On September 8, 2015, 16 federal departments and agencies1 issued a notice of proposed rulemaking (NPRM)2 to revise the "Common Rule," a regulation that sets standards for the protection of “human subjects” participating in federally funded research studies.3 The research community has been anxiously awaiting the proposed final rule, which will significantly impact the health care and life sciences industries, tissue banks, patient advocates, and Institutional Review Boards (IRBs).4

The proposed regulations implement important changes to accommodate the evolving nature of research analytics, particularly in the context of biospecimen collection and testing. Furthermore, the drafters took significant strides in streamlining IRB reviews and even excluding certain categories of research while broadening the exemption categories. Such changes were made to make the scope and nature of IRB reviews commensurate with the risk posed to human subjects.

Stakeholders have less than 90 days to digest the proposal and provide feedback to the major changes being proposed to the human subject regulations. The following summary is intended to help your organization understand the proposed modification to the Common Rule and encourage affected individuals and organizations to provide critical feedback to HHS for consideration prior to implementation of the final rule.

Purpose & Goals of the Regulatory Action 

The Common Rule as we know it today was issued almost 25 years ago with the goal of addressing ethical considerations that exist when human subjects participate in research experimentation. The basic premise of the original Common Rule was to set a uniform standard of regulations aimed at protecting human subjects participating in federally funded research.

Since that time, the volume and landscape of research involving human subjects has changed considerably. The drafters of NPRM point to several factors that have led to a need for updating the current regulations. These changes include an expansion in the number and type of clinical trials, as well as observational studies and cohort studies; a diversification of the types of social and behavioral research being used in human subjects research; increased use of sophisticated analytic techniques for use with human biospecimens; and the growing use of electronic health data and other digital records to enable the creation and analysis of "big data." Alongside these changes, the balance of protections for research participants has shifted among the Common Rule's guiding principles of respect for persons, beneficence, and justice. There is now an increased focus on transparency in government and medicine and how patient and research participant expectations should be incorporated into government policies. Finally, there is also the continuing need to harmonize human subjects regulations and guidance, especially between the Office of Human Research Protections (OHRP) and those promulgated by the U.S. Food and Drug Administration (FDA). The NPRM attempts to modernize the Common Rule in light of these present concerns and reality.

The preamble sets forth three goals in modernizing the Common Rule. First, increasing human subjects' ability and opportunity to make informed decisions. Second, increasing the uniformity of human subject protections in areas such as information disclosure risk, coverage of clinical trials, and coverage of Institutional Review Boards (IRBs). Third, facilitating current and evolving types of research through reduced ambiguity in the regulations, increased efficiencies in the performance of the review system, and reduced burdens on investigators that do not provide commensurate protections to human subjects.

Summary of the Major Provisions

The most significant proposed changes to the Common Rule are listed and summarized below, and relate to the following categories: (1) biospecimen and related data research in the era of new technology; (2) informed consent form and process changes to increase transparency and autonomy; (3) IRB review efficiencies and risk adjustments; and (4) uniformity and harmonization of human subject research protections through expansion of Common Rule to non-federally funded studies.


Biospecimens (e.g., blood and other tissues) collected clinically or specifically for research purposes are essential to biomedical research today. Under the current Common Rule, coded biospecimens are not considered human subject research provided that such biospecimen does not contain identifiers that allow the investigator to readily ascertain the identity of the individual, the key code is not accessible to the investigator, and the specimen is collected for a specific study. Furthermore, research on coded biospecimens collected for clinical care is not regulated to “human subject research” under current regulations.

The NPRM acknowledges that maximizing the societal value of research means reducing barriers to the secondary use of biospecimens. On the other hand, there is growing recognition that many people want to have some degree of control over the circumstances in which an investigator can derive information about them, including the opportunity to consent to research involving their own biological materials. In order to achieve balance between these sometimes conflicting interests, the NPRM proposes to regulate secondary research on biospecimens under the Common Rule by revising the definition of "human subject" to include "a living individual about whom an investigator… conducting research… [o]btains, uses, studies, or analyzes biospecimens." By covering biospecimens as a "human subject" regardless of identifiability, the NPRM avoids any attempt to codify a quickly evolving debate regarding the possibility of re-identification. This departure from OHRP's prior position on the regulation of coded biospecimens will have significant impact on research involving biospecimens that have been primarily collected for clinical purposes. However, NPRM also proposes two alternatives to this all or nothing approach for public consideration and comment.

