On 2 September 2015, the U.S. Department of Health and Human Services (HHS) issued a long-anticipated Notice of Proposed Rulemaking (NPRM) to overhaul regulations that govern research on human subjects (the Common Rule).1 The proposal aims to address a “paradigm shift” in the modern clinical research enterprise, which entails innovative technology, huge volumes of data, diverse research settings, and unprecedented public engagement and scrutiny. The NPRM draws on considerable public comments from the July 2011 Advanced Notice of Public Rulemaking (ANPRM)2 and on recent policy proposals from the Office for Human Research Protections (OHRP) and the National Institutes of Health (NIH). 
The NPRM would substantially change, in several respects, the regulatory framework with which universities and research institutions have had years of experience. For example, if an institution receives federal funding for human subjects research, all clinical trials at the institution would become subject to the Common Rule. New rules would govern research use of biospecimens, and new elements of informed consent would prompt substantive and procedural modifications to current practice. The NPRM also implicates questions such as how institutions manage risk in multi-site studies if such studies are to be reviewed, as the proposal suggests, by a single Institutional Review Board (IRB).  
Many proposed changes to the Common Rule merit evaluation; below we highlight some of those changes.

A. Extension to All Clinical Trials. HHS proposes to extend the Common Rule to cover “clinical trials,” regardless of funding source, conducted at a domestic institution that receives federal funding for non-exempt and non-excluded human subjects research. A “clinical trial” would be a research study in which one or more human subjects are prospectively assigned to one or more interventions (which may include placebo or other control) to evaluate the effects of the interventions on biomedical or behavioral health-related outcomes. Already, many institutions voluntarily extend the Common Rule’s protections to nonfederal research, including via election (check the box) on the Federal Wide Assurance (FWA). HHS would modify the FWA so that institutions no longer have the option to “check the box.” For nonfederal research other than clinical trials, institutions could continue to voluntarily apply the Common Rule, but this voluntary extension would no longer be part of the FWA or subject to OHRP oversight.

B. Regulating Biospecimens. Among the most fundamental changes in the NPRM is the proposal to expand the definition of “human subject” so that the Common Rule covers research use of biospecimens regardless of identifiability, except under limited circumstances. Currently, the Common Rules applies where the biospecimen in the hands of the researcher is considered to be individually identifiable. The revised Common Rule would cover the obtaining, use, study, or analysis of biospecimens regardless of identifiability. HHS acknowledges that this could be a dramatic change in research operations and solicits comments on two alternative but narrower proposals that continue to expand the definition of “human subject” but maintain identifiability as the lynchpin for determining the Common Rule’s applicability to biospecimens. 
Under the proposed rule, informed consent would be necessary for secondary research with biospecimens, even for use of non-identified biospecimens. However, consent is not required for each specific research use; rather, broad consent for future unspecified research would be permissible using a template consent form that HHS would develop. This change would eliminate the current practice of treating biospecimen research as exempt if all individually identifying information is stripped from the sample. (Limited categories of secondary research on biospecimens would be allowed without consent.) Given the major operational implications for research institutions, the government would delay for three years an institution’s compliance obligations under these rules, which would apply only to research involving biospecimens that will be collected in the future.
Additional more stringent informed consent waiver criteria for biospecimen research also would apply, making more rare the circumstances in which an IRB grants a waiver.
C. Level of IRB Review Required. HHS proposes to better calibrate the level of review to the seriousness of the harm or danger to human subjects. Changes under consideration include: 

  • Elimination of continuing review for all minimal risk studies that qualify for and undergo expedited IRB review unless the IRB documents a rationale for continuing review. For studies initially reviewed by a convened IRB, continuing review would not be required, unless specifically mandated by the IRB, after the study reaches the stage where it involves one or both of the following: (1) Analyzing data (even if it is identifiable private information), or (2) accessing follow-up clinical data from procedures that subjects would undergo as part of standard care for their medical condition or disease.
  • Annual confirmation to the IRB that research eligible for expedited review is ongoing and continues to qualify for expedited review, thereby creating a presumption that such studies are no greater than minimal risk unless the IRB hears otherwise.
  • HHS would publish a non-exhaustive list of activities that qualify as “minimal risk” and therefore eligible for expedited review, and HHS would evaluate that list at least every eight years. Such a list apparently would eliminate the need for an IRB determination of minimal risk for listed activities.

D. Movement to a Central IRB Model. The NPRM includes a major new requirement for all domestic sites in a multi-site study to rely upon a single IRB as the IRB of record. Institutions increasingly have experience with reliance on central IRBs, but currently most such situations are voluntary. The proposed rule mandates a single IRB in cooperative research and would change OHRP’s enforcement procedures to hold an external IRB directly accountable for compliance, in order to encourage relying institutions to use unaffiliated or external IRBs. The single IRB requirement would not apply to: (1) cooperative research for which more than a single IRB review is required by law (e.g., FDA-regulated devices); and (2) research determined by the sponsoring agency to require more than a single IRB. The rule would also apply only to U.S.-conducted portions of studies (in many cases, independent local IRB review of international sites is appropriate). The sponsoring agency would designate the single IRB or, if there is no sponsoring agency, the lead institution conducting the study would select the IRB. Institutions could choose, for their own purposes, to conduct additional IRB reviews at local sites, but such reviews would not have “regulatory status” in terms of compliance with the Common Rule. 
E. Research Exempt from IRB Review. All of the exemption categories in the current Common Rule remain in the proposed rule, either as exemptions or “exclusions.” The NPRM proposes additional categories of research that would be “exempt,” such as: 

  • Research involving benign interventions with adults where the information obtained is recorded in such a manner that subjects cannot be identified or where the disclosure of responses would not put subjects at risk of liability or damage.
  • Research involving educational tests, surveys, interviews, or observations of public behavior, provided that security and privacy protection policies are followed.
  • Secondary research use of identifiable private information where notice of such possible use was given and privacy safeguards on reuse of the information are in place.
  • Storage or maintenance of biospecimens or identifiable private information for secondary research use, with broad consent obtained via the HHS consent template and limited IRB review of the process for obtaining such consent.

