitive generalizable knowledge about officials, then the identifiable private information obtained should be kept confidential as required by this final rule. If the purpose of the activity is in fact designed to hold specific elected or appointed officials up for public scrutiny, and not keep the information confidential, such an activity is not considered research under the provision at §__.102(l)(2).

Thus, the final rule adopts the NPRM proposal.

[Back to top]

NPRM Proposal Not Adopted in the Final Rule: Proposal to Exempt Secondary Research Use of Identifiable Private Information Where Notice Was Given

One exemption proposed in the NPRM is not included in the final rule. Note that exclusions proposed in the NPRM and not included in the final rule also are described in Section III.I.4 of [the final rule] preamble.

The NPRM proposed to exempt certain secondary research activities involving identifiable private information where notice of such use had been given. The proposed exemption was included, in part, to be responsive to section 511 of the Medicare Access and CHIP Reauthorization Act of 2015 (MACRA), which requires the Secretary to issue a clarification or modification with respect to the application of these regulations to certain activities involving clinical data registries. The preamble for the Common Rule NPRM noted "...this exemption category might allow certain research activities of these clinical data registries not otherwise covered by the proposed HIPAA-related exclusion (i.e., when the clinical data registries are not part of a HIPAA covered entity or acting as a business associate), such as when a clinical data registry may receive information from a health care entity for research purposes."

The NPRM included the exemption at §__.104(e)(2), in part, to be responsive to section 511 of MACRA, but commenters expressed little support for this exemption, even for activities carried out by clinical data registries. Section 511 of MACRA has directed the Secretary of HHS to issue a clarification or modification with respect to the application of the Common Rule to activities involving clinical data registries, including quality improvement activities. With this final rule,

the Secretary of HHS is providing that clarification here. Because clinical data registries are created for a variety of purposes, and are designed and used in different ways, there is no simple, single answer regarding how the Common Rule applies to clinical data registries. The Secretary of HHS has received advice from SACHRP on this topic, and SACHRP recommended that the pre-2018 rule was adequate to apply to clinical data registries without those registries being given any distinctive status. The Secretary of HHS believes that the same is true for the final rule, and so has not created a specific provision for clinical data registries.

The final rule does not impose any requirements on a large portion of the activities related to clinical data registries. The following points are important: First, the rule does not apply to clinical data registry activities not conducted or supported by a Common Rule department or agency. Second, many clinical data registry activities, including many quality improvement activities, do not meet the definition of research, and so the Common Rule does not apply. For example, the creation of a clinical data registry designed to provide information about the performance quality of institutional care providers, and whose design is not influenced or altered to facilitate research, is not covered by this rule even if it is known that the registry will be used for research studies. Third, the Common Rule does not apply to a clinical data registry research study that only involves obtaining and analyzing nonidentified information because that activity would not involve a “human subject” as defined by the rule. Fourth, some clinical data registry research activities may qualify for exemption under the proposed provision at §__.104(d). Fifth, if an institution solely releases identifiable private information that was obtained in the course of patient clinical care to a clinical data registry for research, that institution is considered to be not engaged in human subjects research, and no requirements of the rule apply to that institution.

In contrast, if investigators receive funding from a Common Rule department or agency to design a clinical data registry for research purposes and the registry includes identifiable private information, or involves interacting with individuals (e.g., a research survey), then such an activity involves human subjects research, but may be exempt if it meets one or more of the exemption categories under §__.104(d)(7). Similarly, if investigators use federal support to obtain identifiable private information from a clinical data registry to conduct a research study, then such secondary research use of clinical registry information would involve human subjects research and the requirements of the rule would apply, although the research may qualify for exemption under §__.104(d)(8). This is comparable to how the rule applies to a research study that involves chart review of identifiable private information drawn directly from hospital medical records.

[Back to top]

NPRM Proposal Not Adopted in the Final Rule: Protection of Identifiable Private Information and Identifiable Biospecimens

The final rule does not adopt the privacy and security protections proposed in the NPRM, but rather retains and acknowledges the IRB’s role in ensuring that privacy safeguards are appropriate for the research studies that require IRB review. To better ensure that appropriate privacy protections are required by IRBs, the final rule includes a new provision in the IRB review and approval criteria at §__.111(a)(7)(i) that requires the Secretary of HHS in consultation with OMB and the Common Rule departments and agencies to issue guidance o assist IRBs in assessing what provisions are adequate to protect the privacy of subjects and to maintain the confidentiality of data. This requirement is discussed in more detail in Section XI [of the final rule preamble].

Although we continue to believe that appropriately protecting the privacy of human subjects who provide identifiable private information and identifiable biospecimens as well as preventing security breaches is critically important, we agree with the public’s concerns about requiring adherence to privacy and security standards when the safeguards to be issued by the Secretary of HHS have yet to be developed. The federal privacy and security laws would apply only to certain federally conducted research. Rather than promulgate a regulation that lacked sufficient specificity, we determined it would be preferable to maintain the requirement that IRBs review research studies to ensure that appropriate privacy and security safeguards are in place to protect research subjects, but include a commitment that the Secretary of HHS will issue guidance to assist IRBs in appropriately protecting subjects’ privacy and confidentiality. This guidance would take into consideration, among other things, the level of identifiability and sensitivity of the information being collected. Although IRBs were not specifically designed to evaluate risk to privacy and confidentiality and the adequacy of safeguards to protect against those risks, IRBs have been responsible for evaluating such risks under the pre-2018 rule. We believe that guidance in this complex and evolving area will assist IRBs to identify appropriate protections, and may be better able than standardized protections, to address the variety of privacy and confidentiality concerns that arise in the broad range of research studies that are being carried out now and those that will be conducted in the years to come.

As discussed in [the final rule preamble], certain NPRM exemption proposals required the application of the NPRM’s proposed safeguards in whole or in part. To accommodate the fact that the final rule does not include the privacy safeguards, exemption categories in the final rule that are predicated on the need for some type of privacy safeguards will instead require that an IRB conduct a limited review to ensure that adequate provisions are in place to protect the privacy of subjects and to maintain the confidentiality of data.

The final rule exemptions subject to this limited IRB review requirement are:

• The exemption for research that includes only interactions involving educational tests, survey procedures, interview procedures, or observations of public behavior regardless of the identifiability or sensitivity of the information collected/ recorded (§__.104(d)(2)(iii));
• The exemption for research involving benign behavioral interventions in conjunction with the collection of information from an adult subject through verbal or written responses or video recording (regardless of the identifiability or sensitivity of the information collected/ recorded (§__.104(d)(3)(i)(C));
• The exemption for the storage or maintenance of identifiable private information or identifiable biospecimens for which broad consent is required, when there is a change specific to the research activity in how the identifiable private information or identifiable biospecimens are stored and maintained (§__.104(d)(7)); and
  
• The exemption for the secondary research use of identifiable private information or identified biospecimens for which broad consent is required (§__.104(d)(8))

[Back to top]

§§__.107(a), __.111(a)(3), and __.111(b) IRB Membership and Modification to References to Vulnerability

A majority of comments agreed that the focus on issues related to coercion or undue influence, and no other considerations related to vulnerability, was appropriate. We agree with this assessment, and have retained this language in the final rule. We believe this change will help guide IRBs when assessing the type of vulnerability that should be the focus of review. We note that the §__.111(a)(3) approval criterion retains the reference to the purposes of the research and the setting in which it is conducted because these considerations are also relevant to the assessment of the equitable selection of subjects, and may include factors such as societal marginalization or discrimination.

The language at the three provisions (§__.107(a), §__.111(a)(3), and §__.111(b)) has been made identical in referring to vulnerability as meaning vulnerability to coercion and undue influence, in recognition that coercion or undue influence refers to the ability to make an informed decision about participating in research.

We agree with comments that said that the list of example vulnerable populations listed in the pre-2018 rule is out of date.

In agreement with the majority of comments, the final rule no longer includes pregnant women or “handicapped” or physically disabled individuals as examples of populations that are potentially vulnerable to coercion or undue influence. Adopting a suggestion from public comment and SACHRP, the final rule uses the term “individuals with impaired decision-making ability” to replace the term “mentally disabled persons.”

[Back to top]

§__.108 IRB Functions and Operations

The final rule adopts the NPRM proposals to move the IRB recordkeeping requirements from §__.103(b)(3), (4), and (5) to §__.108(a)(2), (3), and (4). (See Section IV [of the final rule preamble] regarding changes to §__.103 as well.) The final rule also adopts the NPRM proposal that IRBs must maintain an accurate list of IRB members but are not required to submit changes to that roster to the funding department or agency. The final rule also adopts the NPRM proposal to delete the requirement in the pre-2018 rule that institutions designate one or more IRBs on that institution’s FWA.

[Back to top]

§__.109 IRB Review of Research

The final rule at §__.109(a) modifies the language of the pre-2018 rule to state that IRBs review and have the authority to approve, require modifications in, or disapprove all research activities covered by this policy, including exempt research activities under §__.104 for which limited IRB review is a condition of exemption (§__.104(d)(2)(iii), §__.104(d)(3)(i)(C), §__.104(d)(7), and §__.104(d)(8)). Since the final rule requires limited IRB review for certain categories of exempt research, the provision at §__.109(a) has been modified to clarify that IRBs have the authority needed to conduct limited IRB review.

As proposed in the NPRM, and as generally supported in public comments, continuing review is eliminated for all studies that undergo expedited review, unless the reviewer explicitly justifies why continuing review would enhance protection of research subjects (§__.109(f)(1)(i) and §__.115(a)(3)). For studies initially reviewed by a convened IRB, once certain specified procedures are all that remain for the study, continuing review would not be required, unless specifically mandated by the IRB. These activities include: (1) Research eligible for expedited review in accordance with §__.110; or (2) Research that has progressed to the point that it involves only one or both of the following, which are part of the IRB-approved study: (a) Data analysis, including analysis of identifiable private information or identifiable biospecimens, or (b) Accessing follow-up clinical data from procedures that subjects would undergo as part of clinical care (at § __.109(f)). In addition, the final rule states at §__.109(f)(1)(ii) that continuing review is not required for research reviewed in accordance with the limited IRB review procedure described in §__.104(d)(2)(iii), §__.104(d)(3)(i)(C), §__.104(d)(7), or §__.104(d)(8).

