Final Rule on Revisions to the Federal Policy for the Protection of Human Subjects

On January 19, 2017, the Department of Health and Human Services (“HHS”), along with 15 other federal agencies (collectively, “the Departments”), published a final rule revising the Federal Policy for the Protection of Human Subjects, otherwise known as the “Common Rule.”¹ These regulations govern clinical research involving human subjects conducted or sponsored by the Federal departments and agencies that have adopted the regulations (“Common Rule departments and agencies.”)  The final rule is the first major update of the Common Rule since 2005.

The preamble states that the final rule is intended to modernize and strengthen the Common Rule and make it more effective in protecting human subjects while facilitating valuable research.  The final rule deviated substantially from the notice of proposed rulemaking (“NPRM”) issued in 2015. ²

This final rule is effective on January 19, 2018, except for cooperative research obligations, which become effective January 19, 2020.  Note that in a memorandum dated January 20, 2017, Reince Priebus, the Assistant to the President and Chief of Staff, stated that the Trump Administration will be reviewing all new regulations.  Therefore, this final rule may be subject to further amendment, review, comment, or repeal by the Trump Administration before taking effect. 

This memorandum summarizes several key provisions that were included in the final rule and the major proposals that were omitted by the Departments.

Highlights of the Final Rule

New and Revised Definitions

• • The final rule provided new and revised definitions, including: “clinical trial,” “human subject,” “intervention,” “private information,” “identifiable private information,” “identifiable biospecimen,” “minimal risk,” “research,” and “written or in writing” (to include electronic formats). (§____.102).
• Clinical Trial. The final rule added the definition of “clinical trial,” which was not defined in the previous version of the Common Rule.  A clinical trial is “a research study in which one or more human subjects are prospectively assigned to one or more interventions (which may include placebo or other control) to evaluate the effects of the interventions on biomedical or behavioral health-related outcomes.” (§____.102(b)).
• Human Subject. (§____.102(e)).
  • The final rule expanded the definition of “human subject” to cover the collection of biospecimens.  The new definition includes “a living individual about whom an investigator, whether professional or student conducting research: (i) obtains information or biospecimens through intervention or interaction with the individual, and uses, studies, or analyzes the information or biospecimens; or (ii) Obtains, uses, studies, analyzes, or generates identifiable private information or identifiable biospecimens.”
• Activities deemed not to be research.  The final rule amended the definition of “research” to include four new activities that are deemed to not be “research”:
  • Scholarly and journalistic activities (e.g. oral history, journalism, biography, literary criticism, legal research, and historical scholarship);
  • Public health surveillance activities;
  • Collection and analysis of information, biospecimens, or records for criminal justice or criminal investigative purposes; and
  • Certain activities in support of intelligence, homeland, security, defense, or other national security missions.  (§____.102(l)).

New Exemption Categories Regarding Secondary Research

• The final rule introduced new exemption categories from certain aspects of the Common Rule that relate to secondary research as long as certain conditions are met:
  • Secondary research for which consent is not required. (§____.104(d)(4)).
    • One of the exemptions for this purpose is research using protected health information (“PHI”) conducted by “covered entities” for “health care operations,” “public health activities,” or “research,” as those terms are defined under the Health Insurance Portability and Accountability Act (“HIPAA”) Rules. This change is intended to eliminate duplication between the Common Rule and HIPAA, but only partially succeeds in that effort as it does not explicitly cover “business associates” of covered entities.
  • Storage or maintenance for secondary research use of identifiable private information or identifiable biospecimens for which broad consent is required. (§____.104(d)(7)).
    • This exemption can be met if an IRB conducts a limited IRB review and makes certain determinations required by §______.111(a)(8).
    • Institutions have the flexibility to create their own consent forms that satisfy requirements at §______.116(a)(1)-(14), (a)(6) and (d).
    • The rationale for this exemption is that it respects subjects’ autonomy and provides appropriate privacy safeguards through the requirement for limited IRB review and certain IRB determinations as stipulated in §______.111(a)(8), including subjects’ broad consent, while reducing administrative burden by not requiring specific informed consent for each secondary research study.³
  • Research involving the use of identifiable private information or biospecimens for which broad consent is not required. (§____.104(d)(8)).
    • This exemption can be met if (i) broad consent for the storage, maintenance, and secondary research use of identifiable private information or identifiable biospecimens was obtained in accordance with §______.116(a)(1)-(4), (a)(6), and (d); (ii) documentation of informed consent or waiver of documentation of consent was obtained in accordance with §______.117; or (iii) an IRB conducts a limited IRB review and makes the determination required by §______.111(a)(7) and that the research to be conducted is within the scope of the broad consent referenced in §_____.104(d)(8)(i); or (iv) the investigator does not include returning individual research results to subjects as part of the study plan.
    • The final rule includes this exception because it protects subjects’ autonomy by requiring limited consent or IRB review while reducing administrative burdens.

