Attachment A: Recommendations NPRM

Introduction

The Secretary’s Advisory Committee on Human Research Protections (SACHRP) respectfully submits for your consideration a set of recommendations relative to the Department‘s recent Notice of Proposed Rulemaking (NPRM) entitled “Federal Policy for the Protection of Human Subjects” that appeared in the Federal Register on September 8, 2015, Vol 80, No 173:53933.  SACHRP appreciates the extensive efforts make by representatives from 18 federal agencies to craft the NPRM. 

SACHRP is authorized under 42 U.S.C. 217a, Section 222 of the Public Health Service (PHS) Act, as amended. Our Charter outlines our objectives:

SACHRP shall provide expert advice and recommendations to the Secretary, through the Assistant Secretary for Health (ASH), on issues and topics pertaining to or associated with the protection of human research subjects.  The Committee will work to advise the Secretary on how to improve the quality of the system of human research protection programs, including the responsibilities of investigators, institutional review boards (IRBs), administrators, and institutional officials, and the role of the Office for Human Research Protections and other offices within the Department of Health and Human Services.

The NPRM represents the first set of significant regulatory changes to the “Common Rule” in almost 25 years.  SACHRP appreciates the opportunity to provide comments on this important set of proposals.  SACHRP and its subcommittee members have taken this opportunity seriously and have spent hundreds of hours in efforts to understand the proposals, assess their ethical foundation, anticipate the consequences and potential adverse consequences of the proposals for a range of stakeholders, and to craft the following responses and recommendations.

SACHRP has two broad concerns for the NPRM that we will summarize followed by recommendations on selected specific elements. 

Complexity: The first broad concern is the overwhelming complexity of the proposed changes.  SACHRP members and SACHRP subcommittee members represent some of the most knowledgeable and experienced individuals in the nation with respect to the human subjects regulations.  Despite extensive study of the NPRM in collaboration with numerous colleagues, the universal assessment is that the proposals are virtually impenetrable due to opaque language, unclear concepts, the overlapping nature of various elements, and the intricate relationships of elements to one another.  A common refrain is, “If we cannot understand this, where will that leave the average IRB, administrator, and investigator?”

As Clair Booth Luce observed, “Simplicity is the ultimate sophistication.”  The complexity of this NPRM does not reflect sophistication.  Complex regulations are necessary in many contexts for complicated enterprises.  While the existing Common Rule regulations are themselves rather complex, they have been reasonably interpretable, manageable, and broadly effective for the past 25 years.  The proposed regulations appear far more complex than what should be necessary to establish the desired goals of the regulatory changes: targeted increases in protections, the reductions in burdens to IRBs and investigators, and the rebalancing of values like respect for persons and the value of research resources (e.g., biospecimens).  We recognize that any regulatory change is going to require a learning curve but these proposed changes represent a level of structural complexity that will persist and make compliance a continuing challenge due to the overlapping nature of exclusions and exemptions and the need for tools to guide implementation.

Moreover, many components of the NPRM depend on guidance documents, model agreements, and templates that have yet to be developed — a prominent example being the exemption tool.  The complete lack of information about what that essential but non-regulatory guidance may entail makes it even more difficult to contribute to meaningful discussion of the NPRM.

While SACHRP strongly supports a number of the proposed changes (e.g., decreased burden on minimal risk research), we are deeply concerned that the complexity of the resulting Common Rule would seriously impair the ability of IRBs, research administrators, investigators, and clinical healthcare providers and institutions to effectively implement the new regulations.  In addition, SACHRP has concerns as to whether the proposals as written will serve the stated objectives of enhancing subject comprehension and enhance participant protections.

1. SACHRP recommends that HHS conduct a comprehensive re-write of the NPRM through a concerted effort to simplify the proposed changes and to focus efforts on selected issues for which there is broad support by the public, investigators, IRB professionals, sponsors and other experts.
2. Prior to the publication of final rules, SACHRP supports a second publication of a NPRM that presents a simplified, focused set of proposals for further public consideration and comment. 

Biospecimens and Data: SACHRP’s second broad concern arises from the distinctly different treatments in the NPRM between the management of information about research participants and the management of their biospecimens.  Research involving data and biospecimens are rapidly growing domains of inquiry so careful attention to these forms of research is appropriate.  The NPRM points to surveys of public attitudes as support for the proposals, a few of which suggest that the public has greater concerns over biospecimen uses than over research uses of clinical data.   But SACHRP believes that public attitudes cannot be the sole determinant of public policy in this complex domain and that policy also must be guided by knowledge of system capabilities, experience, and expert opinion. 

More important, SACHRP believes that the issues relevant to human subject protections in research involving information and biospecimens are virtually identical and overlapping in many or most circumstances.  The risks that are associated with research with biospecimens largely flow from the information about the subject that is derived from specimen analysis.  What sense is there in providing greater restrictions for research with a biospecimen than for research using an individual’s full genome sequence derived from that specimen?  Implementing different regulatory approaches to these two forms of research resources is not logical or defensible. 

SACHRP strongly believes that the values of safety, transparency, and choice can be supported through regulations that do not make core distinctions between research using biospecimens and research using data. 

3. SACHRP recommends that the distinctions in the proposed regulations between research with subject information and research with biospecimens be reduced.  The values of transparency, security, choice, and beneficence can be promoted on both domains through similar protections. 

Additional specific recommendations relevant to biospecimens; the proposal to mandate single IRB review; the creation of excluded research and changes to exempt research; as well as revisions relating to consents are discussed in more detail below.

Proposed NPRM Requirement for Mandatory Single IRB Review for Multi-Site Studies

Discussion

The NPRM proposes a requirement for use of a single IRB in any multi-site study for sites located within a U.S. jurisdiction.  It assumes the mandatory use of single IRBs will increase the efficiency of IRB review, prevent duplication of effort, and prevent disparities among protocols and informed consent forms in multi-site studies that often have reviews by multiple local IRBs.  The NPRM proposed change echoes the draft policy issued by the National Institutes of Health on December 3, 2014, requiring the mandatory use of a single IRB system where the research studies involve multiple sites.

The NPRM proposals include two situations where exceptions would be permissible:

(i)  Cooperative research for which more than single IRB review is required by law; or

(ii) Research for which the Federal department or agency supporting or conducting the research determines and documents that the use of a single IRB is not appropriate for the particular study.  This differs from the NIH draft policy issued in December which included the additional exceptions: (1) the designated single IRB is unable to meet the needs of specific populations; or (2) where local IRB review is required by federal, tribal or state laws or regulations.

The NPRM also proposes two provisions that would provide HHS with compliance oversight over the reviewing IRB.

SACHRP recognizes that many sponsors, institutions and investigators have had favorable experiences with single IRB review for some types of multi-site, human subjects’ research.  While the use of single IRB review may prove to be effective and efficient in certain circumstances, SACHRP is unable to arrive at a consensus regarding the appropriateness of mandated single IRB review in federally funded domestic multi-center trials as part of the Common Rule at this time.  As the NIH draft policy illustrates, federal agencies already have the ability to require use of a single IRB for multi-site studies when they deem it to be appropriate and expeditious. 

A concern to SACHRP is the possibility that requiring a single IRB to review a multi-site research protocol may well result in new procedures and policies being created by the relying institutions (those institutions relying on another institution/entity to conduct the IRB review) and the reviewing IRB (the IRB/institution responsible for serving as the single IRB of record) that could undermine the goals of this policy change and create a host of new challenges for research institutions. There is a significant difference between an entity like the NCI CIRB which is in the business of serving as a central reviewing IRB and the rotation of the single IRB function among institutions who will serve this role for some research protocols and not for others. It takes an enormous investment in IT resources and databases to manage the communication flows, state law and local context issues for different institutions as well as the divergent policies and processes of each institution.

Streamlining and efficiency are raised as issues supporting the elimination of multiple IRB reviews, yet the pre-approval review process typically includes much more than just the IRB process. There are many research focused committees, departments and offices that play a role in the pre-approval review of human subject research and delay study initiation more than IRBs. These include, but are not limited to conflict of interest, radiation safety, pathology, pharmacy, nursing, institutional bio-safety, billing, grants and contracts-- reviews that will still occur even with single IRB review of multi-site studies.

Need for More Data

More data should be developed and provided to the research community prior to imposing such a requirement on U.S. research efforts.

Independent institutional review boards, whose purpose is to serve as a single IRB, have been operating for decades. They have been shown to be efficient and effective for certain types of multi-center research. Pharmaceutical and biotech companies utilize the services of independent review boards for single IRB review of multi-site studies. Data should be obtained and analyzed regarding their experiences as this will better inform the consequences of such a mandate on the various stakeholders. This will also provide information as to which types of research would most benefit from a single review model and which research should be excluded from such a requirement.

The NIH draft policy only identifies one paper[1] dating back to 2010 in support of the statement that single IRB use in multi-site studies is more cost effective, and that paper reports on a national central IRB, not the ceding of review by multiple institutions to another institution’s IRB. The NCI CIRB serves as the IRB of record for research with a user base that is relatively stable. Single IRB review of multi-site studies will involve the IRBs of institutions serving as the reviewing IRB on a rotating basis making it difficult for IRBs to invest the necessary resources in a function that will ebb and flow. Comprehensive data is needed to assess: (1) the advantages and disadvantages of single IRB review on the reviewing IRB; (2) the advantages and disadvantages of single IRB review on the relying institution; (3) the categories of research that are most appropriate for single IRB review; (4) the impact on local review concerns; (5) the cost of a single IRB system on the various institutions; and, (6) the impact on investigators.

Evaluation of Impact on Relying and Reviewing Institutions

Mandatory single IRB review may serve to lessen the burden on some institutions, but will increase the burden on others. Most institutions have systems that are not designed for the purpose of managing multi-site research and thus service as a single IRB would require retooling or upgrading involving substantial resources, increased cost and re-tooling of processes for the site that serves as the IRB of record.

A significant barrier to institutional adoption of a single IRB for multi-site research is the information technology that would be required to ensure adequate review, communication, and oversight. Electronic systems currently serving IRBs and institutional human research protection programs differ from one another, are complex and expensive, and are not interoperable.  Institutions incur significant expense to build technical solutions customized and appropriate to the needs of their institution. Changing existing technology to incorporate communication and management of research being conducted at numerous outside sites is a considerable obstacle that has to be acknowledged and addressed before single review can be successful.

The reviewing site will need systems to ensure on-going communication with the other sites, as well as a system for managing and tracking agreements and protocol related issues. The relying sites will have to create processes to manage reviews that are frequently linked to the local review such as management of HIPAA requirements, radiation safety, as well as budgeting among other such internal committees and departments. Investigator conflicts of interest and institutional conflicts of interest are two significant reviews that are often tied to the IRB review because conflicts of interest may well result in IRB determinations regarding: (1) additional information that should be included in the consent; (2) additional monitoring by an independent DMC or DSMB; or (3) removal of an individual as the primary investigator of a research study.

Consideration of local and regional variations in some circumstances and for some studies will be critical to assuring the welfare of subjects in research.  In addition to widely different subject populations, other factors with significant variations among sites would include:

• State laws governing human subjects and/ research data (e.g., genetic testing, genetic privacy, health information laws that go beyond HIPAA, mental health information, developmental disabilities information, surrogate consent, inclusion of children in research, age of majority, age of consent to certain medical treatment such as for substance abuse, investigator licensing requirements, etc.);
• “Emergency research” undertaken without subject consent, for which the FDA requires local community consultation;
• Disparate cultural norms among populations targeted for recruitment;
• Varying investigator and research team experience, which may require more or less oversight during the conduct of the research; and,
• Varying institutional policies regarding availability of compensation for subject injury.

Qualifications of the Reviewing IRB

The method of selection of a single IRB in a specific study is critical; the IRB selected should have the appropriate expertise for the research being reviewed, and the capacity to act as coordinator, receiver and dispenser of critical study-related data to the sites, their research teams, their IRBs and their institutions. 