HHS proposes to facilitate determination of whether a study is exempt by rolling out a voluntary web-based “decision tool.” If the institution inputs accurate information into the decision tool’s algorithm, the NPRM characterizes the web tool’s exemption decision as a “safe harbor” mechanism.  

F. Research Excluded from the Common Rule. The NPRM identifies certain activity as outside the scope of the Common Rule (“excluded”), and thus would not require any administrative or IRB review. This includes certain activities that are deemed not to be research (e.g., internal operational monitoring and program improvement activity); activities that are inherently low risk and subject to other controls (e.g., study of certain publicly available information); and activities that are low risk and do not “meaningfully diminish subject autonomy” (e.g., secondary research use of non-identified biospecimens designed only to generate information about an individual that already is known). Investigators performing excluded studies still would need to respect Belmont Report principles—e.g., inform prospective subjects of the study’s purpose and that they can choose to participate or not—and HHS contemplates the investigator essentially “self-determining” whether their research is properly “excluded.”
G. Elements of Informed Consent. Consent forms have evolved into lengthy and complex documents, possibly affecting their ability to convey necessary information to prospective participants. HHS proposes to revamp the consent form and process to advance patient understanding. Notable modifications include, for example, requirements to:

  • Reorient the consent form in order to first provide essential information that a reasonable person would want to know in order to make an informed decision about whether to participate in the study, and to provide an opportunity to discuss that information.The information would be organized and presented in a way that does not merely provide lists of isolated facts, but rather facilitates the prospective subject’s or representative’s understanding of the reasons why one might or might not want to participate.
  • Limit consent form length and avoid “buried” information by presenting the Common Rule-required elements of consent first, followed by an appendix with other information.
  • Where HIPAA authorization is combined with a consent form, include HIPAA authorization elements in the consent document, not the appendices.
  • Inform subjects about the possibility that their non-identified data could be used for secondary/future research without protections of the Common Rule. 

Three new informed consent elements would require investigators and institutions to:

  • Specify whether biospecimens may be used for commercial profit and whether the subject will or will not share the profit.
  • Inform subjects whether clinically relevant research results, including individual research results, will be disclosed to subjects, and under what conditions.
  • Provide subjects with an option to consent or refuse to consent to investigators re-contacting the subject to seek additional information or biospecimens, or to discuss participation in another study.

The NPRM also explains the concept of “broad consent” (critical to secondary research use of biospecimens) by establishing elements of a broad consent that ensure the individual has sufficient information to make an informed decision about whether to agree to provide broad consent for a wide variety of research. Broad consent would describe the biospecimens and identifiable private information covered by the consent, and would be limited to a period of time not to exceed 10 years from the date of consent for specimens collected for non-research purposes. Another element of broad consent would require institutions to inform subjects that they may withdraw consent, if feasible, at any time without penalty or loss of benefits to which the subject is otherwise entitled. Broad consent also would include an option, where relevant, to consent or refuse to consent to public posting of the subject’s non-identifiable data. 
To increase transparency and accountability, the NPRM proposes to post on a public website a copy of the final consent form for each clinical trial supported by a Common Rule agency.

H. Data Security and Information Protections. HHS proposes that investigators and institutions “implement reasonable safeguards for protecting against risks to the security or integrity of biospecimens or identifiable private information” that they collect, receive, or transmit for research. Public comment from the ANPRM period expressed significant concerns about mandating safeguards modeled on the HIPAA Rules alone. As such, the NPRM proposes more choice about standards to use. HHS would publish a list of specific measures that meet the security requirements (public comment will be sought before the list is finalized). Compliance with HIPAA Rules also would satisfy the safeguard requirements of the Common Rule. Public comment is sought as to whether other privacy and confidentiality statutes also could meet the requirements. IRB review of safeguards generally would not be expected. 

Next Steps
Changes to the Common Rule likely will prompt corresponding changes to FDA regulations and HIPAA privacy regulations. HHS anticipates that FDA and OHRP (among other federal agencies) would together develop guidance on their respective regulatory requirements wherever feasible to harmonize federal guidance on clinical research. 
Although HHS asserts that several NPRM revisions result in cost savings to the research community, the regulatory changes entailed in the Common Rule’s facelift most likely will prompt reassessment of the way institutions have long managed the clinical research enterprise, with both immediate and enduring financial implications. The effective date of the final Common Rule would be one year after publication in the Federal Register, except for changes affecting biospecimen research and the single IRB requirement, where the compliance date would be three years after publication.
Comments on the NPRM are due on 7 December 2015, although several stakeholders indicate the need for an extension.