The final rule does not require investigators to provide annual confirmation to the IRB that such research is ongoing and that no changes have been made that would require the IRB to conduct continuing review. Institutions that choose to require some accounting of ongoing research not subject to continuing review have significant flexibility in how they implement their own requirements. Note that under the final rule, investigators would still have the current obligations to report various developments (such as unanticipated problems or proposed changes to the study) to the IRB.

[Back to top]

§__.110 Expedited Review Procedures

Under the final rule, a study is deemed to be minimal risk and thus eligible for expedited review if the study only involves activities on the Secretary’s list, unless the reviewer determines and documents that the study involves more than minimal risk (§__.110(a) and (b)(1)). Thus, we anticipate that more studies that involve no more than minimal risk will undergo expedited review, rather than full review, which will relieve burden on IRBs.

Further, IRBs will be required to document their rationale when they override the presumption that studies on the Secretary’s expedited review list involve greater than minimal risk (at §__.115(a)(8)). Although public comments argued that this documentation represented an unjustified burden on IRBs, we believe that such documentation could provide a basis for the Secretary’s future determinations about the appropriateness of the list, and allow for greater consistency across institutions, and thus make the Common Rule more just.

At §__.110(b)(1)(iii) the final rule adopts the NPRM proposal that an IRB may use the expedited review process when conducting limited IRB review as required by the exemptions at §__.104(d)(2)(iii), §__.104(d)(3)(i)(C), §__.104(d)(7), and §__.104(d)(8).

Finally, as proposed in the NRPM, evaluation of the list of expedited review categories will occur every 8 years, followed by publication in the Federal Register and solicitation of public comment.

[Back to top]

§__.111 Criteria for IRB Approval of Research

The final rule does not adopt all of the NPRM proposals. It does not include the NPRM proposal regarding IRB review of plans to review the return of clinically relevant results to subjects. This proposal was deleted due to concern over the criteria that would be required for an IRB to appropriately consider this area, the need for particular IRB expertise to appropriately assess the return of results, and ambiguity over the meaning of “clinically relevant.”

The final rule does, however, revise two of the existing criteria for approval of research: (1) special considerations related to the involvement of vulnerable populations, and (2) privacy and confidentiality of data provisions.

As discussed in more detail in Section VII [of the final rule preamble], the language regarding vulnerable populations at §__.111(a)(3) and (b) has been revised to reflect the current understanding of which populations should receive special consideration due to potential vulnerabilities specific to the purposes and context of human subjects studies and to parallel other references to vulnerable populations found at §__.107(a).

Section __.111(a)(7) in the final rule retains the pre-2018 language, but also adds an additional requirement, thereby serving a dual function as both the primary regulatory provision requiring IRB review of the adequacy of protections for the privacy of subjects and confidentiality of identifiable private information (including that obtained from the analysis of biospecimens), and as the primary limited IRB review requirement needed to satisfy certain exemption determinations in §__.104(d).

In §__.111(a)(7)(i) the Secretary of HHS commits to issuing guidance to assist IRBs in assessing what provisions are adequate to protect the privacy of subjects and to maintain the confidentiality of information, after consultation with OMB’s privacy office and other federal departments and agencies that have adopted this policy. This modification is intended to serve a similar function as the privacy safeguards proposed in the NPRM (but not adopted in the final rule). The guidance might address the following considerations such as:

• The extent to which identifiable private information is or has been de-identified and the risk that such de-identified information can be re-identified;
• The use of the information;
• The extent to which the information will be shared or transferred to a third party or otherwise disclosed or released;
• The likely retention period or life of the information;
• The security controls that are in place to protect the confidentiality and integrity of the information; and
• The potential risk of harm to individuals should the information be lost, stolen, compromised, or otherwise used in a way contrary to the contours of the research under the exemption.

The final rule at §__.111(a)(8) modifies the NPRM proposal on the limited IRB review required by §__.104(d)(7). Section __.111(a)(8) specifies that for the purposes of conducting the limited IRB review required by §__.104(d)(7), the IRB must determine that broad consent for storage, maintenance, and secondary research use of identifiable biospecimens or identifiable private information is obtained in accordance with the requirements of §__.116(a)(1)-(4), (a)(6), and (d). As part of its review of these requirements for broad consent, the IRB would review the appropriateness of the process proposed for obtaining broad consent, and ensure that the required elements of broad consent were appropriately included in the broad consent form (or process, if broad consent is to be obtained orally). Additionally, the IRB must determine that consent is appropriately documented, or that a waiver of documentation is appropriate, in accordance with §__.117. Finally, if a change is made for research purposes in the way identifiable private information or identifiable biospecimens are stored or maintained, the IRB must determine that adequate provisions are in place to protect the privacy of subjects and to maintain the confidentiality of data. It is expected that the guidance to be developed by the Secretary of HHS about protecting the privacy of subjects and maintaining the confidentiality of data will also be applicable to the privacy and confidentiality considerations included in this limited IRB review requirement.

[Back to top]

§__.114 Cooperative Research

The final rule adopts the NPRM proposal with modifications that are responsive to public comment. We agree with commenters who speculated that mandated single IRB review would ultimately decrease administrative burdens and inefficiencies for investigators and institutions, while acknowledging that the transition to this model would require significant time and an adjustment to institutional structures and policies. We concur that, rather than offering additional protections, in many cases multiple IRB approvals increase burden and frequently delay the implementation of studies, increasing the costs of clinical trials and potentially stalling access to new therapies. We note comments that expressed frustration with the frequent occurrence of central IRB participating sites insisting on separate institutional reviews. One comment noted that these additional IRB reviews generally reach the same conclusions, or conclusions with minor changes, that are then imposed solely on that site. When working optimally, we expect the central IRB model will work more efficiently and require less personnel time and fewer resources for tracking and implementing IRB changes and approvals, thereby eliminating the potential for unnecessarily duplicative reviews.

Although a large number of comments believed that single IRB review should be encouraged rather than mandated, we feel that this incentivized approach would ultimately fail to yield substantive positive change in the system. Rather, systematic efficiencies have the best chance of occurring if single IRB review is required for all review in domestic research involving more than one institution. We acknowledge that further guidance for this requirement will need to be developed and that initial cost projections may have been low. However, we feel this change supports the best interests of the research infrastructure through increasing efficiency. Note that the final rule permits appropriate flexibilities that will assist in implementation. Institutions may still choose to conduct additional internal IRB reviews for their own purposes, though such reviews would no longer have any regulatory status in terms of compliance with the Common Rule.

We agree with comments recommending that a greater role should be provided for grantee input on choosing the IRB of record, and have modified the language accordingly. The language at §__.114(b)(1) now states that the reviewing IRB (i.e., the IRB of record) will be identified by the federal department or agency supporting or conducting the research, yet allows lead institutions to propose the reviewing IRB, subject to the acceptance of the federal department or agency supporting the research. This provision is consistent with the NIH single IRB policy, which was published on June 21, 2016.

This final rule adopts (in §__.114(b)(2)(i)) the NPRM’s proposal that cooperative research for which more than single IRB review is required by law is not subject to the requirements of §__.114. The rule also adds clarifying language providing that this provision extends to tribal laws passed by the official governing body of an AI/AN tribe. Thus, if the official governing body of an AI/AN tribe passes a tribal law that requires more than single IRB review for certain cooperative research, the requirement for single IRB review does not apply to such cooperative research. In addition, we highlight that §__.114(b)(2)(ii) allows a federal department or agency the flexibility to determine that the use of a single IRB is not appropriate for certain contexts, thereby permitting additional IRB review and consideration of local and regional variations in some circumstances.

Finally, the final rule adopts the NPRM proposal for this provision to have a delayed compliance date of 3-years from the date the final rule is published in the Federal Register. This transition period is intended to allow the regulated community appropriate time and flexibility in adjusting to this new model.

[Back to top]

§__.115 IRB Records

A majority of the changes proposed in the NPRM in §__.115 have been retained in the final rule without alteration. However, the final rule differs from the NPRM in a few ways. First, the NPRM included two provisions requiring documentation of continuing review activities; these have been merged into one provision in the final rule at §__.115(a)(3). Second, the NPRM required that the IRB keep records of the IRB reliance agreements between an institution and the IRBs not operated by that institution that review said institution’s nonexempt research activities. Instead, the final rule includes language at §__.115(a)(9) that requires each institution to maintain adequate documentation of the responsibilities that each entity will undertake to ensure compliance with this policy. This provision differs from the NPRM proposal to correspond to the more flexible provision included at §__.103(e), which does not require the creation of a written agreement between an institution and a reviewing IRB that said institution does not operate.

Because the final rule does not include an exemption determination requirement, the exemption documentation requirement proposed in the NPRM is not included in the final rule. Additionally, because the final rule does not include specified privacy safeguards, the NPRM proposal for an IRB to safeguard records as required by the proposed privacy safeguards is not included.

The final rule includes the NPRM proposal that IRBs document decisions to require continuing review or full board review even in circumstances when such review is not required because we believe it is important to document why an IRB is making a determination that differs from the regulatory baseline. This also helps to promote the principle of justice (as applied to IRB operations). Note that nothing in these regulations prevents an institution from authorizing an IRB to apply standards that exceed those in the regulations, if indeed the institution has chosen to do so.