Consideration also should be given to a process for qualifying a single IRB.  SACHRP identified some of the numerous issues that need to be addressed in its response to the ANPRM in 2011 (see October 13, 2011 SACHRP Letter to the HHS Secretary: SACHRP ANPRM Comments - Final) and again in its comments on the Draft NIH Policy on the Use of a Single Institutional Review Board for Multi-site Research in 2015 (see Attachment F: Recommendations Regarding the Draft NIH Policy on the Use of a Single Institutional Review Board for Multi-site Research).SACHRP repeats and reaffirms these points:

• Adequate record keeping systems and written standard operating procedures for tracking each site independently, including the ability to manage site-specific emergency care, conflicts of interest, sub-studies, unique consent forms, subject complaints, compliance issues, and unanticipated problems;
• Process to adequately obtain knowledge of state laws where the single IRB reviews sites in other states in order to assure compliance;
• Written SOPs describing how local cultural and resource context information will be gathered, both at initial and continuing review;
• Capacity to conduct site visits, as necessary;
• Written SOPs describing how the single IRB and institutions will coordinate issues such as review by other committees (IBC, Radiation, COI, pathology, pharmacy, nursing, utilization review, etc.,) and unique institutional policies;
• Accreditation of its human research protection program; and
• Appropriate oversight by OHRP and FDA.

In addition, there should be a process identified for the management of conflicts that might arise between reviewing and relying IRBs. Once an institution enters into such an arrangement, it is not easy to say that if there is a disagreement, the relying institution can pull out. Researchers invest vast amounts of time working on the study plans prior to their submission for IRB review. Reliance on a single IRB will not be a workable situation if the relying institutions –and their researchers—have inadequate options for working through difficult issues especially those that involve perceived risks to subjects at the relying sites but are not accepted as risks by the reviewing IRB.

Costs of Single IRB Review

Costs of review and legal responsibilities for monitoring research and assuring its appropriate conduct would need to be allocated among a single IRB, local sites, their local IRBs, and other designated study reviewers. An effective cost allocation cannot be a decision to fund a single IRB but not provide resources for the local reviews.

Finally costs to support the single IRB review and the local relying institutions should not be dollars that will reduce the amount of money that would otherwise be available to conduct the research. Budgets for grants should increase where single IRB review is an integral part of the proposal and take into consideration the additional costs to both the reviewing and relying institutions.

Importance of Consistent Reliance Agreements

Reliance arrangements require complex coordination and communication to manage such issues as how the single IRB would interact on an ongoing basis with local IRBs or designated ethics reviewers in regard to, for example, the emergence of risks that might be unique to a site, the local investigator or its study population, and the implementation of uniform or site-specific measures to mitigate those risks. Single IRBs in multi-site studies should be expected, as part of their initial review and approval, to establish formal written standard operating procedures for accomplishing this in an ongoing way during the course of the approved studies. Yet this arrangement may be so complicated that without careful planning and implementation, such a system coupling local review with a single IRB would, in the end, be less efficient than the current practice of each IRB performing its own separate review.

A significant challenge to single IRB review is the development and management of inter-institutional agreements and processes. Whether single IRB review is mandated or voluntary, tools need to be provided to the research community to ensure consistent and reasonable approaches. HHS needs to evaluate and work with institutions and the larger research community to fully develop a single IRB review model that addresses the issues faced by all of the involved parties. Centralized single IRBs are operating now in many NIH-funded and industry-sponsored studies. They can provide the data on which evaluations can be made as to issues arising regarding legal responsibility, IRB and institutional liabilities, as well as general advantages and disadvantages of such systems. Institutions that defer to one another in a single IRB review process need inter-institutional agreements, by which single IRBs and institutions engaged in research can specifically describe what each party would do in a functioning single IRB model. And again, a single IRB review necessarily involves the ebb and flow of service as the reviewing IRB from one institution to another, each with differing policies and procedures regarding such critical issues as protocol violations and unanticipated problems among other issues.  Without more specific guidance on these points, it would likely not be possible for the entire research community to establish template inter-institutional agreements, while issuance of such specific guidance likely would ease and speed the emergence of templates.

Evaluation of Data on Prior Experiences

Given the various complexities discussed above, it is not surprising that adopting a single IRB model, when tried, has presented some tough challenges. Anecdotally, SACHRP understands that the VA has experienced difficulties in implementing a single IRB system. For example, it has been difficult to develop information technology systems across sites to track studies and study reporting, and to coordinate communication among investigators, local facilities, and the VA Central IRB members and staff. Other challenges include considering and accommodating unique local conditions and affiliation arrangements, establishing methods for collecting, analyzing and then reporting back to local sites regarding unanticipated problems, and coordinating study monitoring that is necessarily done by the VA facility sites.  If these issues have occurred within the coordinated VA system, then one would expect the problems to be more serious, complex, and acute if a mandate for single IRBs for all domestic multi-site studies were simply imposed by regulation or policy.

The NCI CIRB model has itself caused delays in the review process; for example. investigators have been asked repeatedly to re-format documents; fix hyperlinks; change margins; and, institutions are not advised of how to integrate other required institutional oversight processes such as radiation safety reviews that have a direct impact on the language contained in the research consent document.

SACHRP strongly supports a more targeted and careful process of encouraging single IRB use, accompanied in a step-wise way by issuing guidance on critical issues involved in the use of single IRB review would result in less disruption of the research enterprise, and eventual improvements in a single IRB review process that is anchored in deep collective experience.

SACHRP believes the use of single IRBs for multicenter trials will enhance efficiency and decrease investigator and sponsor burdens in many circumstances.   A regulatory mandate for such a system should only be done when there is sufficient data to ensure minimal disruption with the review, approval and oversight of research involving human subjects and the conduct of that research at the various sites. SACHRP believes that prior to broad implementation, additional data must be developed regarding:

1. Costs to IRBs serving as reviewing IRBs
2. Costs to IRBs serving as relying IRBs
3. Types of research most likely to benefit from single IRB review
4. The impact on investigators from managing multiple IRBs

Recommendations

SACHRP is divided on whether a mandate for a single IRB as part of the Common Rule is appropriate at this time. However, there is consensus that a single IRB is not appropriate for many domains of human subjects’ research. If the final rule includes a mandate for a single IRB review, SACHRP suggests a narrower mandate than that articulated in the NPRM. HHS and other departments and agencies that follow the Common Rule would continue to have the option of encouraging use of single IRBs for domestic, multi-site studies involving human subjects by making single IRB use a criterion for funding decisions when appropriate

SACHRP recommends that:

1. In the event that single IRB review is mandated for some research,  the following exceptions should apply:
   1. review by a single IRB is unable to meet the needs of specific populations,
   2. where local IRB review is required by federal, tribal or state laws or regulations,
   3. research that does not meet the definition of clinical trial,
   4. research that is not federally funded research,
   5. research with fewer than 5 sites, and,
   6. where the funding agency determines that single IRB review is not appropriate.
2. HHS support data collection regarding:
   1. The advantages and disadvantages of single IRB use in different types of domestic multi-site research.
   2. Experiences to date with single IRB review.  This could include: (1) its own experience with the use of single IRBs for grants that have been mandated to use a single IRB (e.g., the NeuroNEXT multicenter trials) or for those grants where it was voluntarily utilized; ( 2) experiences of independent institutional review boards; and, (3) experiences of sponsors of clinical trials.
3. HHS support meetings with the research community where issues regarding the use of a single IRB can be discussed in a public forum.
4. Where not mandated but deemed appropriate, HHS fund mechanisms to encourage investigators and institutions to voluntarily utilize single IRBs as part of their grant submissions, rather than mandating review by a single IRB. This could be accomplished by providing incentives such as additional funding to those grants that agree to utilize single IRB arrangements.
5. HHS develop a cost structure that would provide financial support for both the reviewing and relying IRBs, based upon the data acquired and analyzed.
6. With respect to the NPRM’s ancillary proposals regarding single IRB review of multi-site studies, SACHRP supports:
   1.  The addition of written agreements for single IRB review of documentation requirements;
   2. The regulatory proposal that would give HHS regulatory oversight over the reviewing Institutional Review Board

NPRM Requirements for the Storage, Maintenance, and Secondary Research Use of Biospecimens and Identifiable Data

Summary of SACHRP Recommendations

Broad Consent in General and Need for Public Information about Biospecimen and Data Research Practices

1. SACHRP believes that public education about research uses of banked biospecimens and data collected during clinical care, notice to patients about research practices, providing patients with an opportunity to opt-out of the future research uses of their biospecimens and identified[2] data, and limitations and sanctions on unauthorized re-identification are preferable in this context to a “broad consent” mandate that would not represent meaningful consent and could “substantially hamper scientific progress.”
2. Comprehensive public education about the practices and benefits of research uses of banked data and biospecimens, one aspect of which is the provision by institutions to their patients and clients of a notice of research practices, is imperative, in order to inform  the public about the nature and scope of research uses of these materials.   

Ability to Withdraw

3. SACHRP maintains that subjects could be more protected by completely de-identifying biospecimens, which thereby would not permit consent withdrawal in the future, and that subjects should be notified that if the biospecimens are de-identified, then withdrawal of consent would not be feasible or available.  

Broad Consent Template

4. If the core NPRM broad consent requirement is imposed, SACHRP believes that institutions should not be required to use a verbatim template, without opportunity to modify as appropriate based on range of future uses, subject populations, and institutional policies and procedures.

Definition of “Human Subject” 

5. SACHRP believes that a diligent review of the overall regulatory impact of the change of definition to label as a “human subject” a living individual about whom a researcher obtains, uses, studies, or analyzes de-identified biospecimens should be undertaken in order to assure that there are no unintended consequences of these regulatory changes.  If there are such unintended consequences, then SACHRP requests that alternate regulatory structures be considered that would allow for Common Rule jurisdiction over de-identified biospecimens while avoiding any unintended regulatory, legal, and administrative consequences.

Sanctions for Unauthorized Re-Identification

6. SACHRP believes that the most appropriate and effective method of preventing and deterring unauthorized re-identification of subject data and biospecimens lies in regulatory, administrative, civil, and criminal penalties against investigators and entities that would seek to re-identify any de-identified biospecimens and data that have been distributed for research uses.

Notice of Biospecimen and Identified Data Research Practices, with Opportunity for Opt-Out

7. SACHRP recommends that the requirement for broad consent under §_.104(f) be replaced with a requirement for provision of notice of research practices, with an opt-out mechanism for those individuals who desire not to allow their biospecimens or identified data to be used for future research.  Such a notice and opportunity to opt out do not constitute informed consent, but are more informative and respectful than current regulatory requirements and avoid many of the problems associated with a “broad consent.” 
8. SACHRP recommends that HHS develop guidance explaining how to implement the notice of research practices and opportunity for opt-out process.  SACHRP recommends that notice be effectuated by the dissemination to individuals of a form containing the information required for adequate notice of research practices.  Depending on feasibility and effectiveness, institutions may consider alternative or additional methods of notice (including public posting of the notice, explanatory videos in public spaces within the institution, and/or posting on public websites) based on the nature and setting of the clinical or social service environment.   However, as guidance should indicate, the goal of offering notice and opportunity for opt-out should be to assure that the notice is thoroughly distributed, available  on an ongoing basis, and is as effective and clear as reasonably possible, and that opportunity to opt-out is offered in ways that allow all concerned individuals to assert their rights.
9. SACHRP recommends that guidance suggest that no signature be required to acknowledge the provision or receipt of notice of research practices.  Further, the opt-out would extend only to those research practices at the institution offering the notice, and not beyond, so that individuals could determine at which institutions, if any, the individuals would prefer to opt out of biospecimen and identified data research. 
10. SACHRP recommends that the guidance to be promulgated by HHS advance the notion of a robust system whereby individuals are made aware of their options, have an opportunity to ask questions and get answers, and be able to exercise readily their opt out rights.   Although SACHRP believes that institutions and researchers should be obligated to track only opt-out determinations and not all individual provisions of notice, institutions should have a practice of documenting how notice and opportunity for opt out have been provided.
11. SACHRP recommends that OHRP exercise enforcement authority in regard to the implementation of this notice and opportunity for opt-out standard, on the basis of which IRBs and institutions may approve downstream research uses of biospecimens and data.  Such enforcement would presumably consist of monitoring such IRB approvals to assure that notice and opportunity for opt-out have actually been provided.

Focused Institutional Review for Exempt Activities and Waiver

12. SACHRP recommends that the IRB (or other) review should require evaluation of the likelihood that the proposed activity would be objectionable to the subject population.  This evaluation would address whether the proposed activity would be offensive to a fundamental belief of the subject population. 
13. SACHRP also recommends an additional criterion for evaluating objectionability under exemptions and waiver of notice and opportunity for opt-out:  whether the proposed activity is designed to produce results inimical to the subject population’s best interests.  SACHRP envisions that a proposed activity’s likelihood of being inimical to a population’s best interests would be evaluated based on the possible psychological, religious, moral, political, social, and emotional responses of individuals, including responses based on their membership in any discrete and insular minority.

14. SACHRP notes that certain minimal risk research could be exempted from institutional review, such as if the proposed research is solely to investigate the basic physiology of normal or diseased cells or tissue, and there is no potential to generate information that could be individually identifiable.

