Federal Policy for the Protection of Human Subjects

AGENCY:

Department of Homeland Security; Department of Agriculture; Department of Energy; National Aeronautics and Space Administration; Department of Commerce; Social Security Administration; Agency for International Development; Department of Housing and Urban Development; Department of Labor; Department of Defense; Department of Education; Department of Veterans Affairs; Environmental Protection Agency; Department of Health and Human Services; National Science Foundation; and Department of Transportation.

ACTION:

Final rule.

SUMMARY:

The departments and agencies listed in this document announce revisions to modernize, strengthen, and make more effective the Federal Policy for the Protection of Human Subjects that was originally promulgated as a Common Rule in 1991. This final rule is intended to better protect human subjects involved in research, while facilitating valuable research and reducing burden, delay, and ambiguity for investigators. These revisions are an effort to modernize, simplify, and enhance the current system of oversight.

DATES:

This rule is effective on January 19, 2018. The compliance date for this rule, except for § __.114(b) (cooperative research), is January 19, 2018. The compliance date for § __.114(b) (cooperative research) is January 20, 2020.

ADDRESSES:

Jerry Menikoff, M.D., J.D., OHRP, 1101 Wootton Parkway, Suite 200, Rockville, MD 20852.

FOR FURTHER INFORMATION CONTACT:

Jerry Menikoff, M.D., J.D., Office for Human Research Protections (OHRP), Department of Health and Human Services, 1101 Wootton Parkway, Suite 200, Rockville, MD 20852; telephone: 240-453-6900 or 1-866-447-4777; facsimile: 301-402-2071; email: jerry.menikoff@hhs.gov.

SUPPLEMENTARY INFORMATION:

Preamble

Executive Summary

I. The Rationale for Modernizing the Common Rule

II. To What Does This Policy Apply? Scope and Applicability of the Regulations

III. Definitions for Purposes of this Policy (§ __.102)

IV. Ensuring Compliance with this Policy (§ __.103)

V. Exempt Research (§ __.104)

VI. Protection of Identifiable Private Information and Identifiable Biospecimens

VII. IRB Membership and Modification to References to Vulnerability (§§ __.107(a), __.111(a)(3), and __.111(b))

VIII. IRB Functions and Operations (§ __.108)

IX. IRB Review of Research (§ __.109)

X. Expedited Review Procedures (§ __.110)

XI. Criteria for IRB Approval of Research (§ __.111)

XII. Cooperative Research (§ __.114)

XIII. IRB Records (§ __.115)

XIV. General Requirements for Informed Consent (§ __.116)

XV. Documentation of Informed Consent (§ __.117)

XVI. Applications and Proposals Lacking Definite Plans for Involvement of Human Subjects (§ __.118)

XVII. Research Undertaken Without the Intention of Involving Human Subjects (§ __.119)

XVIII. Conditions (§ __.124)

XIX. Regulatory Impact Analyses

XX. Environmental Impact

XXI. Paperwork Reduction Analysis

XXII. Tribal Consultation Statement

Final Regulatory Text

Executive Summary

Purpose of the Regulatory Action

Individuals who are the subjects of research may be asked to contribute their time and assume risk to advance the research enterprise, which benefits society at large. U.S. federal regulations governing the protection of human subjects in research have been in existence for more than three decades. The Department of Health, Education, and Welfare first published regulations for the protection of human subjects in 1974, and the Department of Health and Human Services (HHS) revised them in the early 1980s. During the 1980s, HHS began a process that eventually led to the adoption of a revised version of the regulations by 15 U.S. federal departments and agencies in 1991. The purpose of this effort was to promote uniformity, understanding, and compliance with human subject protections as well as to create a uniform body of regulations across federal departments and agencies (subpart A of 45 Code of Federal Regulations [CFR] part 46), often referred to as the “Common Rule” or “Protection of Human Subjects Regulations.” Those regulations were last amended in 2005, and have remained unchanged until the issuance of this final rule.

Since the Common Rule was promulgated, the volume and landscape of research involving human subjects have changed considerably. Research with human subjects has grown in scale and become more diverse. Examples of developments include: an expansion in the number and types of clinical trials, as well as observational studies and cohort studies; a diversification of the types of social and behavioral research being used in human subjects research; increased use of sophisticated analytic techniques to study human biospecimens; and the growing use of electronic health data and other digital records to enable very large datasets to be rapidly analyzed and combined in novel ways. Yet these developments have not been accompanied by major change in the human subjects research oversight system, which has remained largely unaltered over the past two decades.

On July 26, 2011, the Office of the Secretary of HHS, in coordination with the Executive Office of the President's Office of Science and Technology Policy (OSTP), published an advance notice of proposed rulemaking (ANPRM) to request comment on how current regulations for protecting those who participate in research might be modernized and revised to be more effective.

On September 8, 2015, HHS and 15 other federal departments and agencies published a Notice of Proposed Rulemaking (NPRM) proposing revisions to the regulations for protection of human subjects in research. Like the ANPRM, the NPRM sought comment on how to better protect research subjects while facilitating valuable research and reducing burden, delay, and ambiguity for investigators. Public comments on both the ANPRM and the NPRM have informed the final rule that is now being promulgated.

The final rule is designed to more thoroughly address the broader types of research conducted or otherwise supported by all of the Common Rule departments and agencies such as behavioral and social science research. It also benefits from continuing efforts to harmonize human subjects policies across federal departments and agencies.

Summary of the Major Changes in the Final Rule

The final rule differs in important ways from the NPRM. Most significantly, several proposals are not being adopted:

• The final rule does not adopt the proposal to require that research involving nonidentified biospecimens be subject to the Common Rule, and that consent would need to be obtained in order to conduct such research.
• To the extent some of the NPRM proposals relied on standards that had not yet been proposed, the final rule either does not adopt those proposals or includes revisions to eliminate such reliance.
• The final rule does not expand the policy to cover clinical trials that are not federally funded.
• The final rule does not adopt the proposed new concept of “excluded” activities. Generally, activities proposed to be excluded are now either described as not satisfying the definition of what constitutes research under the regulations or are classified as exempt.
• The proposed revisions to the exemption categories have been modified to better align with the long-standing ordering in the final rule. The final rule does not include the proposed requirement that exemption determinations need to be made in specified ways.
• The final rule does not include the proposed standardized privacy safeguards for identifiable private information and identifiable biospecimens. Aspects of proposals that relied on those safeguards have been modified or are not being adopted.
• The final rule does not adopt the most restrictive proposed criteria for obtaining a waiver of the consent requirements relating to research with identifiable biospecimens.

The final rule makes the following significant changes to the Common Rule:

• Establishes new requirements regarding the information that must be given to prospective research subjects as part of the informed consent process.
• Allows the use of broad consent (i.e., seeking prospective consent to unspecified future research) from a subject for storage, maintenance, and secondary research use of identifiable private information and identifiable biospecimens. Broad consent will be an optional alternative that an investigator may choose instead of, for example, conducting the research on nonidentified information and nonidentified biospecimens, having an institutional review board (IRB) waive the requirement for informed consent, or obtaining consent for a specific study.
• Establishes new exempt categories of research based on their risk profile. Under some of the new categories, exempt research would be required to undergo limited IRB review to ensure that there are adequate privacy safeguards for identifiable private information and identifiable biospecimens.
• Creates a requirement for U.S.-based institutions engaged in cooperative research to use a single IRB for that portion of the research that takes place within the United States, with certain exceptions. This requirement becomes effective 3 years after publication of the final rule.
• Removes the requirement to conduct continuing review of ongoing research for studies that undergo expedited review and for studies that have completed study interventions and are merely analyzing study data or involve only observational follow up in conjunction with standard clinical care.

Other minor changes have been to improve the rule and for purposes of clarity and accuracy.

Estimated Costs and Benefits

Table 1 summarizes the quantified and nonquantified benefits and costs of all changes to the Common Rule. Over the 2017-2026 period, present value benefits of $1,904 million and annualized benefits of $223 million are estimated using a 3 percent discount rate; present value benefits of $1,494 million and annualized benefits of $213 million are estimated using a 7 percent discount rate. Present value costs of $528 million and annualized costs of $62.0 million are estimated using a 3 percent discount rate; present value costs of $474 million and annualized costs of $67.0 million are estimated using a 7 percent discount rate. Nonquantified benefits include improved human subjects protections in research; enhanced oversight of research reviewed by IRBs not operated by a Federalwide Assurance (FWA)-holding institution; and increased uniformity in regulatory requirements among Common Rule departments and agencies. Nonquantified costs include the time needed for consultation among Common Rule agencies before federal guidance is issued.

I. The Rationale for Modernizing the Common Rule

A. The Changing Nature of Research

This final rule recognizes that in the past two decades a paradigm shift has occurred in how research is conducted. Evolving technologies—including imaging, mobile technologies, and the growth in computing power—have changed the scale and nature of information collected in many disciplines. Computer scientists, engineers, and social scientists are developing techniques to integrate different types of data so they can be combined, mined, analyzed, and shared. The advent of sophisticated computer software programs, the Internet, and mobile technology has created new areas of research activity, particularly within the social and behavioral sciences. In biomedical science, the Human Genome Project laid the foundation for precision medicine and promoted an environment of data sharing and innovation in analytics and technology, and drew attention to the need for policies that support a changing research landscape. New technologies, including genomic sequencing, have quickly led to exponential growth in the data to which investigators have access. The sheer volume of data that can be generated in research, the ease with which it can be shared, and the ways in which it can be used to identify individuals were simply not possible, or even imaginable, when the Common Rule was first adopted.

Research settings are also shifting. Although much biomedical research continues to be conducted in academic medical centers, more research is being conducted in clinical care settings, thus combining research and medical data. Biospecimen repositories and large databases have made it easier to do research on existing (stored) biospecimens and data. Clinical research networks connected through electronic health records have developed methods for extracting clinical data for research purposes and are working toward integration of research data into electronic health records in a meaningful way. The scientific community recognizes the value of data sharing and open-source resources and understands that pooling intellectual resources and capitalizing on efficient uses of data and technology represent the best ways to advance knowledge.

At the same time, the level of public engagement in the research enterprise has changed. More people want to play an active role in research, particularly related to health.

As technology evolves, so does the nature of the risks and benefits of participating in certain types of research. Many studies do not involve interaction with research subjects, but instead involve secondary analysis of data or biospecimens. Risks related to these types of research studies are largely informational, not physical; that is, harms could result primarily from the inappropriate disclosure of information and not from the research interventions themselves. Nonetheless, those harms can be significant.

Because of these shifts in science, technology, and public engagement and expectations, a wide range of stakeholders have raised concerns about the limitations of the existing regulatory framework, arguing for a re-evaluation of how the fundamental principles of the 1979 Belmont Report that underlie the Common Rule—respect for persons, beneficence, and justice—are applied in practice to the myriad new contexts in which U.S. research is conducted in the 21st century. The changes that are being implemented in the final rule continue to be shaped by those principles (a detailed background discussion of which was provided in the NPRM).

Finally, it is important to note that, to the extent appropriate, the intent is to eventually amend the other subparts of the HHS human subjects protection regulations in 45 CFR part 46 (subparts B, C, D, and E), and consider the need for updates to FDA regulations and other relevant federal departmental or agency regulations with overlapping scope.

B. Public Comments, Expert Advice, Stakeholder Dialogue

The revisions to the Common Rule are based on a variety of sources of public, stakeholder, and expert comments and advice, including comments received on the 2011 ANPRM and the 2015 NPRM. They also benefit from guidance provided by a 2014 National Research Council consensus report, Proposed Revisions to the Common Rule for the Protection of Human Subjects in the Behavioral and Social Sciences, and the National Academies of Science, Engineering, and Medicine 2016 report Optimizing the Nation's Investment in Academic Research: A New Regulatory Framework for the 21st Century.

Since the publication of the 2011 ANPRM, HHS has continued to solicit public comment on a variety of policy issues related to human subjects protections, including consent, the use of a single IRB for multi-institutional studies, and sharing of genomic data. Although these policies were more specific than the issues raised in the ANPRM, the responses received from public comments provide insight for refining the proposals initially put forward in the ANPRM. Of particular relevance are the National Institutes of Health's (NIH's) recently issued policy on the use of a single IRB for multi-institutional research, the Office for Human Research Protection's (OHRP's) draft guidance on the required content of consent language for research conducted within the standard of care, and NIH's policy to promote sharing of large-scale human genomic data generated from studies funded or conducted by NIH.

Other developments include the enactment of the Newborn Screening Saves Lives Reauthorization Act of 2014 (Pub. L. 113-240) in December 2014. The law made a number of changes relevant to the HHS regulations for protecting research subjects, including asserting that research with newborn dried blood spots (DBS) that is federally funded pursuant to the Public Health Service Act is to be considered research with human subjects, and that the provisions allowing IRBs to waive consent would not apply. By statute, the changes made by this law applied only until changes to the Common Rule are promulgated. Thus, the changes made by this statute will no longer apply after the effective date of this rule, January 19, 2018. In addition, in April 2015, the Medicare Access and Children's Health Insurance Program Reauthorization Act of 2015 (Pub. L. 114-10) was passed. That law requires HHS to issue a clarification or modification of the Common Rule with regard to how the regulatory requirements should be applied to activities involving clinical data registries. In addition, in December 2016 the 21st Century Cures Act (Pub. L. 114-255) was enacted.

Finally, as a result of conducting a variety of public discussions associated with the President's Precision Medicine Initiative, many perspectives were heard, with much alignment around the central tenet that participants should be active partners in such research and not merely passive subjects of research studies.

1. Summary of Public Comments on Structural, Conceptual, and Policy Implications of the Proposed Rule

The NPRM received more than 2,100 public comments, the majority of which were from people writing in their individual capacity. The remaining comments were submitted by institutions, professional organizations and societies, and membership organizations. The proposals receiving the most comments were those related to biospecimens (expanded definition of human subject, broad consent, and tightened criteria for waiver of consent). Here we summarize comments on the overall structural, conceptual, and policy implications of the proposed rule. Comments regarding the specific provisions of the rule appear throughout this preamble.

The NPRM asked for public comment on whether the proposed changes will achieve the objectives of: (1) decreasing administrative burden, delay, and ambiguity for investigators, institutions, and institutional review boards (IRBs); and (2) strengthening, modernizing, and making the regulations more effective in protecting research subjects. In response, many public commenters expressed concern about the overall complexity and length of the NPRM, the unavailability of key deliverables, proposals being internally inconsistent, and proposals giving investigators too much leeway to determine if their research is exempt or falls outside the scope of the rule.