Under Alternative A, the proposal is to expand the definition of "human subject" to include whole genome sequencing. More specifically, Alternative A proposes to expand the definition of "human subjects" to include only specifically whole genome sequencing data, or any part of the data generated as a consequence of whole genome sequencing, regardless of the individual identifiability of biospecimens used to generate such data. "Whole genome sequencing" (WGS) would mean the sequencing of a human germ line or somatic biospecimen with the intent to generate the genome or exome sequence of that biospecimen. A new exemption would also be created that would allow this type of research to be considered exempt if consent to secondary future research use were obtained or if consent was waived according to the more stringent waiver criteria proposed by the NPRM, discussed more fully below. Note that an important difference between the primary proposal and this Alternative A is that, under Alternative A, additional consent would be required before data generated from WGS that had been performed on biospecimens collected initially for clinical purposes could be used for research purposes. Another drawback of Alternative A is that it is applicable to only one technology, WGS. Therefore, as other forms of technology advance, the Common Rule protections may not apply to such new technologies requiring further modification of the rule.

Alternative B would extend the definition of "human subjects" to include the research use of information that was produced using a technology applied to a biospecimen that generates information unique to an individual such that it is foreseeable that, when used in combination with publicly available information, the individual could be identified. This information would be referred to as "bio-unique information." Data qualifies as “bio-unique information” if three separate conditions are met: (1) the information was produced by applying to a biospecimen a technology that is capable of producing information that is unique to an individual; (2) the volume of information produced through the use of the technology is such that the information produced is likely to be unique to an individual; and (3) there is publicly available information that, when combined with the information produced by the use of the technology, would create the possibility that some of the individuals whose biospecimens were analyzed using the technologies “may be readily ascertained.”

The difference between Alternative A and Alternative B is that Alternative B would require consent for genomic sequencing of even small portions of a person's genome and for the use of other technologies that might be developed that similarly can generate “bio-unique information.” Alternative B would also require HHS to continually evaluate new technologies and the nature and amount of information produced using such technologies in order for the protections envisioned under Alternative B to remain true across scientific and technological developments.

The NPRM states that, in any event, the compliance date for the proposed expansion of the definition of "human subjects" would be three years after the publication date of a final rule. All biospecimens used for research purposes that are collected after this compliance date would be subject to the Common Rule, unless covered by an exclusion.

The NPRM requests public comment on the following questions related to these proposals:

  • Would providing a definition of biospecimen be helpful in implementing this provision? If so, how might the definition draw a line between when a biospecimen is covered by the Common Rule, and when processing of biological materials (e.g., to create a commercial product used for treatment purposes) has sufficiently altered the materials so that they should not be subject to the regulations? Would only covering biospecimens that include nucleic acids draw an appropriate line?
  • To what extent do the issues raised in this discussion suggest the need to be clearer and more direct about the definition of identifiable private information? How useful and appropriate is the current modifier “may be readily ascertained” in the context of modern genomic technology, widespread data sharing, and high-speed computing? One alternative is to replace the term “identifiable private information” with the term used across the federal government: personally identifiable information (PII).The Office of Management and Budget’s concept of PII refers to information that can be used to distinguish or trace an individual's identity (such as their name, social security number, biometric records, etc.) alone, or when combined with other personal or identifying information that is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc. It is acknowledged that replacing “identifiable private information” with “PII” would increase the scope of what is subject to the Common Rule. However, the practical implications of such an expansion, other than the need to ensure that the data are securely stored and otherwise protected against disclosure, may be minimal.
  • Which of the three proposals regarding the definition of "human subject" achieves the most reasonable tradeoff between the principles of autonomy (including transparency and level of trust) versus beneficence (as measured by facilitating valuable research)?
  • Are there any concerns that you have about each of the three proposals, including concerns about implementation or burden to investigators and institutions?