Data Security Standards

15. SACHRP recommends that HHS develop a new, broad scheme that would require institutions, researchers, and authorized recipients of de-identified biospecimens only to establish appropriate and calibrated protections to prevent, or minimize the risk of, the unauthorized release, access, or use of de-identified biospecimens. 

Exemption for Storage, Maintenance, or Secondary Research Use of De-Identified Biospecimens

16. SACHRP recommends that §_.104(f) be revised to exempt the storage, maintenance, or secondary research use of de-identified biospecimens from the requirements of the Common Rule if the following conditions are met:
    1. Notice of de-identified biospecimen research practices and opportunity for opt-outhave been provided prior to the storage, maintenance, and secondary research use;
    2. No de-identified biospecimen from an individual who opted-out may be used, or otherwise made available, for the proposed de-identified biospecimen research practices;
    3. If the storage, maintenance, or secondary research use is likely to be offensive to a fundamental belief of the subject population or is designed to produce results inimical to its best interests, then the investigator must submit the protocol for full IRB review.  The IRB in that case must consider the protocol and impose appropriate safeguards, protections, and conditions, if applicable, to eliminate or substantially reduce the risk of dignitary harms that could be posed to the subject population by the approved protocol, which may include not undertaking the proposed research; and
    4. Application of standards for de-identified biospecimens protection in §_.105 (as revised).

Exemption for Storage, Maintenance, or Secondary Research Use of Identified Biospecimens and Identified Data

17. SACHRP recommends that §_.104(f) be revised to exempt the storage, maintenance, or secondary research use of identified biospecimens or identified data from the requirements of the Common Rule if the following conditions are met:

(i) Notice of biospecimen and identified data research practices and opportunity for opt-out have been provided prior to the storage, maintenance, and secondary research use;

(ii) No identified biospecimens or identified data from an individual who opted-out may be used, or otherwise made available, for the proposed biospecimen and identified data research practices;

(iii) The investigator and an IRB designee or institutional designee must review the storage, maintenance, or secondary research use to determine if it is likely to be offensive to a fundamental belief of the subject population, or is designed to produce results inimical to its best interests. If so, then the investigator must submit the protocol for full IRB review.  The IRB in that case must consider the protocol and impose appropriate safeguards, protections, and conditions, if applicable, to eliminate or substantially reduce the risk of dignitary harms that could be posed to the subject population by the approved protocol, which may include not undertaking the proposed research; and

(iv) Application of standards for information and biospecimens protection in §_.105.

Waiver to Allow Storage, Maintenance, and Secondary Research Use of Biospecimens Collected for Non-Research Purposes Without Prior Provision of Notice of Research Practices and Opportunity for Opt-Out

18. SACHRP recommends that HHS revise the waiver criteria at §_.116(f) to allow an IRB to approve the storage, maintenance, and secondary research use of biospecimens collected for non-research purposes without the prior provision of notice of research practices and an opportunity for opt-out, provided that the IRB finds and documents that:
    1. If the storage, maintenance, or secondary research use is likely to be offensive to a fundamental belief of the subject population, or is designed to produce results inimical to its best interests, then the IRB must consider and impose appropriate safeguards, protections, and conditions, if applicable, to eliminate or substantially reduce the risk of dignitary harms that could be posed to the subject population by the approved protocol; 
    2. Research could not be conducted with other reasonably available biospecimens for which notice of research practices and opportunity for opt-out have been provided;
    3.  There are compelling scientific reasons for the research use of the biospecimens;
    4. An institution’s failure to offer notice and the opportunity for opt-out was reasonably justified; and
    5. If an individual is provided notice of research practices and an opportunity for opt-out, and elects to opt-out, an IRB cannot waive the requirement that no biospecimens from an individual who opted-out may be used, or otherwise made available, for the proposed de-identified biospecimen research practices. 
19. SACHRP recommends that OHRP guidance define “compelling scientific reasons” as “study hypotheses and methods that are well-defined and offer promise of scientifically important findings or results.”  
20. SACHRP further recommends that in guidance, OHRP describe standards and examples for failure to give notice and opportunity to opt-out as being “reasonably justified,” and that OHRP note its ability to take enforcement action against institutions for inappropriate determinations under that standard.

Waiver to Allow Storage, Maintenance, and Secondary Research Use of Identified Data Collected for Non-Research Purposes Without Prior Provision of Notice of Research Practices and Opportunity for Opt-Out

21. SACHRP recommends that HHS revise the waiver criteria at §_.116(f) to allow an IRB to approve the storage, maintenance, and secondary research use of identified data collected for non-research purposes without the prior provision of notice of research practices and an opportunity for opt-out, provided that the IRB finds and documents that:
    1. If the storage, maintenance, or secondary research use is likely to be offensive to a fundamental belief of the subject population, or is designed to produce results inimical to its best interests, then the IRB must consider and impose appropriate safeguards, protections, and conditions, if applicable, to ameliorate any risk of dignitary harms that could be posed to the subject population by the approved protocol;
    2. Research could not be conducted with other reasonably available identified data for which notice of research practices and opportunity for opt-out have been provided;
    3. The storage, maintenance, and secondary research use procedures are consistent with sound research design;
    4. An institution’s failure to offer notice and opportunity for opt-out was reasonably justified; and
    5. If an individual is provided notice of research practices and an opportunity for opt-out, and elects to opt-out, an IRB cannot waive the requirement that no identified data from an individual who opted-out may be used, or otherwise made available, for the proposed de-identified biospecimen research practices. 

Respond to Requests for Summaries of Approved Waivers

22. SACHRP encourages making IRB grants of waiver of consent (or grants of waiver of notice and opportunity for opt-out) for research involving identified biospecimens or identified data more transparent to the general public.

Transition Provisions

23. SACHRP recommends that prior collections of biospecimens and identifiable information continue to be available for secondary research use, provided that adequate and appropriate human subject protections are in effect.

24. Background to Biospecimen Recommendations

    The NPRM, like the ANPRM preceding it, proposes extensive modifications to the ways in which biospecimens, including de-identified biospecimens, must be treated for research purposes.  The changes proposed are revolutionary, in that they would treat biospecimens shed of all phenotypic data as nevertheless identifiable, and thus requiring a level of review, approval and consent for research uses that would be unprecedented under American law.  Protections for human subjects in the area of biospecimen and data research must be rigorous and robust, and indeed, SACHRP believes that existing practices of research with biospecimens and data that have been collected for non-research uses (most often in the course of clinical care) should be examined and revised to offer better protections for subjects’ welfare and dignity interests.  This may be achieved through greater transparency and public education about these research uses, more exacting standards in regard to protecting against dignity harms to human sources of biospecimens and data, the allowance of opt-outs for persons who decide against future research use of their biospecimens, requiring IRB or institutional review and approval of specific research uses of identified biospecimens and identified data, and through new statutory authority, criminalizing the re-identification of de-identified biospecimens and data that have been shared for research purposes.  Yet the NPRM’s core proposal – that in order for biospecimens to be used for research, even de-identified biospecimens collected in clinical care, their human sources must sign, at a point well before those uses are even contemplated, a “broad consent” for unspecified future uses – would insufficiently protect the dignity and welfare interests of subjects.  Further, SACHRP believes that the NPRM proposal on this issue would disguise that threat by offering the pretense of informed consent, when “broad consent” would predictably be so routinized and so unspecific that it in fact would not protect any meaningful autonomy or dignity interest of research participants.

    As an alternative to the NPRM proposal, SACHRP recommends that individuals from whom biospecimens, both de-identified and identified, and identified data have been collected and that are to be stored, maintained, and used in secondary research, be provided with a notice of research practices and an opportunity to opt out of participation.  SACHRP also proposes data security protections to safeguard biospecimen-associated data and identified data against unauthorized release or access, and to create incentives for researchers to de-identify biospecimens to the extent practicable without compromising the science or ethics of the protocol.  SACHRP also recommends that an institution conduct a focused review of the storage, maintenance, or secondary research use of identified biospecimens and identified data to determine whether the proposed activity is likely to be objectionable.  SACHRP offers additional recommendations regarding criteria for waiver of the process of notice and opportunity for opt-out, changes to the transition provisions, sanctions for the unauthorized re-identification of de-identified biospecimens and information, and possible ways to make IRB waivers of notice and opportunity for opt-out  for research involving biospecimens or identified data more transparent.  SACHRP believes that its proposed alternative framework of notice with opportunity for opt-out and more rigorous institutional oversight would enhance human subject protections and ensure that the wishes of individuals to opt-out of certain research practices are respected.

    SACHRP notes that while certain provisions of the NPRM have warranted the Committee’s attention and comments, silence regarding other provisions should not be read to constitute endorsement. 

    Current Federal Framework and Extensive Stakeholder Reliance

    At present, the Common Rule does not apply to the research use of de-identified biospecimens or de-identified personal data collected for another purpose.  Since at least 1991, the regulatory definition of “human subject” has meant “a living individual about whom an investigator (whether professional or student) conducting research obtains data through intervention or interaction with the individual, or identifiable private information.”[3]  In 2008, HHS clarified its interpretation of the Common Rule to exclude from the scope of “human subject” research involving only coded biospecimens or coded private information, if (1) the biospecimens were not collected specifically for the proposed research through interaction or intervention with living individuals, and (2) the investigator(s) cannot readily ascertain the identity of the individual(s) to whom the coded biospecimens pertain because, for example:

    1. The investigators and the holder of the key enter into an agreement prohibiting the release of the key to the investigators under any circumstances, until the individuals are deceased (note that the HHS regulations do not require the IRB to review and approve this agreement);
    2. There are IRB-approved written policies and operating procedures for a repository or data management center that prohibit the release of the key to the investigators under any circumstances, until the individuals are deceased; or
    3. There are other legal requirements prohibiting the release of the key to the investigators, until the individuals are deceased.[4]

FDA had previously adopted a similar policy since at least 1999, announcing that samples not traceable to a human subject would not be subject to informed consent requirements in relation to in vitro diagnostic studies.[5]  In 2006, FDA confirmed and expanded the position, describing its intent to not enforce informed consent requirements for minimal risk device research involving the use of leftover de-identified or coded biospecimens.[6]

As SACHRP described in its comments to the ANPRM, an important component of any regulatory framework would be the education of the public and of patient and client populations on the importance of biospecimen research, as well as of the magnitude and volume of biospecimens that are currently used for research without prior consent.   SACHRP believes that public education and awareness of the practices and value of research, and the protections offered for that research, would do much to dispel suspicions about these research practices.  One means of achieving education would be for HHS to present public service messages conveying the public health value of biospecimen research, including, for example, ascertaining the time at which HIV entered the U.S. population, through research use of banked biospecimens originally collected for hepatitis B care; the development of tests to predict response to therapies for breast cancer; isolation of the 1918 flu virus; and the identification of Helicobacter pylori as a cause of gastric ulcers (which also has been linked to the development of stomach cancer).  Many of these discoveries came from the use of previously existing pathology collections for which no consent for future use of biospecimens was obtained at time of care.  Similarly, there are a number of current situations in which it is not feasible to gain a broad consent at time of care, but the value of  biospecimens from that care for future research may be significant, and the public should be educated about this as well.   

In SACHRP’s view. comprehensive public education about the practices and benefits of research uses of banked data and biospecimens, one aspect of which is the provision by institutions to their patients and clients of a notice of research practices, is imperative, in order to inform the public about the nature and scope of research uses of these materials.