Several commenters expressed concerns that they were unable to adequately or meaningfully comment on particular provisions proposed in the NPRM because an underlying document, tool, or list had not been developed or shared with the public at the time the NPRM was published, specifically: (1) the proposed broad consent templates; (2) the proposed standards for privacy protection; (3) the proposed list of eligible expedited procedures; and (4) the proposed exemption decision tool. Several commenters suggested that these items should be removed from the final rule and developed independently, urging government personnel to work collaboratively with representatives from the research community and funding agencies in the development of such documents, tools, and lists.

Some commenters suggested issuing a new NPRM that would be more complete and would include details on the privacy protection standards, exemption decision tool, and broad consent templates. Another commenter recommended that only the fully developed, less controversial provisions of the NPRM should be adopted into a final rule. Another commenter urged the Common Rule departments and agencies to reissue the NPRM to solicit comment on several of these documents, tools, and lists, arguing that it would be unlawful for a final rule to be issued until such an action were taken. This commenter noted that for members of the public to reasonably participate in rulemaking, agencies must provide enough factual detail and rationale to allow interested parties to comment meaningfully on the rule. This commenter also argued that the NPRM did not satisfy the requirement set forth in the Administrative Procedure Act that the notice provided to the public in rulemaking include either the terms or substance of the proposed rule or a description of the subjects and issues involved. In sum, the commenter argued that the NPRM sought comments on numerous provisions without providing the “terms or substance” of the specific proposals.

Some commenters encouraged dropping the proposal to require consent for research use of nonidentified biospecimens and instead exploring a system of public notification and opportunity to opt out of such research through issuance of a new NPRM following widespread consultation. A few commenters suggested that Common Rule departments and agencies fund pilot studies to better understand how such a system might work. Additional commenters focused on the importance of public education about the research enterprise regardless of the policy choices pursued in a final rule.

Commenters, including state health departments and other health entities involved in newborn screening activities, raised concerns that several of the NPRM proposals represented unfunded mandates, specifically the expansion of the definition of human subject to include all biospecimens regardless of identifiability, expansion of the policy to apply to all clinical trials that meet certain conditions, and mandatory single IRB review of cooperative research. Several institutions and disease advocacy groups noted that statewide newborn screening programs are often modestly funded, and the NPRM proposals would impose processes that could cost millions of dollars each year.

In addition, commenters raised concerns that HHS and other Common Rule departments and agencies are not authorized under 42 U.S.C. 289 to regulate humanities and social science research.

Public comments also discussed several ideas for consideration in a final rule that were not otherwise proposed in the NPRM, including:

• Develop or strengthen sanctions and penalties for investigators or institutions that re-identify subjects without proper authorization or review, rather than focusing solely on obtaining consent as the way to protect subjects. To this end, several commenters suggested that a separate section be added to the Common Rule focused on investigator responsibilities.
• Develop an IRB efficiency rating system.
• Deem research about IRB operations as an excluded, exempt, or expeditable activity to foster research into IRB operations.
• Include provisions about compensation for research-related injuries.
• More fully review and address how the rule should or should not apply to prisoners, children, and pregnant women and fetuses.
• Include provisions about U.S.-funded studies in developing countries with regard to defining standards of care and addressing post-trial access to proven therapies.

2. Response to Public Comments on Structural, Conceptual, and Policy Implications of the Proposed Rule

The final rule differs in numerous, major ways from what was proposed in the NPRM. Most significantly, the provisions relating to making nonidentified biospecimens subject to the Common Rule are not being implemented. That change alone addresses many of the public comments on the NPRM. Eliminating that proposal is intended to address concerns about the complexity of and lack of justification for the proposed changes in the rule, as well as concerns about embarking on significant changes without evidence that they would improve the system. Responses to public comments on specific provisions appear throughout this preamble. Below we summarize our responses to comments that addressed major structural or organizational issues or perceived insufficiencies in the NPRM proposals and their presentation.

Concerns about the overall complexity of the proposed changes have been addressed in several ways. For example, concerns about creating a new category of “excluded” activities have been addressed by not adopting that concept in the final rule. Instead, the goal of clarifying what is covered by the rule has been accomplished by modifying the definition of what constitutes research, and by adding or modifying exemptions that were already in the pre-2018 rule. And, even where existing concepts are modified, we have attempted to make those modifications in ways that minimize the extent of the change (such as largely preserving much of the core structure of the previous exemption categories).

To reduce public concerns about the aspects of the proposal that were not yet developed, we chose not to implement most of those provisions. For example, given the changes made to the proposals regarding broad consent, the final rule does not reference or include the concept of broad consent templates. The requirement that the Secretary of HHS develop a list of proposed privacy safeguards has been eliminated, as has the proposed exemption decision tool. In addition, we have dropped the regulatory requirement for the Secretary of HHS to publish a list of activities that are minimal risk (as was proposed in the NPRM in the definition of minimal risk). The final rule retains the requirement at § __.110(a) that the Secretary of HHS will establish and publish for public comment a list of categories of research that may be reviewed by an IRB through the expedited review procedure, consistent with the pre-2018 rule.

Some of the “new ideas” for altering the system for protecting research subjects that were presented by commenters—for example, addressing compensation for research-related injuries or the meaning of equivalent protections when research is conducted in foreign countries—were either very innovative or not yet widely discussed. This made it difficult to adopt them at this point without further study and additional notice and opportunity for public comment. Therefore, the fact that one or another of these ideas was not incorporated into the final rule should not be viewed as a rejection of their possible merits, or an indication that they might not be explored in some future revision of the Common Rule or in guidance.

a. Process Issues

We carefully considered concerns voiced by commenters about the process that led to this final rule, and other legal concerns about the adequacy of that process. We concluded that the approach proposed in the NPRM and the approach adopted in this final rule are consistent with the Federal Government's obligations under the Administrative Procedure Act.

Regarding the concerns expressed that the Common Rule departments and agencies are not authorized to regulate humanities and social science research, this challenge had been asserted previously against the 1981 HHS protection of human subjects regulations, as well as the 1991 Common Rule, and in each case the regulatory agencies concluded that the regulation of humanities and social science research is justified. We continue to assert the authority to regulate humanities and social science research that falls within the scope of the final rule.

C. Signatories to the Common Rule

This section provides information about where each Common Rule department or agency's statutory authority for enacting and revising human subjects research protection regulation lies, and provides additional information about new signatories to the Common Rule.

The regulations are codified in each department or agency's title or chapter of the CFR. The Common Rule was based on HHS's regulations, 45 CFR part 46, subpart A, and includes identical language in the separate regulations of each department and agency.

Although they did not previously issue the Common Rule in regulations, four departments and agencies have historically complied with all subparts of the HHS protection of human subjects regulations at 45 CFR part 46. These are the Central Intelligence Agency (CIA), the Office of the Director of National Intelligence (ODNI), the Department of Homeland Security (DHS), and the Social Security Administration (SSA).

Pursuant to Executive Order 12333 of December 4, 1981, as amended, elements of the Intelligence Community must comply with the guidelines issued by HHS regarding research on human subjects found in 45 CFR part 46. This final rule does not supersede the Executive Order. The CIA will continue to adhere to the HHS regulations at 45 CFR part 46, pursuant to the Executive Order.

Through this rulemaking, DHS is codifying the final rule into its own agency regulations. DHS, which was created after issuance of the pre-2018 rule, has been required by statute (Pub. L. 108-458, title VIII, section 8306) to comply with 45 CFR part 46, or with equivalent regulations promulgated by the Secretary of Homeland Security or his designee. Through this rulemaking, DHS is issuing equivalent regulations, consistent with statute, and will comply with the DHS regulations as the requirements will be equivalent to compliance with HHS regulations at 45 CFR part 46, subpart A.

Through this rulemaking, SSA is codifying the final rule into its own agency regulations. SSA was separated from HHS in 1995 and, pursuant to the transition rules provided in Section 106 of title 1 of Pub. L. 103-296, has been required to apply regulations that applied to SSA before the separation, absent action by the Commissioner. With this rulemaking, SSA will follow the SSA regulations (adopting the provisions of this final rule) instead of HHS regulations at 45 CFR part 46, subpart A. (See Pub. L. 103-296 §106(b), 108 Stat. 1464, 1476.)

The Department of Labor (DOL), which was not a signatory to the pre-2018 rule, is now a signatory to this rulemaking and is codifying the final rule in DOL regulations for human subjects research that DOL conducts or supports.

The Consumer Product Safety Commission (CPSC), subject to Commission vote, intends to adopt this rule through a separate rulemaking.

The legal authority for the departments and agencies that are signatories to this action is as follows:

Department of Homeland Security, 5 U.S.C. 301; Pub. L. 107-296, sec. 102, 306(c); Pub. L. 108-458, sec. 8306. Department of Agriculture, 5 U.S.C. 301; 42 U.S.C. 300v-1(b). Department of Energy, 5 U.S.C. 301; 42 U.S.C. 7254; 42 U.S.C. 300v-1(b). National Aeronautics and Space Administration, 5 U.S.C. 301; 42 U.S.C. 300v-1(b). Department of Commerce, 5 U.S.C. 301; 42 U.S.C. 300v-1(b). Social Security Administration, 5 U.S.C. 301; 42 U.S.C. 289(a). Agency for International Development, 5 U.S.C. 301; 42 U.S.C. 300v-1(b), unless otherwise noted. Department of Housing and Urban Development, 5 U.S.C. 301; 42 U.S.C. 300v-1(b) and 3535(d). Department of Labor, 5 U.S.C. 301; 29 U.S.C. 551. Department of Defense, 5 U.S.C. 301. Department of Education, 5 U.S.C. 301; 20 U.S.C. 1221e-3, 3474; 42 U.S.C. 300v-1(b). Department of Veterans Affairs, 5 U.S.C. 301; 38 U.S.C. 501, 7331, 7334; 42 U.S.C. 300v-1(b). Environmental Protection Agency, 5 U.S.C. 301; 7 U.S.C. 136a(a) and 136w(a)(1); 21 U.S.C. 346a(e)(1)(C); sec. 201, Pub. L. 109-54, 119 Stat. 531; and 42 U.S.C. 300v-1(b). Department of Health and Human Services, 5 U.S.C. 301; 42 U.S.C. 289(a); 42 U.S.C. 300v-1(b). National Science Foundation, 5 U.S.C. 301; 42 U.S.C. 300v-1(b). Department of Transportation, 5 U.S.C. 301; 42 U.S.C. 300v-1(b).

II. To what does this policy apply?

Scope and Applicability of the Regulations

This section of the preamble describes changes made in the final rule with regard to its scope and applicability. Specifically, it addresses which entities are subject to the rule; coverage of clinical trials; department and agency discretion in applying the rule; the relevance of state and local laws; coverage of research conducted in foreign countries; the goal of harmonizing guidance across the federal entities; effective and compliance dates; and severability.

A. IRBs Not Operated by an Institution Holding a Federalwide Assurance (§ __.101(a)(1))

1. Background and Pre-2018 Requirements

Before this final rule, IRBs not operated by an institution holding an FWA were not directly subject to oversight for compliance with the Common Rule. In situations in which an institution relied on an IRB not operated by the institution, OHRP's practice was to hold the institution engaged in human subjects research accountable for compliance violations, even in circumstances in which the regulatory violation was directly related to the responsibilities of the IRB.

An institution might rely on an IRB not operated by that institution to review cooperative research, that is, research conducted at more than one institution. However, for some, such reliance has been considered problematic due to lack of direct regulatory accountability for these IRBs. Previously, the choice to have cooperative research reviewed by a single IRB was voluntary and, for federally funded research, most institutions have been reluctant to replace review by their own IRB with review by a single IRB not operated by that institution.

2. NPRM Proposal To Cover IRBs not Operated by an Institution Holding an FWA

For the reasons outlined above, and based on comments to OHRP's 2011 ANPRM, the NPRM proposed adding a new provision at § __.101(a) that would explicitly give Common Rule departments and agencies the authority to enforce compliance directly against IRBs that are not operated by an FWA-holding institution (sometimes referred to as “independent IRBs”). Under the pre-2018 rule, even if an institution engaged in research relied on an IRB operated by another FWA-holding institution, OHRP's practice has been to enforce compliance through the engaged institution and not the reviewing IRB.

Relatedly, another NPRM proposal would require single IRB review of multi-institution studies (see Section XII of this preamble). This proposal would place responsibility for meeting the relevant regulatory requirements on the IRB of record in a multi-institutional study, rather than on the institution engaged in the research.

3. Public Comments

Approximately 50 comments addressed this proposal, largely in support, because it would encourage institutions to rely on IRBs not operated by an FWA-holding institution when necessary and would place responsibility on the IRB and its decisions rather than on the institution relying on the IRB's determination. Commenters stated that this change could increase IRB accountability and protect institutions relying on IRBs that they do not operate. However, a few commenters supported the proposal only if the mandate for a single IRB of record in multi-institutional research was not implemented. That is, they supported the concept of holding IRBs not operated by the institution engaged in research accountable for compliance, but did not support it if it was intended solely to facilitate mandatory single IRB review for cooperative research, because they opposed that mandate. One organization that advocates for human subjects protections opposed the proposal because it did not believe that any research should be reviewed by an independent IRB, and feared this practice would become more frequent with this change. Several academic institutions opposed the proposal, as did a large trade organization, stating that this extension of the rule was not necessary.

4. Response to Comments and Explanation of the Final Rule: Authority To Enforce Compliance Directly Against IRBs Not Operated by an FWA-Holding Institution

New language at § __.101(a) is adopted that gives Common Rule departments and agencies the authority to enforce compliance directly against IRBs that are not operated by an assured institution. This authority will allow Common Rule departments and agencies to avoid involving other engaged institutions in enforcement activities related to the responsibilities of the designated IRB. It is anticipated that this change will reassure institutions using an IRB that they do not operate because compliance actions could be taken directly against the IRB responsible for the regulatory noncompliance, rather than against the institutions that relied on that review.

B. Coverage of Clinical Trials

1. Background and Pre-2018 Requirements

The Common Rule has historically applied to human subjects research that is conducted or supported by a Common Rule department or agency. Research that is not federally conducted or supported has not been subject to the Common Rule's requirements unless the U.S. institution receiving federal funding for research voluntarily extended the Common Rule to all research conducted at that institution, regardless of funding source.