Informed Consent

• Initiation of informed consent. Informed consent must begin with “a concise and focused presentation of the key information that is most likely to assist a prospective subject or legally authorized representative in understanding the reasons why one might or might not want to participate in the research.”  (§____.116(a)(5)(i)).
  • This statement “must be organized and presented in a way that facilitates comprehension.” (§____.116(a)(5)(i)).
• Elements. Elements of informed consent can be found at §____.116(b) and (c), and include: statement explaining the purpose, procedures, and reasonably foreseeable risks and discomforts of the research.
• Broad consent for secondary research. Broad consent (e., prospective consent to unspecified future research) may be obtained in lieu of informed consent for secondary research use, storage, and maintenance of identifiable private information and identifiable biospecimens.  (§____.116(d)).
  • The NPRM’s general requirement of consent for secondary research use of nonidentified biospecimens, including imposing narrow stringent criteria for IRB waiver of consent with respect to such research, is not implemented in the final rule. This is because the NPRM’s requirement that all biospecimens, regardless of their identifiability, be covered under the Common Rule was not adopted.  The final rule establishes that broad consent is permissible only for secondary research and no other types of research.
• Screening, recruiting, determining eligibility. IRBs do not need to obtain informed consent in instances of obtaining information or biospecimens for the purpose of screening, recruiting, or determining the eligibility of prospective subjects, under certain circumstances.  (§ ____.116(g)).
  • The final rule adopts the NPRM’s provision, but without a requirement that investigators adhere to the proposed privacy safeguards at (§ ____.105, since this provision is not included in the final rule.
• For research involving collection of identifiable private information or identifiable biospecimens. In these instances, subjects should be provided with:
  • A statement that identifiers might be removed from the identifiable private information or identifiable biospecimens; and
  • The information or biospecimens could be used for future research studies or distributed to another investigator for future research studies without additional informed consent, where applicable; or
  • A statement that the subject’s information or biospecimens collected as part of the research, even if identifiers are removed, will not be used or distributed for future research studies. (§ ____.116(b)(9)).
• Consent form for clinical trials. Each clinical trial conducted or supported by a Federal department or agency must have an approved consent form, and this form must be posted online.  (§ ____.116(h)).
  • This provision was not in the pre-2018 rule.
  • The final rule, unlike the NPRM, no longer specifies that certain information needs to be posted in addition to the consent form. This change eliminates the need for mandatory posting of information that might not be justified by the purpose of this provision.
  • Only one posting would be required for each multi-institution study. There is, accordingly, no expectation that a version would need to be posted for each class of subjects in the study (for example, a posting both for adults and for minors); nor for each study site.
  • This provision applies only to those clinical trials that are conducted or supported by a federal department or agency.

Elimination of Continuing Review

• The final rule eliminated continuing review for many minimal risk studies. (____.109(f)).
• Unless an IRB determines otherwise, continuing review of research is not required if the research:
  • Is eligible for expedited review in accordance with ____.110;
  • Is reviewed by the IRB in accordance with the limited IRB review procedure described in several of the exemption categories (specifically, ____.104(d)(2)(iii), § ____.104(d)(3)(i)(C), §____.104(d)(7), or §____.104(d)(8)); or
  • Only involves data analysis (including analysis of identifiable information or identifiable biospecimens) or access to follow-up clinical data from procedures that subjects would undergo as part of clinical care. ( ____.109(f)).
• The IRB must document the rationale for conducting continuing review if any of the above conditions are met

Cooperative Research

• A single IRB must approve cooperative (projects that involve more than one institution) studies for research conducted in the United States, except where:
  • More than a single IRB review is required by law (including tribal law); or
  • Research for which any Federal department or agency supporting or conducting the research determines and documents that the use of a single IRB is not appropriate. (§ ____.114)).  The single IRB requirement reduces administrative burden on IRB review of cooperative research studies, as the Common Rule previously required review and approval from each institution’s IRB.
• The reviewing IRB will be identified by the Federal department or agency supporting or conducting the research or proposed by the lead institution subject to the acceptance of such Federal department or agency.
• The effective date for this provision is January 19, 2020.

Harmonization with Other Agency Guidance

• The Common Rule previously did not require that agencies harmonize their guidance on application of the Common Rule. The final rule states that guidance can only be issued after consultation with the other sixteen Federal departments and agencies that adopted the Common Rule, unless the consultation is not feasible. (§____.101(j)).
• The final rule requires the Secretary of HHS to issue guidance to assist IRBs in assessing privacy and confidentiality protections. (§____.111(7)(i)).

