FDA & Life Sciences Practice Group September 28, 2015 HHS Issues Proposed Rule That Would Revise the Federal Policy for the Protection of Human Subjects Proposals are Intended to Enhance Protections for Higher Risk Clinical Research and Privacy Safeguards, including Uses of Biospecimens and Identifiable Private Information On September 8, 2015, the Department of Health and Human Services (HHS) and fifteen other Federal departments and agencies collectively issued in the Federal Register1 a notice of proposed rulemaking (NPRM) that would extensively revise the Federal Policy for the Protection of Human Subjects, which is also known as the Common Rule (the Policy). Among the proposed changes in the NPRM are modifications to: (1) exclusions and exemptions from the Policy; (2) conduct and functions of institutional review boards (IRBs); including expedited review and waivers of informed consent; and (3) requirements for institutions engaged in research conducted or supported by a Federal department or agency. This client alert focuses on only those proposed changes that are likely to have the greatest potential impact on the conduct of human biomedical and behavioral research in the United States, if adopted in the final rule. Overall, the NPRM aims to achieve several important goals, including (1) making it easier to enroll certain human subjects in clinical research; (2) allowing for informed consent to focus not just on the immediate human investigation, but also on how biospecimens and data may be used for future efforts, even if those efforts are not known at the time of the consent; (3) streamlining the consent process and expanding categories of exempt research to relieve certain burdens on IRBs; and (4) achieving these benefits while also ensuring more stringent protection of patient information and biospecimens. Comments on the proposed revision of the Common Rule must be submitted to the docket by December 7, 2015. 2 Background and Overview The Policy was first promulgated as a Common Rule by fifteen Federal departments and agencies on June 18, 19913 ; at that time, the Food and Drug Administration (FDA) also issued a final rule4 to amend its regulations on For more information, contact: Beverly H. Lorell, MD +1 202 383 8937 firstname.lastname@example.org Christina Markus +1 202 626 2926 email@example.com Elaine Tseng +1 415 318 1240 firstname.lastname@example.org Seth Lundy +1 202 626 2924 email@example.com King & Spalding Washington 1700 Pennsylvania Avenue, NW Washington, D.C. 20006-4707 Tel: +1 202 737 0500 Fax: +1 202 626 3737 San Francisco 101 Second Street, Suite 2300 San Francisco, CA 94105-3664 Tel: +1 415 318 1200 Fax: +1 415 318 1300 www.kslaw.com 2 of 7 informed consent and IRBs to conform to the Common Rule as closely as possible under different statutory authorities. Although FDA has not yet issued a proposed rule to amend its current regulations for the protection of human subjects to harmonize with the proposed changes in the Common Rule, we anticipate that FDA will do so since HHS and FDA have shared a common framework for the protection of human subjects since 1981, based on the foundational ethical principles of the Belmont Report.5 This new NPRM follows an advanced notice of proposed rulemaking (ANPRM) that was issued on July 26, 2011 by HHS, in coordination with the President’s Office of Science and Technology Policy, seeking public comment on how current regulations might be modernized to better protect human subjects while facilitating research and reducing burden, delay, and ambiguity for investigators. The preamble to the NPRM emphasizes that clinical research has continued to rapidly evolve since the ANPRM due to larger and more complex clinical studies, the expansion of multi-site clinical trials, and the expectation by patients for a more participatory and transparent research model. In addition, the NPRM preamble highlights the explosive advances in analytics for genomic data as well as computational analysis of large public databases, raising the potential for identifying individuals from biospecimens and other information from which direct identifiers have been removed. These considerations shape the proposed major revisions to the Common Rule, including the provision of a new regulatory paradigm for research uses of biospecimens and identifiable personal information, as well as a shift to a more risk-based regulatory framework for the informed consent process and IRB oversight. We discuss these important proposed changes below in turn. Extension of Coverage of the Common Rule to All Clinical Trials (With Exceptions) The Common Rule currently covers human subjects research not explicitly excluded or exempt from the Policy that is conducted or supported by certain Federal agencies and departments, including the National Institutes of Health (NIH). All institutions in the United States that engage in federally-conducted or -supported human subjects research are required to hold a Federalwide Assurance (FWA) approved by the Office of Human Research Protections (OHRP); via the FWA, an institution may voluntarily extend the applicability of the Common Rule to all human subjects research conducted at the institution (not limited to the federally-conducted or -supported research). The NPRM would require that all clinical trials be covered by the Common Rule “if conducted at an institution in the United States that received Federal support for non-exempt and non-excluded human subjects research, regardless of the funding source of the specific clinical trial.” Clinical trials subject to FDA regulation would be excluded. For purposes of the revised Policy, “clinical trial” is defined as “a research study in which one or more human subjects are prospectively assigned to one or more interventions (which may include placebo or other control) to evaluate the effects of the interventions on biomedical or behavioral health outcomes.” New Requirements for Research Using Biospecimens and Identifiable Private Information In the NPRM, extensive new standards are proposed to facilitate the collection and use of biological specimens (biospecimens) and other collected