Broad Consent to Secondary Use: The NPRM goes a step further by requiring informed consent for the use of stored biospecimens in secondary research, even if the investigator is not being given information that would enable him or her to identify whose biospecimen it is. The NPRM proposes to develop a secretary's template for broad consent to the storage or maintenance for secondary research use of biospecimens and identifiable private information, and the use of such stored biospecimens and information for specific research studies. This broad consent would be permissible for the storage and maintenance for secondary research use of such information and biospecimens that were originally collected for either research studies other than the proposed research or for non-research purposes. The broad consent document would meet the consent requirements for the storage or maintenance of biospecimens and identifiable private information for secondary research, as well as the use of such stored material for individual research studies. With respect to biospecimens collected in a non-research context, NPRM proposed that the broad consent would be limited to covering either or both of the following: (1) biospecimens or identifiable private information that exist at the time at which the consent is sought; or (2) biospecimens or identifiable private information that will be collected up to 10 years after broad consent is obtained for adult subjects, and for research involving children as subjects, biospecimens or identifiable private information that will be collected up to 10 years after broad consent is obtained or until the child reaches the legal age of consent to treatments or procedures involved in the research, whichever comes first.

The broad consent must allow the subject to withdraw his or her consent without loss of benefits to which the subject is otherwise entitled. It must also give the adult subject or his or her legally authorized representative an option to refuse consent for inclusion of the subject's identifiable information being included in a publically available database.

The NPRM requests public comment on the following questions related to this proposal:

  • Should broad consent to secondary research use of information and biospecimens collected for non-research purposes be permissible without a boundary, or should there be a time limitation or some other type of limitation on information and biospecimens collected in the future that could be included in the broad consent as proposed in the NPRM? If a time limit should be required, is the NPRM proposal of up to 10 years a reasonable limitation? Would a limitation related to an identified clinical encounter better inform individuals of the clinical information and biospecimens that would be covered by a broad consent document?
  • Should all of the elements of consent proposed at § __.116(c) be required for the secondary use of biospecimens or identifiable private information originally collected as part of a research study that was conducted without consent because either the original research study met an exclusion or exempt category of research, or a waiver of consent was approved by an IRB?
  • How likely are investigators to seek broad consent for the use of identifiable private information (as contrasted with biospecimens), given that there are provisions within the NPRM that would make it easier to do such research without consent (such as the new exemption at § __.104(e)(2))? In this regard, note that the NPRM proposal to prohibit waiver of consent by an IRB if a person has been asked for broad consent and refused to provide it might create a disincentive on the part of investigators from choosing to seek broad consent for research involving secondary use of identifiable private information. Given the costs, time, and effort involved in implementing the system for obtaining broad consent for the use of identifiable private information and tracking when people provide consent or refuse to do so, are the benefits to the system likely to outweigh the costs, and if so, should the broad consent provisions be limited to obtaining broad consent for research use of biospecimens?

Stringent Conditions and Requirements for Waiver of Consent: The NPRM offers several proposals related to the waiver or alteration of informed consent provisions while proposing to retain the current language regarding the necessity to evaluate the rights and welfare of subjects before issuing a waiver of consent or altering consent procedures. The NPRM would add a new waiver criterion to require that, for research involving access to or use of identifiable biospecimens or identifiable information, the research could not practicably be carried out without accessing or using identifiers. This criterion was modeled on the comparable criterion in the HIPAA Privacy Rule, which requires that the research could not practicably be conducted without access to and use of the protected health information. Additionally, more stringent waiver conditions would also apply to research involving biospecimens, specifically that (1) there are compelling scientific reasons for the research use of the biospecimens; and (2) the research could not be conducted with other biospecimens for which informed consent was or could be obtained. Under the proposed, more stringent waiver standard, the circumstances in which a waiver could be granted by an IRB should be extremely rare. The NPRM also proposes that the Common Rule prohibit IRBs from waiving consent if a subject was asked and refused to provide broad consent to storage and maintenance of biospecimens. This entails a tracing requirement to honor individuals’ wishes.