In addition, while the NPRM proposed to require that IRB records that contain identifiable private information be safeguarded through compliance with the proposed privacy safeguards, the final rule does not require such safeguards. Although no public comments were received on this provision, in deciding not to include the NPRM’s proposed privacy safeguard requirements in the final rule, we determined that it was unnecessary for the Common Rule to impose additional privacy requirements on IRB records as we are unaware of instances in which IRB records were breached. In addition, IRB records are not the regulatory equivalent of research records, which should be adequately secured or safeguarded against inappropriate uses or disclosures of identifiable private information. IRB records will generally be secured for a variety of reasons. These include not only protecting identifiable private information, but also, for example, protecting discrete information and intellectual property that might be included in a protocol. There are other means for ensuring institutions and IRBs protect their records beyond what is required by the Common Rule.

[Back to top]

§__.116 General Requirements for Informed Consent

The final rule contains several major revisions to the requirements for informed consent, specifically with respect to: (1) new requirements relating to the content, organization, and presentation of information included in the consent form and process to facilitate a prospective subject’s decision about whether to participate in research; (2) the basic and additional elements of consent; (3) the elements of broad consent for the storage, maintenance, or secondary research use of identifiable private information and identifiable biospecimens; (4) attendant changes in the waiver or alteration criteria for consent; (5) a new provision that allows IRBs to approve a research proposal for which investigators obtain information or biospecimens without individuals’ informed consent for the purpose of screening, recruiting, or determining the eligibility of prospective human subjects of research, provided certain conditions are met; and, (6) a new requirement to post to a federal website a copy of an IRB-approved version of the consent form that was used for enrollment purposes for each clinical trial conducted or supported by a federal department or agency. Each of the final rule provisions are discussed separately below.

[Back to top]

§__.116(a) General Requirements for Informed Consent

Before addressing how the general requirements for informed consent proposed in the NPRM have been adopted and altered in the final rule, it is important to note that the structure for this regulatory text has been altered. In the pre-2018 rule, the general requirements were included in an unnumbered introductory paragraph. The NPRM proposed the same approach. To emphasize the fact that this paragraph includes multiple independent and important regulatory requirements, and to enable stakeholders and Common Rule departments and agencies to more easily reference particular requirements, these general requirements have been redesignated into a new §__.116(a). In addition, the general requirement for consent in the final rule at §__.116(a)(6) removes the reference to oral or written consent that was in the pre-2018 rule. This is the provision that addresses the prohibition on including exculpatory language through which the subject or the legally authorized representative is made to waive or appear to waive any of the subject’s legal rights, or releases or appears to release the investigator, the sponsor, the institution, or its agents from liability for negligence. The reference to oral or written consent was removed from this provision in the final rule. In its place, a similar reference was included in to §__.116(a) to clarify that all the requirements set forth in §__.116(a) apply to written and oral consent.

Another change made in the final rule, as compared with the pre-2018 rule and the language proposed in the NPRM, is that §__.116(a) contains introductory language summarizing each paragraph of §__.116 and the relationship between those paragraphs. Given that the framework for informed consent has been altered and reorganized through this regulation, this introductory language is intended to explain the overall approach set forth in revised §__.116, as well as the significance of each paragraph. This introductory language is also intended to explain the role of broad consent under revised §__.116. The introductory paragraph explains that the general requirements for informed consent are now set forth in §__.116(a) and that these general requirements apply with respect to informed consent obtained pursuant to §__.116(b), (c), and (d) (except, as described later, §__.116(a)(5) does not apply to broad consent obtained under §__.116(d)). This introductory language also explains that the basic elements of informed consent (which were described in §__.116(a) of the pre-2018 rule) are included in §__.116(b) of this final rule and that additional elements of informed consent that pertain only to certain studies (which were described in §__.116(b) of the pre-2018 rule) are included in §__.116(c) of this final rule.

In addition, this introductory language explains that the requirements for broad consent (a concept not specifically addressed in the pre-2018 rule) are described in §__.116(d) of this final rule. As discussed below, broad consent under this final rule differs from the broad consent approach proposed for §__.116(c) in the NPRM. The introductory language of §__.116(a) explains that broad consent may be obtained in lieu of informed consent obtained under §__.116(b) and §__.116(c) (which describe basic elements of informed consent as a general matter and additional elements of informed consent that apply only to certain studies, respectively) for certain purposes. Specifically, in lieu of obtaining study-specific informed consent in accordance with §__.116(b) and (c), broad consent may be obtained under §__.116(d) for the use of identifiable private information or identifiable biospecimens collected for either research studies other than the proposed research or nonresearch purposes for: (1) storage and maintenance for secondary research use; and (2) secondary research. For those purposes (and no others), broad consent under §__.116(d) may be obtained instead of specific consent under §__.116(b) and (c).

New introductory language at §__.116(a) also summarizes the provisions describing circumstances in which waiver or alteration of the requirements of informed consent are permitted. These circumstances pertain to research involving public benefit and service programs conducted by or subject to the approval of state or local officials at §__.116(e), and to research more generally at §__.116(f) (see below).

Another change reflected in the final rule is that specific requirements for informed consent have been included in subparagraphs for clarity and emphasis. For example, the requirement that information that is given to the subject or the legally authorized representative shall be in language understandable to such subject or representative is no longer included as part of a general introductory paragraph and is instead included as §__.116(a)(3). Except as noted here, these requirements remain the same as they were under the pre-2018 rule.

The final rule adopts, almost verbatim, all of the proposals made in the NPRM to improve and clarify the general requirements for informed consent. For example, the final rule adopts the proposed requirement specifying that the information provided in an informed consent form must be presented in sufficient detail relating to the research, and must be organized and presented in a way that does not merely provide lists of isolated facts, but rather facilitates the prospective subject’s or legally authorized representative’s understanding of the reasons why one might or might not want to participate. The final rule also adopts new language clarifying that this requirement applies to the informed consent as a whole. In addition, the final rule adopts the NPRM’s proposal that prospective subjects or legally authorized representative must be provided with key information that is most likely to assist a prospective subject or legally authorized representative in making a decision about participating in research, and to provide an opportunity to discuss that information. Moreover, the final rule adopts an approach, consistent with many public comments, emphasizing efforts to foster understanding overall rather than imposing specific length limitations on the entire consent forms.

The final rule also includes language slightly different from that proposed in the NPRM for clarity or for conformance with other language in the final rule. For example, the final rule replaces references to a subject’s representative with references to a subject’s legally authorized representative (a term defined in §__.102) for clarity.

As discussed above, a significant proposal in the NPRM was that in obtaining informed consent, investigators would first have to present the information required by §__.116, before presenting any other information, if any. In addition, the NPRM proposed mandating that consent forms must include only the required information under §__.116 and that any other information be included in appendices. The final rule does not adopt a requirement that certain information be included only in appendices. This approach is responsive to public comments expressing concerns that such a mandate might sometimes undermine the informed consent process. The final rule adopts a slight variation of that approach in response to public comments about perceived lack of flexibility in the proposed language. Whereas the NPRM referred to the “body” of the consent form as opposed to appendices to the consent form, the final rule replaces those concepts with references to material that must be at the beginning of the consent form, versus material that can appear after that beginning section. The final rule does not limit the information that can be provided in the beginning of a consent form to only the §__.116 requirements, but instead offers a more flexible and meaningful approach in response to public concerns that the NPRM proposal was too prescriptive. Moreover, the approach recognizes public comments that expressed concerns about creating a “dual document” system. As such, the final rule does not address appendices to the informed consent. However, the NPRM’s references to the appendices of the consent form have in general been conceptually replaced by references to the material in a consent form that follows the “beginning” section.

In particular, the final rule imposes a new requirement (set forth in §__.116(a)(5)(i)) that the informed consent begin with a concise and focused presentation of the key information that is most likely to assist a prospective subject or legally authorized representative in understanding the reasons why one might or might not want to participate in the research. This provision further requires that this beginning portion of the informed consent must be organized and presented in a way that facilitates comprehension. This requirement applies to all informed consents, except for broad consents obtained pursuant to §__.116(d), which may warrant a different presentation.

This new requirement included at §__.116(a)(5)(i) is somewhat similar to the proposal advanced in the NPRM insofar as both emphasize the importance of presenting the information that would be most important to a subject (or a legally authorized representative) before presenting other information. However, the requirement included in §__.116(a)(5)(i) is more specific, detailed, and flexible. First, this provision requires that key information be included in the beginning of the informed consent in a concise and focused presentation. We recognize that how this requirement applies will depend on the nature of the specific research study and the information presented in the informed consent and believe that this requirement strikes an appropriate balance between facilitating the comprehension of subjects of key issues and allowing study-specific flexibilities. In general, our expectation is that this initial presentation of the key pieces of information will be relatively short. This section of the consent could, in appropriate circumstances, include a summary of relevant pieces of information that are explained in greater detail later in the consent form.

The requirement that key information be presented in a concise and focused way will require an assessment that is specific to a study and its informed consent. For example, for most complicated clinical trials involving cancer patients with long (e.g., 20- to 25-page) consent documents, our expectation would be that the concise and focused presentation referred to in §__.116(a)(5)(i) would be no more than a few pages, and would provide the key pieces of information about the trial in such a manner that facilitates a person’s comprehension of why they might or might not want to participate in the research.

In such cases, for example, we would not consider a 10-page description of elements such as potential risks, accompanied by lengthy and complex charts and graphs, to satisfy the “concise and focused” requirement of §__.116(a)(5)(i). With regard to risks in the type of cancer trial mentioned above, for example, instead of needing to mention every reasonably foreseeable risk, which would be required by §__.116(b)(2), this beginning section of the consent form should identify the most important risks, similar to the information that a doctor might deliver in the clinical context in telling a patient how sick the chemotherapy drugs will make them, but with a particular emphasis on how those risks are changed by participating in the study.

We recognize the advantages of allowing institutions to design informed consents, consistent with §__.116(a)(5)(i), that are tailored to particular research studies to assist prospective subjects in understanding the most fundamental aspects of the informed consent. For this reason, the final rule does not strictly specify the types of information that should or should not be included to satisfy §__.116(a)(5)(i), or the length of such concise and focused presentations. This flexibility is responsive to public comments recommending against a rigid approach to enable institutions and individuals to tailor informed consents to the circumstances of particular studies. A discussion of the key information to be included in the beginning section of the consent form, and how it will operate in practice, may be further clarified in future guidance.