The Institute of Medicine, the National Bioethics Advisory Commission, and others have stated that human subjects would be best protected by applying consistent ethical standards and a uniform system of regulatory oversight to all human subjects research conducted in the United States. Common Rule departments and agencies do not have statutory authority to directly apply the Common Rule to all human subjects research conducted in the United States. However, departments and agencies can require U.S. institutions that receive some federal funding from a Common Rule department or agency for research with human subjects to extend regulatory protections to all research studies conducted at the institution as a condition of funding. The 2011 ANPRM sought comment on this approach.

2. NPRM Proposal

The NPRM proposed changes in the regulatory language to extend the rule to all clinical trials, irrespective of funding source, that met three conditions: (1) The clinical trials are conducted at an institution that receives support from a federal department or agency for human subjects research that was not proposed to be excluded under the NPRM and was not exempt; (2) the clinical trials are not subject to FDA regulation; and (3) the clinical trials are conducted at an institution located within the United States.

The purpose of the proposed clinical trials extension was to ensure that clinical trials involving significant risks that would otherwise not be covered be subject to federal oversight. It was for that reason that the proposed extension excluded clinical trials subject to FDA oversight. The proposed extension also was based on whether an institution received funding specifically for other human subjects research that had to comply with the substantive requirements of the Common Rule. The Common Rule departments and agencies have a more substantial relationship with institutions that receive federal support to conduct research subject to the regulatory requirements than they do with institutions that receive such support for only exempt human subjects research.

The NPRM proposed that a clinical trial be defined as a research study in which one or more human subjects are prospectively assigned to one or more interventions (which may include placebo or other control) to evaluate the effects of the interventions on biomedical or behavioral health-related outcomes. By the term “behavioral health-related outcomes,” the NPRM recognized that clinical trials may occur outside of the biomedical context, and further stated that the studies addressed in the proposed definition of clinical trial are more likely to present more than minimal risk to subjects, and, therefore, require the highest level of oversight.

3. Public Comments

Approximately 70 comments discussed the proposal to extend the Common Rule to cover certain clinical trials. Opinion was mixed, with a slim majority opposing the proposed change. Universities and medical centers providing comments largely opposed the proposed measure, while professional associations and advocacy groups largely supported the proposal. We note that some of those who opposed the clinical trial extension did so because they felt that the proposal did not go far enough to include additional types of research.

Those supporting the proposed change indicated that it had the potential to ensure greater consistency of rules and protections for research subjects, thereby aiding efficiency and speeding the review process of study protocols. However, even those commenters who supported the proposal indicated that such an extension must fulfill the intent of a risk-based, streamlined approach to human subject protection, considering the effects of this extension on certain minimal risk research activities, such as student research, and social, behavioral, and educational research.

Those expressing opposition to this expansion of coverage noted concerns that: (1) Because the research institutions likely to engage in clinical trials already require IRB review of such research, the expansion would only increase administrative burdens (such as federal reporting requirements) for this type of research without a meaningful increase in protections to human subjects; (2) the regulatory extension to nonfederally funded clinical trials would encompass many minimal-risk social and behavioral research activities and currently unregulated institutional activities that involve randomization (such as nonfederally funded quality improvement or quality assurance activities); and (3) because an institution's funding status may change, implementation of this proposal would be complicated. Several commenters expressed concern about the lack of detail in the NPRM regarding the planned implementation of the proposed requirement.

Several commenters also expressed concern that the unfunded clinical trials encompassed by this proposal would be subject to the single IRB mandate without a corresponding provision of federal funds to implement that requirement.

Some commenters suggested that the proposed change in the NPRM will not address the real gap in human subjects protections—facilities that receive no federal funding—and that if broad concern exists that some subjects are not being adequately protected in research that is not federally funded, then Congress would be the appropriate body to address any such deficiency through legislation. Further, some commenters expressed concern that extending the Common Rule to nonfederally funded clinical trials might have an overall effect of decreasing human subject protections by discouraging some smaller organizations from accepting any federal funding, thus removing federal oversight of their work.

One research institution noted that, if finalized, the proposed clinical trials extension would be implemented at the same time the ability of institutions to formally extend the application of the rule to all research conducted at the institution is being eliminated. Some states, such as Virginia, have state human subjects regulations that must be applied to research when federal regulations are not required. The commenter noted that removing the option to voluntarily extend the FWA would have the effect of reducing uniform application of the federal standards, as nonfederally funded research that does not meet the proposed definition of a clinical trial would by default be subject to state law.

A few commenters challenged whether the legal authority provided by the Public Health Service Act was sufficient to extend the Common Rule to nonfederally funded clinical trials. Commenters also suggested that this proposal is an unfunded mandate from the Federal Government with no benefit accruing to subjects or the research enterprise.

4. Response to Comments and Explanation of the Final Rule: Coverage of Certain Clinical Trials

The final rule does not adopt the NPRM proposal. Although we continue to maintain the position that increased harmonization of appropriate standards for ethical oversight of human subjects research is an important and desirable endpoint, we agree with the concerns expressed by commenters suggesting that our proposal for extending the Common Rule to currently unregulated clinical trials would benefit from further deliberation. Some commenters asserted that, in our attempt to close the perceived “gap” in oversight, the NPRM created a structure that would be both confusing and complicated for institutions to implement. We received multiple comments objecting to the administrative complexity involved in applying a regulatory extension triggered by the receipt of Common Rule department or agency funding for other nonexempt research, and asserting that the administrative burden is not offset by a corresponding increase in the meaningful protection of human subjects. Additionally, it is apparent from the public comments received that our intention to apply the Common Rule to cover the most risky types of research—clinical trials—was not accomplished through the NPRM proposal, given the definition of “clinical trial” included in the NPRM, as that definition encompassed research that would pose no more than minimal risk to subjects. Commenters were further concerned that an unintended consequence might be that the proposed extension would apply to low-risk student research and social, behavioral, or educational research, and would cause currently unregulated institutional activities, such as certain quality improvement or quality assurance activities, to fall within regulatory oversight. Upon reflection on the perspectives expressed by these commenters, we are persuaded that the proposed extension of the Common Rule is not appropriate to include in a final rule at this time. We will continue to carefully consider the related issues.

As an alternative, we contemplated explicitly limiting the extension of this policy to clinical trials that present greater than minimal risk to subjects in order to better align with the intent of this extension, as described in the preamble to the NPRM. However, such an alteration of the rule would itself introduce a variety of complexities, including the question of how a determination would be made that a particular activity involves more than minimal risk. Thus, there would be a very real possibility that such a rule would lead to an administrative burden on substantially more activities than the rule itself would be targeting (such as many minimal risk quality improvement activities).

We also considered the alternative of maintaining the pre-2018 standard of allowing institutions to voluntarily extend their FWAs to nonfederally funded research. We concluded that this alternative would not further the expressed goal of increasing the application of consistent protections to clinical trials, regardless of the source of support, because the extension of the FWA would be optional. We therefore plan to implement the proposed nonregulatory change to the assurance mechanism to eliminate the voluntary extension of the FWA to nonfederally funded research.

We note the concern expressed by commenters that a gap in federal oversight will remain for nonfederally funded research, and the comment that Congress would be the appropriate body to address any such deficiency through legislation. We recognize that institutions may choose to establish an institutional policy that would require IRB review of research that is not funded by a Common Rule department or agency (and indeed, as commenters noted, almost all institutions already do this), and nothing in this final rule precludes institutions from providing protections to human subjects in this way. As a result, the final rule continues to allow institutions the same wide degree of flexibility that they currently have with regard to making other similar determinations regarding ethical oversight of research not regulated by the Common Rule.

Although we are not implementing the proposed extension of the Common Rule to “clinical trials” (as defined by this policy), the proposed definition of “clinical trial” is still relevant to the final rule provision requiring posting of one IRB-approved consent form used to enroll subjects for a clinical trial conducted or supported by a federal department or agency, at § __.116(h). The definition of clinical trial is unaltered from the NPRM proposal and appears at § __.102(b).

C. Activities Deemed Not To Be Research Appear at § __.102(l) and Research Exempt From This Policy Appears at § __.104

In response to the public comments, the NPRM's general approach of designating various categories of activities as excluded is not included in the final rule. The final rule reverts to the general structure of the pre-2018 rule and integrates some of the categories proposed for exclusion in the NPRM into that structure. Some changes to the categories are also included in the final rule.

In the final rule, some of the proposed exclusions from the requirements of the Common Rule are addressed in the definition of research, which includes a provision identifying “activities that are deemed not to be research” (see Section III). In addition, some of the proposed exclusions are included as exemptions in the final rule. Under § __.101(b) of the pre-2018 rule, six categories of research were considered exempt from this policy unless otherwise required by department or agency heads. In the final rule, exempt research is now described at § __.104 and eight categories are included (see Section V).

D. Department or Agency Discretion in Applying the Policy (§ __.101(c), (d), (i))

1. Background and Pre-2018 Requirements

The pre-2018 requirements included provisions at § __.101 that allowed federal department or agency heads to determine which specific activities or classes of activities are covered by the rule and whether certain requirements could be waived. This flexibility was allowed in recognition of the varying missions of the federal departments and agencies, the possibility that there may be superseding or alternative statutes or regulations governing their activities, and the possibility that a given situation requires either more stringent oversight (e.g., “sensitive research”) or reduced requirements (e.g., a public health emergency).

2. NPRM Proposals

The NPRM proposed to retain the Common Rule's pre-2018 requirement that federal department or agency heads retain final judgment about the coverage of particular research activities under the Common Rule (§ __.101(c)) and proposed an additional requirement that federal department or agency heads exercise their authority consistent with the principles of the Belmont Report.

The NPRM also proposed at § __.101(d) that a department or agency may require additional protections for specific types of research it supports or conducts, or that is otherwise subject to regulation by the federal department or agency but not otherwise covered by the Common Rule. However, advance public notice would be required when those additional requirements apply to entities outside of the federal department or agency itself. This latter requirement was intended to promote harmonization among federal agencies or departments, to the extent possible, and to ensure transparency between funding entities and the regulated community.

Finally, at § __.101(i) the NPRM proposed to amend the criteria for a department or agency waiving the applicability of some or all of the provisions of the policy, by stating that the alternative procedures to be followed must be consistent with the principles of the Belmont Report. The addition of this provision was to make explicit the ethical basis underpinning how waiver decisions have and must be considered. The NPRM also proposed that such waivers be posted on a publicly accessible federal Web site.

3. Public Comments

Approximately 25 comments related to the NPRM proposals at § __.101(c) and (i) and none on § __.101(d). Comments received on these proposals generally expressed opposition to ever granting the authority to department or agency heads to retain final judgment as to whether a particular activity is covered by this policy, or to waive certain requirements, even though these provisions existed in the pre-2018 rule. These commenters were concerned about the potential for Common Rule departments and agencies to exclude certain activities for political purposes or for expediency, such as certain activities that might involve surveillance or criminal investigative aims. With regard to § __.101(i), some commenters stated that reference to the ethical principles of the Belmont Report was too narrow. That is, one might rely on additional ethical considerations to evaluate the applicability of the regulations.

4. Response to Public Comments and Explanation of the Final Rule: Department or Agency Discretion About Applicability of the Policy

The final rule adopts the NPRM proposals in § __.101(c). Thus, under § __.101(c), department or agency heads retain final judgment as to whether a particular activity is covered by the Common Rule, and this judgment should be exercised consistent with the ethical principles of the Belmont Report. We note that under the pre-2018 requirements Common Rule departments and agencies retained final authority as to whether a particular human subjects research study conducted or supported by that department or agency is covered by the Common Rule (§ __.101(c)) and that authority continues under the final regulations, but with the new limitation that this judgment must be consistent with the ethical principles of the Belmont Report. This discretion provides important flexibility given the varying missions and policies of the many departments and agencies.

Although some commenters were opposed to ever granting departments or agencies the authority permitted by § __.101(c), we believe requiring that these decisions be consistent with the principles of the Belmont Report is an approach that promotes accountability while still giving federal departments and agencies the necessary flexibility to achieve their respective missions.

The final rule in § __.101(d) does not adopt the NPRM proposals, and instead retains the pre-2018 language. The NPRM proposed to modify § __.101(d) to say that department or agency heads could require additional protections to research activities conducted or supported by federal departments or agencies, but that were not otherwise covered by the Common Rule. This language was intended as a clarification to the pre-2018 language. However, we determined that the term “additional protections” could potentially be confusing in that the activities at issue in this provision are those for which no Common Rule protections are required; thus the protections imposed by department or agency heads might be the only protections to which these activities are subject. We also note that departments or agencies conducting or supporting an activity subject to the Common Rule may require additional protections for human subjects.

The final rule also does not incorporate the NPRM proposal in § __.101(d) that advance public notice must be provided when a department or agency head requires that the Common Rule, or part of it, be applied to research activities not otherwise subject to the rule. Upon further assessment, we decided that such a requirement could hinder the ability of a department or agency to move quickly in cases where the department or agency determined that additional protections are warranted.

Section __.101(i) of the final rule adopts a majority of the NPRM proposals. As proposed in the NPRM, § __.101(i) is modified to require that any alternative procedures adopted by departments or agency heads are consistent with the principles of the Belmont Report. Also as proposed in the NPRM, § __.101(i) is modified to state that, unless otherwise required by statute or executive order, notice of these alternative procedures must be forwarded to OHRP (or any successor office), or to the equivalent office within the appropriate federal department or agency. The pre-2018 rule only listed OHRP (or any successor office) as the office to which notices must be sent. This final rule modification is intended to ensure that if a non-HHS department or agency allows for alternative procedures, the appropriate office within that same department or agency receives notification. The final rule retains the pre-2018 requirement for the notice to also be published in the Federal Register or in such other manner provided for in department or agency procedures.

The final rule also adopts in § __.101(i) the NPRM proposal to require that the waiver notice include a statement that identifies the conditions under which the waiver will be applied and a justification as to why the waiver is appropriate for the research, including how the decision is consistent with the principles in the Belmont Report.

Section __.101(i) of the final rule does not include the NPRM proposal that would have required each federal department or agency conducting or supporting the research to establish on a publicly accessible federal Web site a list of the research for which a waiver has been issued. We decided that the rule's requirement to publish the waiver notice in the Federal Register, or in such other manner as provided in department or agency procedures, adequately ensures that the waiver notice will be available to the public without also requiring that such notices be listed on a federal Web site. We note that some departments, such as HHS, currently post such notices on their Web sites.