The NPRM requests public comment on the following questions related to these proposals:

  • How could the waiver criterion regarding “practicably” at § __.116(d)(3) be explicitly defined or otherwise clarified (e.g., what term should replace “practicably”?)?
  • Comments on the proposed differences between the criteria for waiving informed consent for the research use of biospecimens versus identifiable information.
  • Should the proposal to permit an IRB to waive consent for research involving the use of biospecimens be included in the regulations?
  • Public comment is sought on the proposal to permit an IRB to waive consent for the secondary use of biospecimens or information originally collected for research purposes, even if the original research study required subjects' informed consent.
  • Public comment is sought on the proposed prohibition on waiving consent when an individual has been asked to provide broad consent under § __.116(c) and refused. In particular, how would this prohibition on waiving consent affect the secondary research use of identifiable private information? If an individual was asked to provide such consent, should the absence of a signed secondary use consent be considered a refusal? Does this prohibition on waiving consent for the secondary use of identifiable private information create a disincentive for institutions to seek broad secondary use consent and instead seek a waiver of consent from an IRB? Under what circumstances, if any, would it be justified to permit an IRB to waive consent even if an individual declined or refused to consent?

Safeguards for Protecting Biospecimens and Identifiable Private Information: The NPRM proposes to have the Secretary of HHS publish a list of specific measures that an institution or investigator can use to meet these requirements. These measures would include security safeguards to assure that access to physical biospecimens or data is limited only to those who need access for research purposes. The standards would also assure that access to electronic information is only authorized for appropriate use. Finally, the safeguards would assure that information and biospecimens posing information risks to subjects would be protected according to appropriate safeguards. For institutions or investigators currently required to comply with the HIPAA rules, however, the safeguards required by the Common Rule would be satisfied. No additional requirements are proposed to protect information that is subject to the HIPAA rules. The IRB would no longer need to consider the requirements for investigators to protect information, and biospecimens as a criterion for research, unless they find that the protections are unsatisfactory.

The NPRM requests public comment on the following questions related to this proposal:

  • What types of safeguards would be appropriate?
  • Would the goals of this proposal be served by referencing any other statute(s) or act(s) that mandate the protection of privacy and confidentiality of identifiable private information?
  • Should any particular information security measures be required for certain types of information or research activities? If so, what measures and for what types of information or research? Specifically, should the safeguards be calibrated to the sensitivity of the information to be collected?
  • Are the proposed limitations on re-disclosure more or less restrictive than necessary? Are there additional purposes for which re-disclosure of biospecimens or identifiable private information should be permitted?


Informed Consent Forms: The NPRM proposes to address (1) the organization and presentation of information included in the consent document and the process to facilitate a prospective subject's decision about whether to participate in research; (2) the elements of consent, basic and additional; and (3) broad consent for the storage or maintenance of biospecimens and identifiable private information for research use generally, and the use of such stored biospecimens and information for specific research studies. (The NPRM's proposal regarding broad consent is summarized above, and therefore will not be discussed further here.)

Organization and Presentation: The NPRM proposes adding new language to the introductory text of 45 CFR 46.116 to emphasize the need to first provide essential information that a reasonable person would want to know in order to make an informed decision about whether to participate, and to provide an opportunity to discuss that information. The information would need to be presented in sufficient detail relating to the specific research. The NPRM would also require that the information in these forms be organized and presented in a way that does not merely provide a list of isolated facts, but rather facilitates the prospective subject's understanding of the reasons why one might or might not want to participate. The investigator would be required to present this information first before providing any other information to the subject.