We also recognize that for some relatively simple research studies with limited risks or benefits, the entire informed consent document may be relatively brief and still satisfy §__.116. In such circumstances, an institution may determine that virtually all of the information required by §__.116 would also satisfy §__.116(a)(5)(i). In such cases, the informed consent document could include the concise and focused presentation of §__.116(a)(5)(i) at the beginning of the informed consent document, followed by limited additional information required to satisfy §__.116.

In all circumstances (those involving lengthy and complex informed consents as well as short and relatively simple informed consents), if information included at the beginning of the informed consent satisfies both §__.116(a)(5)(i) and the elements of informed consent under §__.116(b) and §__.116(c) more generally, the information included at the beginning need not be repeated later in the body of the informed consent. Thus, with respect to the example provided above concerning a clinical trial with cancer patients, the most important reasonably foreseeable risks to subjects would be summarized at the beginning of the informed consent as part of §__.116(a)(5)(i)’s concise and focused presentation, but that a more comprehensive and detailed description of reasonably foreseeable risks to subjects would be included later in the body of the informed consent. In contrast, with respect to a relatively simple research study with limited risks, we would expect that all of the information provided to potential subjects concerning such risks might satisfy both §__.116(a)(5)(i) (as part of a concise and focused presentation of key information) and §__.116(b)(2) (a description of any reasonably foreseeable risks or discomforts to the subject). In such circumstances, the information provided at the beginning of the informed consent would not need to be repeated or further detailed in the informed consent and the entire informed consent could be relatively short.

In general, we would expect that to satisfy §__.116(a)(5)(i), the beginning of an informed consent would include a concise explanation of the following: (1) the fact that consent is being sought for research and that participation is voluntary; (2) the purposes of the research, the expected duration of the prospective subject’s participation, and the procedures to be followed in the research; (3) the reasonably foreseeable risks or discomforts to the prospective subject; (4) the benefits to the prospective subject or to others that may reasonably be expected from the research; and (5) appropriate alternative procedures or courses of treatment, if any, that might be advantageous to the prospective subject. As a general matter, a brief description of these five factors would encompass the key information most likely to assist a reasonable person (or legally authorized representative) in understanding the reasons why one might or might not want to participate in research, as required by §__.116(a)(5)(i) and §__.116(a)(4). However, we recognize that this determination is necessarily fact-specific and that IRBs and institutions may require that somewhat different (or additional) information be presented at the beginning of an informed consent to satisfy §__.116(a)(5)(i).

The NPRM also proposed adding a new requirement to the general introductory paragraph of §__.116, which would provide that if an authorization required by 45 CFR parts 160 and 164 (parts of the HIPAA Privacy Rule) is combined with a consent form, the authorization elements required by 45 CFR 164.508 must be included in the consent form (and not the appendices). Because this final rule does not incorporate the distinction proposed in the NPRM between the informed consent and appendices, the final rule does not incorporate this language.

We are satisfied that the approach adopted in this final rule will enable regulated entities and individuals to pursue different and innovative approaches to obtaining informed consent, as recommended in some public comments, while ensuring that the important aspects of informed consent are clearly communicated to prospective subjects and subjects.

[Back to top]

§__.116(b) Basic Elements of Informed Consent

The final rule, at §__.116(b)(9), adopts the NPRM proposal to inform potential subjects about the possible use of their identifiable private information with two clarifying changes. First, because the final rule at §__.102(e)(1) now states that the definition of human subject, in part, includes research in which an investigator obtains, uses, studies, analyzes, or generates identifiable biospecimens or identifiable private information, this new element of informed consent has been clarified to specifically apply to any research that involves the collection of identifiable biospecimens, rather than all biospecimens, in addition to research that involves the collection of identifiable private information. In addition, a change to what was proposed in the NPRM has been made to the new element of consent in the final rule at §__.116(b)(9)(ii), to clarify that it is intended to inform subjects that their information or biospecimens collected as part of the research will not be used or distributed for future research, even if identifiers are removed.

We agree with the public comments that indicated this new element of consent will provide useful information to prospective subjects about whether their identifiable private information or identifiable biospecimens might be stripped of identifiers and used for future research studies or distributed to another investigator for future research studies without additional informed consent from the subject or the legally authorized representative.

We expect that this information can usually be provided in a brief statement, and disagree with the commenters that suggested that this new basic element of consent would increase the length of consent forms without appreciably improving potential subjects’ understanding of a specific research activity. This new requirement is intended to give the potential subject a right to know that identifiers might be removed from information or biospecimens and be used for future research without additional consent, when such a possibility exists, so he or she can make a fully informed decision about whether to participate in the research. If subjects’ identifiable private information or identifiable biospecimens will not be used for future research studies, even if identifiers are removed, this new element of consent requires that subjects be informed of this as well. Finally, if a specific technology or technique determined to be capable of generating identifiable private information or identifiable biospecimens through the consultative process described at §__.102(e)(7) will be used, that information should be included in the description of the research at §__.116(b)(1).

[Back to top]

§__.116(c) Additional Elements of Informed Consent

The final rule contains two of the three proposed additional elements of consent. The final rule does not include the additional element proposed in the NPRM relating to providing subjects or their legally authorized representatives the option to consent or refuse to consent to being re-contacted to obtain additional information or biospecimens, or for future research.

New additional elements included in the final rule are: (1) a statement that the subject’s biospecimens (even if identifiers are removed) may be used for commercial profit and whether the subject will or will not share in this commercial profit (§__.116(c)(7)); and (2) a statement regarding whether clinically relevant research results, including individual research results, will be disclosed to subjects, and if so, under what conditions (§__.116(c)(8)). Because many public comments addressed a desire to share in the profits of successful products developed using their biospecimens, we believe that investigators, when appropriate, should inform prospective subjects about whether they might or might not benefit commercially from future products resulting from the research, should that possibility be important in their decision making process. Also, several comments received from individuals who reported participation in research studies described disappointment that research results were not returned to them. We believe that potential subjects should be aware of the possibility that they might not receive research results, as well as the possibility that they might, so that they can factor that information into their decision about whether to consent to research. This provision is intended to pertain to all clinically relevant research results, including general or aggregate research findings and individual research results.

We are also including in the final rule an additional element that when appropriate for research involving biospecimens, subjects be informed of whether the research will (if known) or might include whole genome sequencing (WGS) (§__.116(c)(9)). This provision of the final rule describes WGS as the sequencing of a human germline or somatic specimen with the intent to generate the genome or exome sequence of that specimen. WGS generates an extremely large amount of information about people, including factors that will contribute to their future medical conditions. As was recognized in the NPRM’s Alternative Proposal A to expand the definition of “human subject” to include WGS (discussed in Section III [of the final rule preamble]), data obtained through WGS can provide important insights into the health of individuals as well as their biological family. It is also possible that WGS data gathered for one purpose may reveal important information, perhaps unanticipated and unplanned for, years later. Given the unique implications of the information that can be developed through WGS, if it is either known that a specific research study will include this technique, or might include it, we believe that this aspect of the research must be disclosed to prospective subjects as part of the informed consent process. It is recognized that under the pre-2018 rule, if a research study were to involve WGS, this research procedure would have almost always been included in the description of the research. However, to remove any ambiguity about whether such information would need to be included in the informed consent, the final rule makes this requirement explicit through this new element of consent.

The information that would have to be disclosed under these additional elements of consent is often relevant to an individual’s decision of whether to participate in a research study. Such information may have been included in informed consent forms under the pre-2018 rule. However, the final rule now requires inclusion of these additional elements, when appropriate.

The additional element of consent proposed in the NPRM that was not included in the final rule would have required providing subjects or their legally authorized representatives with an option to consent, or refuse to consent, to investigators re-contacting the subject to seek additional information or biospecimens or to discuss participation in another research study. Although for some research studies, it will be desirable to inform prospective subjects about investigators’ plan to re-contact subjects for certain purposes, and give them the option to agree or disagree to such re-contact, we agree with the public comments that questioned the importance of requiring that such information be included in the consent form. Although the final rule does not include this additional element of consent, this information can be included in the consent form.

[Back to top]

§__.116(d) Elements of Broad Consent for the Storage, Maintenance, and Secondary Research Use of Identifiable Private Information or Identifiable Biospecimens

The final rule includes an option to obtain broad consent for the storage, maintenance, and secondary research use of identifiable private information or identifiable biospecimens, as defined at §__.102(e)(5) and (6), but several significant changes were made in response to public comments. Although in some ways the final rule’s broad consent provision resembles the provision that was proposed in the NPRM, it is important to recognize a very fundamental difference between the role that this provision will play under the final rule, as compared to the role it was intended to play under the NPRM. This key difference relates to the fact that the provisions in the NPRM that would have generally required consent for secondary research use of nonidentified biospecimens, including imposing narrow stringent criteria for IRB waiver of consent with respect to such research, are not being implemented because the NPRM’s proposal that all biospecimens, regardless of their identifiability, be covered under the Common Rule has not been adopted. Importantly, under the final rule, broad consent is permissible only for secondary research and no other types of research.

Thus, had all of those NPRM provisions been implemented, investigators who wanted to conduct secondary research with biospecimens would in most instances have found themselves essentially forced to use the new broad consent provisions as their only practical option for conducting such research. This is because generally, under the NPRM proposals, they would no longer have had the option to de-identify information or biospecimens, or to use them in coded form, to avoid application of the Common Rule’s requirements. Under the NPRM’s proposals, had investigators not obtained broad consent, they would often not practicably be able to meet the informed consent requirements relating to such research (which would have been covered under the Common Rule). Therefore, it would generally have been the case that they would have had little choice but to obtain broad consent, assuming they did not want to undertake the alternative of obtaining study-specific consent from subjects each and every time they conducted a study involving secondary use of biospecimens.