The final rule thus formally codifies in § __.101(c) and (i) the general practice that the ethical standards articulated in the Belmont Report are the ethical standards that Common Rule departments or agencies will use in determining whether an activity is covered under this policy or whether to grant a waiver of the applicability of some or all of the provisions (unless otherwise required by law). The addition of the reference to the Belmont Report makes explicit the ethical basis underpinning how waiver decisions have and must be considered.

E. State and Local Laws That Provide Additional Protections for Human Subjects (§ __.101(f))

1. Background and Pre-2018 Requirements

The pre-2018 rule specified that the policy does not affect any state or local laws or regulations that may otherwise be applicable and that provide additional protections for human subjects. The NPRM did not propose any changes to this statement. However, questions raised by public comments, as described below, led to some clarifications to the final rule.

1. Public Comments

Several public comments raised questions and concerns about the ability of tribal nations to require additional protections that might be needed for research involving American Indian/Alaska Native (AI/AN) populations.

One tribal government noted the documented mistrust of research by AI/AN people and communities, and advocated for specific provisions acknowledging the authority and role of tribal nations in overseeing research that happens on their lands and with their citizens. Additionally, this entity noted that tribal nations do not always have their own regulatory bodies for human subject research protections, expressing concern about external groups deciding what constitute risks and benefits for the community.

Other AI/AN Population concerns of commenters included:

• Tribal (i.e., group) and individual consent for secondary research with biospecimens: Commenters noted that group consent can occur and should inform the proposed changes in the rule. They also noted that broad consent for future, unspecified research use of biospecimens presents a challenge to the ongoing ability of both tribes and individuals to choose to remove their data from research, or to understand how their information is being used to benefit, or put at risk, themselves or others.
• Tribal and individual consent for research with biospecimens or other data from people who are no longer alive: AI/AN groups noted the need to address protections for biospecimens initially collected from living humans after those humans pass away.
• Research oversight by tribal IRBs and other tribal regulatory bodies: AI/AN groups raised concerns about the use of a single IRB in cooperative and multi-institutional research, which does not foster community-based governance and oversight of research that has the potential to improve outcomes for tribal and minority populations.
• Research oversight for categories of research and activities important in tribal contexts: Commenters noted concerns about the proposed changes related to the exclusion of certain categories of activities (e.g., oral history, biography), addition of exempt categories of research (e.g., educational tests, surveys, interviews), and elimination of continuing review requirements for some studies because tribal research review often extends the scope of examination beyond individual-level protections to enact community-level protections important for maintaining the integrity of culturally significant information and practices. Changes to excluded and exempt categories of research and eliminating some continuing review requirements, especially where no clear mechanism for additional tribal oversight and input has been established, are a cause for concern for the AI/AN community.

2. Response to Public Comments and Explanation of the Final Rule: State and Local Laws That Provide Additional Protections

Consistent with the pre-2018 rule, this final rule retains the language in § __.101(f)) providing that the Common Rule does not affect any state or local laws or regulations that may otherwise be applicable and that provide additional protections for human subjects. However, the final rule adds clarifying language providing that the referenced state or local laws or regulations include tribal laws passed by the official governing body of an AI/AN tribe. Thus, if the official governing body of a tribe passes a tribal law that provides additional protections for human subjects, the Common Rule does not affect or alter the applicability of such tribal law. (Note that a similar change was also made to § __.116(i) and (j) to provide the same clarification.) In addition, for purposes of the exception to the single IRB review requirement for cooperative research, relating to circumstances where review by more than a single IRB is required by law, § __.114(b)(2)(i) specifies that tribal law is to be considered in assessing whether more than single IRB review is required by law.

F. Research Covered by This Policy Conducted in Foreign Countries (§ __.101(h))

1. Background and Pre-2018 Requirements

The pre-2018 requirements at § __.101(h) stated that when research covered by this policy takes place in foreign countries, procedures normally followed in those countries to protect human subjects may differ from those set forth in this policy. The previous rule cited the Declaration of Helsinki, as amended in 1989, as an example of internationally recognized ethical standards that a foreign country might use as its ethical standard. The rule provided that if a department or agency head determined that procedures prescribed by the institution in the foreign country afforded protections that are at least equivalent to those provided in this policy, the department or agency head may approve the substitution of the foreign procedures in lieu of the procedural requirements provided in this policy.

2. NPRM Proposal

The NPRM proposed to remove the specific reference to the Declaration of Helsinki in this provision. A concern with providing a specific example of an internationally recognized ethical document is that such a document is subject to change independent of Common Rule departments and agencies, and therefore could be modified to contain provisions that are inconsistent with future U.S. laws and regulations.

3. Public Comments

A few comments addressed the removal of the reference to the Declaration of Helsinki. These comments were equally divided between those opposed and those supportive or generally supportive. Those opposed feared that the removal of the reference would suggest that the Declaration of Helsinki does not apply and that it was cited in the pre-2018 requirements as an example, not as an equivalent replacement for the Common Rule. These commenters also noted that the United States had refused to sign on to some recent revisions to the Declaration. One organization commented that it would have been useful for the NPRM to address the issue of equivalent protections for U.S.-funded research conducted in foreign countries, as that might have addressed ongoing concerns about the use of alternative systems of protections when research is conducted outside the United States. Those supportive of removing the reference to the Declaration of Helsinki agreed with the arguments laid out in the NPRM and felt that it was judicious to not align U.S. regulations with other standards because those standards are likely to change, perhaps in ways inconsistent with U.S. policy.

4. Response to Public Comments and Explanation of Final Rule: Removing the Reference to the Declaration of Helsinki

The final rule adopts the NPRM proposal. Although the pre-2018 requirements cited the Declaration of Helsinki as an example of internationally recognized ethical standards that a foreign country might use as its ethical base, we note that providing a specific example of an internationally recognized ethical document is concerning because such a document is subject to change independent of Common Rule department or agency policies, and therefore might be modified in ways that create standards that are inconsistent with U.S. laws and regulations.

G. Harmonization of Department and Agency Guidance (§ __.101(j))

1. Background and Pre-2018 Requirements

Each Common Rule department and agency and the Food and Drug Administration (FDA) are authorized to issue its own guidance with regard to interpreting and implementing the regulations protecting human subjects. That guidance may differ substantially across entities. Currently, multiple efforts are underway to address variation in guidance across the Federal Government, but no regulatory requirement exists for departments and agencies to consult with other departments before issuing a policy, to the extent appropriate. As a result, interdepartmental communication has been at times uneven, leading to potentially avoidable inconsistencies. The Common Rule departments and agencies have procedures for sharing proposed guidance before it is adopted, and these procedures have generally been successful. Additionally, FDA and OHRP have worked closely to ensure harmonization of guidance to the extent possible, given the differing statutory authorities and regulatory missions. Also, as mentioned earlier in section I.B., the 21st Century Cures Act was enacted in December 2016. Among other things, it requires that the Secretary of HHS, to the extent practicable and consistent with other statutory provisions, harmonize the differences between 45 CFR part 46, subpart A, and FDA's human subject regulations.

2. NPRM Proposal

Responses to questions in the 2011 ANPRM about the need for harmonization of guidance across Common Rule departments and agencies reflected widespread support for such efforts. Several commenters acknowledged the difficulty of getting all Common Rule departments and agencies to agree on all issues, as each has a different mission and research portfolio. However, they encouraged seeking harmonized guidance whenever possible. Thus the NPRM proposed that the regulations contain language requiring consultation among the Common Rule departments and agencies for the purpose of harmonization of guidance, to the extent appropriate, before guidance on the Common Rule is issued, unless such consultation is not feasible. The NPRM requested public comment on whether the proposed language would be effective in achieving greater harmonization of department and agency guidance, and if not, how it should be modified.

3. Public Comments

Approximately 60 comments were received regarding this proposal, and they were almost equally divided for and against it, although some of those opposed thought it did not go far enough to achieve the intended goal. Those who supported the proposal, either fully or partially, cited concerns they have as institutions, investigators, or IRBs in navigating different sets of regulations and different department or agency guidance documents. As noted above, among those who opposed the proposal, some expressed concern that the proposed language about harmonization did not go far enough. That is, they thought the language should mandate harmonization in guidance across Common Rule departments and agencies. These commenters felt that without a requirement to harmonize, federal departments and agencies will continue with business as usual and policy and guidance will continue to differ, creating complexity in the research environment. For example, one large research university emphasized the importance of harmonization across federal departments and agencies regarding guidance on the protections of human subjects for investigators, IRB administrators, and human subjects, and felt that the proposed language in the Common Rule NPRM might be ineffective in harmonizing agency guidance. Several commenters emphasized the need, in particular, for greater harmonization between the Common Rule and FDA requirements, and between the Common Rule and the requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA; Pub. L. 104-191).

Others were concerned that this provision would, in effect, mean that Common Rule departments and agencies issue fewer guidance documents because of lengthy internal government review and approval processes.

4. Response to Public Comments and Explanation of the Final Rule: Harmonization of Guidance

We believe there is a compelling case for as much consistency as is possible regarding guidance on the protections of human subjects. As such, the final rule implements the NPRM proposal at § __.101(j). The final rule creates a requirement that guidance should be issued only after consultation among the Common Rule departments and agencies, while also permitting guidance to be issued without such consultation when it is not feasible. The proposal recognizes that harmonization will not always be possible or desirable given the varied missions of the departments and agencies that oversee the protection of human subjects and differences in their statutory authorities.

We note that some public comments expressed concern about the acceptable degree of variability among departments and agencies and encouraged attention to these concerns when diverging on guidance. The departments and agencies that oversee the protection of human subjects have a variety of missions and functions, including regulatory agencies and agencies that conduct and support research. In addition, in some cases, statutory differences among the departments and agencies have resulted in different regulatory requirements and guidance. They also oversee very different types and phases of research and thus may have reasonable justifications for differences in guidance. However, we agree that efforts should be made to issue collective guidance when possible and feasible and in a timely manner. We do not believe that this provision will result in the issuance of less guidance, because it largely codifies what has been the working practice among Common Rule departments and agencies up to this point.

H. Compliance Dates and Transition Provisions of the Final Rule (§ __.101(l))

1. NPRM Proposal

In the NPRM, we shared the expectation that both the effective date of the final rule (meaning the date that the regulatory text is published in the Code of Federal Regulations) and the general compliance date of the final rule (meaning the date after which, as a general matter, regulated entities must comply with this rule) would be 1 year after publication of the final rule in the Federal Register. The NPRM also proposed two exceptions that would provide different compliance dates for two provisions. The first proposed exception pertained to the NPRM's proposal that the Common Rule be extended to cover all biospecimens regardless of identifiability. The second proposed exception pertained to the NPRM's proposal that a single IRB would be responsible for certain multi-institutional clinical trials, also described as cooperative research. The NPRM proposed that both of these provisions would have compliance dates of 3 years after publication of the final rule in the Federal Register. The intent behind this proposed delay was to enable institutions to develop institutional policies and procedures necessary to implement these new requirements. The NPRM sought public comments about the advisability of this proposed approach as well as possible alternatives.

The preamble to the NPRM also discussed the option for institutions or investigators to implement provisions of the final rule anticipated to provide additional regulatory flexibilities voluntarily 90 days after publication of the final rule in the Federal Register. This proposed approach was intended to enable institutions or investigators to gain the benefit of revisions to the Common Rule as soon as possible. The NPRM proposed a 90-day timeframe for this flexibility to enable the Common Rule departments and agencies time to develop the documents and tools needed to assist institutions in implementing the rule's regulatory flexibilities (e.g., the Secretary's broad consent templates) and the Secretary's list of privacy safeguards.

The NPRM also explained that the proposed extension of the Common Rule to clinical trials that are not directly funded by a Common Rule department or agency, but that are conducted at an institution that receives funding from a Common Rule department or agency for other human subjects research, would not apply to an institution until the institution had received federal funding for nonexempt research in an award made after the effective date of the final rule.

The NPRM also proposed that ongoing human subjects research initiated before the effective date of the final rule would not need to comply with particular regulatory requirements.

In addition, the NPRM proposed a grandfather clause for research involving the use of biospecimens collected before the compliance date. This clause applied to the provision that would extend the Common Rule to cover all biospecimens, regardless of identifiability. Specifically, the NPRM proposed that such research would not need to comply with the final rule if any research uses of the biospecimens occurred only after removal of any individually identifiable information.

2. Public Comments

A majority of comments received on the effective dates opposed the NPRM's proposal that only nonidentified biospecimens would be grandfathered. Others commented on the proposed 3-year compliance date for the proposed expansion of the definition of human subjects to all biospecimens, regardless of their identifiability. In Section III, we discuss the determination not to finalize the biospecimen provisions, which addresses these comments. Some commenters expressed support for the general compliance date, as well as the delayed compliance date for the cooperative research provision.

Many commenters expressed the viewpoint that regulated entities would need to invest significant time and resources before they would be able to comply with the changes to the Common Rule proposed in the NPRM. Some commenters (including an academic institution and a hospital association) noted that such investments would have implications not only for research operations, but also for clinical care. Some commenters also noted their concern that 1 year was not enough time for institutions to comply with the large number of new and different regulatory requirements proposed in the NPRM and that such changes would necessitate significant modifications to their research and clinical enterprises and might impose hardships on IRBs, IRB staff, institutional leadership, and the regulated research community. Several commenters explained that the proposed 1-year general compliance period would not provide enough time to update written IRB procedures (which are required under the Common Rule), disseminate such procedures, update related documents (e.g., forms), and develop appropriate training materials. One of these commenters explained that accredited institutions will need time for accrediting bodies to align their accreditation standards with the revised regulatory standards or risk conflicts between meeting proposed regulatory standards and losing accreditations.

Other commenters recommended 2-year or 3-year general compliance dates (including some that recommended permitting institutions to comply earlier), noting that compliance would be particularly challenging for institutions with smaller research programs. At least one commenter argued that the 3-year compliance date for the proposed cooperative research provision was inadequate given the significant costs and time that would be associated with establishing reliance agreements between collaborating research sites, maintaining required documents at the reviewing IRB, and ensuring that applicable laws were followed. At least one commenter argued that the proposed effective and compliance provisions left institutions with the discretion to remove studies from the oversight of the Common Rule without establishing any protective standards for doing so.