Elements of Consent: Under the NPRM, informed consent would be required to include certain new basic and additional elements. A new basic element of consent would apply to all research collecting identifiable private information. Based on the investigator's plans, the informed consent form and process would need to inform subjects either that (1) identifiers might be removed from the data and that the non-identified data could be used for future research studies or distributed to another investigator for future research studies without additional information consent from the subject or representative; or (2) the subject's data collected as a part of the research would not be used or distributed for future research studies, even in non-identified form. Note that, for those predictably few investigators who choose to restrict the future research use of non-identified data, the institutions and investigators will have to develop a system for tracking impermissible uses of non-identified information.

The NPRM proposes adding three additional elements of consent that, when appropriate, would be required to be included in the informed consent form and process. One proposed new element would require that prospective subjects be informed that their biospecimens may be used for commercial profit and whether the subject will or will not share in this commercial profit. The second proposed new element would require that prospective subjects be informed of whether clinically relevant research results, including individual research results, will be disclosed to subjects, and if so, under what conditions. The third new element would provide subjects with an option to consent, or refuse to consent, to investigators re-contacting the subject to seek additional information or biospecimens or to discuss participation in another research study.

Additionally, if a HIPAA authorization is combined with a consent form, the authorization elements required by 45 CFR 164.508 must be included in the consent document and not the appendices. In other words, when consent is combined with authorization, the authorization elements should be considered to constitute one of the required elements of consent.

The NPRM requests public comment regarding the following question related to these proposals:

  • What topics should be addressed in future guidance on improving the understandability of informed consent?
  • Would research subjects continue to be appropriately protected if the definition of “legally authorized representative” were broadened to include individuals authorized by accepted common practice to consent on behalf of another individual to participation in clinical procedures? If the definition of “legally authorized representative” was broadened in this way, public comment is sought on the interpretation of “accepted” and “common,” as these terms would be used in the revised definition.

Posting on Public Accessibility: In an effort to increase transparency, the NPRM requires a copy of the final version of the consent (absent patient or other signatures) for each clinical trial to be posted on a publicly accessible website within 60 days of the close of recruitment for such trial. Amendments to the consent are not required to be posted, and in the case of multi-center studies, only one consent is required to be posted. Such website will serve as a registry of informed consents and each consent must include the protocol number, the contact information for the site, and sponsors of the study. This database will be searchable and subject to public scrutiny.


Excludes activities that are not "research," are inherently low risk, or are already subject to protections: Currently, the Common Rule excludes from coverage (1) activities that do not meet the definition of "research," (2) activities that are not described as "research subject to regulation," and (3) activities that do not involve a "human subject." However, the Common Rule has been criticized for not being clear about how to interpret what activities are covered by the policy and for inappropriately being applied to and inhibiting certain activities.

In response, the NPRM creates a new section in the regulations referred to as "exclusions," where 11 categories of activities are outlined and excluded from the scope of the Common Rule. The first six activities (1-6 below) are deemed not to be research for the purposes of this policy, without needing to consider whether the regulatory definition applies. Federal agencies engaged in these activities already interpret such activities as being outside the scope of the Common Rule, so the new specification in the NRPM is intended to largely affirm current practice. The next four categories of proposed exclusions (7-10 below) are for activities that are considered low-risk either in themselves or because there are appropriate safeguards already in place independent of the Common Rule. Two of these proposed categories relate to the current exemption categories at 45 CFR 46.101(b)(2), but propose to make these activities exempt from the Common Rule in its entirety. The last exclusion (11 below) applies to research involving the secondary use of non-identified biospecimens when the research is limited to generating information about the subject that is already known.

The proposed exclusions are generally identified as follows:

  1. program improvement activities;
  2. oral history, journalism, biography, and historical scholarship activities;
  3. criminal justice activities;
  4. quality assurance and quality improvement activities;
  5. public health surveillance activities;
  6. intelligence surveillance activities;
  7. research activities involving the use of certain educational tests, survey procedures, interview procedures, or observation of public behavior uninfluenced by the investigators;
  8. research activities involving the collection or study of information, even if the information will be collected in the future so as long as the investigator has no plans to conduct any type of analysis that could lead to creating identifiable private information;
  9. research activities conducted by a government agency using government-generated, non-research data;
  10. certain data collection and analysis activities using identifiable health information subject to the HIPAA Privacy Rule; and
  11. research activities involving non-identified biospecimens where no new information about an individual is generated.