Given that we did not adopt the NPRM’s proposal to cover all biospecimens regardless of their identifiability under the Common Rule, the final rule also does not adopt proposed consent requirements for secondary research with nonidentified biospecimens. For this reason, the final rule’s provisions relating to broad consent now play a very different role from those proposed in the NPRM. In most instances, these provisions will be providing new options - that is, new flexibility - to an investigator, in addition to those options that an investigator would have had under the pre-2018 rule. An investigator wishing to do secondary research with biospecimens will continue to have the option of doing secondary research with nonidentifiable biospecimens, as was the case in the pre-2018 rule. An investigator also could continue to use biospecimens that are coded, thus allowing the collection of additional information about the subjects over time. In both of those instances, no additional consent would be required because the research would not involve human subjects as defined by the final rule. Furthermore, even if the investigator wanted to use the biospecimens with identifiers attached, he or she would still have the option of asking an IRB to waive the requirement to obtain informed consent: the waiver criteria are in most respects unchanged under the final rule.

For these reasons, the broad consent provisions at §__.116(d) afford investigators wishing to conduct secondary research on identifiable private information or identifiable biospecimens an additional alternative to obtaining an IRB waiver of consent or to obtaining study-specific consent. Given that these new broad consent provisions are essentially a new alternative to other options that are very similar to those that existed under the pre-2018 rule, these provisions are not increasing any regulatory burden or making it more difficult to do research. Indeed, just the opposite is the case. The changes made in the final rule are responsive to the significant criticisms expressed by many of the commenters about what the NPRM proposed, under which obtaining broad consent would have imposed substantial new burdens on a vast amount of secondary research with biospecimens. In contrast, when investigators choose to use the broad consent provisions under the final rule, they will presumably be doing so because this new option is less burdensome to them than their other (largely unchanged) options for conducting such research.

Although we recognize public commenters’ concern that broad consent might not be as meaningful or informative as study-specific consent, it is also important to note that when an investigator chooses to use this new option, doing so will generally provide increased protection to the autonomy of research subjects. It will give them a choice to say no to such research, in contrast to most of the other routes by which an investigator might generally choose to conduct this type of research, such as with a waiver of informed consent, which allows research to take place regardless of the wishes of the person whose information or biospecimens are being studied, and without their knowledge. In addition, in response to the public’s concerns that broad consent would not be meaningful, some of the elements of broad consent have changed from what was proposed in the NPRM to require more specific information about the research that may be conducted. As discussed in the NPRM, one of the main purposes of the final rule is to facilitate the conduct of minimal risk research, while enhancing subjects’ autonomy. We believe that the option to obtain broad consent furthers this goal.

It is important to recognize that broad consent is a permissible option only for secondary research. Secondary research is limited to research using identifiable private information or identifiable biospecimens that are collected for either research studies other than the proposed research or nonresearch purposes. It is not permissible to obtain broad consent for any other type of research (e.g., research involving the collection of information or biospecimens through a research interaction or intervention with a subject). The informed consent requirements in §__.116(b) and (c) will be applicable to all human subjects research for which broad consent is not an option. However, it is envisioned that research requiring study-specific consent, such as research involving the collection of information or biospecimens through a research interaction or intervention with a subject, will sometimes also involve seeking subjects’ broad consent for the secondary research use of identifiable private information or identifiable biospecimens obtained as part of the original research study.

When broad consent is obtained, the general requirements for informed consent in §__.116(a) apply, except that the requirements at §__.116(a)(5) (imposing certain requirements concerning the presentation of information for informed consent and prescribing the order in which consent information is presented) do not apply to broad consent.

We expect that, given the different requirements set forth for study-specific consent and broad consent, some institutions and investigators may elect to pursue study-specific consents for the storage, maintenance, and secondary research uses of identifiable private information and identifiable biospecimens (or for some subset of such research) whereas other institutions and investigators may elect to pursue broad consent for the same types of research (or for some subset of such research). For instance, with regard to the public comments raising concern about broad consent being sought from AI/AN peoples, it is expected that institutions, investigators, and IRBs will consider these concerns when determining when it might be appropriate to seek study-specific consent for the secondary research use of identifiable biospecimens, as well as the need for tribal consent, when appropriate.

Perhaps even more commonly, however, given that the NPRM proposal regarding generally requiring consent for research use of nonidentifiable biospecimens has not been adopted, many investigators may choose to use the routes that previously existed under the pre-2018 rule, and will continue to exist, for conducting such research without informed consent under the Common Rule. Those options include using nonidentifiable biospecimens, including perhaps having a code maintained that will allow the investigator to obtain additional information about the subjects, or obtaining a waiver from an IRB of the need to obtain informed consent.

The broad consent provision in the final rule is different in three main ways from what was proposed in the NPRM. First, consistent with the decision not to revise the definition of human subject to include biospecimens regardless of identifiability, the broad consent provision in §__.116(d) only applies to secondary research using identifiable private information and identifiable biospecimens.

Second, the elements of broad consent have been strengthened and simplified in response to public comments. The final rule strengthens the element of broad consent proposed in the NPRM regarding the need to provide a general description of the types of research that may be conducted with identifiable private information and identifiable biospecimens. It does this by requiring that this description must include sufficient information to allow a reasonable person to expect that the broad consent would permit the types of research conducted. This “reasonable person” standard is consistent with the interpretation that the Office for Civil Rights provided for authorization obtained from an individual for the use or disclosure of protected health information for future research purposes. In addition, the final rule has been strengthened to require that when subjects will not be informed about the details for any specific research studies that might be conducted using their identifiable private information or identifiable biospecimens, the broad consent must disclose this fact and inform subjects that they might have chosen not to consent to some of those specific research studies. It is envisioned that for certain types of research, such as research for which there is reason to believe some subjects will find the research controversial or objectionable, a more robust description of the research will be required in order to meet this “reasonable person” standard. This requirement has been included in the final rule in recognition of the concerns raised by some public commenters that broad consent would not be meaningful because it will not provide detailed information about specific research studies that might be conducted with the individual’s identifiable private information or identifiable biospecimens.

As proposed in the NPRM, the final rule permits broad consent to be sought for either a narrow type of research to be conducted in the future (e.g., cancer research), or a broader scope of

research. Given this flexibility, while the final rule includes an exemption for secondary research for which broad consent is required, the exemption is contingent on several criteria being satisfied, including that an IRB determines that the research to be conducted is within the scope of the broad consent (§__.104(d)(8)). This exemption is further discussed in Section V [of the final rule preamble]. For research that is not exempt, the IRB is expected to assess whether the description of the research included in the broad consent form is adequate to permit a reasonable person to expect that they were providing consent for the currently proposed secondary research study.

While strengthening the broad consent requirements, the final rule also adopts simplified and more flexible elements of broad consent than what was proposed in the NPRM. For example, the final rule requires that the broad consent include a description of the identifiable private information or identifiable biospecimens that might be used in research, whether sharing of such information or biospecimens might occur, and the types of institutions or investigators that might conduct research with such information or biospecimens. However, the final rule does not adopt the NPRM’s proposed limitations on the research use of biospecimens or identifiable private information obtained for nonresearch purposes, that would have only permitted a broad consent to cover either or both of the following: (1) biospecimens or identifiable private information that exist at the time at which broad consent is sought; and (2) biospecimens or identifiable private information that will be collected up to 10 years after broad consent is obtained or until the child reaches the legal age of consent to the treatments or procedures involved in the research, whichever comes first. We were persuaded by the public comments that raised concerns about the complexity and tracking burden that such limitations would impose, without clearly offering individuals a more meaningful way to control the use of their information or biospecimens.

In addition, the broad consent requirements have been simplified to avoid creating redundant requirements with the basic elements of informed consent under §__.116(b) that must also be included in broad consent obtained under §__.116(d). For example, in the final rule, it is required that broad consent include a statement that participation is voluntary, refusal to participate will involve no penalty or loss of benefits to which the subject is otherwise entitled, and the subject may discontinue participation at any time without loss of benefits to which the subject is otherwise entitled ((§__.116(d)(1), incorporating §__.116(b)(8) for broad consent). Therefore, the comparable element of broad consent that was proposed in the NPRM is not included in the final rule.

As discussed in the NPRM, we expect that, when appropriate, this element of broad consent will inform subjects that information that has been stripped of identifiers might not be traceable, and thus it might not be feasible to withdraw consent for future use or distribution in this case. However, if an investigator commits to permitting a subject to discontinue use of the subject’s identifiable private information or identifiable biospecimens, it is expected that the investigator will honor this commitment by not removing identifiers.

Similarly, the final rule also does not include the element of broad consent proposed in the NPRM that, when relevant, would have required the broad consent to include an option for an adult subject or the representative to consent, or refuse to consent, to the inclusion of the subject’s data, with removal of the identifiers listed in 45 CFR 164.514(b)(2)(i)(A) through (Q), in a database that is publicly and openly accessible to anyone, and that this option be prominently noted and include a description of the risks of public access to the data. We believe this proposed requirement is unnecessary because it overlaps with the broad consent elements included in the final rule requiring a statement describing the extent, if any, to which confidentiality of records identifying the subject will be maintained (§__.116(d)(1), incorporating §__.116(b)(5) for broad consent), and a description of any reasonably foreseeable risks or discomforts to the subject (§__.116(d)(1), incorporating §__.116(b)(2) for broad consent).