information for research purposes. At the same time, there is emphasis on the protection of human subjects from informational harm that may potentially occur consequent to participation in biomedical or behavioral research that uses biospecimens and/or identifiable private information. Among the proposed revisions are: • Revision of the definition of human subject. The NPRM would expand the definition of “human subject” to mean a living individual about whom an investigator conducting research “obtains, uses, studies, or analyzes biospecimens,” regardless of whether or not the human subject that is the source of the biospecimen is identifiable. For the purposes of this definition, there is a presumption that any biospecimen may potentially be “identifiable” (i.e., linked to a specific person), and the definition does not distinguish biospecimens that were initially obtained for clinical purposes from those initially obtained for research. Thus, the procurement, storage, 3 of 7 or analysis of human biospecimens for research purposes would be explicitly covered under the Common Rule with only limited exclusion for research that is designed “to only generate information about the person that is already known” – such as the development of a diagnostic test for a condition using biospecimens from individuals already known to have the condition and those known not to have the condition. • Broad consent for secondary research using biospecimens and identifiable private information. The NPRM would establish an entirely new type of informed consent: human subjects would be permitted to provide broad consent for future, unspecified research (secondary research) using biospecimens and identifiable private information that involves the (1) storage and maintenance and/or (2) use of such materials in future research. Identifiable private information is defined as “private information that is individually identifiable (i.e., the identity of the subject is or may readily be ascertained by the investigator or associated with the information)”; however, biospecimen is not defined. The preamble emphasizes that waiver of informed consent for specified or future, unspecified biospecimen research, regardless of identifiability, would occur only in very rare circumstances. However, broad consent for secondary research would exempt the investigator from having to obtain further informed consent for each specific future use of these materials (unless the investigator anticipates that individual results will be provided to a research subject). The NPRM also would require HHS to publish standard templates for human subjects to provide broad consent to the future, unspecified research uses of biospecimens and/or identifiable private information. In addition, the NPRM would prohibit an IRB from waiving the consent requirement for future unspecified uses of biospecimens or identifiable private information with respect to individuals who had been asked, and refused, to provide broad consent. • New mandatory elements of informed consent specific to broad consent. If a subject is asked to provide broad consent for future, unspecified research using biospecimens or identifiable private information, specific information would be required in the informed consent document, including (i) a statement that the subject may withdraw consent, if feasible, for research use or distribution of the subject’s biospecimens or information at any time without penalty, and (ii) information about whom to contact in order to withdraw consent. At the same time, “[t]he statement must make clear that information or biospecimens that already have been distributed for research use may not be retrieved.” Under the NPRM, the following new mandatory elements would also need to be included for broad consent: (1) a general description of the types of research that may be conducted; (2) the scope of the broad consent, including the types of biospecimens or information that were or will be collected (e.g., all biospecimens and information from the subject’s medical record existing at the institution at the time the broad consent is sought); (3) the period of time during which biospecimen or information collection will occur6 ; (4) the period of time during which an investigator can continue to conduct research using the collected biospecimens or information (which can be unlimited); (5) if applicable, a statement that the subject will not be informed of the details of the specific future research studies that might be conducted, including the purpose of the research; (6) if applicable, a statement that the subject’s information and biospecimens are likely to be used by multiple investigators and institutions, and might be identifiable when shared; and (7) the names of the institutions where the subject’s biospecimens or information were or will be collected. In the case of publicly accessible databases such as registries, the NPRM would require that the subject be notified of the option to consent to the inclusion of the subject’s biospecimen or other data, with the removal of identifiers, and include a “description of risks of public access to the data.” • Safeguards: Protection of biospecimens and identifiable private information. The NPRM would implement new standard safeguards to reasonably protect biospecimens and identifiable private information against 4 of 7 anticipated threats to their security and integrity, as well as intentional or unintentional use, release, or disclosure in violation of the Policy. The NPRM preamble discloses that a purpose of this proposal is to relieve IRBs from their current obligation to review privacy safeguards that are specific to individual clinical studies. Under the NPRM, the Secretary of HHS would establish and publish for public comment a list of specific measures that an institution or investigator could implement to satisfy the requirement for “reasonable and appropriate” safeguards. The list would be updated at least every 8 years. Alternatively, if an institution or investigator is currently required, or chooses, to comply with the Health Insurance Portability and Accountability Act (HIPAA), as amended, and