This final exclusion would remove from the Common Rule the secondary research use of non-identified biospecimen for the purpose of the development and validation of certain tests and assays, quality assurance and control activities, and proficiency testing. However, despite this exclusion, it is anticipated that the vast majority of research activities involving specimens will fall under the NRPM.

The NPRM requests public comment regarding the following questions related to these proposals:

  • Should the exclusion for program improvement activities simply be discussed in the text of the final rule's preamble, and guidance produced to assist investigators in making such a determination? Should any other similar exclusions be addressed?
  • Should biospecimens not be included in any of these exclusion categories related to program improvement activities? If so, which ones?
  • Are the parameters of the exclusions sufficiently clear to provide the necessary operational guidance, or should any additional criteria or parameters should be applied to clarify or narrow any of these exclusions?
  • Would covering any of these exceptions under the Common Rule substantially add to the protections provided to human research subjects?
  • Should the exclusion for research activities involving educational tests, survey procedures, interview procedures, or observation of public behavior only apply to research activities in which notice is given to prospective subjects or their legally authorized representatives as a regulatory requirement? If so, please comment on what kind of information should be included in the notice, such as the research purpose, privacy safeguards, contact information, ability to opt-out, etc. Would requiring notice as a condition of this exempt research strike a good balance between autonomy and beneficence?
  • Is it reasonable to rely on investigators to make self-determinations for the types of research activities covered in these exclusion categories? If so, should documentation of any kind be generated and retained?
  • Should some or all of these activities be exemptions rather than exclusions?
  • Should these exclusions be narrowed such that studies with the potential for psychological risk are not included? Are there certain topic areas of sensitive information that should not be covered by the exclusion for research activities involving educational tests, survey procedures, interview procedures, or observation of public behavior? If so, please provide exemplary language to characterize such topic areas in a manner that would provide clarity for implementing the Rule.
  • Would excluding any of the research activities involving educational tests, survey procedures, interview procedures, or observation of public behavior from the Common Rule result in an actual or perceived reduction or alteration of existing rights or protections provided to human research subjects? Are there any risks to scientific integrity or public trust that may result from excluding these research activities from the Common Rule?
  • Are the protections provided by the HIPAA Rules for identifiable health information used for health care operations, public health activities, and research activities sufficient to protect human subjects involved in such activities? Does the current process of seeking IRB approval meaningfully adds to the protection of human subjects involved in such research studies?
  • To what extent do the HIPAA Rules and HITECH adequately address the beneficence, autonomy, and justice aspects for the collection of new information (versus information collected or generated in the course of clinical practice—e.g., examination, treatment, and prevention)? Should this exclusion be limited to data collected or generated in the course of clinical practice? If additional data collection is allowable, should it be limited to what is on the proposed Secretary's list of minimal risk activities?
  • Are there additional or fewer activities regulated under the HIPAA Privacy Rule that should be included in this exclusion?

New Categories and Process for Exempt Research: These proposals attempt to address criticism that the Common Rule has inadequately calibrated the review process to the risk of research. Requirements applicable to each of the eight proposed exemptions are based on the kinds of risks characteristically involved and what protections are called for due to such risks. The proposed exempted activities are as follows:

  1. Certain research activities involving benign interventions with adult subjects. These activities do not require application of standards for information and biospecimen protection or informed consent.
  2. Research involving educational tests, surveys, interviews, or observations of public behavior when sensitive information may be collected. These activities may not involve biospecimens, but require application of standards for information and biospecimen protection.
  3. Secondary research use of identifiable private information originally collected as part of a non-research activity, where notice of such possible use was given. This type of activity may not involve biospecimens, but requires application of standards for information and biospecimen protection.
  4. Storing or maintaining biospecimens and identifiable private information for future, unspecified secondary research studies.This type of activity requires application of standards for information and biospecimen protection and written informed consent for the storage, maintenance, and secondary research use of the information or biospecimens on a template to be published by the Secretary of HHS.
  5. Research involving the use of biospecimens or identifiable private information that has been stored or maintained for secondary use, if consent to the storage, maintenance, and secondary research use of the information or biospecimens was obtained on the broad consent template to the published by the Secretary of HHS. This type of activity requires application of standards for information and biospecimen protection and limited IRB approval.

