On September 2, 2015, the U.S. Department of Health and Human Services (HHS) and 15 other federal agencies issued a long-anticipated Notice of Proposed Rulemaking (NPRM) to overhaul regulations that govern research on human subjects (the Common Rule).1 The proposed amendments to the Common Rule address a “paradigm shift” in how research is conducted in the 21st century, such as the growth in scale and diversity of research, evolving technologies, use of electronic health data in research, and new research settings. The NPRM draws on considerable public comments from the July 2011 Advanced Notice of Public Rulemaking (ANPRM)2 and on recent policy proposals from the Office for Human Research Protections (OHRP) and the National Institutes of Health (NIH).    Manufacturers of pharmaceutical products and medical devices, and those who conduct clinical investigations of drugs and devices that are regulated by the Food and Drug Administration (FDA), encounter regulations that are very similar to the Common Rule’s requirements with slight modifications at 21 CFR Parts 50, 56, 312, and 812. Although clinical research conducted on products regulated by the FDA may not always be governed by the Common Rule, pharmaceutical and medical device companies may nonetheless want to comment on the new proposed regulations, which may influence future revisions to FDA’s Good Clinical Practice (GCP) Regulations. Comments on the NPRM are due December 7, 2015, although several stakeholders already have indicated the need for an extension given the NPRM’s breadth.

Numerous proposed changes to the Common Rule merit evaluation; below we highlight some of those changes:                        

  1. Extension to All Clinical Trials. HHS proposes to extend the Common Rule to cover “clinical trials” regardless of funding source, conducted at a domestic institution that receives federal funding for non-exempt and non-excluded human subjects research. Already, many institutions voluntarily extend the Common Rule’s protections to nonfederal research, including via election (“check the box”) on the Federal Wide Assurance (FWA). HHS would modify the FWA so that institutions would no longer have the option to “check the box.” For research other than clinical trials, institutions could continue to voluntarily apply the Common Rule, but this voluntary extension would no longer be part of the FWA.
  2. Regulating Biospecimens. The NPRM proposes to expand the definition of “human subject” so that the Common Rule covers research use of biospecimens regardless of identifiability, except under limited circumstances. Currently, the Common Rule applies only if the biospecimen in the hands of the researcher is considered to be individually identifiable. The NPRM solicits comments on two alternative proposals that continue to expand the definition of “human subject” but maintain identifiability as the lynchpin for determining the Common Rule’s applicability to biospecimens.

The proposed revisions would require informed consent for secondary research with biospecimens, even for use of non-identified biospecimens. However, consent is not required for each specific research use; rather, broad consent for future unspecified research would be permissible using a template consent form that HHS would develop. This change would eliminate the current practice of treating biospecimen research as exempt if all individually identifying information is stripped from the sample.  (Limited categories of secondary research on biospecimens would be allowed without consent.) The government recognizes that this would be a major operational shift for research institutions; accordingly, compliance with this section would be delayed until three years after publication of the final rule and would apply only to research involving biospecimens that will be collected in the future.   The NPRM also specifies more stringent informed consent waiver criteria for biospecimen research, making it more difficult to obtain such waivers.

  1. Level of IRB Review Required.  HHS proposes to calibrate the level of review to the seriousness of the harm or danger to be avoided. Changes under consideration include:
  • Elimination of continuing review for all minimal risk studies that qualify for and undergo expedited IRB review unless the IRB documents a rationale for continuing review.  
  • Annual confirmation to the IRB that research eligible for expedited review is ongoing and continues to qualify for expedited review, thereby creating a presumption that such studies are indeed minimal risk unless the IRB hears otherwise; and  
  • A requirement that HHS publish a non-exhaustive list of activities that qualify as “minimal risk” and therefore eligible for expedited review.HHS would reevaluate the list at least every 8 years. This would eliminate the need for an IRB determination of minimal risk for activities that appear on the HHS’s list.
  1. IRB Review of Multi-Site Studies.  The NPRM includes a significant new requirement for all domestic sites in a multi-site study to rely upon a single IRB as the central IRB of record. Changes to OHRP enforcement procedures would hold an external IRB directly accountable for compliance, in order to encourage institutions to rely on unaffiliated or external IRBs. The single IRB requirement would not apply to: (1) cooperative research for which more than single IRB review is required by law ( e.g ., FDA-regulated devices); and (2) research determined by the sponsoring agency to require more than a single IRB. The rule would also apply only to U.S.-conducted portions of studies. The sponsoring agency would designate the single IRB or, if there is no sponsoring agency, the lead institution conducting the study would select the IRB. Institutions could choose, for their own purposes, to conduct additional IRB reviews at local sites, but such reviews would not have “regulatory status” in terms of compliance with the Common Rule.
  2. Informed Consent Requirements . HHS proposes to enhance the informed consent process to advance patient understanding. Notable modifications include, for example, requirements to: (1) limit consent form length by presenting the elements of consent first, followed by an appendix with other information; (2) include HIPAA authorization elements in the consent document, not the appendices; and (3) inform subjects about the possibility that their non-identified data could be used for future research without protections of the Common Rule. 