Hospitals, academic medical centers, universities and medical schools, IRBs, contract research organizations, laboratories, tissue banks, and drug, device, and biologic product manufacturers have relied extensively on the current regulatory landscape to facilitate and support important clinical research translatable into proven and established procedures and safe, effective, reliable, and high quality medicines, diagnostics, therapies, and medical innovations.   Because research infrastructure in academia and industry has been premised on this existing regulatory structure and because transition costs for a radically different regulatory structure could be steep,[7] a major shift in federal policy in this area must: (1) significantly enhance the protection of human subjects in research, (2) not impede medical innovation, research, and development, (3) be supported by empirical data and/or compelling policy reasons, and (4) be consistent with the principles identified in the Belmont Report of respect for persons, beneficence, and justice.[8]    

Summary of the NPRM

Requiring Consent for the Storage, Maintenance, and Secondary Research Use of Biospecimens and Identifiable Data (§§_.102(e) and_.116(c))

The NPRM would expand the scope of “human subject” to include a living individual about whom an investigator (whether professional or student) conducting research “[o]btains, uses, studies, or analyzes biospecimens.”[9]  The NPRM would cover all biospecimen collections for research and all research uses of biospecimens, regardless of whether the biospecimens are identifiable or de-identified, if those biospecimens are collected or used in federally-funded research or “clinical trials,” as defined in the NPRM.[10]  Under the NPRM, the storage, maintenance, and secondary research use of biospecimens could be exempt from the Common Rule if the research satisfies documentation of exemption, broad consent, institutional review,[11] and data security protection requirements.[12]  If the investigator anticipates that individual research results will be returned to a research subject, the biospecimen research cannot be exempted and instead must be reviewed by the IRB, and standard informed consent for the research must be obtained.[13]

Broad Consent Requirements (§_.116(c))

Under the NPRM, broad consent for future research use of biospecimens would include certain basic elements, additional elements, and new elements.  For the storage, maintenance, or secondary research use of the biospecimens to be exempt under §_.104(f) of the NPRM, an HHS-provided broad consent template must be used.[14]

The existing basic elements for informed consent that must also be included in broad consent are: (1) a description of reasonably foreseeable risks or discomforts; (2) a description of any benefits to the subject or to others that may reasonably be expected; (3) a statement describing the extent, if any, to which confidentiality of records identifying the subject will be maintained; and (4) an explanation of whom to contact for answers to pertinent questions about the research and subjects’ rights, and whom to contact in the event of research-related injury. 

Further, the NPRM proposes new additional elements applicable to all informed consent, which also must be included in broad consent forms: (1) a statement that the subject’s biospecimens may be used for commercial profit and whether the subject will or will not share in this commercial profit; (2) a statement explaining whether clinically relevant research results, including individual research results, will be disclosed to subjects, and if so, under what conditions; and (3) an option for the subject to consent, or refuse to consent, to investigators’ re-contacting the subject to seek additional information or biospecimens or to discuss participation in another research study.

In addition, the NPRM would prescribe certain consent elements unique and specific to broad consent, including: (1) a general description of (i) the types of research that may be conducted with biospecimens/information, (ii) the information that is expected to be generated from the research, (iii) the types of biospecimens/information that might be used in research, and (iv) the types of institutions that might conduct research with the biospecimens/information; (2) a clear description of the types of biospecimens/information that were or will be collected and the period of time during which biospecimen/information collection will occur; (3) a description of the period of time during which an investigator can continue to conduct research on the biospecimens/information (can be indefinite); (4) a statement that subjects may at any time, and without penalty or loss of benefits, withdraw consent, if feasible, for research use or distribution of the subject’s biospecimens/information, though biospecimens/information already distributed for research use may not be retrieved; and (5) an option, if relevant, for an adult subject to consent or refuse to consent to the inclusion of the subject’s data, with removal of the identifiers listed in the HIPAA Privacy Rule, in a database that is publicly available and openly accessible to anyone.

As part of the description of the types of biospecimens or information that were or will be collected and the period of time during which biospecimen or information collection will occur, the NPRM would permit the collection to include all biospecimens and information from the subject’s medical record or other records existing at the institution at the time informed consent is obtained.  However, the period of time during which biospecimen or information collection can occur cannot exceed 10 years from the date of consent.  For research involving children as subjects, that time period cannot exceed 10 years after parental permission is obtained, or until the child reaches the legal age for consent to the treatments or procedures involved in the research, whichever time period is shorter. Importantly, the time limitations do not apply to biospecimens or information initially collected for research purposes.

Waiver Criteria (§_.116(f))

The NPRM proposes to add a new generally applicable waiver criterion that would only permit waiver of consent for research involving access to or use of identifiable biospecimens or identifiable information if the research could not practicably be carried out without accessing or using identifiers.[15]  The criterion is modeled on the HIPAA Privacy Rule, which requires that the research could not practicably be conducted without access to and use of the protected health information.[16]

In addition, the NPRM would impose two more stringent waiver conditions for research involving biospecimens.[17]  First, there must be “compelling scientific reasons” for the research use of the biospecimens.  Second, the research “could not be conducted with other biospecimens for which informed consent was or could be obtained.”  Finally, the NPRM would prohibit IRBs from waiving informed consent if individuals were asked and refused to provide broad consent to the storage and maintenance for secondary research use of biospecimens and identifiable private information.

Exclusion for Certain Assay Research (§_.101(b)(3)(i))

The NPRM proposes to exclude from Common Rule jurisdiction certain activities that are low-risk human subjects research that “do not meaningfully diminish subject autonomy.”  The only type of research that would fall within the exclusion would be the secondary research use of non-identified biospecimens designed only to generate information about the individual “that is already known.”  This exclusion would include the development and validation of certain tests and assays (such as research to develop a diagnostic test for a condition using specimens from individuals known to have the condition and those known not to have the condition), quality assurance and control activities, and proficiency testing.

Broad Consent Template (§_.116(d))

The NPRM proposes that the HHS Secretary will establish and publish in the Federal Register for public comment, broad consent templates containing all required elements of consent.  The NPRM would not require IRB review of the broad consent template, if no changes are made.  HHS would develop at least two broad consent templates, one for biospecimens originally collected in the research context, and another for biospecimens originally collected in the non-research context.

Transition Provisions (§_.101(k)(2))

The NPRM would not apply to research involving the use of prior collections of biospecimens if: (1) the biospecimens were “collected for either research or non-research purposes before the compliance date; and (2) the research use “occurs only after removal of any individually identifiable information associated with the biospecimens.” 

SACHRP Comments on the ANPRM

In October 13, 2011, SACHRP submitted comments on the ANPRM.[18]  As the NPRM’s core proposal to require broad consent for future research uses of biospecimens was included in the original ANPRM, many SACHRP comments on the ANPRM are applicable to the NPRM.  Further, SACHRP notes at the outset that its own principled opposition to the core ANPRM proposal to require “broad consent” as a predicate for future uses of biospecimens was consistent with the overwhelming public response to that ANPRM proposal.[19]  Although the NPRM reflects some consideration by HHS of the public comments on the ANPRM (such as eliminating the proposed requirement of broad consent for future research uses of data), SACHRP notes that HHS appears not to have responded to or even acknowledged the overwhelming opposition in the comments submitted in the ANPRM process to the requirement of broad consent for future research uses of biospecimens.

On the issue of general consent for future biospecimen research, SACHRP concluded that a general consent for future use should not be a necessary predicate for any and all future research uses of biospecimens.  SACHRP noted that general consent cannot act as an adequate substitute for careful consideration by an IRB, through the existing waiver of consent mechanism, of specific future research uses and their risks to subjects.  SACHRP reasoned that even with general consent for future research uses, no researcher, under current Common Rule interpretations, would believe that such consent would obviate the need, in the case of future specific research uses of identified biospecimens or data, for that researcher to seek and obtain from an IRB a waiver of consent.  SACHRP’s underlying theory was that although the subject may have been generally notified of, and may even have permitted, future research uses, the process of general consent could not adequately and fairly address specific future studies for which the IRB, in considering waiver of consent, would seek to protect the welfare and rights of the subjects. 

SACHRP evaluated the ANPRM through the values set forth in the Belmont Report.  SACHRP determined that the ANPRM, with its insistence that each person be given a “choice” of executing a broad consent for unspecified future uses of his or her biospecimens or data, was proposing a model in which respect for persons invariably trumps beneficence and justice.  SACHRP stated that under the principle of beneficence, members of society incur an obligation to one another to participate in low-risk activities that benefit society at large, even if the specific activities do not directly benefit the participating individuals, and that yield benefit and promise for future generations.  Much research relies on the altruistic motivations of human subjects.  Accordingly, SACHRP asserted that an optimal regulatory framework would – unlike the ANPRM – impose more exacting, more protective standards on the waiver of informed consent process and implement measures to penalize attempts to re-identify subjects through their data and biospecimens that have been used for research purposes. 

Finally, SACHRP noted that concerns for justice arise when one considers whether allowing future research uses without subject consent somehow unfairly allocates burdens and risks. However, given the widespread nature of the research uses of such substantial amounts of data and biospecimens, and the wide and diffuse benefit to the public good, SACHRP concluded that it is difficult to argue that one social group has been harmed or preferred in place of another under the current regulatory structure.  SACHRP concluded that in fact, the ANPRM proposals would act contrary to the principles of beneficence and justice by advocating for a state of affairs in which persons may refuse use of their own data and biospecimens, even when risk to them is negligible, but who nevertheless benefit from such research by depending upon the beneficence and voluntarism of others.  SACHRP also recognized that the self-exclusion of certain individuals from research projects could skew and bias the results, and cause the data to not be representative of or generalizable to those excluded individuals or subpopulations. 

SACHRP Comments on the NPRM

SACHRP fully supports the expressed NPRM objectives of better protecting human subjects, facilitating valuable research, and reducing burden, delay and ambiguity for investigators.[20]  However, after several months of intense discussions on this issue, SACHRP does not believe that the NPRM proposed framework for regulating research involving de-identified biospecimens would enhance human subjects protections; in fact, it holds the potential to erode those protections and to slow, impede, and stifle important medical research. 

Inadequate Justification for Radical Shift of Current Federal Policy

The NPRM states that the bioethical justification for the biospecimen proposal is respect for persons (“justified primarily by the special autonomy interest of a person in controlling the research use of [] biospecimens”).[21]  However, merely furthering one bioethical tenet does not, by itself, further the ethics of the research or enhance human subject protections.  SACHRP recognizes the challenge of balancing the Belmont Report’s principles of respect for persons, justice, and beneficence.  After carefully evaluating the NPRM, SACHRP believes that the proposed biospecimen framework inappropriately diminishes the relevance of justice and beneficence, and only purports to assign predominance and primacy to respect for persons. However the NPRM, in actuality, would not vindicate the value of autonomy that it intends to serve.  Specifically, broad consent as proposed and its effectuation would fail to protect adequately human subjects in any meaningful way.  Subjects would not be sufficiently informed to make a knowledgeable and educated decision about participation in undefined future research, while researchers would rely on a vague broad consent to conduct unfettered, unsupervised and unlimited future research on subjects’ biospecimens and data.   One might expect, therefore, that “broad consent” will be less a commitment to individual autonomy than a license to researchers for unfettered use.  It is worth noting, for example, that if broad consent, under the NPRM proposal, had been obtained from the members of the Havasupai tribe and from Henrietta Lacks, the full range of future secondary uses and manipulations of their identified biospecimens and data could have occurred without any regulatory or institutional oversight.

The NPRM also refers to various empirical data to support its proposed biospecimen framework.  The first assertion is that re-identification of de-identified biospecimens and data is technologically possible.  Citing a 2013 Science article in which the identity of individual research subjects could be ascertained by collating and analyzing certain types of genomic data, including genomic data from publicly available information sources,[22] the NPRM concludes that “the possibility of fully identifying biospecimens and some types of data from which direct identifiers had been stripped or did not originally include direct identifiers has grown, requiring vigilance to ensure that such research be subject to appropriate oversight.”[23]  We agree fully that ensuring proper oversight of research involving genomic data is necessary.  SACHRP also agrees with the note of caution and recommendation with which the cited article concludes:

[T]he appropriate response to genetic privacy challenges is not for the public to stop donating samples or for data sharing to stop. These would be devastating reactions that could substantially hamper scientific progress. Rather, we believe that establishing clear policies for data sharing, educating participants about the benefits and risks of genetic studies, and the legislation of proper usage of genetic information are pivotal ingredients to support the genomic endeavor.[24]

SACHRP believes that public education about research uses of banked biospecimens and data collected during clinical care, notice to patients about research practices, providing patients with an opportunity to opt-out of the future research uses of their biospecimens and identified[25] data, and limitations and sanctions on unauthorized re-identification are preferable in this context to a “broad consent” mandate that would not represent meaningful consent and could “substantially hamper scientific progress.”

Second, the NPRM claims that “many prospective participants want to be asked for their consent before their biospecimens are used in research.”[26]  However, the more appropriate and accurate question is whether individuals would strongly prefer to provide consent before their de-identified biospecimens are used in minimal risk research, appreciating that research with fully de-identified biospecimens, for example, carries no demonstrable or proven risk to the dignity or welfare of the human sources of those biospecimens.  The NPRM cites four articles as footnote support for this proposition, but none of those articles, when carefully examined, directly supports the NPRM proposal that would require broad consent for research on de-identified biospecimens.[27]  In fact, when informed about current policies and practices regarding research uses of clinical data and residual specimens, research indicates that the public is generally supportive of a practice of notice with an opt-out opportunity.[28]

Moreover, a proposal that requires individuals to provide broad consent in the context of clinical care predictably would be implemented in so routinized a fashion that it could not constitute an informed, meaningful, or effective consent under state and other federal law.  The proposed approach also would not solve the potential problem of the unauthorized re-identification of biospecimens. In other words, to the extent that the NPRM’s core proposal is meant to ensure that subjects provide meaningful consent to future research with biospecimens and to prevent biospecimen re-identification, the NPRM would do nothing of the sort.