The final rule includes a slightly different provision relating to the return of research results than that proposed in the NPRM. As set forth in §__.116(d)(6) of the final rule, unless it is known that clinically relevant research results, including individual research results, will be disclosed to the subject in all circumstances, a statement that such results may not be disclosed to the subject must be included in the broad consent. This element of broad consent differs from the related requirement in §__.116(c)(8) that pertains when an investigator is seeking consent for a specific study, since unlike the circumstances under which broad consent is likely to be sought, investigators seeking consent for a specific study will know if the study includes a plan to return research results to subjects. The NPRM proposed that a general element of informed consent be included as part of a broad consent, namely that the consent include a statement regarding whether clinically relevant research results, including individual research results, would be disclosed to subjects, and if so, under what conditions. The language adopted in the final rule is intended to provide transparency, but is tailored to the broad consent context as those seeking broad consent may not know whether clinically relevant research results, including individual research results, will always be disclosed to subjects, and if so, under what conditions. Nonetheless, unless investigators know that such results will be disclosed to subjects in all circumstances, subjects will be informed through a broad consent of the possibility that such results will not be disclosed to them. This provision is intended to pertain to all clinically relevant research results, including general or aggregate research findings and individual research results. This element of broad consent will affect the applicability of the exemption set forth at §__.104(d)(8), for secondary research for which broad consent is required. This exemption applies only if the investigator does not include returning individual research results to subjects as part of the study plan (noting, however, that this provision does not prevent an investigator from abiding by any legal requirements to return individual research results). Although it is envisioned that broad consent will often be sought with the expectation that specific secondary research studies using identifiable private information or identifiable biospecimens will be exempt under §__.104(d)(8), this will not always be the case. Broad consent can also be obtained for secondary research that will not qualify for this exemption, such as secondary research that will involve returning clinically relevant research results to subjects. In these cases, the specific secondary research study will need to undergo IRB review and approval under §__.111, and we expect that the IRB would consider what subjects were told in the broad consent regarding the return of research results. The only exception to the requirement for IRB review of such research, if covered by this policy, is if the research qualifies for another exemption or the research is carried out under a Secretarial waiver at §__.101(i).

Finally, the third main difference between the NPRM and final rule provision on broad consent is that the final rule does not include broad consent templates to be established by the Secretary of HHS. We agree with the public comments that favored allowing institutions to create their own broad consent forms that could be tailored to a variety of circumstances. Therefore, under the final rule, investigators and institutions may develop broad consent forms, which, provided specified conditions are satisfied, would meet the exemption for the storage and maintenance for secondary research use of identifiable biospecimens or identifiable private information (§__.104(d)(7)). This exemption is further discussed in Section V [of the final rule preamble]. At a later time, the Secretary of HHS expects to develop guidance on broad consent, which could include broad consent templates.

In addition, we are also including in the final rule an element that for research involving biospecimens, when appropriate, the broad consent must state whether the research will (if known) or might include whole genome sequencing (WGS) (§__.116(d)(1), incorporating §__.116(c)(9)). The reasons for requiring this element in the broad consent are similar to those discussed above regarding the addition of this requirement in the additional elements of consent at §__.116(c)(9). WGS generates an extremely large amount of data, which when analyzed can yield information about an individual, including factors that could contribute to their future medical conditions. Therefore, given the implications of WGS information for an individual and his or her biological family, if it is known that the broad consent will or might permit the use of individuals’ biospecimens for WGS, we believe that this aspect of the research must be disclosed to prospective subjects as part of the broad consent process. The broad consent must include a general description of the types of research that may be conducted with the identifiable private information or identifiable biospecimens, with sufficient information to allow a reasonable person to expect that the broad consent would permit the types of research conducted (§__.116(d)(2)). Including an additional element of broad consent that specifically addresses WGS makes it clear that such information must be disclosed to prospective subjects.

Under the final rule, if the subject or the subject’s legally authorized representative is asked to provide broad consent, the broad consent must satisfy the general informed consent requirements at §__.116(a)(1)-(4), and (a)(6), and must include all of the following 12 elements that are applicable:

• A description of any reasonably foreseeable risks or discomforts to the subjects (§__.116(d)(1), incorporating basic elements of informed consent in §__.116(b)(2));
• A description of any benefits to the subject or to others that may reasonably be expected from the research ((§__.116(d)(1), incorporating basic elements of informed consent in §__.116(b)(3);
• A statement describing the extent, if any, to which confidentiality of records identifying the subject will be maintained ((§__.116(d)(1), incorporating basic elements of informed consent in §__.116(b)(5));
• A statement that participation is voluntary, refusal to participate will involve no penalty or loss of benefits to which the subject is otherwise entitled, and the subject may discontinue participation at any time without penalty or loss of benefits to which the subject is otherwise entitled ((§__.116(d)(1), incorporating basic elements of informed consent in §__.116(b)(8));
• If applicable, a statement that the subject’s biospecimens (even if identifiers are removed) may be used for commercial profit and whether the subject will or will not share in this commercial profit ((§__.116(d)(1), incorporating additional elements of consent in §__.116(c)(7));
• When appropriate, for research involving biospecimens, whether the research will (if known) or might include WGS (i.e., sequencing of a human germline or somatic specimen with the intent to generate the genome or exome sequence of that specimen.) ((§__.116(d)(1), incorporating the additional element of consent in §__.116(c)(9));
• A general description of the types of research that may be conducted with identifiable private information or identifiable biospecimens. This description must include sufficient information to permit a reasonable person to expect that the broad consent would permit the types of research conducted (§__.116(d)(2));
• A description of the identifiable private information or identifiable biospecimens that might be used in research, whether sharing of such information or biospecimens might occur, and the types of institutions or investigators that might conduct research with such information or biospecimens (§__.116(d)(3));
• A description of the period of time allowed that the identifiable private information or identifiable biospecimens may be stored and maintained (which period of time could be indefinite), and a description of the period of time that such information or biospecimens may be used for research purposes (which period of time could be indefinite (§__.116(d)(4));
• Unless the subject or legally authorized representative will be provided details about specific research studies, a statement that they will not be informed of the details of any specific research studies that might be conducted using the subject’s identifiable private information or identifiable biospecimens, including the purposes of the research and that they might have chosen not to consent to some of those specific research studies (§__.116(d)(5));
• Unless it is known that clinically relevant research results, including individual research results, will be disclosed to the subject in all circumstances, a statement that such results may not be disclosed to the subject; (§__.116(d)(6)); and
• An explanation of whom to contact for answers to questions about the subject’s rights about storage and use of the subject’s identifiable private information or identifiable biospecimens, and whom to contact in the event of a research-related harm (§__.116(d)(7)).

The elements of broad consent described in the first six bullet points above are not unique to broad consent, while the elements described in the last six bullet points are specific to the requirements of broad consent.

[Back to top]

§__.116(e) Waiver or Alteration of Informed Consent Involving Public Benefit and Service Programs

The final rule adopts one of the two proposals made in the NPRM for proposed §__.116(e). The final rule adopts (in §__.116(e)(1)) the language proposed in the NPRM providing that if an individual was asked to consent to the storage or maintenance for secondary research use of identifiable private information or identifiable biospecimens in accordance with the proposed broad consent provisions and such individual refused to consent, the IRB would be prohibited from waiving consent for the storage, maintenance, or the secondary research use of such biospecimens or information. The references in this provision to biospecimens are changed to refer specifically to identifiable biospecimens as the final rule does not apply to the research use of nonidentifiable biospecimens. This change is intended to honor the autonomy of individuals and to further the Belmont Report principle of respect for persons, in that this provision will prevent an individual’s refusal to consent to additional research use of information or biospecimens from being overridden.

The final rule does not incorporate the NPRM’s proposed additional waiver criterion to apply to research involving the use of biospecimens. This change is not necessary given that the proposal in the NPRM that the Common Rule extend to all biospecimens has not been adopted in the final rule. We determined that the waiver and alteration criteria included in the final rule are appropriately protective of identifiable biospecimens, as defined at §__.102(e)(6) and that an additional waiver criterion for such biospecimens is not warranted. For example, §__.116(e)(3)(ii) mandates that an IRB may not waive or alter the requirements of informed consent with respect to research under this category unless the research could not practicably be carried out without the waiver or alteration.

The format and organization of §__.116(e) in the final rule is different from that included in the pre-2018 rule or proposed in the NPRM. These changes were implemented to be clearer about the effect of each requirement. Most significantly, §__.116(e) in the final rule provides separate paragraphs concerning the applicable criteria for waiver and the applicable criteria for alteration of the requirements for informed consent. This differs from the approach proposed in the NPRM, and the approach included in the pre-2018 rule, that did not separate those discussions. We concluded that separating the discussion of waiver and the discussion of alteration would help clarify the applicable criteria, particularly given that the final rule addresses broad consent.

Section __.116(e)(1) describes the general framework for an IRB to waive the requirements for informed consent. This paragraph explains that an IRB may waive the requirement to obtain informed consent under §__.116(a) (general requirements for informed consent), §__.116(b) (basic elements of informed consent), or §__.116(c) (additional elements of informed consent that apply to certain research) if the IRB satisfies the criteria set forth at §__.116(e)(3) (discussed below). As explained above, the ability to satisfy the requirement to obtain informed consent of a subject or a subject’s legally authorized representative through use of a broad consent in particular circumstances is a flexibility offered to institutions, but institutions are never required to obtain informed consent through a broad consent process. For this reason, §__.116(e)(1) does not provide that an IRB may waive the requirement to obtain informed consent under §__.116(d) (broad consent) because use of broad consent is not a requirement. As noted above, and to honor the autonomy of individuals, §__.116(e)(1) prohibits an IRB from waiving consent for the storage, maintenance, or secondary research uses of identifiable private biospecimens or identifiable private information if an individual was asked to provide broad consent for such purposes and refused to provide such consent.

Section __.116(e)(2) describes the general framework for an IRB to alter the requirements for informed consent. An IRB may omit or alter some or all of the elements of informed consent under §__.116(b) (basic elements of informed consent) or §__.116(c) (additional elements of informed consent that apply to certain research) if the IRB satisfies the criteria set forth at §__.116(e)(3) (discussed below). This is consistent with the proposal made in the NPRM. This paragraph further explains that an IRB may not omit or alter any of the requirements described in §__.116(a) (general requirements for informed consent). This is also consistent with the proposal made in the NPRM (which proposed permitting an IRB to omit or alter elements of informed consent, but did not propose permitting omissions or alterations of the general requirements of informed consent that were included in the unnumbered introductory paragraph in the pre-2018 rule at §__.116). This paragraph also specifies that if a broad consent is used, an IRB may not omit or alter any of the elements required under §__.116(d). We determined that it would not be appropriate to permit the omission or alteration of any of the broad consent elements given the fact that the required elements of broad consent are limited and given our view that each of these elements (described at §__.116(d)) is critical for the purpose of soliciting broad consent that is both informed and ethically appropriate. This approach is different from what was proposed in the NPRM because of the NPRM’s different approach to broad consent than that adopted in the final rule.