One group representing multiple professional societies stated that the efficiencies achieved by eliminating protracted negotiations concerning consent forms and institutional responsibilities will far outweigh any upfront costs incurred through implementation of this policy, and advocated for a faster timeframe for compliance than the proposed 3 years from the time of final publication: 1 year for clinical trials and 2 years for research studies. Another commenter echoed these views.

We did not receive many comments concerning the proposal to allow institutions to implement provisions offering regulatory flexibilities before the compliance date.

3. Response to Comments and Explanation of the Final Rule: Compliance Dates and Transition Provisions

The effective date and compliance dates included in this final rule are intended to meet the same general objectives as those described in the NPRM. Nonetheless, the approach adopted in the final rule is different in certain respects from the approach proposed in the NPRM.

As a general matter, none of the proposed dates in the NPRM related to research with biospecimens will be implemented because the proposal included to extend the Common Rule to research with all biospecimens, regardless of identifiability, is not being implemented.

The final rule adopts an effective date and a general compliance date of 1 year from publication of this final rule in the Federal Register. During this 1-year timeframe, institutions will be able to revise forms, documents, and practices for consistency with the revisions reflected in this regulation. Although we recognize the work associated with compliance, we concluded that 1 year is a reasonable and adequate timeframe. We note that ongoing research studies that were initially approved by an IRB, waived pursuant to § __.101(i), or determined to be exempt before January 19, 2018 will not be required to comply with the changes reflected in this final rule.

Section 101(l) describes the regulatory requirements that will apply to specific categories of research once the final rule goes into effect. For clarity, § __.101(l) begins by defining two sets of requirements. First, as set forth in § __.101(l)(1), the pre-2018 rule is described as the “pre-2018 Requirements”, which refers to the Common Rule as published in the 2016 edition of the Code of Federal Regulations. As described below, certain ongoing research may be subject to these requirements.

Section 101(l)(3)-(4) describes the different regulatory requirements that apply to different categories of research. For clarity and in order to have an easy-to-implement standard, these categories are generally based upon the date the research was initially approved by an IRB, waived pursuant to § __.101(i), or determined to be exempt.

The first category of research, described in § __.101(l)(3), applies to research initially approved by an IRB, waived pursuant to § __.101(i), or determined to be exempt before January 19, 2018. We believe that such research (e.g., research for which an initial determination was made before the effective date of this final rule) should, as a general rule, be able to follow the same set of standards throughout the entire course of the research. The intent is to minimize burdens associated with research conducted over a period of time and to avoid a requirement that such research be subject to two sets of rules during the lifetime of the research. For that reason, this regulation adopts as a default rule, set forth in § __.101(l)(3), that research initially approved by an IRB, waived pursuant to § __.101(i), or determined to be exempted before January 19, 2018 (the effective date of this final rule) will not be subject to this final rule but will continue to be subject to the requirements of the Common Rule in place before January 19, 2018.

However, we also recognize that institutions may prefer, for a particular study initiated before to January 19, 2018, to comply with this final rule given the benefits that it offers and for administrative simplicity such as common regulatory requirements across an institution. Thus, § __.101(l)(3) permits institutions engaged in ongoing research that was initially approved by an IRB, waived pursuant to § __.101(i), or determined to be exempted before January 19, 2018, to choose, on a study-by-study basis, whether such research will be subject to the pre-2018 requirements (the rule in place before January 19, 2018, or the final rule. This is an exception and is offered as an additional flexibility to regulated entities. If an institution engaged in such research determines that it prefers to comply with the final rule for a particular research study, such research will be subject to the final rule if the institution formally makes a determination that the final rule will apply to such research and an IRB documents the decision made by the institution. If these requirements are not met or if the institution makes no decision, the pre-2018 requirements will apply to such research.

The second category of research, described in § __.101(l)(4), applies to research initially approved by an IRB, waived pursuant to § __.101(i), or determined to be exempted on or after January 19, 2018. Because such research does not begin and is not conducted until after the general compliance date of this final rule, this category of research is subject to the final rule throughout its lifetime.

A single IRB requirement for cooperative research has been adopted in § __.114(b) of this final rule. As set forth in § __.101(l)(2), this final rule adopts the proposed 3-year compliance date for this requirement to afford affected institutions sufficient time to prepare for and implement this requirement (e.g., developing institutional policies and procedures).

Although we understand the concerns expressed concerning the complexities that will be involved in establishing reliance agreements to satisfy the cooperative research provision adopted in this final rule, this final rule reflects the conclusion that a 3-year compliance date is adequate for this provision, based on our belief that this provision will offer significant benefits to institutions, particularly as the regulated community becomes accustomed to this requirement. In addition, we believe it is likely that the institutional policies, procedures, and standard documents needed to implement this regulatory provision will, over time, become increasingly standardized, which will significantly minimize the burden on institutions associated with this requirement. So long as all other regulatory requirements are satisfied, institutions may use a single IRB to oversee cooperative research even before this compliance date occurs with respect to any research that institutions believe may benefit from this approach.

This final rule does not adopt the proposal mentioned in the preamble to the NPRM to permit institutions and investigators to voluntarily implement provisions in the final rule that allow additional flexibilities 90 days after publication of the final rule. We determined that the approach adopted at § __.101(l)(3), and described above, offers institutions and investigators similar advantages with respect to the conduct of ongoing research, while providing greater clarity and more simplicity concerning which set of regulatory requirements apply to particular studies.

We disagree with the comment that the proposed timelines enable institutions to remove their studies from the oversight of the Common Rule without establishing appropriate standards for doing so. The final rule does not enable institutions to opt out of compliance with the Common Rule. The effective dates do afford institutions the discretion to choose, on a study-specific basis whether existing research should comply with the Common Rule in place when the research was initiated (the pre-2018 requirements) or this final rule (the 2018 requirements). This flexibility is offered only for certain ongoing research studies that were initially approved, determined to be exempt, or subject to a § __.101(i) waiver before the effective date of this final rule.

To explain the approach adopted in this final rule, the following chart describes the standards that apply to different categories of research:

I. Severability (§ __.101(m))

A severability clause has been added as § __.101(m), providing that if any provision of this final rule is held to be unenforceable in one set of circumstances, it should be construed to give maximum effect to the provision as applied to other persons or circumstances. Similarly, if a provision is held to be invalid or unenforceable, that provision should be severable from, and have no impact on the application of, the remainder of the rule. This provision reflects our intention regarding the way that this final rule, and the pre-2018 rule, should be construed and interpreted and is meant as a clarification.

III. Definitions for Purposes of this Policy (§ __.102)

The final rule revises and adds new definitions of key terms for the purposes of this policy, as summarized below. Some of the changes are made to clarify new provisions that appear elsewhere in the final rule. In addition, the definitions have been placed in alphabetical order to facilitate searching by the reader. The definitions of institution, IRB, and IRB approval are unchanged but appear in a different place in the regulatory language.

A. Certification (§ __.102(a))

Although “certification” was defined in the pre-2018 requirements, as was proposed in the NPRM, the final rule clarifies that notification by the institution that a proposed research study has been reviewed and approved is made to the supporting “federal” department or agency and that it might be a component of the agency or department that is notified rather than the entity as a whole. This clarification relates to the change included in the final rule at § __.102(d) regarding the definition of “federal department or agency” that clarifies that this phrase refers to the department or agency itself, not its bureaus, offices, or divisions. There were no public comments on this clarification.

B. Clinical Trial (§ __.102(b))

1. Background and Pre-2018 Requirements

The pre-2018 rule did not include a definition of “clinical trial.”

2. NPRM Proposal

The NPRM proposed defining “clinical trial,” for purposes of this policy, as a research study in which one or more human subjects are prospectively assigned to one or more interventions (which may include placebo or other control) to evaluate the effects of the interventions on biomedical or behavioral health-related outcomes. In addition, the NPRM requested public comment on whether the proposed definition should include additional explanation of what is encompassed by the term behavioral health-related outcomes.

3. Public Comments

Approximately 20 comments explicitly addressed the definition of “clinical trial” included in the NPRM. All expressed concern that the proposed definition encompassed more activities than intended, given the NPRM discussion that the definition was intended to cover the riskiest research. Commenters who responded asked for some type of clarification, either in guidance or in the regulatory language itself about the term “behavioral health-related outcomes.” One commenter noted that clinical trials involving activities such as behavioral interventions, psychotherapy, or skills training, for example, should be included in the proposed regulations of clinical trials in a risk-based manner, as for nonbehavioral studies. That is, greater oversight would be required for trials with a higher potential degree of risk, regardless of what type of trial. The commenter noted that certain populations for whom behavioral health research is conducted are high risk by nature, such as chronically suicidal individuals. Another commenter asked that the regulatory language include additional explanation of what is encompassed by the term “behavioral health-related outcomes” because practitioners and researchers conceptualize the term differently.

4. Response to Comments and Explanation of the Final Rule Definition of Clinical Trial

The final rule at § __.102(b) adopts the NPRM definition of “clinical trial,” which is a research study in which one or more human subjects are prospectively assigned to one or more interventions (which may include placebo or other control) to evaluate the effects of the interventions on biomedical or behavioral health-related outcomes. We generally expect that this definition will be applied harmoniously with the definition of clinical trial recently promulgated in the ClinicalTrials.gov final rule.

In response to public concerns about an overly expansive definition of “clinical trial” given the importance of that definition to the proposed extension of the rule to clinical trials previously not covered by the rule, we have eliminated that proposed expansion of coverage in this final rule. As such, the definition that appears in the final rule will only be relevant to the requirement for posting of consent forms for clinical trials conducted or supported by Federal departments or agencies (§ __.116(h)). It should be appropriate for that relatively narrow regulatory purpose.

C. Department or Agency Head and Federal Department or Agency/Institutions (§ __.102(c) (d) and (f))

1. Background and Pre-2018 Requirements

The pre-2018 rule provided a definition of “department or agency head.” The phrase appeared repeatedly throughout the regulations.

2. NPRM Proposals

New definitions of “department or agency head” and “federal department or agency” were proposed in the NPRM to clarify requirements related to federal department and agency discretion in applying the policy to their funded or conducted research.

3. Public Comments

There were no comments directly related to these proposed revisions.

4. Explanation of the Final Rule: Definition of Department or Agency Head, Federal Department or Agency, and Institution

The final rule adopts the NPRM proposals to provide new definitions of “department or agency head” and “federal department or agency,” which appear at § __.102(c) and (d). “Department or agency head” at § __.102(c) refers to the head of any federal department or agency, for example, the Secretary of HHS, and any other officer or employee of any federal department or agency to whom authority has been delegated. To add clarity to the definition found in the pre-2018 regulations, the example of the Secretary of HHS was inserted.

The final rule provides at § __.102(d) a definition of “federal department or agency” in order to avoid confusion as to whether this phrase encompasses federal departments and agencies that do not follow the Common Rule. The definition also clarifies that this phrase refers to the department or agency itself, not its bureaus, offices, or divisions. This is consistent with the historical interpretation of the Common Rule. Related to this, the definition of “institution” was changed at § __.102(f) in the final rule to clarify that departments can be considered institutions for the purposes of this policy. The final rule provides examples of what is intended by this definition: HHS, the Department of Defense, and the Central Intelligence Agency.

D. Human Subject (§ __.102(e))

1. Background and Pre-2018 Requirements

The pre-2018 rule defined “human subject” as a living individual about whom an investigator (whether professional or student) conducting research obtains (1) data through intervention or interaction with the individual, or (2) identifiable private information. Further, the pre-2018 rule asserted that “private information” was considered individually identifiable if the identity of the subject is or may readily be ascertained by the investigator or is associated with the information.

Thus, in cases where no intervention or interaction with an individual occurred, determining the meaning of “identifiable” and “readily ascertainable” was central to determining whether human subjects were involved in a research activity covered by the pre-2018 rule. Under the pre-2018 rule, provided the data were collected for purposes other than the currently proposed research, it was permissible for investigators to conduct research on biospecimens and data that had been stripped of all identifiers or coded without obtaining consent because the nonidentified biospecimens and data did not meet the regulatory definition of a human subject.

Moreover, “private information” was not considered to be identifiable under the pre-2018 rule if the identity of the subject is not or may not be “readily ascertained” by the investigator from the information or associated with the information.

If the definition of “human subject” was met, together with the other significant requirements, the pre-2018 rule required IRB review and approval unless the study was exempt. IRB waiver of informed consent was allowable under the Common Rule, if the research study satisfied the criteria for waiver of informed consent.

2. NPRM Proposal

The NPRM proposed to revise the definition of “human subject” to include research in which an investigator obtains, uses, studies, or analyzes biospecimens, regardless of identifiability. Thus, the focus of this proposal was to require informed consent for research involving biospecimens in all but a limited number of circumstances. In addition, the NPRM proposal would have still permitted IRBs to waive the requirement for informed consent for research use of biospecimens, but the requirements for approval of such waivers would have been very strict, and such waivers would have occurred only in rare circumstances (see Section XIV on waiver of informed consent). This expansion of the definition of “human subject” would also have triggered other provisions of the NPRM relating to the use of biospecimens, including security measures. Thus, it was a complex and far-reaching proposal.

The NPRM also offered two alternative proposals to altering the definition of “human subject,” both of which maintained “identifiability” as a major aspect of determining applicability of the Common Rule to biospecimens. The public was asked to comment on which of the three proposals achieved the most reasonable tradeoff between the principles of autonomy and beneficence.

Alternative Proposal A would have expanded the definition of “human subject” to include whole genome sequencing (WGS). Under this alternative, WGS would have been considered to be the sequencing of a human germline or somatic biospecimen with the intent to generate the genome or exome sequence of that biospecimen.

Alternative Proposal B would have expanded the definition of “human subject” to include the research use of information that was produced using a technology applied to a biospecimen that generated information unique to an individual. In such a case, it was foreseeable that, when used in combination with publicly available information, the individual could have been identified. Information that met this standard would have been referred to as “bio-unique information.”

The NPRM also asked the public to comment on whether the rule should include a definition of “biospecimen” and whether the rule should be clearer and more direct about the definition of “identifiable private information.”

The NPRM also proposed some minor changes to the wording of the definition of “human subject” merely to clarify how the word “obtains” has been interpreted.