Biospecimen Exceptionalism

The NPRM proposes a different framework for biospecimens than for data.  Currently, both biospecimens and data can be de-identified and used in research without application of the Common Rule.  The NPRM, however, would treat de-identification of biospecimens as technologically impossible because, the NPRM asserts, all biospecimens are inherently and presumptively identifiable.  However, this argument, if accurate, extends to data as well, especially genetic data, in that a third party with ill intent could also seek to match de-identified data with data points derived from publicly available or accessible data sets, thus ascertaining the identity of the person from whom the data were collected.  In fact, given the plethora of publicly available data and the relative paucity of publicly available biospecimens, it is more likely that subjects would be exposed to more informational risks through re-identification via data matches than through matches of biospecimens.

Moreover, the NPRM’s cited philosophical and empirical arguments for requiring consent for de-identified biospecimen research do not support divergent regulation of biospecimens and data.  The principles of respect for persons, beneficence, and justice should apply equally to biospecimens and data, and the NPRM does not reference any scientific, qualitative, social science, or behavioral study that definitively concludes that it is more critical for persons to exercise greater control over their de-identified biospecimens than over their de-identified data.   

The Elusive Benefit of “Broad Consent”

The NPRM proposes that the HHS Secretary will publish in Federal Register broad consent templates containing all required elements of consent, and that use of the broad consent template would be required for exemption under §_.104(f).  Although termed “consent,” “broad consent” would not provide a prospective subject with sufficient information about the procedure(s) involved in the proposed research, the duration of the proposed research, the purpose(s) of the proposed research, or the reasonably foreseeable risks of the proposed research, to allow the prospective subject to make a meaningful, informed, and voluntary decision about whether to participate.  Thus, “broad consent” could meet none of the basic requirements of the traditional doctrine of informed consent, which requires each of these elements. 

Moreover, broad consent would predictably be obtained in a wide variety of clinical settings and by staff who, in many circumstances, would be unfamiliar with research generally and with details of the consent elements.  Therefore, in application, a broad consent approach would virtually guarantee that, in many clinical settings, the consent process would not be robust or meaningful.  Health care providers and all settings where biospecimens are regularly collected (e.g. physician offices, school clinics, public health clinics, mental health agencies, developmental disability settings, nursing homes, emergency rooms, international, non-U.S.-based service and demonstration projects) would be required to secure upfront broad consent from patients to ensure that those biospecimens will be available for future research uses.  Hospitals, outpatient clinics, and educational and social service providers would need to train clinical staff on how to obtain research consent, and how to explain the complex concepts of broad consent and future unspecified research on biospecimens.  These are staff ordinarily responsible for admitting patients and obtaining third party payment information from them, or for assisting patients or clients before clinical tests, procedures, or examinations.  These clerical and clinical staff would need to ensure that patients or clients with questions about broad consent have the opportunity to ask questions and receive answers at the point of contact, before signing broad consent.  Based on these realities for a wide range of clinical settings, SACHRP believes that the broad consent process, already compromised by overgeneralization of purposes and scope, would become, in many settings removed from the rarified environment of research hospitals, a routinized, administrative task that cannot facilitate true informed consent.  Instead, a pro forma practice of offering broad consents would often become a “Sign here!” reality in crowded clinic settings, and the broad consents so obtained will only serve to provide a token rationale to allow researchers unfettered, unsupervised, uncontrolled and unknown future use of biospecimens and associated data.  This would undermine, not enhance, the protection of the rights and welfare of the human sources of those materials.[29]

It may be that in order to avoid the “Sign here!” approach to obtaining broad consents, HHS will – as it has done in other regulatory initiatives – decide to offer some categorical funding to some classes of health care providers (such as, in this case, federally qualified health centers), but unless such funding covers all of the environments in question (e.g., STD clinics, TB clinics, mental retardation services, developmental disability providers, school health clinics, non-U.S.-based clinical programs), then such limited categorical funding would do nothing to vindicate the rights of the many whom the NPRM seeks to defend.  A more effective and meaningful implementation of “broad consent” in clinical and social service settings would require HHS to modify the Medicare payment system and the minimal conditions for state participation in Medicaid in order to assure appropriate reimbursement to health providers so that resources are available throughout the health care and social service system to provide real, not elusive, consent.  That this was not proposed as part of the NPRM shows, at the least, insufficient planning on the part of HHS; more seriously, the lack of reimbursement mechanisms for providing broad consent counseling suggests that the NPRM’s core proposal is either meant to be an unfunded new mandate on the health care and social service system, or that HHS in fact expects that the broad consent will be implemented in an entirely routinized manner.  

Disincentivizing De-Identification and Increasing Risk to Subjects

Although the NPRM cites one recent article for the proposition that biospecimen de-identification is no longer technologically possible, SACHRP asserts, as it did in response to the ANPRM, that the remote possibility of re-identification should not cause all biospecimens to be considered identifiable.  Indeed, the NPRM, as constructed, increases risks to subjects in the course of biospecimen research precisely because it treats the risks from identified and de-identified biospecimen research as equivalent.  By attaching the same requirements for broad consent, data security standards, and institutional review to research with both identifiable and de-identified biospecimens, the NPRM would eliminate incentives for researchers to de-identify biospecimens before conducting research, thus increasing risk of violations of subjects’ privacy.  The NPRM states that the goal of the data security standards is to “create information privacy protections that would apply to research, calibrated to the level of identifiability and sensitivity of the information being collected.”[30]  However, the NPRM would establish the same regulatory framework for both identified and de-identified biospecimen research, despite the fact that de-identified biospecimen research poses fewer privacy and informational risks.  If the goal in this area is truly increased subject protections, the NPRM misses the mark.

Ability to Withdraw Consent Creates Privacy Risks

The NPRM would require that subjects be informed that at any time and without penalty or loss of benefits, they may withdraw consent, if feasible, for research use or distribution of the subject’s information or biospecimens.  However, information that has been stripped of identifiers often will not be traceable.  In fact, any possibility of retaining a link identifying biospecimens for the purpose of allowing for future withdrawal of consent would actually increase the privacy and informational risks of the research and thus may decrease overall human subject protections.  Thus, it is unclear when the ability to withdraw one’s de-identified biospecimens would ever be “feasible.” 

Thus, SACHRP maintains that subjects could be more fully protected by completely de-identifying biospecimens, which thereby would not permit consent withdrawal in the future, and that subjects should be notified that if the biospecimens are de-identified, then withdrawal of consent would not be feasible or available. 

Extensive Resources Necessary to Obtain and Track Consent for De-Identified Biospecimens

Even assuming that health and social service providers other than top-tier academic medical centers can implement a broad consent process that would, along with other admissions forms, be supplied to patients and clients at the point of entry, every institution that obtains broad consent would be required by the NPRM to adopt and maintain a sophisticated electronic and workplace infrastructure to track the biospecimens and broad consent to ensure that:

1. Only biospecimens with associated broad consent are used for research;
2. The database is kept up date with the most recent decision of each patient;
3. No biospecimen collection from an individual who provided broad consent occurs after 10 years from the date of consent for the non-research collection (or if the subject is a child, the earlier of 10 years from the date of parental permission or the age of majority);
4. If a subject refused to provide broad consent, an IRB cannot waive consent for the storage, collection, or secondary research use of that subject’s biospecimen;
5. The right to withdraw consent for study participation is respected, when feasible, by developing a mechanism to permit re-identifying biospecimens for withdrawal purposes; and
6. Each biospecimen is used only for the duration specified in the consent form (which could be indefinitely).

SACHRP believes that such a detailed tracking infrastructure, which would be necessary to comply with the extensive NPRM proposals, would require substantial and ongoing expenditures for those institutions.  For smaller institutions, including public and community hospitals, public health clinics, and physician offices, the NPRM would create substantial barriers for engaging in, or supporting, important clinical research, and is likely to bias research data in some domains by excluding certain underrepresented and diverse subpopulations.  For example, when surgery is performed, it is often unknown at the time of the procedure whether the tissues remaining in paraffin blocks will be needed for future research. To ensure the use of these future archival collections, under the NPRM, institutions would be required to obtain broad consent from all surgical patients from whom tissues are removed during surgery.  For certain medical centers, that number could approach 50,000 annually, and many hospitals will not be able to afford the associated expenses and implement a compliant infrastructure.[31]

Transition Provisions Could Deprive Research Community of Important Scientific Resources

The NPRM would apply transition provisions to biospecimens collected before the final rule’s compliance date, if the research use of the biospecimens occurs after “removal of any individually identifiable information associated with the biospecimens.”[32]  Thus, banked biospecimens without relevant consent would only be grandfathered if researchers (i) remove all individually identifiable information, which would exclude coded biospecimens from the transition provisions, or (ii) re-identify, relocate, recontact, and reconsent the human sources of the biospecimens.  Otherwise, as currently drafted in the NPRM, such biospecimens would no longer be available for clinical research, especially considering that the NPRM would narrowly confine waiver for biospecimen research, permitting that waiver be granted only in “extremely rare” circumstances.[33]  SACHRP is concerned that effectively rendering unavailable such extensive and important troves of medical research would impede scientific research and innovation, and that any efforts to reestablish such biospecimen collections would require extraordinary expenses and resources.

Restrictive Waiver for Biospecimen Research

The NPRM does not elucidate the “compelling scientific reasons” standard required for an IRB to grant a waiver of consent for use of biospecimens not collected under a broad consent, stating merely that waiver under this more rigorous standard would be granted only “in very rare circumstances.”[34]  Under what conditions exploratory research, for example, could meet this criterion remains unclear.  Moreover, the other new requirement that the IRB determine whether a research project could be conducted using other biospecimens for which broad consent has been obtained would create a considerable due diligence effort and present logistical challenges for researchers and IRBs to survey all potential biobanks and determine the availability of other consented biospecimens.  SACHRP believes that the additional waiver criteria for biospecimen research are too restrictive and onerous, and would limit the extent to which important medical research could be conducted on biospecimens obtained without consent.

Broad Consent Template

The HHS-developed broad consent template must be used, according to the NPRM, in order for research to be exempt; otherwise future research uses are subject to full IRB review and informed consent provisions.  However, each category of biospecimen research may require study-tailored consent language to describe adequately the types of biospecimen investigations.  The NPRM does not explain whether templates would allow for sponsors or investigators to customize and fill in study-specific details.  Thus, if the core NPRM broad consent requirement is imposed, SACHRP believes that institutions should not be required to use a verbatim template, without opportunity to modify as appropriate based on range of future uses, subject populations, and institutional policies and procedures.

SACHRP Recommendations

In accordance with the NPRM’s stated objectives of enhancing human subject protections, facilitating valuable medical research, and reducing burden, delay and ambiguity for investigators, SACHRP proposes the following recommendations to modernize and strengthen the Common Rule. 

Definition of “Human Subject”

SACHRP supports a more rigorous oversight of the research use of de-identified biospecimens, in light of an increased ability to re-identify biospecimens and in light of the views of some persons who may be concerned about unconsented research uses of their biospecimens.  SACHRP believes that a diligent review of the overall regulatory impact of the change of definition to label as a “human subject” a living individual about whom a researcher obtains, uses, studies, or analyzes de-identified biospecimens should be undertaken in order to assure that there are no unintended consequences of these regulatory changes.  If there are such unintended consequences, then SACHRP requests that alternate regulatory structures be considered that would allow for Common Rule jurisdiction over de-identified biospecimens while avoiding any unintended regulatory, legal, and administrative consequences.    

Sanctions for Unauthorized Re-Identification

SACHRP believes that the most appropriate and effective method of preventing and deterring unauthorized re-identification of subject data and biospecimens lies in regulatory, administrative, civil, and criminal penalties against investigators and entities that would seek to re-identify any de-identified biospecimens and data that have been distributed for research uses.  HHS could, under its existing statutory authorities or under new authorization sought from Congress, impose administrative, regulatory, civil, and even criminal penalties on institutions and/or investigators for the unauthorized re-identification of de-identified biospecimens or data.  SACHRP proposed this in its response to the ANPRM and reiterates the need for law for this purpose, which would represent a much more effective protection for privacy of human sources of biospecimens and data than any measure proposed in the NPRM.