Section __.116(e)(3) sets forth the specific criteria that an IRB must find and document to waive or alter the requirements for informed consent, consistent with the limitations set forth in §__.116(e)(1) and §__.116(e)(2). These criteria are the same as those proposed in the NPRM. First, the IRB must find and document that the research or demonstration project is to be conducted by or subject to the approval of state or local government officials and is designed to study, evaluate, or otherwise examine public benefit or service programs; procedures for obtaining benefits or services under those programs; possible changes in or alternatives to those programs or procedures; or possible changes in methods or levels of payment for benefits or services under those programs. Second, the IRB must find and document that the research could not practicably be carried out without the waiver or alteration.

[Back to top]

§__.116(f) General Waiver or Alteration of Informed Consent

Overall, two of the three proposals made in the NPRM for proposed §__.116(f) have been retained. The final rule adopts (in §__.116(f)(3)(iii)) a new waiver criterion very similar to that proposed in the NPRM, which now mandates that for research involving access to or use of identifiable private information or identifiable biospecimens, the requirements of informed consent can be waived or altered only if the research could not practicably be carried out without using such information or biospecimens in an identifiable format. The minor wording change made in the language of this provision, as compared with that proposed in the NPRM, is intended for clarity. This change is intended to protect the privacy of individuals, while not unduly inhibiting research. After considering the diversity of opinions expressed in the public comments on this issue, including many comments seeking further guidance concerning the proper interpretation of the “practicably” language, the final rule does not define this language (which was also included in the pre-2018 rule). We have concluded that the requirements for waiver and alteration in §__.116(e) and (f) appropriately honor respect for persons and balances this with other ethical principles.

The final rule also adopts (in §__.116(f)(1)) the language proposed in the NPRM (for §__.116(f)(3)) prohibiting IRBs from waiving informed consent if individuals were asked and declined to provide broad consent to the storage and maintenance for secondary research use of identifiable private information or identifiable biospecimens (except that the final rule’s formulation is limited to identifiable biospecimens, consistent with changes made in the final rule). We considered public comments that opposed this prohibition and understand that IRBs may not always understand the reason that individuals refused to sign a consent form and that the effects of this broad prohibition could be significant in the context of broad consent (given the broad scope of research that such a broad consent could potentially extend to). Nonetheless, we determined that it is important to prevent an individual’s refusal to consent to additional research use of such information or biospecimens from being overridden. This change to the Common Rule is intended to honor the autonomy of individuals and to further the Belmont Report principle of respect for persons.

The final rule does not incorporate the NPRM’s proposed additional waiver criteria (proposed for §__.116(f)(2)) to apply to research involving the use of biospecimens. This change is not necessary given that the proposal in the NPRM that the Common Rule extend to all biospecimens regardless of their identifiability has not been adopted in the final rule. We determined that the waiver and alteration criteria included in the final rule are appropriately protective of identifiable biospecimens and that an additional waiver criterion for such biospecimens is not warranted. For example, §__.116(f)(3)(iii) in the final rule is a research criterion specific to research that involves using identifiable private information or identifiable biospecimens. Under this criterion, an IRB may not waive or alter requirements of informed consent with respect to such research unless the IRB finds and documents that the research could not practicably be carried out without using such information or biospecimens in an identifiable format.

The format and organization of §__.116(f) in the final rule are different from the proposed §__.116(f) described in the NPRM. We made these changes in an effort to be clear about the effect of each requirement. Most significantly, §__.116(f) in the final rule provides separate paragraphs concerning the applicable criteria for waiver and the applicable criteria for alteration of the requirements for informed consent. This differs from the approach proposed in the NPRM, and the approach included in the pre-2018 rule that did not separate those discussions. We conclude that separating the discussion of waiver and alteration will help clarify the applicable criteria, particularly given that the final rule addresses the application of the waiver and alteration provisions in the context of broad consent.

Section __.116(f)(1) describes the general framework for an IRB to waive the requirements for informed consent. This paragraph explains that an IRB may waive the requirement to obtain informed consent under §__.116(a) (general requirements for informed consent), §__.116(b) (basic elements of informed consent), or §__.116(c) (additional elements of informed consent that apply to certain research) if the research satisfies the criteria set forth at §__.116(f)(3) (discussed below). As explained above, the ability to satisfy the requirement to obtain informed consent of a subject or a subject’s legally authorized representative through use of a broad consent in particular circumstances is a flexibility offered to institutions, but institutions are never required to obtain informed consent through a broad consent process. For this reason, §__.116(f)(1) does not provide that an IRB may waive the requirement to obtain informed consent under §__.116(d) (broad consent) because use of broad consent is a regulatory flexibility, and not a requirement. Consistent with the proposal made in the NPRM (proposed §__.116(f)(3)), § __.116(f)(1) provides that if an individual was asked to provide broad consent for the storage, maintenance, and secondary research use of identifiable private information or identifiable biospecimens and refused to consent, an IRB cannot waive consent for either the storage, maintenance, or secondary research use of such biospecimens or information.

Section__.116(f)(2) describes the general framework for an IRB to alter the requirements for informed consent. This paragraph explains that an IRB may omit or alter some or all of the elements of informed consent under §__.116(b) (basic elements of informed consent) or §__.116(c) (additional elements of informed consent that apply to certain research) if the IRB satisfies the criteria set forth at §__.116(f)(3) (discussed below). This is consistent with the proposal made in the NPRM. This paragraph further explains that an IRB may not omit or alter any of the requirements described in §__.116(a) (general requirements for informed consent). This is also consistent with the proposal made in the NPRM (which proposed permitting an IRB to omit or alter elements of informed consent, but did not propose permitting omissions or alterations of the general requirements of informed consent that were included in the unnumbered introductory paragraph in the pre-2018 rule at §__.116). This paragraph also specifies that when reviewing a broad consent, an IRB may not omit or alter any of the elements required under §__.116(d). As with §__.116(e)(2), we determined that it would not be appropriate to permit the omission or alteration of any of the broad consent elements in §__.116(f). The elements of broad consent reflected in this NPRM are limited. We have concluded that each of these elements (which are included at §__.116(d)) is critical to the solicitation of an informed and ethically appropriate broad consent. For that reason, none of the elements of broad consent may be omitted or altered if broad consent is solicited. This prohibition is different than the NPRM’s proposal given the different formulation of broad consent represented in this final rule.

Section 116(f)(3) sets forth the specific criteria that an IRB must find and document in order to waive or alter the requirements for informed consent. These criteria are the same as those proposed in the NPRM, except that the third criterion includes minor wording changes that were made for clarity: (1) the research involves no more than minimal risk to the subjects; (2) the research could not practicably be carried out without the requested waiver or alteration; (3) if the research involves using identifiable private information or identifiable biospecimens, the research could not practicably be carried out without using such information or biospecimens in an identifiable format; (4) the waiver or alteration will not adversely affect the rights and welfare of the subjects; and (5) whenever appropriate, the subjects will be provided with additional pertinent information after participation.

[Back to top]

§__.116(g) IRB Approval of Research Involving Screening, Recruiting, or Determining Eligibility of Prospective Subjects

The final rule adopts the NPRM proposal at §__.116(g), with minor changes made for clarity, and without a requirement that investigators adhere to the proposed privacy safeguards at §__.105, since this provision is not included in the final rule. The provision at §__.116(g) addresses concerns that the pre-2018 regulations required an IRB to determine that informed consent can be waived before investigators may record identifiable private information for the purpose of identifying and contacting prospective subjects for a research study. This change is intended to address these concerns by eliminating the requirement for the IRB to waive informed consent for these activities. In response to public comments, we are clarifying that this is not a waiver of the consent requirement but rather an exception to the requirement. This change is also responsive to SACHRP’s recommendation regarding how the Common Rule should apply to activities that are conducted before subjects provide consent to participate in research, such as identifying potential subjects, contacting subjects, and recruiting subjects.

The final rule includes some minor changes from the NPRM proposal, to clarify the circumstances in which the IRB may approve the investigator’s proposal to obtain information directly from a prospective subject, or to obtain already collected identifiable private information or identifiable biospecimens by accessing records or stored biospecimens, for purposes of screening, recruiting, or eligibility assessment, without the informed consent of the prospective subject or the subject’s legally authorized representative. The final rule also adds a reference to the subject’s legally authorized representative at §__.116(g)(1) to clarify that this exception to informed consent will also apply in circumstances in which the prospective subject has a legally authorized representative who will provide information about the prospective subject through oral or written communication with the investigator.

We note that in approving this exception to informed consent for the purpose of screening, recruiting, or determining the eligibility of prospective subjects, the IRB will be reviewing and approving the entire research proposal. Therefore, all of the IRB approval criteria at §__.111 will need to be satisfied, including that when appropriate, there are adequate provisions to protect the privacy of subjects and to maintain the confidentiality of data (§__.111(a)(7)). Thus, as part of its review and approval of the research, the IRB must determine that there are adequate privacy and confidentiality safeguards for information obtained by investigators for these preparatory-to-research activities.

We believe that these preparatory-to-research activities are critical means by which to identify subjects that do not involve additional risks, given their limited nature. If prospective subjects are identified through these “screening” activities, then all other relevant requirements of this rule must be met if they are subsequently recruited to participate in the research.