The NPRM did not propose any major substantive modifications to the descriptions of “private information” and “identifiable private information” found in the pre-2018 rule. However, the NPRM proposed clarifying language with regard to “private information” and “identifiable private information.” The pre-2018 rule used the example of a medical record as constituting private information. The NPRM added the example of a biospecimen in keeping with the proposal to expand the definition of “human subject” to include all biospecimens. In addition, the NPRM proposed adding the words “shared or” to the description of what constitutes “private information,” for the purpose of expanding the scope of the information that would be described by that term.

In addition, the NPRM asked for public comment about whether a different identifiability standard would be appropriate. One alternative discussed was to adopt the term “identifiable private information” with the term used across the Federal Government: “personally identifiable information” (PII). PII refers to information that can be used to distinguish or trace an individual's identity (such as name, social security number, biometric records) alone, or when combined with other personal or identifying information that is linked or linkable to a specific individual, such as date and place of birth, or mother's maiden name. It acknowledged that replacing “identifiable private information” with “PII” would increase the scope of what is subject to the Common Rule. Subsequent to the release of the NPRM, the Office of Management and Budget (OMB) updated government-wide guidance for managing personally identifiable information.

Related to this issue, the NPRM noted new legislative developments, specifically the Newborn Screening Saves Lives Reauthorization Act of 2014 (Pub. L. 113-240), signed into law in December 2014. The law required consent for federally funded research with newborn dried blood spots and prohibits IRBs from waiving consent. These changes were to be effective until updates to the Common Rule were promulgated, and applied whether or not the newborn dried blood spots would be considered “identifiable private information” under the regulatory definition.

3. Public Comments

a. Public Comments on the Primary NPRM Proposal

The proposal regarding revising the definition of “human subject” to include biospecimens regardless of identifiability was commented on by almost 50 percent of the commenters. Others commented on the effects such an expansion would have on consent requirements, the ability to waive consent, and the applicability of exemptions and exclusions. The vast majority of commenters who addressed this expansion (80 percent) were opposed to it for a variety of reasons, particularly because of the implications of this change for requiring consent for most research uses of biospecimens that were collected as part of clinical care.

A majority of these commenters responded as members of the general public (that is, not explicitly affiliated with a specific organization or institution) or as patients (including family members of patients). Patients tended to oppose these proposals, focusing on the additional and more stringent criteria for waiver of informed consent because they believed the effects of the proposals would be that many people would not provide consent, thus restricting access by investigators to biospecimens, which would in turn slow research. Investigators also expressed concerns about the negative impact on research. Organizations and institutions with some affiliation with the research enterprise expressed opposition to this suite of proposals as well, but for different reasons, as discussed further below.

Most support for the expansion of the definition of “human subject” to encompass all biospecimens and its implications for consent, waiver of consent, and exempt research came from members of the public who argued that they wanted to always be consulted before their biospecimens were used in research, without exception. Within this group, a strong majority opposed the comprehensive biospecimen-related proposals because they were uncomfortable with the concept of broad consent (as discussed in Section IIV of this preamble) to any future research use of those biospecimens and the existence of any type of over-ride by an IRB of the requirement to obtain informed consent.

Many of the commenters supporting the expansion stated that it would respect autonomy by requiring that nearly all research with biospecimens be subject to IRB review and informed consent requirements. Others expressed distrust of the medical and scientific enterprises. One member of the public felt that consent should be required for government research seeking to use an individual's biospecimens, and that researchers should be required to inform the individual of the “who, what, how, and why” of the desired research.

Many of those who expressed support for this proposal also indicated that they felt it important for their biospecimens to be anonymized in research activities. For example, a member of the public with experience in biobanking expressed a willingness to consent to the use of his biospecimens to advance science, but called for a mechanism to inform the public about such research use even if some individuals might decline to participate. The commenter stressed the importance of respecting the individual's right to know and refuse, citing privacy concerns and stressing the importance of anonymity of biospecimens to protect individuals from potential negative consequences.

Still others supported the expansion of the definition of “human subject” to include all biospecimens because of a desire to receive research results or to financially profit from discoveries, implying that retaining identifying information with biospecimens would enable both of these possibilities. Some who felt there is an entitlement to financially profit from discoveries described biospecimens as personal property. For example, one commenter compared the use of an individual's biospecimens without consent to one party illegally taking another's property such as land, a house, or an arm.

Several commenters noted that medical services should not be allowed to be contingent upon a person's consent to use of their leftover biospecimens for research despite the fact that this was not proposed in the NPRM. In fact, the pre-2018 rule states that informed consent must include a statement that “refusal to participate will involve no penalty or loss of benefits to which the subject is otherwise entitled” and that element appears in the final rule as well.

For example, one commenter indicated that patients should be informed and be given the opportunity to consent to the use of their body tissues, and if one declines consent, the individual should not be denied treatment or receive diminished care. In other words, they felt that consent should never be a condition of treatment.

The reasons for opposing the expansion of the definition of “human subject” to include all biospecimens were numerous, including: the feasibility of obtaining broad consent in a clinical setting; the costs of obtaining, tagging, and tracking consents given the low risk nature of the research in question; allowing autonomy to trump beneficence and justice; insufficient evidence of risk or public concern about the issue; the fact that it would result in fewer specimens collected from fewer sources, with adverse implications for rare diseases and for justice; the idea that requiring all biospecimens to remain identified poses greater privacy and confidentiality risks than the current system; and overall negative impacts on research.

Many expressed concern about the number of biospecimens that might no longer be available for research, not out of concern that individuals would decline to have their leftover tissue used in research, but rather because many hospitals and medical providers might decline to enact the expensive consent and tracking system that the NPRM envisioned. Some commenters were concerned that this would then limit the heterogeneity of biospecimens obtained and stored, as community hospitals and clinics might opt out of participating in such collections.

Several comments suggested that for academic medical centers where a large amount of research is conducted, research activities often do not result in profits, and that the proposed policies would come at great costs to institutions already struggling to financially sustain a healthy research enterprise. For example, one commenter noted that the NPRM proposal would require additional resources to obtain consent, which would hinder smaller institutions with fewer staff or resources available in their ability to contribute to scientific and medical research, and limit the opportunities for patients at these facilities to participate in research. The commenter also pointed out that academic institutions rarely receive significant financial gain from their research, and institutions sometimes share biospecimens, which can be valuable in research, especially in the case of uncommon and poorly understood diseases. Thus, this commenter expressed concern that biospecimens might not be available for research given the requirements of the proposed policy.

Many members of the public with rare diseases commented on how research into their specific diseases might be affected should the NPRM proposal be finalized. For example, several commenters expressed interest in the proposed rule because they or a family member had been diagnosed with a desmoid tumor, which are often limb threatening and sometimes life threatening. Research using tissue blocks is critical to determine how to treat these tumors, which are rare and can vary among patients. The commenter felt that the proposed rule would make desmoid tumor research virtually impossible by reducing access to the already low number of tissue blocks available for research.

More than one academic medical center asserted that there was a lack of evidence that patients value their autonomy over the potential for innovative diagnostics, treatments, cures, or preventative interventions that could result from research with leftover biospecimens, and called for empirical research on whether patients, patient advocacy groups, and the general public value autonomy (in the form of written consent for research use of nonidentified biospecimens) above other values when explained in light of potential impact on medical advances.

Some public commenters pointed out the illogic of treating biospecimens differently from information for the purposes of defining what constitutes a human subject. For instance, one professional organization composed of investigative pathologists and dozens of individual pathologists around the country noted that there are several areas in which the NPRM proposes treating biospecimens differently from identifiable information unjustifiably since both create the potential for identification of the donor and a potential negative impact on the individual and their family, such as employment or insurance discrimination, embarrassment, or stigmatization. That organization noted that no empirical evidence has been provided to indicate either that biospecimens pose a risk greater than that posed for identifiable information or that the public is more concerned about the use of biospecimens compared to the use of identifiable private information.

One member of the public asserted that the research use of leftover biospecimens in medical research poses less of a privacy risk to individuals than market research that analyzes one's attitudes, words, and behaviors and is used to generate commercial profit.

Several commenters noted that the proposed expansion of the definition of “human subject” creates a cascade of consequences throughout the rule that are overly complex and unnecessary given the minimal risk of such research.

Other commenters suggested that the NPRM proposals would have negative impacts on the advancement of precision medicine. For example, a research university felt that mandating consent for de-identified biospecimens would impair the ability to achieve precision medicine for all. The commenter asserted that to offer care tailored to the needs of each individual based on understanding how each person is affected by disease requires understanding differences in the origins and manifestations of disease in individual patients who differ in genetics and environmental exposures. The commenter felt that restricting access to nonidentified biospecimens would violate the principles of justice and beneficence because many health care facilities serving under-represented minorities and economically-disadvantaged individuals, particularly those in rural settings, might not have the financial resources to obtain and track consent. As a result, medical research therefore might represent a skewed population of individuals receiving care at large, research intensive referral centers. In addition, the commenter felt that compliance would impose an onerous and expensive bureaucratic burden that would result in many institutions no longer collecting and using these critically important specimens with the net effect of thwarting efforts to provide precision medicine for all citizens.

Many commenters expressed the opinion that the existing regulatory framework is adequate and that current practices should be maintained, stressing that the research use of nonidentified data or biospecimens involves minimal or low risk to the research subject. Furthermore, several commenters noted that, although it is theoretically plausible to identify a person based on their biospecimen, the likelihood remains remote enough to argue against the presumption that the sources of all biospecimens are identifiable and cited a study showing that the risk of re-identification from a system intrusion of databases was only 0.22 percent. Other commenters noted that the existing definition of human subject is sufficient because once a biospecimen becomes identifiable in research, such research is considered to involve human subjects and therefore IRB review and consent or waiver of consent would be required. They argued that the current policy works and there has been no evidence provided that it needs to be fixed.

The NPRM specifically asked whether the final rule should include a definition of “biospecimen” to assist the regulated community in understanding what types of activities might fall under the rule. Approximately 100 comments answered this question. A majority of these comments did not provide a suggestion for how biospecimen should be defined, but suggested that the Federal Government convene panels and solicit input from governmental and nongovernmental experts.

One university emergency medical department suggested including in this definition biological samples from human subjects which contain DNA and are being obtained for the purpose of medical analysis and provided examples of biospecimens which would fall under this definition, including excised tissue (fresh, fixed, or paraffin embedded), whole blood, urine (when hematuria is known to exist), and saliva among others. The commenter also provided examples of biospecimens which would not fit in this definition, including serum or plasma, urine (when no hematuria is known to exist), and processed tissues where the DNA has been removed as a part of the processing.

Others indicated that the definition of biospecimen used by the National Cancer Institute seemed appropriate and workable for this rule.

A majority of comments on the definition of “biospecimen” asked for explicit clarification on how certain biospecimens would be treated under the rule. Several comments asked whether microbiology biospecimens would be considered covered under the NPRM proposal. One research university requested specification that biologic material of organisms that use human biospecimens merely as a host (e.g., bacteria, viruses, fungi) not be considered to involve human subjects.

The NPRM also asked whether covering only biospecimens that include nucleic acids would be a reasonable definition. A majority of those who responded to this said it would not be a good line to draw. One commenter specifically noted that the presence of nucleic acids does not guarantee re-identification.

b. Public Comments on Alternative NPRM Proposals A and B

Some of the alternative NPRM proposals were partly based on the premise that biospecimens could at some point become readily identifiable as a result of increasingly sophisticated technology. Many public commenters stated that a better approach to protecting privacy than requiring consent is to impose sanctions against investigators who aim to or do re-identify biospecimens without authorization by an IRB or other body. Such an approach, they said, would be less onerous for the entire enterprise, and if accompanied by clear guidance from funding agencies, would do more to protect privacy and guard against potential harms to subject rights and welfare.

Few commenters, approximately 20, explicitly supported Alternative A or B over the NPRM proposal or the pre-2018 rule.

The Presidential Commission for the Study of Bioethical Issues explicitly supported Alternative B, noting that it is the most forward-looking of all three proposals, using “bio-unique” data as human subjects research with a focus on the technology and its ability to identify donors using small amounts of data, as opposed to tying the definition of human subjects research to a particular kind of data. Another commenter identified alternative B as the best proposal to keep pace with advances in technology (including technologies driving personalized medicine), protect research participants, respect autonomy, increase trust, and close the gap in protection in the current regulations.

Those who supported the primary NPRM proposal—to expand the definition of “human subject” to include all biospecimens—indicated that Alternatives A and B would not give individuals who wanted to control the use of their biospecimens the opportunity to do so.

Approximately 250 commenters (about 12 percent of the total comments received) said that they endorsed the pre-2018 policy, but that if the Federal Government must do something other than maintain the current definition of human subject, Alternative A would be preferable to the NPRM proposal or to Alternative B. These comments argued that Alternative A would be the least disruptive to the research enterprise, but that the pre-2018 policy would be better.

However, the majority of those commenters addressing the alternative proposals indicated that neither struck an appropriate balance among the Belmont Report principles. A research university concluded that both alternatives lack balance, emphasizing respect for persons with little regard for the principles of beneficence and justice.

Additional concerns about Alternative A included the fact that while limiting the expansion of the scope of activities covered by the rule to whole genome sequencing may be a reasonable line for inclusion today, that line might not be inclusive enough in the future.

Additional concerns about Alternative B included that by requiring continual re-review of technologies and databases by the federal government, there would be an “inevitable lag” between when a technology might be identified and when it would be added to the list. Thus, these commenters argued that the list might end up being useless.

c. Alternative Proposals Offered by Public Commenters

Many commenters proposed or endorsed alternatives to the NPRM proposals. Generally, these alternatives involved maintaining the existing schema, developing a system of notice and opt out, engaging in a public education campaign about how the research enterprise works, and developing penalties and sanctions for re-identification of biospecimens and information. A policy that requires notice, opt out, and public education were generally endorsed or discussed together.

The Secretary's Advisory Committee on Human Research Protections (SACHRP) offered one of the most detailed alternative proposals. SACHRP indicated that existing practices of research with biospecimens and data that have been collected for nonresearch uses (most often in the course of clinical care) should be revised to better protect subjects through greater transparency, public education about research with biospecimens, more exacting standards for protecting against dignity harms, allowing individuals to opt out, requiring IRB or institutional review and approval of specific research uses of identified biospecimens and identified data, and through strict legal consequences for re-identification of de-identified biospecimens and data that have been shared for research purposes.