Notice of Biospecimen and Identified Data Research Practices, with Opportunity for Opt-Out

SACHRP recommends that the requirement for broad consent under §_.104(f) be replaced with a requirement for provision of notice of research practices, with an opt-out mechanism for those individuals who desire not to allow their biospecimens or identified data to be used for future research.  Such a notice and opportunity to opt out do not constitute informed consent, but are more informative and respectful than current regulatory requirements and avoid many of the problems associated with a “broad consent.”  The storage, maintenance, and secondary research use of biospecimens and identified data collected for non-research purposes would be exempt under §_.104 provided that each individual is given a written or electronic notice of the range of research uses of biospecimens and identified data collected for non-research purposes, and the types of persons and entities that would be authorized to access and use the biospecimens and identified data for the specified research uses.  The notice would include an option to have one’s biospecimens and/or identified data not subject to the specified research uses, except in special circumstances by an IRB, as further described below.  Institutions would be required to track and honor “opt-outs,” but the biospecimens and identified data could still be used for certain excluded activities, not described in the notice of research practices, such as operational, non-research activities, such as quality assurance and quality improvement programs.  In defined conditions and with strong justifications, an IRB may permit biospecimens and identified data not obtained under the notice and opportunity for opt-out to be used for research under a narrow waiver exception. 

SACHRP recommends that HHS develop guidance explaining how to implement the notice of research practices and opportunity for opt-out process.  SACHRP recommends that notice be effectuated by the dissemination to individuals of a form containing the information required for adequate notice of research practices.  Depending on feasibility and effectiveness, institutions may consider alternative or additional methods of notice (including public posting of the notice, explanatory videos in public spaces within the institution, and/or posting on public websites) based on the nature and setting of the clinical or social service environment.   However, as guidance should indicate, the goal of offering notice and opportunity for opt-out should be to assure that the notice is thoroughly distributed, available on an ongoing basis, and is as effective and clear as reasonably possible, and that opportunity to opt-out is offered in ways that allow all concerned individuals to assert their rights.  Guidance also could specify the period of time during which an individual, after being provided with the notice of research practices and an opportunity for opt-out, may elect to opt out.  After the specified period of time lapses, the individual’s implicit agreement to participate will become effective.  In addition, HHS guidance would describe the contents of the notice of research practices, and recommend that a more complete and comprehensive explanation of the research practices be made available upon request at institutions. 

SACHRP recommends that guidance suggest that no signature be required to acknowledge the provision or receipt of notice of research practices.  Further, the opt-out would extend only to those research practices at the institution offering the notice, and not beyond, so that individuals could determine at which institutions, if any, the individuals would prefer to opt out of biospecimen and identified data research. 

SACHRP recommends that the guidance to be promulgated by HHS advance the notion of a robust system whereby individuals are made aware of their options, have an opportunity to ask questions and get answers, and be able to exercise readily their opt out rights.   Although SACHRP believes that institutions and researchers should be obligated to track only opt-out determinations and not all individual provisions of notice, institutions should have a practice of documenting how notice and opportunity for opt out have been provided.    In contrast to the HIPAA notice of privacy practices acknowledgment process, the SACHRP proposal would not require that individuals sign the notice to document receipt of the research notice.  The tracking burden would be reduced significantly because only biospecimens and information associated with an opt-out election would require tracking.  All other biospecimens and information would not require tracking because such storage, maintenance, and secondary research use would be permissible only (i) with the provision of notice of research practices and an opportunity for opt-out, without an election of the opt-out, or, (ii) in situations where notice and an opportunity for opt-out have not been provided, and the IRB deems the omission to be reasonable and waives the requirement for the provision of notice of research practices and opportunity for opt-out.

SACHRP recommends that OHRP exercise enforcement authority in regard to the implementation of this notice and opportunity for opt-out standard, on the basis of which IRBs and institutions may approve downstream research uses of biospecimens and data.  Such enforcement would presumably consist of monitoring such IRB approvals to assure that notice and opportunity for opt-out have actually been provided.

Institutional Review

SACHRP recommends that, to be eligible for the two exemptions or two waivers described below, the storage, maintenance, or secondary research use of biospecimens and identified information must undergo some review, either by the investigator, an IRB or other institutional body or official.  SACHRP acknowledges the need for flexibility in effectuating an institutional review mechanism, including the creation by institutions of separate biorepository review boards, or the formation within IRBs of subcommittees skilled and trained on the risks, safeguards, and scientific and ethical issues associated with the storage, maintenance, and secondary research use of biospecimens. 

The IRB (or other) review should require evaluation of the likelihood that the proposed activity would be objectionable to the subject population.  This evaluation would address whether the proposed activity would be offensive to a fundamental belief of the subject population.  SACHRP also recommends an additional criterion for evaluating objectionability:  whether the proposed activity is designed to produce results inimical to the subject population’s best interests.  SACHRP envisions that a proposed activity’s likelihood of being inimical to a population’s best interests would be evaluated based on the possible psychological, religious, moral, political, social, and emotional responses of individuals, including responses based on their membership in any discrete and insular minority.

There are important, critical and potentially competing interests here regarding protection of the interests of discrete and insular minorities in biospecimen and data research, as well regarding protection of scientific interests in pursuing truth, however radical and unsettling.  The standards proposed above for review of biospecimen and data research represent, at the present time and given the exigencies and time limits for preparing these comments, SACHRP’s best attempt at formulating ethically appropriate and practical criteria.  The interests here are so important on all sides that SACHRP recommends that HHS undertake a full public consultation about the appropriate standards to be applied here, perhaps even including an expert committee, such as one drawn from NAS.  The experiences of the Havasupai here are illustrative of the risks, and developing appropriate standards for review and approval of these research uses of biospecimens and data must occur, in order to prevent, insofar as possible, similar instances in the future.  The current NPRM skirts this vexing issue, in that as long as broad consent has been gained, future uses may occur without any review.  In an attempt to assure some protection of these discrete and insular minorities, however, SACHRP has instead proposed these exemption and waiver processes, which in turn demand that these standards be defined and adopted.

The review for exemption would also assure that notice of research practices and an opportunity for opt-out have been provided.  If the storage, maintenance, or secondary research use of identified or de-identified biospecimens or identified data is found to be likely to be objectionable to the subject population, IRB review will be required.   In order for an IRB to allow a research use that is likely to be objectionable, that is, that in some way would work a significant dignitary harm (i.e., that presents a significant challenge to a fundamental belief of an individual or of a discrete and insular group of which he or she is a member, or that would produce results inimical to the best interests of that discrete and insular group), the IRB must consider and impose stringent safeguards, protections, and conditions, if applicable, to eliminate or substantially reduce any risk of dignitary harm, regardless of whether biospecimens or data are identified.  For this purpose, IRBs should consider data or biospecimens that are identifiable to a particular individual or insular group as requiring higher standards for protection than de-identified data or de-identified biospecimens. 

SACHRP also recommends that HHS consider whether certain narrowly defined types of biospecimen research should be allowed to proceed without any institutional review, because of their inherently innocuous nature.   For example, SACHRP notes that certain minimal risk research could be exempted from institutional review, such as if the proposed research is solely to investigate the basic physiology of normal or diseased cells or tissue, and there is no potential to generate information that could be individually identifiable.  However, SACHRP acknowledges that another exempted research domain necessitates further discussion, and requests that HHS consider whether a categorical exemption should be created for certain minimal risk research in which potential harm, including information risks, are vanishingly small.

Protection of De-Identified Biospecimens

SACHRP believes that the protections currently proposed in §_.105 would be too extensive, burdensome, and rigorous for the minimal risk posed by the storage, maintenance, and secondary research use of de-identified biospecimens.  Thus, SACHRP recommends that HHS develop a new, broad scheme that would require institutions, researchers, and authorized recipients of de-identified biospecimens only to establish appropriate and calibrated protections to prevent, or minimize the risk of, the unauthorized release, access, or use of de-identified biospecimens.  SACHRP also recommends, as described elsewhere, sanctions for the unauthorized re-identification of de-identified biospecimens.

Exemption for Storage, Maintenance, or Secondary Research Use of De-Identified Biospecimens

SACHRP recommends that §_.104(f) be revised to exempt the storage, maintenance, or secondary research use of de-identified biospecimens from the requirements of the Common Rule if the following conditions are met:

(i)  Notice of de-identified biospecimen research practices and opportunity for opt-out have been provided prior to the storage, maintenance, and secondary research use;

(ii) No de-identified biospecimen from an individual who opted-out may be used, or otherwise made available, for the proposed de-identified biospecimen research practices;

(iii)       If the storage, maintenance, or secondary research use is likely to be offensive to a fundamental belief of the subject population or is designed to produce results inimical to its best interests, then the investigator must submit the protocol for full IRB review.  The IRB in that case must consider the protocol and impose appropriate safeguards, protections, and conditions, if applicable, to eliminate or substantially reduce any risk of dignitary harms that could be posed to the subject population by the approved protocol, which may include not undertaking the proposed research; and

(iv) Application of standards for de-identified biospecimens protection in §_.105 (as revised).

Exemption for Storage, Maintenance, or Secondary Research Use of Identified Biospecimens and Identified Data

SACHRP recommends that §_.104(f) be revised to exempt the storage, maintenance, or secondary research use of identified biospecimens or identified data from the requirements of the Common Rule if the following conditions are met:

(i)  Notice of biospecimen and identified data research practices and opportunity for opt-out have been provided prior to the storage, maintenance, and secondary research use;

(ii) No identified biospecimens or identified data from an individual who opted-out may be used, or otherwise made available, for the proposed biospecimen and identified data research practices;

(iii)       The investigator and an IRB designee or institutional designee must review the storage, maintenance, or secondary research use to determine if it is likely to be offensive to a fundamental belief of the subject population, or is designed to produce results inimical to its best interests. If so, then the investigator must submit the protocol for full IRB review.  The IRB in that case must consider the protocol and impose appropriate safeguards, protections, and conditions, if applicable, to eliminate or substantially reduce any risk of dignitary harms that could be posed to the subject population by the approved protocol, which may include not undertaking the proposed research; and

(iv)       Application of standards for information and biospecimens protection in §_.105.

Waiver to Allow Storage, Maintenance, and Secondary Research Use of Biospecimens Collected for Non-Research Purposes Without Prior Provision of Notice of Research Practices and Opportunity for Opt-Out

SACHRP recommends that HHS revise the waiver criteria at §_.116(f) to allow an IRB to approve the storage, maintenance, and secondary research use of biospecimens collected for non-research purposes without the prior provision of notice of research practices and an opportunity for opt-out, provided that the IRB finds and documents that:

1. If the storage, maintenance, or secondary research use is likely to be offensive to a fundamental belief of the subject population, or is designed to produce results inimical to its best interests, then the IRB must consider and impose appropriate safeguards, protections, and conditions, if applicable, to eliminate or substantially reduce any risk of dignitary harms that could be posed to the subject population by the approved protocol; 
2. Research could not be conducted with other reasonably available biospecimens for which notice of research practices and opportunity for opt-out have been provided;
3.  There are compelling scientific reasons for the research use of the biospecimens;
4. An institution’s failure to offer notice and the opportunity for opt-out was reasonably justified; and

(v) If an individual is provided notice of research practices and an opportunity for opt-out, and elects to opt-out, an IRB cannot waive the requirement that no biospecimens from an individual who opted-out may be used, or otherwise made available, for the proposed de-identified biospecimen research practices. 

SACHRP recommends that OHRP guidance define “compelling scientific reasons” in (iii) as “study hypotheses and methods that are well-defined and offer promise of scientifically important findings or results.”   SACHRP further recommends that in guidance, OHRP describe standards and examples for failure to give notice and opportunity to opt-out as being “reasonably justified” under (iii) above and that OHRP note its ability to take enforcement action against institutions for inappropriate determinations under that standard.

I.  Waiver to Allow Storage, Maintenance, and Secondary Research Use of Identified Data Collected for Non-Research Purposes Without Prior Provision of Notice of Research Practices and Opportunity for Opt-Out

SACHRP recommends that HHS revise the waiver criteria at §_.116(f) to allow an IRB to approve the storage, maintenance, and secondary research use of identified data collected for non-research purposes without the prior provision of notice of research practices and an opportunity for opt-out, provided that the IRB finds and documents that:

1. If the storage, maintenance, or secondary research use is likely to be offensive to a fundamental belief of the subject population, or is designed to produce results inimical to its best interests, then the IRB must consider and impose appropriate safeguards, protections, and conditions, if applicable, to ameliorate any risk of dignitary harms that could be posed to the subject population by the approved protocol;
2. Research could not be conducted with other reasonably available identified data for which notice of research practices and opportunity for opt-out have been provided;
3.  The storage, maintenance, and secondary research use procedures are consistent with sound research design;
4. An institution’s failure to offer notice and opportunity for opt-out was reasonably justified; and
5. If an individual is provided notice of research practices and an opportunity for opt-out, and elects to opt-out, an IRB cannot waive the requirement that no identified data from an individual who opted-out may be used, or otherwise made available, for the proposed de-identified biospecimen research practices. 