[Back to top]

§__.116(h) Posting of Consent Forms

The final rule adopts the NPRM proposal with some modifications and clarifications. The primary purpose of this provision is to improve the quality of consent forms in federally funded research by assuring that–contrary to current practices, under which it is often very difficult to ever obtain a copy of these documents–they eventually would become subject to public scrutiny and that they will provide useful models for others. The consent form plays a key role in making sure that someone asked to enter a clinical trial receives the information they need to be making an informed decision about whether to enroll in that trial. Accordingly, it also plays a key role in supporting and justifying the public’s trust in the integrity of our clinical trial enterprise.

We are not persuaded by the arguments of those commenters who suggest that potential negative consequences of this proposal outweigh its benefits. Fundamentally, this proposal is about increasing the transparency of one of the most important aspects of our human subjects protection system. Increased transparency is in general a good thing, and in this instance, as in many others, it offers multiple benefits–including increased trust–at very low cost. This provision is not a form of shaming, but rather an effort to ask people to work together to create a system that will improve the quality of informed consent. Moreover, the new standards for determining the acceptable content of a consent form–including §__.116(a)(5), which will require a concise presentation of key information at the beginning of the consent form–should counter any consequences of attempts to pad consent forms with additional information as a response to the posting requirement.

We are not persuaded by the arguments of those commenters who suggest that potential negative consequences of this proposal outweigh its benefits. Fundamentally, this proposal is about increasing the transparency of one of the most important aspects of our human subjects protection system. Increased transparency is in general a good thing, and in this instance, as in many others, it offers multiple benefits–including increased trust–at very low cost. This provision is not a form of shaming, but rather an effort to ask people to work together to create a system that will improve the quality of informed consent. Moreover, the new standards for determining the acceptable content of a consent form–including §__.116(a)(5), which will require a concise presentation of key information at the beginning of the consent form–should counter any consequences of attempts to pad consent forms with additional information as a response to the posting requirement.

We agree with the conclusions of SACHRP that implementing this proposal will indeed result in better consent forms. Having a repository of such forms freely available for analysis and public discussion will create multiple opportunities for improving these forms. In an era in which we have previously unheard of capabilities for analyzing textual material and processing large amounts of data, the fact that there will be a high volume of consent forms posted should be a minor impediment, if any, to the ability to learn from the content of this database.

With regard to those who suggested that it would indeed be desirable to make consent forms more public, but that posting should be optional, we note that nothing in the pre-2018 rule prevents the people in charge of research from making their consent forms public, yet that is rarely done. In order to significantly increase the transparency of this portion of our system for protecting subjects, we are finalizing this proposal.

With regard to the commenters who were concerned that posting consent forms would create a rich environment for litigation, it is noteworthy that the existing evidence fails to suggest that there has been much of a problem with regard to inappropriate litigation over clinical trials. Whatever disincentives currently exist for such litigation, it seems unlikely that the mere fact that consent forms would now be more available will dramatically alter such disincentives.
With regard to the commenters who were concerned about the added regulatory burden, we note that this change, compared to the traditional costs of clinical trials, will add a relatively small amount of additional burden, one that is well justified in comparison to the likely increase in transparency. This new provision has specifically been designed to minimize that burden. And the final rule has been modified in a number of respects from the NPRM proposal in response to public comments. As discussed below in detail, the time by which a consent form must be posted has been greatly extended. That change would also address the concerns of some commenters that the posted consent forms might create confusion among research subjects. Furthermore, provisions have been added that allow for redaction, as necessary, of portions of consent forms.

As a means of increasing transparency and facilitating the development of more informative consent forms, the final rule accordingly requires at §__.116(h)(1) that for clinical trials conducted or supported by a Common Rule department or agency, a copy of an IRB-approved version of a consent form that was used to enroll subjects would need to be posted by the awardee or the federal department or agency conducting the trial on a publicly available federal website that will be established as a repository for such forms. Unlike the NPRM, which required that the “final version” of the consent form be posted, the final rule adds flexibility in merely requiring that it be an IRB-approved consent form that was used for enrollment purposes. There is accordingly no further restriction as to which version of a consent form (which might have been subject to many modifications over the course of time) must be posted. The final rule also gives greater flexibility than the NPRM proposal in terms of when that posting needs to be done. It can take place any time after the trial is closed to recruitment, so long as the posting is no later than 60 days after the last study visit by any subject (as required by the protocol). If the federal department or agency supporting or conducting the clinical trial determines that certain information should not be made publicly available on a federal website (e.g., confidential commercial information), the department or agency may permit appropriate redactions to the information posted. In rare instances, it could be the case that the federal department or agency would determine that the very existence of a particular clinical trial should not be publicly disclosed, in which case no posting relating to such a trial would be required.

The final rule differs from the NPRM proposal in that it no longer specifies that certain information needs to be posted in addition to the consent form. This change eliminates the need for mandatory posting of information that might not be justified by the purposes of this provision.

Only one posting would be required for each multi-institution study. There is accordingly no expectation that a version would need to be posted for each class of subjects in the study (for example, a posting both for adults and for minors), nor for each study site.

We also note that this provision applies only to those clinical trials that are conducted or supported by a federal department or agency.

A website will be developed by HHS, which could be used by other federal departments or agencies, or the other federal departments or agencies could create their own websites for the posting of these consent forms. Public posting of consent forms is intended to increase transparency, enhance confidence in the research enterprise, increase accountability, and inform the development of future consent forms. It is anticipated that the website will be searchable. With regard to the comments suggesting that ClinicalTrials.gov might be an appropriate choice as the website, we agree that such a choice has the possibility of minimizing administrative burdens. Using ClinicalTrials.gov has another advantage, in addition to what some of the commenters said. Many clinical trials funded by HHS have records in ClincialTrials.gov due to requirements that certain clinical trials register and submit results information to that database (section 402(j) of the Public Health Service Act and 42 CFR Part 11, and other policies that incentivize trial registration and results submission, such as the NIH Policy on Dissemination of NIH-Funded Clinical Trial Information). The fact that these trials already have a record in the database will mean that the burden of submission of the informed consent document will be substantially lower. Accordingly, we will take these points into consideration as we determine what federal website will be used to implement this provision.

[Back to top]

§__.117 Documentation of Informed Consent

The language at §__.117(b)(1) and (2) are altered in the final rule to conform to the requirements included at §__.116, which are discussed above. The goal in §§__.116 and __.117 of the final rule is to facilitate a prospective subject’s or legally authorized representative’s understanding of the reasons why one might or might not want to participate in the research, in part by requiring that only the key information essential to decision making receive priority by appearing at the beginning of the consent document. In the final rule, these requirements also apply when a short form written informed consent process is used, or the requirement for written informed consent is waived.

We agree with the majority of public comments that favored adding a new provision allowing a waiver of the requirement for a signed consent form if the subjects are members of a distinct cultural group or community for whom signing documents is not the norm, provided that the research presents no more than minimal risk of harm to subjects and there is an appropriate alternative method for documenting that informed consent was obtained. Therefore, this new provision is added at §__.117(c)(1)(iii). The final rule includes a reference to the subject’s legally authorized representative to clarify that this provision applies when a subject has a legally authorized representative who is a member of a distinct cultural group or community in which signing forms is not the norm.

The final rule does not include the NPRM’s proposal at §__.117(c)(3) to prohibit a waiver of documentation of broad consent for the storage, maintenance, or secondary research use of biospecimens.

Some of those who commented on the NPRM proposals related to oral broad consent found it to be unnecessarily confusing. In response to these comments, the final rule permits waiver of documentation of informed consent under §§__.117(c) when a broad consent procedure is used. No additional criteria or special restrictions apply. Additionally, the final rule removes all NPRM references to “oral consent” to reduce confusion.

However, we expect that it will rarely be permissible to waive documentation of broad consent for the secondary research use of medical records or stored biospecimens because there will likely be a need to track which individuals have provided broad consent and which have not, so the informed consent would not be the only record linking the subject and the research as required for a waiver under §__.117(c)(1)(i). Additionally, when identifiable information and

identifiable biospecimens are shared for a nonresearch purposes, the person’s consent is usually required, so we expect that documentation of consent often could not be waived under §§__.117(c)(1)(ii), which requires that the research involves only procedures for which written consent is not normally required outside of the research context.

One instance when we believe it may be appropriate for the IRB to waive the requirement for a signed broad consent form is when the initial activity involved obtaining information from a person through oral communication, such as a phone survey, because there might not be an opportunity to obtain written broad consent from such individuals for the secondary research use of their information. In this scenario, documentation of broad consent could be waived under §__.117(c)(1)(ii) if the research presents no more than minimal risk of harm to subjects and involves no procedures for which written consent is normally required outside of the research context. In addition, it might be appropriate for an IRB to waive the requirement for a signed broad consent document under the provision included in the final rule related to when the subjects or their legally authorized representatives are members of a distinct cultural group or community for whom signing documents is not the norm, provided that the research presents no more than minimal risk of harm to subjects and an appropriate alternative method is available for documenting that informed consent was obtained (§__.117(c)(1)(iii)).

The final rule also does not include the NPRM’s proposed clarification that waivers of documentation may not be permitted for research subject to regulation by FDA. Because this is not the only difference between what is permitted under the Common Rule and the FDA regulations, we determined that clarifying only this specific difference in the final rule is likely to create more confusion rather than provide clarification.

[Back to top]

§__.118 Applications and Proposals Lacking Definite Plans for Involvement of Human Subjects

The final rule adopts the language of the NPRM, with updated citations. This provision makes explicit that it applies only to nonexempt human subjects research.

[Back to top]

§__.119 Research Undertaken Without the Intention of Involving Human Subjects

The final rule adopts the language of the NPRM, with updated citations. This provision makes explicit that it applies only to nonexempt human subjects research, and clarifies the reference to department or agency to be a federal department or agency component supporting the research.

[Back to top]

§__.124 Conditions

The final rule adopts the NPRM language, which clarifies the pre-2018 rule by stating that the head of either the conducting or the supporting federal department or agency may impose additional conditions on research, when necessary for the protection of human subjects.

[Back to top]