implementing rules, the requirement for safeguards under the Common Rule would be satisfied. Further, under the NPRM, unless otherwise required by law, institutions and investigators would only be allowed to use or release biospecimens or disclose personal identifiable private information for research purposes to other parties for the following four purposes: (1) human subjects research regulated by this policy; (2) public health purposes; (3) any lawful purpose with the consent of the subject; or (4) other research purposes if the investigator or institution obtains “adequate assurances” from the recipient that the recipient will implement the level of safeguards required by this policy, obtains documentation from the recipient that the research has been approved by an IRB using this policy’s criteria for approval; and the recipient shall not further release the biospecimens or disclose identifiable private information except for one of these four purposes. Revision of the Informed Consent Document and Documentation of Consent The NPRM aims to strengthen human subjects protections for higher risk research while at the same time making the informed consent document less lengthy with a focus on “essential information that a reasonable person would want to know in order to make an informed decision about whether to participate” in the research. To this end, the NPRM would require that the consent document first provide the essential information; specifically, the general requirements for informed consent. These general requirements would continue to include the current prohibition against the inclusion of exculpatory language through which the subject is made to waive or appear to waive any of the subject’s legal rights, or releases or appears to release the investigator, sponsor, institution, or its agents from liability for negligence. Further additional information, if any, to be provided to the subjects outside of the general requirements would be included in an appendix to the consent document. • Expansion of the basic elements of informed consent. Under existing Common Rule’s general requirements for informed consent, there are eight mandatory Basic elements of informed consent that must be presented to each subject. The NPRM would add a new mandatory element for research that involves the collection of identifiable private information, namely, the inclusion of either of the following statements that: (1) identifiers might be removed from the data, and the data that are not identifiable could be used for future research studies or distributed to another investigator for future research studies without additional informed consent from the subject, if this might be a possibility, or (2) the subject’s data collected as part of the research, from which identifiers are removed, will not be used or distributed for future research studies. In addition, if a HIPAA authorization were to be combined with the consent document, the authorization elements would be considered to be required elements of consent and could not be provided as an appendix. Notably, although the preamble identifies, as a source of excessively lengthy consent documents, the current mandatory requirement for the “description of any reasonably foreseeable risks or discomforts to the subject,” the NPRM itself fails to modify or clarify the meaning of this problematic element. 5 of 7 • Additional elements of informed consent. Under the current rule, there are six “additional elements of informed consent” that, when appropriate, must be provided to each subject. The NPRM would add three new additional elements of informed consent, to be provided when appropriate: (1) a statement that the subject’s biospecimens may be used for commercial profit and whether the subject will or will not share in this commercial profit; (2) a statement regarding whether clinically relevant research results, including individual research results, will be disclosed to subjects, and if so, under what conditions; and (3) an option for the subject to consent, or refuse to consent, to investigators re-contacting the subject to seek additional biospecimens or information, or to discuss participation in another study. • Documentation of informed consent. The NPRM would retain the requirements for documentation using either written informed consent by the subject or his legally authorized representative, or signing of the “short form” stating that the required elements have been presented orally, in which case the IRB must approved the written summary of what is said to the subject or representative and the oral presentation must be witnessed. The NPRM, however, would modify these current requirements by specifying that such documentation of informed consent pertains only to the information required under the general requirements for informed consent, not any appendices that may be attached to the consent document. In addition to the current regulatory conditions in which an IRB may choose to waive the requirements for written consent from some or all subjects, the NPRM would also allow the IRB to waive the requirement for a signed consent form if the subjects are “members of a distinct cultural group or community in which signing forms is not the norm,” the research presents no more than minimal risk of harm, and there is an appropriate alternative mechanism for documenting that informed consent was obtained. Notably, the NPRM would not impose a new requirement for some demonstration of competency by the subject or its representative in understanding the information presented in the consent process, including the information in the consent document. Cooperative Research: Use of a Single IRB for Research Conducted at Multiple Sites The NPRM would require for the first time that any institution located in the United States that is engaged in a human research project covered by the Policy that involves more than one institution (i.e., cooperative research) must rely upon review and approval by a single IRB for that portion of the research that is conducted in the United States. If the research project were conducted or supported by a Federal department or