Respond to Requests for Summaries of Approved Waivers

SACHRP encourages making IRB grants of waiver of consent (or grants of waiver of notice and opportunity for opt-out) for research involving identified biospecimens or identified data more transparent to the general public.  In implementing this proposal, HHS should balance research participants’ interest in understanding generally under what conditions a specific IRB has waived consent for research, and instituting a workable federal mandate or recommended “best practice” with which institutions and IRBs can comply without expending substantial resources.  One possible method of accomplishing the objective could be that investigators who seek a waiver provide a one paragraph abstract to the IRB, which would be posted to the institution’s public website.  

Transition Provisions

SACHRP recommends that prior collections of biospecimens and identifiable information continue to be available for secondary research use, provided that adequate and appropriate human subject protections are in effect.  Thus, SACHRP recommends that the NPRM delete the requirement that the secondary research use of prior collected biospecimens occur only after removal of any individually identifiable information associated with the biospecimens (§_.101(k)(2)(ii)).  Instead, SACHRP recommends that any final rule grandfather identifiable biospecimens, if collected with IRB review and either informed consent or waived consent, with any future secondary research use to be regulated under the Common Rule requirements in effect at the time of collection.

The NPRM Proposal on Exclusions and Exemptions

One substantial class of proposals in the NPRM is the creation of a new category in the regulations referred to as “exclusions,” accompanied by significant changes to the current exempt categories.  This section of the SACHRP recommendation addresses the proposed exclusions and exemptions item by item.  However, SACHRP has elsewhere recommended significant changes to the proposals in the NPRM regarding identified and de-identified biospecimens and identified and de-identified data.  If SACHRP’s recommendations regarding biospecimens and data are accepted by the government and implemented in the final rule, then some of the recommendations below would need to be modified to adopt to that revised framework.  It is SACHRP’s intent that if the broader SACHRP recommendations regarding biospecimens and data are adopted, then these recommendations regarding exclusions and exemptions should be considered to be subservient and modified as necessary to meet the recommendations on biospecimens and data.  To the extent that the broader proposals on biospecimens and data are not adopted in the final rule, or do not affect these recommendations on exclusions and exemptions, then these recommendations on exclusions and exemptions represent SACHRP’s thinking.

SACHRP notes that the agencies should consider whether the definition of “intervention” is consistent throughout the NPRM, including the proposed exclusions and exemptions.

Exclusions

The NPRM creates a new section in the regulations referred to as “exclusions.” This section outlines eleven specific types of activities that will be outside the scope of the regulations. These activities will therefore not have to satisfy any regulatory requirements, nor is it expected (unlike exempt research) that they will undergo any type of review process to determine this status.  It is also not expected that the decision that a project fits an excluded category will be documented. 

SACHRP believes that some of the proposed exclusions are acceptable as drafted.  These will be listed together.  SACHRP believes that other proposed exclusions should have revisions to the language.  These will be listed together.  SACHRP recommends that some of the proposed exclusions are not appropriate and should not be adopted.  These will also be listed as a group.  Finally, SACHRP believes it does not have sufficient expertise to comment on one proposed exclusion, and this will be listed separately.  Please note that this section of the SACHRP commentary will not address exclusion .101(b)(3)(i) as it primarily involves biospecimens, and thus is addressed in that section of the SACHRP recommendation.

Exclusions that are acceptable as proposed in the NPRM

Exclusion .101(b)(1)(iii)

Exclusion .101(b)(1)(iii) applies to “Collection and analysis of data, biospecimens, or records by or for a criminal justice agency for activities authorized by law or court order solely for criminal justice or criminal investigative purposes.”

Exclusion .101(b)(1)(v)

Exclusion .101(b)(1)(v) applies to “Public health surveillance activities, including the collection and testing of biospecimens, conducted, supported, requested, ordered, required, or authorized by a public health authority and limited to those necessary to allow the public health authority to identify, monitor, assess, or investigate potential public health signals or the onset of a disease outbreak, including trends, or signals, and patterns in diseases, or a sudden increase in injuries from using a consumer product, or conditions of public health importance, from data, and including those associated with providing timely situational awareness and priority setting during the course of an event or crisis that threatens public health, including natural or man-made disasters.”

Exclusions with proposed modifications

Exclusion .101(b)(1)(i)

Exclusion .101(b)(1)(i) applies to “data collection and analysis, including the use of biospecimens, for an institution’s own internal operational monitoring and program improvement purposes, if the data collection and analysis is limited to the use of data or biospecimens originally collected for any purpose other than the currently proposed activity, or is obtained through oral or written communications with individuals (e.g., surveys or interviews).” 

SACHRP recommends that this exclusion be adopted with the following revision noted in italicized underlining (addition of “and quality”) to ensure that the concept of quality improvement is clearly included in this exclusion:

“Data collection and analysis, including the use of biospecimens, for an-institution’s own internal operational monitoring and program and quality improvement purposes, if the data collection and analysis is limited to the use of data or biospecimens originally collected for any purpose other than the currently proposed activity, or is obtained through oral or written communications with individuals (e.g., surveys or interviews).”

Exclusion .101(b)(1)(ii)

Exclusion .101(b)(1)(ii) applies to “Oral history, journalism, biography, and historical scholarship activities that focus directly on the specific individuals about whom the information is collected.”

SACHRP recommends that this exclusion be modified to more clearly emphasize that the nature and purpose of the activity warrant the exclusion, not the academic discipline of the investigator.  SACHRP is concerned that as currently written, it could be interpreted to mean that these four academic disciplines are completely excluded, because “activities that focus directly on the specific individuals about whom the information is collected” could be misinterpreted as a description of these disciplines rather than an added qualifier limiting the extent of the exclusion.  SACHRP believes that the NPRM proposal comments were supportive of the view that these academic disciplines are not completely exempt.  However, it should be more clearly stated in the exclusion itself, or in the preamble to the final rule, or in guidance.  To that end, SACHRP recommends that the exclusion language be modified to state:

“Oral history, journalism, biography, historical, and other scholarship activities whose purpose is to collect and share evidence-based portrayals of specific individuals who have been selected as a result of the relevance of their personal experience to the phenomena being studied.” 

Exclusion .101(b)(1)(iv)

Exclusion .101(b)(1)(iv) applies to “Quality assurance or improvement activities involving the implementation of an accepted practice to improve the delivery or quality of care or services (including, but not limited to, education, training, and changing procedures related to care or services) if the purposes are limited to altering the utilization of the accepted practice and collecting data or biospecimens to evaluate the effects on the utilization of the practice. This exclusion does not cover the evaluation of an accepted practice itself.”

SACHRP recommends that this exclusion be modified to provide greater clarity regarding the types of activities that meet and do not meet this exclusion due to concern the proposed wording will be interpreted in too restrictive a fashion regarding the collection of data that could lend itself to “evaluation of an accepted practice itself.” 

SACHRP recommends that the current OHRP FAQ’s on Quality Improvement activities be left as they currently exist on the OHRP website to continue to provide guidance. 

Exclusion .101(b)(2)(ii)

Exclusion .101(b)(2)(ii) applies to “Research involving the collection or study of information that has been or will be acquired solely for non-research activities or were acquired for research studies other than the proposed research study, when either of the following two criteria is met:

(A) These sources are publicly available, or

(B) The information is recorded by the investigator in such a manner that human subjects cannot be identified, directly or through identifiers linked to the subjects, the investigator does not contact the subjects, and the investigator will not re-identify subjects or otherwise conduct an analysis that could lead to creating identifiable private information.”

SACHRP recommends that this exclusion be limited to section (A) only, when the “sources are publicly available.”  SACHRP recommends that the class of research in section (B) be moved to the exempt category for several reasons. SACHRP believes that classifying this type of human subject research as exempt provides better conceptual clarity about the distinction between exclusions and exemptions.  Also, SACHRP believes the exemption process will assist investigators in interpretation of the regulatory requirements. 

Exclusions that should not be adopted

Exclusion .101(b)(2)(i)

Exclusion .101(b)(2)(i) applies to ““Research, not including interventions, that involves the use of educational tests (cognitive, diagnostic, aptitude, achievement), survey procedures, interview procedures, or observation of public behavior (including visual or auditory recording) uninfluenced by the investigators, if at least one of the following criteria is met:

(A) The information is recorded by the investigator in such a manner that human subjects cannot be identified, directly or through identifiers linked to the subjects;

(B) Any disclosure of the human subjects’ responses outside the research would not reasonably place the subjects at risk of criminal or civil liability or be damaging to the subjects’ financial standing, employability, educational advancement, or reputation; or

(C) The research will involve a collection of information subject to the Paperwork Reduction Act of 1995, 44 U.S.C. 3501 et seq.; research information will be maintained on information technology that is subject to and in compliance with section 208(b) of the E-Government Act of 2002, 44 U.S.C. 3501 note; and all of the information collected, used, or generated as part of the research will be maintained in a system or systems of records subject to the Privacy Act of 1974, 5 U.S.C. 552a.”

SACHRP recommends that this class of research be moved to the exempt category for several reasons.  SACHRP believes that classifying these types of human subject research as exempt provides better conceptual clarity about the distinction between exclusions and exemptions.  SACHRP also notes in regard to the cited alternative laws and regulations providing privacy and confidentiality protections that there may be issues involved beyond privacy and confidentiality concerns.  Finally, SACHRP believes the exemption process will assist investigators in interpretation of the regulatory requirements. 

Exclusion .101(b)(2)(iii)

Exclusion .101(b)(2)(iii) applies to “Research conducted by a Federal department or agency using government-generated or government-collected information obtained for non-research purposes (including criminal history data), if the information originally involved a collection of information subject to the Paperwork Reduction Act of 1995, 44 U.S.C. 3501 et seq.; the information is maintained on information technology that is subject to and in compliance with section 208(b) of the Government Act of 2002, 44 U.S.C. 3501 note; and all of the information collected, used, or generated as part of the research is maintained in a system or systems of records subject to the Privacy Act of 1974, 5 U.S.C. 552a.”

SACHRP recommends that this class of research be moved to the exempt category.  SACHRP believes that classifying these types of human subject research as exempt provides better conceptual clarity about the distinction between exclusions and exemptions.  SACHRP also notes in regard to the cited alternative laws and regulations providing privacy and confidentiality protections that there may be issues involved beyond privacy and confidentiality concerns.  Finally, SACHRP believes the exemption process will assist investigators in interpretation of the regulatory requirements. 

Exclusion .101(b)(2)(iv)

Exclusion .101(b)(2)(iv) applies to “Research as defined by this policy that involves only data collection and analysis involving the recipient’s use of identifiable health information when such use is regulated under 45 CFR parts 160 and 164, subparts A and E, for the purposes of “health care operations” or “research” as those terms are defined at 45 CFR 164.501 or for the purpose of “public health activities” as described under 45 CFR 164.512(b).”

SACHRP recommends that this class of research be moved to the exempt category for several reasons.  SACHRP believes that classifying these types of human subject research as exempt provides better conceptual clarity about the distinction between exclusions and exemptions.  SACHRP believes that 45 CFR parts 160 and 164 (HIPAA) does not supply sufficient safeguards against research risks other than privacy and confidentiality, and therefore subjects could face psychological distress or have their information used in research they would not agree with and that under an exemption process would not be allowed to proceed for those types of reasons.  Finally, SACHRP believes the exemption process will assist investigators in interpretation of the regulatory requirements. 

Exclusions which SACHRP has insufficient expertise to address

Exclusion .101(b)(1)(vi)

Exclusion .101(b)(1)(vi) applies to “Surveys, interviews, surveillance activities and related analyses, or the collection and use of biospecimens conducted by a defense, national security, or homeland security authority solely for authorized intelligence, homeland security, defense, or other national security purposes.”

SACHRP notes there is public concern about this proposed exclusion, but SACHRP does not have the expertise to provide commentary. SACHRP encourages additional public justification for and description of this exclusion.