Three new informed consent elements would:

  • Specify whether biospecimens may be used for commercial profit and whether the subject will or will not share the profit;  
  • Inform subjects of whether clinically relevant research results, including individual research results, will be disclosed to subjects, and under what conditions; and  
  • Provide subjects with an option to consent or refuse to consent to investigators re-contacting the subject to seek additional information or biospecimens, or to discuss participation in another study.
  1. Research Excluded from the Common Rule.  The NPRM identifies certain activity as outside the scope of the Common Rule (“excluded”), and thus would not require any administrative or IRB review. This includes certain activities that are deemed not to be research ( e.g ., internal operational monitoring and program improvement activity), are inherently low risk and subject to other controls (e.g ., study of certain publicly available information), or where activities are low-risk and do not “meaningfully diminish subject autonomy” ( e.g ., secondary research use of non-identified biospecimens designed only to generate information about an individual that already is known).
  2. Research Exempt from IRB Review.  The NPRM proposes additional categories of research that would be “exempt,” such as:
  • Research involving benign interventions with adults where the information obtained is recorded in such a manner that subjects cannot be identified or where the disclosure of responses would not put subjects at risk of liability or damage3;  
  • Research involving educational tests, surveys, interviews, or observations of public behavior, provided that security and privacy protection policies are followed;  
  • Secondary research use of identifiable private information where notice of such possible use was given and privacy safeguards on reuse of the information are in place; and  
  • Storage or maintenance of biospecimens or identifiable private information for secondary research use, with broad consent obtained via the HHS consent template and limited IRB review of the process for obtaining such consent.  

HHS proposes to facilitate determination of whether a study is exempt by creating a voluntary web-based “decision tool.” If accurate information is input into the decision tool’s algorithm, the NPRM characterizes the tool’s exemption decision as a “safe harbor” mechanism.  Entities involved in research that falls within various exempt categories must nonetheless implement privacy safeguards in accordance with the new Common Rule privacy requirements described below. Entities conducting research falling within the last three of these exempt categories must nonetheless implement privacy safeguards in accordance with the new Common Rule privacy requirements described below. 

  1. Data Security and Information Protections.  HHS proposes that investigators and institutions “implement reasonable safeguards for protecting against risks to the security or integrity of biospecimens or identifiable private information.” Public comment from the ANPRM period expressed significant concerns about mandating safeguards modeled on the HIPAA Rules alone. As such, the NPRM proposes several sets of security standards, with a choice about which one to use. HHS will publish a list of specific measures that meet the security requirements (public comment will be sought before the list is finalized). Compliance with HIPAA Rules would satisfy the safeguard requirements of the Common Rule. Public comment is sought as to whether other privacy and confidentiality statutes also could satisfy the safeguarding requirements. IRB review of required safeguards generally would not be expected. 

What This Means for the Pharmaceutical and Medical Device Industry  The NPRM intends to address advances in science while balancing protections for subjects, patient expectations, and transparency in government. These changes will have important implications for clinical trial sponsors, such as pharmaceutical and medical device companies, research institutions, investigators, clinical research organizations, and institutional review boards, as well as entities that maintain biospecimen repositories.  Even though the Common Rule does not govern most FDA-regulated clinical studies, pharmaceutical and medical device companies should understand the significant impact of these amendments on clinical trial practices. In particular, HHS anticipates that changes to the Common Rule likely will prompt corresponding changes to FDA regulations and HIPAA privacy regulations; furthermore, FDA and OHRP would together develop guidance on their respective regulatory requirements wherever feasible in order to harmonize federal guidance.