Guidance on Application to Clinical Data Registries

• Section 511 of the Medicare Access and CHIP Reauthorization Act of 2015 (“MACRA”) requires HHS to provide guidance on how the Common Rule applies to clinical data registries. In an effort to provide such guidance, the preamble to the final rule states that the final rule does not apply to clinical data registry activities in the following circumstances:
  • Activities not conducted or supported by a Common Rule department or agency;
  • Activities that do not meet the definition of research, such as many quality improvement activities (for example, the creation of a registry designed to provide information about the performance quality of providers, and whose design is not influenced or altered to facilitate research, is not covered by the final rule even if it is known that the registry will be used for research studies);
  • Research studies that only involve obtaining and analyzing nonidentified information because it would not involve a “human subject”;
  • Activities that qualify for exemption under §____.104(d);
  • Institutions that release identifiable private information obtained in the course of patient clinical care to a clinical data registry for research because it is not engaged to “human subjects” research. ⁴

Key Proposals Not Adopted in the Final Rule

Proposed exclusion for quality assurance/improvement (“QA/QI”) activities involving the implementation of an accepted practice.

• Comments on the proposed exclusion asked for expansion of the exception beyond “accepted practices,” substantial guidance to implement the provision, and expressed concerns that all other QA/QI activities would fall under the Common Rule. ⁵
• This exclusion is not included in the final rule because “it could create more confusion than resolved, and it might have inadvertently created some inappropriate obstacles to those QA/QI activities that should not fall under the rule.” ⁶
• This omission was a major disappointment for clinical data registries and other entities that engage in benchmarking and other QA/QI activities.

Proposed exclusion for data collection and analysis for internal operational monitoring and program improvement purposes.

• While the majority of comments supported the proposed exclusion, some comments indicated that the exclusion required substantial guidance to clarify what activities would be included in the exclusion. ⁷
• The final rule did not adopt the proposed exclusion because “this exclusion would have created more misunderstanding and confusion than it would have resolved” because some program activities involve research and deserve protections of the rule, while others are not research and are not under the rule. ⁸

Proposed exemption from IRB review for secondary research use of identifiable private information where notice was given.

• The majority of commenters opposed the proposed exemption, with concerns that the exemption was too permissive, would not provide adequate protections to prospective subjects, or did not respect subject autonomy. ⁹ Other commenters stated the exemption was too restrictive and some said that the exemption would not be a viable alternative to the proposed HIPAA exclusion for clinical data registries unless the exemption did not include the notice requirement.   The preamble states that this proposed exemption was included in part to be responsive to section 511 of MACRA. ¹⁰
• Based on opposition from the commenters, HHS decided to remove the proposed exemption and include guidance on the application of the Common Rule to clinical data registries within the preamble of the final rule instead. ¹¹

Proposed definition of human subject to include biospecimens regardless of identifiability.

• The final rule does not adopt the proposal to require that research involving nonidentified biospecimens be subject to the Common Rule. The reasons for opposing the expansion of the definition of human subject to include all biospecimens were numerous, including the feasibility of obtaining broad consent in a clinical setting, the costs of obtaining, tagging, and tracking consents given the low risk nature of research, prioritizing autonomy over beneficence and justice, and negative impacts on research. ¹²
• However, the final rule requires the Common Rule departments and agencies to assess the meaning of the terms “identifiable private information” and identifiable biospecimen” at least every 4 years. (§____.102(e)(1)(i).

Expansion of applicability of Common Rule to cover all clinical trials regardless of funding source.

• Commenters stated that the NPRM created a confusing and burdensome structure for extending the Common Rule, the excessive burdens are not offset by an increase in protections for human subjects, and the extension of the Common Rule would apply to low-risk research which would negatively impact overall research activities. ¹³
• The final rule does not adopt the NPRM’s proposal to extend the Common Rule to currently unregulated clinical trials.

 

¹ 82 Fed. Reg. 7149 (Jan. 19, 2017) (“Final Rule”).
² 80 Fed. Reg. 53931 (Sept. 8, 2015)(“Notice of Proposed Rulemaking,” or “NPRM”).
³ Final Rule at 7198.
⁴ Id. at 7200. See the final rule for further examples.
⁵ Id. at 7178-79.
⁶ Id. at 7173.
⁷ Id. at 7179.
⁸ Id.
⁹ Id. at 7200.
¹⁰ Id.
¹¹ Id.
¹² Id. at 7165.
¹³ Id. at 7156.

---

For more information on the Final Rule on Revisions to the Federal Policy for the Protection of Human Subjects, contact Rob Portman at Rob.Portman@PowersLaw.com or 202-872-6756.