To facilitate timely and accurate determinations of exemption status, the NPRM proposes to require the Secretary of HHS to develop a web-based tool for investigators. Using inputs from the investigator, the tool would produce a determination as to whether a particular study is exempt or not. Institutions would be able to rely on use of the federally developed tool as a "safe harbor" for this determination, so long as the information that was provided to the tool was accurate. The institution or IRB would be required to maintain records of exemption determinations that include, at a minimum, the name of the research study, the name of the investigator, and the exemption category applied to the research study.

The NPRM requests public comment regarding the following questions related to this proposal:

  • How likely it is that institutions would allow an investigator to independently make an exempt determination for his or her own research without additional review by an individual who is not involved in the research and immersed in human research protection—e.g., a member of the IRB staff?
  • Would an investigator be able to contrive his or her responses to the automated exemption decision tool in order to receive a desired result—i.e., an exempt determination—even if it does not accurately reflect the research activities?
  • Would it be more appropriate for some of the exempt categories than others to rely on the exemption determination produced by the decision tool where investigators themselves input the data into the tool, or should there be further administrative review in such circumstances?
  • Would relying on the exemption determination produced by the decision tool where investigators themselves input the data into the tool as proposed reduce public trust in research?
  • How likely is it that institutions would rely on such a decision tool to provide a safe harbor for an investigator making a determination that the proposed research qualifies for an exemption, or would developing such a tool not be worthwhile? Would institutions be able to adequately manage exemption determinations without the use of the decision tool?
  • What additional information should be required to be kept as a record other than the information submitted into the decision tool—for example, a study abstract, the privacy safeguards to be employed, or any notice or consent document that will be provided?
  • What is the value of adding an auditing requirement?

Changes to IRB Review and Operations: The NPRM made several proposed changes that impact IRB operations. Some of the highlights include:

  • The NPRM proposes updating the IRB review criteria related to storage and maintenance for biospecimens and identifiable private information for the purpose of later doing secondary research by requiring the IRB only ensure a broad consent is obtained.
  • The NPRM proposes some changes to the vulnerable populations IRB review. Under the NPRM, the only criterion that should be assessed by the IRB with regard to "vulnerable subjects" is that there is no undue coercion. In addition, the new rule would change the term "handicapped" to "physically disabled individuals," and indicates that economically or educationally disadvantaged person would be considered vulnerable subjects.
  • Another proposed change is that if the investigator includes a returning research result as part of the protocol, the IRB would be required to determine whether the plan was appropriate. The IRB would also be required to determine whether the plan to provide results was necessary.

Single IRB for Cooperative Research: The Common Rule currently requires that each institution engaged in a cooperative research study obtain IRB approval of the study, although it does not require that a separate local IRB at each institution conduct the review. In many cases, however, a local IRB for each institution does independently review the research protocol, informed consent forms, and other materials. The NPRM proposes to mandate that all institutions located in the United States engaged in cooperative research rely on a single IRB as their reviewing IRB for that study. This requirement would not apply to (1) cooperative research for which more than a single IRB review is required by law (e.g., FDA-regulated devices) or (2) research for which the federal department or agency supporting or conducting the research determines and documents that the use of a single IRB is not appropriate for the particular study.