SACHRP also proposed that data security protections be developed to safeguard biospecimen-associated data and identified data against unauthorized release or access, and focused review of the storage, maintenance, or secondary research use of identified biospecimens and identified data to determine whether the proposed activity is likely to be objectionable.

A professional organization of investigative pathologists urged consideration of opt-out broad consent models for nonidentified biospecimens collected in research and nonresearch settings, and suggested that this model would bring consent for the broad use of nonidentified biospecimens in line with HIPAA privacy practices, preserving the ability for an individual to decide not to participate in research efforts. This organization asserted that this option would be less burdensome and an inclusive, respectful, and functional way to promote ethically conducted biomedical research on biospecimens.

d. Public Comments on Identifiability

Approximately 40 comments were received in response to the request to comment on the definition of identifiable private information. Comments were mixed. The largest proportion of those comments (approximately 13) supported the definition in the pre-2018 rule. Others felt that the pre-2018 definition of identifiable private information was sufficient, but that additional guidance would be needed to implement it. Another group of commenters supported adopting a different identifiability standard in the final rule (such as the federal government's personally identifiable information standard, or the HIPAA identifiability standard).

Several public comments claimed that the meaning of “identifiable” with regard to information and biospecimens will change as technology advances. They indicated that the technique of whole genome sequencing altered the conversations about the identifiability of biospecimens and future technological advances using advanced computing and large databases could provide methods for easily aggregating disparate data for the purposes of identifying an individual.

Public comments received from a large professional association related to the definition of identifiable private information noted that the modifier “may be readily ascertained” that was included in the definition of identifiable private information within the definition of human subject allows for changes in scientific technology and data sharing over time since what was readily ascertainable 10 years ago has changed and will be different 10 years from now. The commenter noted that this allows IRBs and investigators to assess identifiability based on current technology, data sharing and computing capabilities, rather than comparing it to an enumerated list of identifiers or scientific technologies.

Some commenters expressed a desire for guidance to be issued on these definitions or for the definitions to be better clarified and explained in the regulatory text. Several comments specifically suggested a need for a definition of or guidance on the term “readily ascertainable.”

Approximately 10 comments endorsed replacing the Common Rule's identifiability standard with either the Federal Government's concept of personally identifiable information (PII) or HIPAA's concept of protected health information (PHI).

One academic medical center felt that the concept of PII would unnecessarily broaden the scope of the Common Rule and create a larger administrative burden due to the vagueness of the PII definition without providing substantial added protection to human subjects, and suggested replacing the term “identifiable private information” with the definition of “protected health information,” which can be found at 45 CFR 160.103.

Those who supported the use of the PII concept noted that it would harmonize other definitions of identifiability used in other Federal Government regulations. One state department of health and human services noted that adopting PII would be consistent with other confidentiality laws, policies, and industry standards that require organizations to protect the privacy and security of PII, achieving consistency across standards and helping organizations comply with the various privacy and security requirements. The commenter felt that replacing the identifiable private information standard with the concept of PII should not be overly burdensome on the research community since exemptions and waivers of informed consent would likely apply in many contexts.

A few commenters also noted that regardless of how identifiability might be defined, some concerns about group harms still were not addressed in the NPRM.

Several other commenters noted that a change to the definition of PII would not increase public trust or understanding of the system, nor would it likely clarify for investigators whether biospecimens or private information are identifiable.

A majority of the commenters noted that whatever direction the final rule takes; additional guidance will be necessary to reduce ambiguity within the regulated community.

e. Public Comments on Newborn Dried Blood Spots

Approximately 50 comments discussed how issues related to research use of residual newborn dried blood spots (DBS) were addressed by the proposal to expand the definition of human subject. Of those comments, 35 supported the idea of parental consent for research with DBS. Thirty-two comments stated that specific consent should be required for all research uses, in other words, that the exemptions and exclusion categories should not apply to research involving DBS. Those who felt that parental consent should always be required for the research use of DBS expressed the need to respect autonomy and parents' rights, and frequently conveyed a distrust of medicine and scientists. These individuals generally supported the spirit of the main NPRM proposal, but objected to any exemptions, exclusions, and waivers of informed consent.

Fifteen comments expressed concerns that the biospecimen proposals in the NPRM would impede research involving DBS, which could negatively affect the expansion and improvement of newborn screening programs due to, among other things, a possible lack of resources for obtaining consent. In this regard, an employee of a California state health department described the health department's experience of seeking and obtaining consent for the research use of DBS. This individual noted that 52 percent of new parents were offered the opportunity to consent. Of those offered the opportunity, 90 percent said yes. This employee was thus concerned that due to staffing constraints, the majority of new parents simply would not be asked to provide consent to future research uses of DBS.

Others indicated that some kind of notice and opt-out process would be acceptable, but that as a general matter the research community would benefit from guidance on the extent to which the exemptions and exclusions apply to this type of work.

4. Response to Comments and Explanation of the Final Rule: Definition of Human Subject

The final rule does not implement the proposed expansion of the definition of “human subject” to include all biospecimens regardless of identifiability. It is clear from the comments received that the public has significant and appropriate concern about both the need for obtaining consent before using such biospecimens for research, and the potential negative impacts of implementing that proposal on the ability to conduct research. And, while it does not substantially change the definition of “identifiable private information,” the final rule includes a new process by which Common Rule departments and agencies can regularly assess the scientific and technological landscape to determine whether new developments merit reconsideration of how identifiability of either information or biospecimens is interpreted in the context of research. Because the final rule does not implement the NPRM's proposed expansion to the definition of “human subject,” it also does not implement the NPRM proposal to exclude certain research activities involving nonidentified biospecimens.

With regard to changing the definition of “human subject” to include all biospecimens, the majority of commenters who addressed this expansion opposed it for a variety of reasons, as described above. As explained in the NPRM, one of the core reasons for proposing that the rule be broadened to cover all biospecimens, regardless of identifiability, was based on the premise that continuing to allow secondary research with biospecimens collected without consent for research places the publicly funded research enterprise in an increasingly untenable position because it is not consistent with the majority of the public's wishes, which reflect legitimate autonomy interests. However, the public comments on this proposal raise sufficient questions about this premise such that we have determined that the proposal should not be adopted in this final rule.

Further, the current regulatory policy appears to sufficiently protect against the unauthorized research use of identifiable biospecimens. Under the pre-2018 rule, if an investigator funded by a Common Rule department or agency uses nonidentified biospecimens and manages to re-identify them, that investigator would then be conducting human subjects research without IRB approval, in violation of the rules. It should also be noted that the position adopted in the final rule does not eliminate any authority, separate and apart from the Common Rule, that Common Rule departments and agencies have to establish policies with additional requirements related to consent for research involving nonidentifiable biospecimens or nonidentifiable private information, or preclude them from exercising such authority.

Nonetheless, we acknowledge the need to also appropriately respect and promote autonomy interests. Any future proposals aimed at promoting autonomy should jointly evaluate the importance of the autonomy interests at issue, as well as explicitly quantify the potential negative impacts the proposal might have on the ability to conduct research, including such consequences on the representativeness of biospecimens available for research.

In the final rule, we have added requirements to the informed consent process to increase transparency so that potential subjects will have more information about how their biospecimens or private information might be used. Specifically, prospective subjects will be told that identifiers might be removed from their biospecimens or private information and used for future research, if this might be a possibility. Finally, as some public comments addressed the desire to share in any profits that might accrue as a result of research use of their biospecimens, an additional element of consent will require, as appropriate, a statement that the subject's biospecimens may be used for commercial profit and whether the subject will or will not share in this commercial profit. We believe that this increased attention to transparency in the consent process will allow individuals to make informed choices about whether they want to consent to current or future research uses of their biospecimens. A few clarifying changes are made in the final rule pertaining to the definition of “human subject” and the components within that definition, particularly referring to both information and biospecimens as key determinants of whether a human subject is involved in research.

With respect to the definition of “identifiable private information,” although the pre-2018 definition of “identifiable” did not incorporate a specific process for considering the growing volume of information being generated and shared in research (including from biospecimens), or consider how evolving technology can ease and speed the ability to re-identify information or biospecimens previously considered nonidentifiable, we appreciate that a change in that definition could have collateral implications with respect to imposing unwarranted consent requirements on activities that were not subject to the regulations. We appreciate the commenter requests for more guidance on how they should interpret the definition of identifiable private information. Thus, although the final rule only makes minor changes to the existing definition of “identifiable private information,” it sets in place a process (§ __.102(e)(7), discussed below) that will help facilitate any necessary future updates to the understanding of that term.

In the final rule the language at § __.102(e)(1)(i) relating to information obtained through intervention or interaction with an individual was adopted and modified by replacing the reference to data, as proposed in the NPRM, with a reference to information or biospecimens, and by adding the NPRM-proposed language relating to using, studying, or analyzing the information or biospecimens. The explicit reference to biospecimens in this context is intended as a mere clarification of the previous understanding of how the pre-2018 rule operated.

Likewise, the final rule adopts the NPRM-proposed language at § __.102(e)(1)(ii) relating to obtaining identifiable private information, but modifies it by adding an explicit reference to “identifiable biospecimens.” This is also intended as a mere clarification of the previous understanding of how the pre-2018 rule operated as applied to biospecimens. Similarly, the definition of intervention has been modified to clarify that information or biospecimens might be gathered, replacing the former reference only to data. This, too, is merely a clarification of the existing understanding of that concept.

A definition of “identifiable biospecimen” has been added at § __.102(e)(6). This new definition was not added as a result of any substantive change, but rather to enable greater clarity in other provisions of these regulations in explaining when a particular provision relates to either identifiable private information alone (not including biospecimens), or identifiable biospecimens alone, or both. The pre-2018 rule's concept of “identifiable private information” had encompassed the concept of an identifiable biospecimen, whereas under the final rule that concept has been “cleaved off” from that definition and given its own definition. Note that a biospecimen is deemed to include private information (consistent with the understanding of this concept under the pre-2018 rule), so there is no need to add the adjective “private” in the definition of an “identifiable biospecimen.” In effect, once a biospecimen becomes identifiable (for example, by being tagged with the name or other information that indicates the person from whom the biospecimen was obtained), then an investigator using that biospecimen is already using something to which § __.102(e)(1)(ii) would apply. There is no need to make any additional determination about the “private” aspects of what is taking place.

In addition, the minor clarifying change in the language for the concept of “private information” that was proposed in the NPRM, namely adding the phrase “shared or,” was not adopted. It was decided that because any information that should not be shared would always meet the standard of being information that should not be made public, this change would not actually expand the amount of information that is considered private information.

Although the description of when private information is identifiable was not significantly changed, a new provision has been added at § __.102(e)(7) requiring federal departments and agencies that implement the Common Rule to regularly, upon consultation with appropriate experts, reexamine the meaning of the terms “identifiable private information,” as defined in § __.102(e)(5), and “identifiable biospecimen,” as defined in § __.102(e)(6). Such reexamination shall take place at least every 4 years. This new provision specifically requires that the federal departments and agencies implementing this policy collaborate on this process to avoid a duplication of efforts and in order to have a consistent interpretation of these terms.

This new process responds to the growing volume of information being generated and shared in research (including from biospecimens), and evolving technology that can ease and speed the ability to re-identify information or biospecimens previously considered nonidentifiable. With an increase in the number of exemptions included in this final rule, it will be important to reconsider the potential identifiability of information and biospecimens and facilitate uniform interpretation to ensure adequate privacy and security measures are in place.

Section 102(e)(7) also provides that, after conducting this process, if it is determined to be appropriate and permitted by law, Common Rule departments and agencies could alter the interpretation of identifiable private information or identifiable biospecimens, including through the use of guidance.

In addition, there will occur, also at least every 4 years and as a collaborative process among those federal departments and agencies, upon consultation with appropriate experts, an assessment as to whether there are analytic technologies and techniques that should be considered by investigators to generate identifiable private information or identifiable biospecimens. The ultimate goal is to implement the Common Rule in a way that is aligned with the evolving understanding of the concept of identifiability while protecting subjects and encouraging and facilitating valuable research.

To the extent that this process leads to a determination that particular analytic technologies or techniques, when applied to information or biospecimens that are not identified, do lead to the generation of identifiable private information or identifiable biospecimens, those technologies or techniques will be placed on a list of technologies and techniques satisfying that determination, and recommendations might accordingly be made with regard to relevant issues relating to consent and privacy and data security protections. The result may be that such technologies and techniques could therefore only be used in instances where the person has provided their consent (broad or study-specific) which meets the requirements of the Common Rule, or where an IRB has waived the requirement for consent.

Notice and the opportunity for public comment would take place before a technology or technique could be placed on this list. The expectation is that whole genome sequencing will be one of the first technologies to be evaluated to determine whether it should be placed on this list.

It is important to note that an investigator who possesses information or biospecimens to which such a technology or technique might be applied is not to be considered in possession of identifiable private information or identifiable biospecimens merely as a result of such a circumstance: that would only be true were the investigator to actually apply the technology or technique to generate identifiable private information or identifiable biospecimens.

This new provision is not being added as a result of any pre-conceived determination that there is indeed a need to change, whether by guidance or otherwise, the interpretation of “individually identifiable” as that concept is currently interpreted. Consistent with a core theme underpinning the process that led to this final rule, it would be inappropriate to expand the scope of coverage of the Common Rule with regard to activities that usually involve very little risk absent good reason to think that there is a problem that the added administrative burden will be correcting. The public comments on both the ANPRM and the NPRM do not identify a specific problem, but clarification from the regulatory agencies might be useful. Thus, apart from the consequences of placing technologies and techniques on the new list, the most significant effect of § __.102(e)(7) may be the issuance of guidance from time to time that facilitates understanding of and compliance with existing interpretations.

Finally, with regard to the use of newborn DBS, retaining the pre-2018 approach toward nonidentified biospecimens resolves many of the concerns expressed by commenters who felt that important research involving newborn screening would be halted or inhibited under the NPRM. The Newborn Screening Saves Lives Reauthorization Act of 2014 (Pub. L. 113-240) will no longer be effective following the effective date of this final rule, given that its changes applied only until changes to the Common Rule were promulgated. As a result, under the final rule, secondary research with nonidentified newborn DBS would be treated in the same way as secondary research with any other type of nonidentified biospecimen. Such research would not be considered research with human subjects under the final rule, and thus would not be subject to the rule.