agency, that entity would select the single IRB to conduct initial and continuing review of the multi-site research project; otherwise, the single IRB would be selected by the “lead institution conducting the research.” Each institution participating in the multi-site research would continue to be responsible for safeguarding the rights and welfare of human subjects engaged in research at the institution. Only two types of multi-site research conducted in the United States would not be subject to these requirements: (1) cooperative research for which more than single IRB review is required by law; or (2) research for which the Federal department or agency conducting or supporting the research determines that use of a single IRB is not appropriate for the particular study. As an example of the first exclusion from this proposed requirement, there is a statutory barrier in the Federal Food, Drug, and Cosmetic Act that precludes the use of a single IRB of record in FDA-regulated multi-site medical device human investigations, unless a local IRB does not exist or its review is determined to be inadequate.7 A separate but related proposed change would address the situation where research is conducted at an institution with a Federalwide Assurance (FWA), but an IRB with oversight over the research is not operated by or affiliated with the institution (e.g., a central IRB). Under current OHRP practices of enforcement, the institution carrying out the research is held accountable for compliance violations that are directly related to actions by the unaffiliated IRB. Under the NPRM, OHRP would directly enforce compliance violations against an unaffiliated IRB, rather than 6 of 7 through the institution conducting the research. In addition, the institution conducting the research and the organization operating the unaffiliated IRB would be required to establish and follow procedures for documenting the institution’s reliance on the IRB for oversight of the research and the separate responsibilities of each entity for ensuring compliance with the requirements of the rule. Effective and Compliance Dates The NPRM preamble anticipates that the effective date of the final rule would be one year after publication in the Federal Register. The compliance date would also be one year after the publication of the final rule, with two exceptions for which institutions would have longer than one year to comply: (1) the requirement for the Common Rule to cover all biospecimens; and (2) the requirement for identification of a single IRB for review of certain multisite clinical trials. (It is not clear how informed consents that are already in place for human investigations underway might be affected.) Considerations for Manufacturers and Healthcare Institutions that Conduct Human Research Sponsors of research involving human subjects, including manufacturers of pharmaceutical products and medical devices, and investigators and research institutions, should carefully review the NPRM, including the key proposed changes cited in this client alert. Although a proposed rule has not yet been issued by FDA for the purpose of modifying its regulations for protection of human subjects, it is likely that FDA will modify its regulations to conform, where possible, to the final amended Common Rule because this has previously occurred. In addition, many postmarket studies of FDA-regulated products that are conducted by manufacturers or supported as investigator-initiated studies, which are not subject to FDA requirements for an Investigational New Drug (IND) or Investigational Device Exemption (IDE), will continue to be covered by the Common Rule. Institutions that conduct human research under an OHRP-approved FWA will identify many proposed changes that would affect the conduct of human research at their institutions. Although some proposed changes would simplify the review and oversight of research by the institution and its affiliated IRB, some proposed changes, such as the extensive new requirements related to specified and future, unspecified research using biospecimens and identifiable private information, would likely require major changes in research oversight by IRBs and the conduct of investigators. Healthcare institutions may also wish to consider the proposal to require the use of a single reviewing IRB for multi-site clinical research and whether this would potentially limit or enhance local oversight over the conduct of research at the institution. King & Spalding would be pleased to assist in preparing comments for posting to the public docket. Celebrating more than 130 years of service, King & Spalding is an international law firm that represents a broad array of clients, including half of the Fortune Global 100, with 900 lawyers in 18 offices in the United States, Europe, the Middle East and Asia. The firm has handled matters in over 160 countries on six continents and is consistently recognized for the results it obtains, uncompromising commitment to quality and dedication to understanding the business and culture of its clients. More information is available at www.kslaw.com. This alert provides a general summary of recent legal developments. It is not intended to be and should not be relied upon as legal advice. 1 80 Fed. Reg. 53933 (September 8, 2015). 2 Comments may be submitted electronically to the docket via the portal at http://www.hhs.gov/ohrp/humansubjects/regulations/nprmhome.html 3 56 Fed. Reg. 28003 (June 18, 1991). 4 56 Fed. Reg. 29025 (June 18, 1991). 5 The Belmont Report is accessible at http://videocast.nih.gov/pdf/ohrp_belmont_report.pdf. 7 of 7 6 For the materials initially collected for non-research purposes (i.e., clinical uses), broad consent for future, unspecified research uses would have a time limitation covering either or both: (1) materials that already exist at the time broad consent is sought; and (2) materials that will be collected for up to 10 years after broad consent is obtained from adults. For children, broad consent for collection would be permitted for a period up to 10 years or the child reaches the legal age of consent, whichever comes first. 7 See 21 U.S.C. §360j(g)(3)(A).