To minimize concerns regarding this requirement, the NPRM also proposes to expand the scope of the Common Rule to cover IRBs unaffiliated with an assurance-holding institution so that these "unaffiliated" IRBs can be held directly responsible for compliance with the Common Rule. This change is intended to address concerns about the OHRP's current practice of enforcing compliance with the Common Rule through the institutions that were engaged in human subjects research, even in circumstances when the regulatory violation is directly related to the responsibilities of an external IRB. As a result, more institutions should be willing to rely on a single IRB for cooperative research.

The NPRM requests public comment on the following questions related to these proposals:

  • Is mandated single IRB review for all cooperative research a realistic option at this time? Please provide information about the likely costs and benefits to institutions. Will additional resources be necessary to meet this requirement in the short term? Should savings be anticipated in the long run?
  • What areas of guidance would be needed for institutions to comply with this requirement? Is there something that OHRP could do to address concerns about institutional liability, such as the development of model written agreements?
  • Would it be useful for this requirement to include criteria that federal departments or agencies would need to apply in determining whether to make exceptions to the use of a single IRB requirement? If so, what should these criteria be?
  • Are the exceptions proposed appropriate and sufficient, or should there be additional exceptions to this mandate for single IRB review than those proposed in the NPRM? If additional exceptions should be included, please provide a justification for each additional exception recommended.
  • Is three years appropriate timing to establish compliance with this provision?

Eliminates Continuing Review for Low-Risk Studies: The NPRM proposes to eliminate continuing review for many minimal risk studies, unless the reviewer documents why continuing review should take place. The Secretary of HHS would create, publish, and maintain a list of activities that should be considered minimal risk. Unlike the current rule, if it is on the list, it should be treated as “minimal risk.” Continuing review would be eliminated for all studies undergoing expedited review unless justification is made. Moreover, for studies initially reviewed by a convened IRB, continuing review would not be required, unless specifically mandated by the IRB, after the study reaches the stage where it involves one or both of the following: (1) analyzing data (even if it is identifiable private information), or (2) accessing follow-up clinical data from procedures that subjects would undergo as part of standard care for their medical condition or disease. Although investigators would need to provide annual confirmation to the IRB that research is ongoing and no changes have been made requiring continuing review. Continuing review would not be required for research involving certain secondary research using information about biospecimens that requires limited IRB review in order to qualify for exemption. The IRB would need to receive annual confirmation that such research is ongoing and that no changes have been made that would require the IRB to conduct continuing review (because, for example, the study no longer involves "no greater than minimal risk"). These proposals are intended to reduce or eliminate the need for continuing review in circumstances where the reviews do not meaningfully enhance the protection of subjects.

The NPRM requests public comment on the following questions related to this proposal:

  • How often should the Secretary's list of minimal risk activities be updated? Should advice be solicited from outside parties when updating the list?
  • Is this Secretarial list of minimal research activities a useful tool for the research community, or does it represent a loss of IRB flexibility in risk determination?


Covers all clinical trials, regardless of funding source, at federally-funded institutions: The NPRM wants to ensure that studies that generally pose the most risk to potential subjects (such as surgical clinical trials) are encapsulated by the Common Rule. The NPRM proposes to apply the Common Rule to all clinical trials, irrespective of funding source, that are (1) conducted at an institution that receives support from a federal department or agency for human subjects research that is not excluded from the Common Rule and does not qualify for an exemption under the Common Rule; (2) not subject to FDA regulation; and (3) conducted at an institution located within the United States. This proposal would cause many surgical clinical trials that do not receive support from a Common Rule department or agency and are outside of the scope of FDA's human subjects protection regulation to come under the purview of the Common Rule.

The NPRM requests public comment on the following questions related to these proposals:

  • Could there be unintended consequences from the clinical trials expansion under this proposal? Unintended consequences may include an increase in burden or costs, or an inappropriate redistribution of costs.
  • Should the criterion that the policy extends to all clinical trials conducted at an institution that receives federal support be further clarified in some way? For example, should it specify a timeframe for support (e.g., within the past number of years), or a minimum monetary threshold value?
  • Should the definition of "clinical trial" include additional explanation of what is encompassed by the term "behavioral health-related outcomes"?