Exemptions

The NPRM proposes three classes of exemptions.  The exemptions in 104(d) are low-risk interventions that do not require application of standards for information and biospecimen protection.  The exemptions in .104(e) are research that may involve sensitive information, and therefore require application of standards for information protection described in proposed §__.105.  Finally, the third class of exemptions at .104(f) are secondary research involving biospecimens and identifiable private information that requires application of privacy safeguards discussed at proposed §__.105, broad consent as discussed in proposed §__.116(c), and limited IRB review as discussed in proposed §__.111(a)(9). 

SACHRP believes most of the proposed exemptions are acceptable as drafted.  SACHRP does provide some limited comments on some of them.  SACHRP believes it does not have sufficient expertise to comment on one proposed exemption, and this will be listed separately.  This section of SACHRP’ recommendation does not address exemption .104(f) as it primarily involves biospecimens, which are addressed separately.

Exemptions that are acceptable as proposed in the NPRM

Exemption Decision Tool - .104(c)

Section .104(c) of the proposed new exemption categories addresses an exemption decision tool that the agencies shall develop to assist in exemption determinations.   Exemption determinations shall be made by an individual who is knowledgeable about the exemption categories and who has access to sufficient information to make an informed and reasonable determination, or by the investigator or another individual at the institution who enters accurate information about the proposed research into the decision tool, which will provide a determination as to whether the study is exempt.  If the decision tool is used, further assessment or evaluation of the exemption determination is not required.  An institution or, when appropriate, the IRB, must maintain records of exemption determinations.  These records must include, at a minimum, the name of the research study, the name of the investigator, and the exemption category applied to the research study.  Maintenance of the completed decision tool shall be considered to fulfill this recordkeeping requirement.

SACHRP supports the creation and use of an exemption decision tool assuming it is effective and reduces administrative burden. , However, it is difficult to opine on a tool that has not been created. 

Exemption .104(d)(1)

Exemption .104(d)(1) applies to “Research conducted in established or commonly accepted educational settings when it specifically involves normal educational practices. This includes most research on regular and special education instructional strategies, and research on the effectiveness of or the comparison among instructional techniques, curricula, or classroom management methods that are not likely to adversely impact students’ opportunity to learn required educational content in that educational setting or the assessment of educators who provide instruction.”

Exemption .104(d)(3)

Exemption .104(d)(3) applies to;

“(i)Research involving benign interventions in conjunction with the collection of data from an adult subject through verbal or written responses (including data entry) or video recording if the subject prospectively agrees to the intervention and data collection and at least one of the following criteria is met:

(A) The information obtained is recorded in such a manner that human subjects cannot be identified directly or through identifiers linked to the subjects; or

(B) Any disclosure of the human subjects’ responses outside the research would not reasonably place the subjects at risk of criminal or civil liability or be damaging to the subjects’ financial standing, employability, educational advancement, or reputation.

(ii) For the purpose of this provision, benign interventions are brief in duration, harmless, painless, not physically invasive, not likely to have a significant adverse lasting impact on the subjects, and the investigator has no reason to think the subjects will find the interventions offensive or embarrassing.  If these criteria are met, such benign interventions might include research activities in which a subject is asked to read materials, review pictures or videos, play online games, solve puzzles, or perform cognitive tasks.

(iii) If the research involves deceiving the subjects regarding the nature or purposes of the research, this exemption is not applicable unless the subject authorizes the deception as described in paragraph (d)(3)(iv) of this section.

(iv) For the purpose of this provision, authorized deception is prospective agreement by the subject to participate in research where the subject is informed that he or she will be unaware of or misled regarding the nature or purposes of the research.”

Exemption .104(d)(4)

Exemption .104(d)(4) applies to “Taste and food quality evaluation and consumer acceptance studies

(i) If wholesome foods without additives are consumed, or

(ii) If a food is consumed that contains a food ingredient at or below the level and for a use found to be safe, or agricultural chemical or environmental contaminant at or below the level found to be safe, by the Food and Drug Administration or approved by the Environmental Protection Agency or the Food Safety and Inspection Service of the U.S. Department of Agriculture.”

Exemption .104(e)(1)

Exemption .104(e)(1) applies to “research, not including interventions, involving the use of educational tests (cognitive, diagnostic, aptitude, achievement), survey procedures, interview procedures, or observation of public behavior (including visual or auditory recording), if the information obtained is recorded in such a manner that human subjects can be identified directly or through identifiers linked to the subjects.”

Exemption .104(e)(2)

Exemption .104(e)(2) applies to “Secondary research use of identifiable private information that has been or will be acquired for non-research purposes, if the following criteria are met:

(i) Prior notice has been given to the individuals to whom the identifiable private information pertains that such information may be used in research; and

(ii) The identifiable private information is used only for purposes of the specific research for which the investigator or recipient entity requested access to the information.”

SACHRP support this exemption, but believes that further discussion of the “notice” requirement is warranted.

Exemptions with proposed modifications

None.

Exemptions that should not be adopted

None.

Exemptions which SACHRP has insufficient expertise to address

Exemption .104(d)(2)

Exemption .104(d)(2) applies to “Research and demonstration projects that are conducted or supported by a Federal department or agency, or otherwise subject to the approval of department or agency heads, and that are designed to study, evaluate, or otherwise examine public benefit or service programs, including procedures for obtaining benefits or services under those programs, possible changes in or alternatives to those programs or procedures, or possible changes in methods or levels of payment for benefits or services under those programs.

(i) Each Federal department or agency conducting or supporting the research and demonstration projects must establish, on a publicly accessible federal Web site or in a similar manner, a list of the research and demonstration projects that the Federal department or agency conducts or supports under this provision. The research or demonstration project must be published on this list prior to or upon commencement of the research.”

SACHRP does not feel it has sufficient expertise or familiarity with this class of research to provide substantive commentary.  SACHRP notes that it supports the public posting included in section (i). 

Proposed NPRM Changes to the Content and Format of Informed Consent Documents

The NPRM would require that the main consent document could only include the elements of consent that were required by the rule, with any other information included in an appendix. This is intended to lead to substantially shorter consent forms, with prospective subjects receiving the most important information in the body of these relatively short forms, instead of that key information being buried in a long and overly complex document.   In addition, the preamble to the NPRM proposes that informed consent forms be written in language understandable to the subject in a manner consistent with Federal Plain Language guidelines and the Federal Plain Writing Act of 2010.

In addition, the NPRM proposes that if a HIPAA authorization is combined with a consent form, the authorization elements required by 45 CFR 164.508 must be included in the consent document and not the appendices.

SACHRP supports a goal of informed consent language that is generally consistent with the language in the Federal Plain Language guidelines and the separation of information into a consent form that is limited to the information required at §__.116 and an appendix.  SACHRP also recommends that OHRP develop guidance on implementation of the appendix, including the IRB’s role in evaluating the nature and volume of information included in the appendix.

Elements of Consent

The new basic element of consent at §__.116(a)(9) would apply to all research collecting identifiable private information. Based on the investigator’s plans, the informed consent form and process would need to inform subjects either that: (1) identifiers might be removed from the data and that the non-identified data could be used for future research studies or distributed to another investigator for future research studies without additional informed consent from the subject or the representative, if this might be a possibility; or (2) the subject’s data collected as part of the research would not be used or distributed for future research studies, even in a non-identified form. This proposed additional element of informed consent is intended to create greater transparency and enable prospective research subjects to make a more informed decision about whether to participate in research.

The NPRM also proposes adding three additional elements of consent at §__.116(b)(7)-(9) that, when appropriate, would be required to be included in the informed consent form and process. These three additional elements of consent all pertain to issues that have become more relevant in recent years as science has advanced and the nature of research has changed. The proposed new element at §__.116(b)(7) would require that prospective subjects be informed that their biospecimens may be used for commercial profit and whether the subject will or will not share in this commercial profit. The proposed new element at §__.116(b)(8) would require that prospective subjects be informed of whether clinically relevant research results, including individual research results, will be disclosed to subjects, and if so, under what conditions. The proposed new element at §__.116(b)(9) would provide subjects or their legally authorized representatives with an option to consent, or refuse to consent, to investigators re-contacting the subject to seek additional information or biospecimens or to discuss participation in another research study.

SACHRP continues to endorse its prior recommendations on revision to the elements of informed consent.  SACHRP supports the proposed changes, as they address gaps in the current regulations, with the exception of the proposed new additional element at §__.116(b)(9). 

SACHRP recommends the following modifications to the proposed language:

§__.116(b)(7) would require that prospective subjects be informed that their biospecimens may be used for the development of commercial products and whether the subject will or will not share in any revenue from the commercial product

§__.116(b)(8) would require that prospective subjects be informed of whether research results, including individual research results, will be disclosed to subjects, and if so, under what conditions

§__.116(b)(9) would provide subjects or their legally authorized representatives information about whether investigators might re-contact the subject for other purposes (e.g., to seek additional information or to discuss participation in another research study) or offer an option to refuse re-contact.

Proposed Changes in the NPRM for Posting of Consent Forms for Common Rule Agency-Supported Clinical Trials (NPRM at §__.116(h))

The NPRM proposes a new provision at §__.116(h)(1) that would require that a copy of the final version of the consent form (absent any signatures) for each clinical trial conducted or supported by a Common Rule department or agency be posted on a publicly available federal website that will be established as a searchable repository for such consent forms. The name of the protocol and contact information would be required to be included with the submission of the consent form. The primary purpose of this provision is to improve the quality of consent forms in federally funded research by assuring that they would become subject to public scrutiny.

Under proposed §__.116(h)(2), the consent form must be published on the website within 60 days after the trial is closed for recruitment. By final consent form, it is anticipated that investigators generally will post the version of the consent form that had been most recently approved by an IRB. Note that even though a newer consent form could be developed after the timeframe specified here, investigators would only be required to post one consent form. Thus, even if a modification to a consent form occurs after it has been posted, investigators would not be required to re-post an updated document. Moreover, only one posting would be required for each multi-site study. There is no expectation that a version would need to be posted for each study site.

SACHRP supports greater transparency with the American public regarding research and measures that will lead to better informed consent documents. 

In general, SACHRP endorses a requirement for posting consent forms, but recommends strongly that OHRP develop robust guidance to minimize confusion about implementation of the rule, reduce the risk that posted consent forms will be misunderstood or misused, and maximize the ability of investigators, institutions, and regulators to review posted consent forms in order to learn and improve the consent form and process.  In multisite studies it will be necessary for the research leadership to ensure that the requirements are met.  SACHRP recommends that IRBs not be responsible for enforcement of this requirement.  SACHRP also recommends that HHS consider ClinicalTrials.gov as the repository for these forms.

Proposed Changes in the NPRM Related to Continuing Review of Research (NPRM at §__.109(f); current Rule at §__.109(e))

The NPRM proposes eliminating continuing review for many minimal risk studies (namely those that qualify for expedited review), unless the reviewer documents why continuing review should take place. Moreover, for studies initially reviewed by a convened IRB, continuing review would not be required, unless specifically mandated by the IRB, after the study reaches the stage where it involves one or both of the following: (1) analyzing data (even if it is identifiable private information), or (2) accessing follow-up clinical data from procedures that subjects would undergo as part of standard care for their medical condition or disease.

In addition, continuing review would not be required for research involving certain secondary research using information and biospecimens that requires limited IRB review in order to qualify for exemption under §__.104(f)(1).

Traditional continuing review would be eliminated for all studies that undergo expedited review.  If an IRB elects to subject such studies to continuing review, the IRB would be required to explicitly justify why continuing review would enhance protection of research subjects. For studies initially reviewed by a convened IRB, once certain specified procedures are all that remain for the study, continuing review would not be required, unless specifically mandated by the IRB. However, the NPRM proposes at §__.109(f)(2) that investigators be required to provide annual confirmation to the IRB that such research is ongoing and that no changes have been made that would require the IRB to conduct continuing review.

SACHRP recommends the elimination of continuing review for all minimal risk research.  By definition, minimal risk research means that the probability and magnitude of harm or discomfort anticipated in the research are not greater in and of themselves than those ordinarily encountered in daily life or during the performance of routine physical or psychological examinations or tests.”  If the IRB initially determines that the risks are so low as to be commensurate with daily life, then the value of continuing review as a mechanism to protect human subjects is limited.  As indicated in the proposed rule, investigators should still be required to notify the IRB of any changes to approved research and of any unanticipated problems related to the implementation of the research, and when the research is complete.   

SACHRP supports the annual confirmation requirement.  However, SACHRP recommends that OHRP issue guidance to promote a streamlined annual confirmation process.