E. Legally Authorized Representative (§ __.102(i))

1. Background and Pre-2018 Requirements

The Common Rule contains a definition of legally authorized representative to clarify who can consent on behalf of a prospective subject who is unable to consent to research participation on his or her own behalf. Under the pre-2018 rule, a legally authorized representative was defined as an individual or judicial or other body authorized under applicable law to consent on behalf of a prospective subject to the subject's participation in the procedure(s) involved in the research.

As there is no federal legal standard as to who, or what entity, is authorized to serve as a legally authorized representative to provide consent to a subject's research participation, the issue of who can serve as a legally authorized representative has been determined by the laws of the jurisdiction in which the research will be conducted. Within the United States, this generally means state or local law. “Applicable law” could be a state statute or regulation, case law on point, an opinion of a State Attorney General, or a combination of these.

Some states and jurisdictions have statutes, regulations, or common law that specifically address consent by someone other than the subject for participation in research. Most states and jurisdictions have no law specifically addressing the issue of consent in the research context. In these states and jurisdictions, law that addresses who is authorized to give consent on behalf of another person to specific medical procedures or generally to clinical care may be relevant if those types of procedures are the procedures involved in the research. The long-standing interpretation by OHRP has been that such laws relating to surrogate consent in the clinical context can be used for purposes of the Common Rule.

In every state, a legally authorized representative can be authorized through an advance directive or by a court through guardianship proceedings. However some states have no law specifically addressing the issue of consent by a surrogate in the research setting, and some states have no applicable statutes, regulations, or common law specifying when an individual can provide consent for another to medical treatment. In the absence of such law, it is usually the case that community or other standards (such as institutional policies) define hierarchies or identify individuals who are allowed to provide consent, for medical treatment purposes, on behalf of others who cannot consent for themselves.

SACHRP and the Presidential Commission for the Study of Bioethical Issues have raised concerns that the definition of legally authorized representative may be inappropriately hindering the conduct of research with subjects who lack capacity to consent. In the second part of its report on neuroscience and ethics, Gray Matters: Topics at the Intersection of Neuroscience, Ethics, and Society (Volume 2), the Commission recommended that federal regulatory agencies establish clear requirements to identify who can serve as legally authorized representatives for individuals with impaired decision-making capacity to support their responsible inclusion in research.

2. NPRM Proposal

Although the NPRM did not propose regulatory text that would change the definition of “legally authorized representative,” it requested public comment on whether we should modify the definition in light of the definition's reference to persons or entities “authorized under applicable law.”

The NPRM sought comment on whether expansion of the current definition to permit a legally authorized representative to be defined by an accepted common practice standard within a state or jurisdiction that lacks applicable state law for determining who can legally consent to clinical care would be consistent with the ethical principles underlying the Common Rule. The NPRM proposed to allow use of this alternative standard only in jurisdictions in which there is also no applicable law affirmatively authorizing a legally authorized representative to provide consent to the subject's research participation.

3. Public Comments

Approximately 60 commenters discussed the Common Rule's definition of “legally authorized representative.” A clear majority supported the goal of addressing the barrier that the regulatory definition of “legally authorized representative” poses in jurisdictions that have no applicable law affirmatively authorizing an individual to provide consent for another. Commenters also favored the suggested approach and responded that including the allowance of an accepted common practice standard would still appropriately protect subjects. About one-third of the commenters responding to this question, including disability rights organizations, advocacy organizations, and academic institutions, did not agree with the direction of the contemplated modification or whether this issue should be addressed through regulatory change.

Those supporting a modified definition generally agreed that broadening the definition to cover anyone considered acceptable to provide consent for another individual in the clinical setting would be appropriate, would represent an alignment with accepted common practice, and would bring consistency to the consent process for the jurisdictions that are silent on both who may provide consent for clinical care and who may provide consent for research. A number of commenters who supported the proposal for modification noted that state law authorizing individuals to provide consent would continue to apply.

Among the commenters who opposed the modification, several said state law provides sufficient guidance regarding the hierarchy of those who can consent for an adult incapable of consenting on his or her own behalf, and reduces the institution's liability in the event that an inappropriate person consents for the subject. A research institution recommended that we reassess this proposal and include more specific requirements and details as to the role and authority of the legally authorized representative. A disability rights organization, while recognizing that the pre-2018 standard is not acceptable, commented that the problem is not solved by incorporating broad discretion among different jurisdictions. The organization also opined that a common practice standard does not provide sufficient guidance to assess and balance reasonable risk, considering that a legally authorized representative's consent is not equivalent to an autonomous decision by the subject. A research subject advocacy organization expressed concern that such a change would not provide sufficient oversight of investigators, who might use this standard in a way that would violate local law. Another commenter stated that certain individuals may be considered able to give consent for participation in clinical procedures for individuals unable to do so for themselves, but may not have the best interests of the individual in mind.

Commenters responded specifically to the solicitation of comment on the proposed standard of “accepted common practice” and indicated that practices for surrogate consent should be those used in clinical settings. Several commenters provided ideas for a more specific approach to interpreting the terms “accepted” and “common.” A researchers' association commented that interpretation of these terms should include standards that define hierarchies or identify individuals who may provide legally acceptable consent, for clinical purposes, on behalf of others who cannot consent for themselves. One commenter supporting the modification suggested that the terms could be defined to refer to the historically used form of governing and familial decision making within the group of subjects. A research institution commented that an IRB's careful review and documentation of who may serve as a legally authorized representative would be preferable to an accepted common practice standard, as that standard is vague. A research institution commenting in support of broadening the definition to those who are allowed to consent to clinical procedures advised that this would reduce confusion between physicians and researchers as to who can consent for whom in research situations, and suggested that the terms “accepted” and “common” should refer to the conducting institution's own policies on who can provide consent to clinical procedures.

4. Responses to Comments and Explanation of the Final Rule: Definition of Legally Authorized Representative

The definition of legally authorized representative in the final rule at § __.102(i) has been modified to address jurisdictions in which no applicable law authorizes a legally authorized representative to provide consent on behalf of a prospective research subject. In these jurisdictions, an individual recognized by institutional policy as acceptable for providing consent in the nonresearch context to the subject's participation in the procedures involved in the research, will now be considered a legally authorized representative for purposes of this rule.

The change made from the NPRM discussion that “accepted common practice” could be used to identify a legally authorized representative is in response to objections to the vagueness of these terms and the potential for confusion in implementation, which was expressed by the majority of commenters opposed to the proposal. We agree with the commenters' suggestion that an institution's own policies as to surrogate consent may be a better touchstone than “accepted common practice,” as a standard referencing institutional policy will provide additional clarity as to who may serve as a legally authorized representative at that particular institution.

The final rule also differs from the NPRM discussion in that it allows institutional policies applicable to surrogate consent in either the clinical context, or other nonresearch contexts, to authorize a legally authorized representative. We expect that implementation of this aspect of the final rule definition will in large part rely on institutional policies for determining surrogates for clinical decision making. In those instances, there is relatively little risk that this rule will have inappropriate consequences, as far more significant considerations, not related to the Common Rule, play a role in shaping and constraining an institution's policies relating to surrogate decision making in the clinical context.

However, we recognize that some studies could be taking place that do not relate to the types of decisions that are involved in clinical care, or that do not involve procedures utilized in the clinical context. If the institution has a policy relating to who acts as a surrogate outside of the research context for those types of decisions, then such a policy could be employed in the research context. Similar to our assessment of policies relating to surrogate decision making in the clinical context, we expect that considerations not related to the Common Rule would constrain the institution's design and implementation of policies in other nonresearch contexts, and thus see relatively little risk that this added regulatory flexibility will have inappropriate consequences.

Maintaining the pre-2018 standard would have continued to allow disparate results in terms of when research can take place in those states that have specific laws governing either surrogate clinical consent or research consent, and those that do not. Accepting that the Common Rule has been interpreted to allow the use of laws governing surrogate consent in the clinical context to be applied to surrogate decision making in the research context, it is difficult to see why there should be different outcomes in terms of what research is allowable based on whether the standards for surrogate consent in the clinical context in a state are based on specific laws or some other accepted regime.

This outcome also appears inconsistent with the Belmont Report principle of justice. Individuals who lack the capacity to consent to research ought not be inappropriately excluded from research participation based solely on these circumstances. Research that an IRB has approved as ethical to conduct with the participation of subjects with impaired decision-making capacity ought not be prohibited in the few states and jurisdictions in which no affirmative law authorizing a legally authorized representative exists, while being allowed to proceed in the vast majority of states and jurisdictions that have laws specifically authorizing consent by a legally authorized representative in the clinical or research context.

Reduced ambiguity in the interpretation of the regulatory requirements will facilitate research that may offer the promise of improved medical treatment for this subject population, thus increasing beneficence. This approach reflects the calls for increased clarity in the regulatory requirements regarding who may serve as a legally authorized representative, which will serve to facilitate the responsible inclusion of subjects who cannot consent on their own behalf to research participation.

F. Minimal Risk (§ __.102(j))

1. Background and Pre-2018 Requirements

The concept of “minimal risk” is central to numerous aspects of the Common Rule, as it affects the type of review required, the permissibility of waiver of informed consent, considerations for IRBs in the review process, and the frequency of review. In sum, the review process has been calibrated, for the most part, to the risk of the research. For example, under the pre-2018 rule at § __.110, a research study could receive expedited review if the research activities to be conducted appeared on the list of activities published by the Secretary of HHS that are eligible for such review, and found by the reviewer(s) to involve no more than minimal risk. Under an expedited review procedure, the review could be carried out by the IRB chairperson or by one or more experienced reviewers designated by the chairperson.

The definition of “minimal risk” in the pre-2018 rule at § __.102(i) encompassed research activities where the probability and magnitude of harm or discomfort anticipated in the research are not greater in and of themselves than those ordinarily encountered in daily life or during the performance of routine physical or psychological examinations or tests. IRBs report challenges in assessing the level of risk presented by some studies in order to make the critical minimal risk determination. This is, in part, due to the difficulties in applying the definition of minimal risk under the pre-2018 rule, particularly because the terms “ordinarily encountered in daily life” and “routine physical or psychological examinations or tests” are not clarified.

2. NPRM Proposal

The NPRM did not propose to modify the definition of “minimal risk,” but rather proposed adding to the definition a requirement that the Secretary of HHS create and publish a list of activities that qualify as “minimal risk.” This list would be re-evaluated periodically, but at least every 8 years, based on recommendations from federal departments and agencies and the public. This would not be an exhaustive list of all activities that should be considered minimal risk under the Common Rule, but would allow IRBs to rely on the determination of minimal risk for activities appearing on the list. IRBs would still need to make minimal risk determinations about activities that do not appear on this list. The public was asked to comment on whether 8 years was a reasonable time period for updating the list and whether advice should be solicited from outside parties when updating the list. The public was also asked to comment on whether the Secretary's list would be a useful tool for the research community, and whether it would represent a loss of IRB flexibility in risk determinations.

3. Public Comments

Approximately 100 comments were received on this proposal. A strong majority supported the proposal, stating that it would be useful to have such a list, and some even suggested that the list of minimal risk activities should be reviewed more often than once every 8 years. One research university suggested that it is impossible to determine the future direction of human research and therefore a list of minimal risk activities would need to be updated at least yearly.

Several commenters, including those who supported this proposal generally, stated that even though this list of minimal risk activities was a good idea in theory, it should be developed separately from a final rule to allow for more time to work collaboratively with other Common Rule departments and agencies and with members of the regulated community. Some of those who supported the proposal asked that there be widely solicited public input on the list. Others who supported the proposal noted the list does not represent a loss of flexibility because the IRB can still override the presumption of minimal risk as long as the rationale is documented. One large research university felt that the Secretary's list should not replace the IRB's discretion to review a study, particularly if it will only be updated periodically. One commenter was opposed to the NPRM proposal that the list be further codified, suggesting that it should instead be eliminated as a regulatory yardstick to simplify the regulations and remove added administrative burden.

4. Response to Comments and Explanation of the Final Rule: Definition of Minimal Risk

Although this proposal received significant support, several commenters expressed concern that the Secretary's list was another NPRM deliverable that the public did not have a chance to see and comment on during the NPRM public comment period. These commenters suggested that this proposal be removed from a final rule and developed on a separate track. We agree that this list should be developed as a separate process from the final rule promulgation, and thus this proposal has not been included in the final rule.

Thus, no change is made to the definition of “minimal risk” in the final rule at § __.102(j). We still intend to publish guidance on this issue and could still pursue publication of such a list in the future.

G. Public Health Authority (§ __.102(k))

The pre-2018 rule did not provide a definition of “public health authority.” As proposed in the NPRM, the final rule now defines the term so that references to it in the definition of research are understood. Specifically, because the definition of “research” (§ __.102(l)(2)) removes from that definition public health surveillance activities that are conducted, supported, requested, ordered, required, or authorized by a public health authority, this definition of “public health authority” clarifies the scope of the activities removed from the definition of “research” for the purposes of this final rule.

In the final rule, as in the NPRM, the term “public health authority” means an agency or authority of the United States, a state, a territory, a political subdivision of a state or territory, an Indian tribe, or a foreign government, or a person or entity acting under a grant of authority from or contract with such public agency, including the employees or agents of such public agency or its contractors or persons or entities to whom it has granted authority, that is responsible for public health matters as part of its official mandate. We received no public comments on this definition.

H. Research (§ __.102(l))

1. Background and Pre-2018 Requirements

The pre-2018 rule defined “research” as a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge. Activities that met this definition constituted research for the purposes of that rule. An activity was only subject to that rule if it met this definition (in addition to meeting various other criteria). The pre-2018 rule also included categories of research involving human subjects that would be considered exempt from the rule.

The pre-2018 rule was criticized for not being clear about how to interpret which activities were covered by the rule and which were not. Some commenters also criticized the pre-2018 rule for extending to activities that should not be covered and for inhibiting the conduct of certain activities. According to some, the definition of “research” did not provide a sufficiently clear and precise way to distinguish between similar activities in a way that made it immediately obvious which activities fell under the definition and which did not.

2. NPRM Proposals

The NPRM proposed creating a new section in the regulations referred to as “exclusions.” By proposing exclusion categories, the NPRM intended to make clear that these activities would not have to satisfy the regulatory requirements of the Common Rule. That is, the proposed excluded activities would have been outside the scope of the Common Rule.

Three of the proposed exclusions sought to reduce uncertainty about whether certain internal program improvement activities, historical or journalistic inquiries, or quality assurance or improvement activities satisfied the Common Rule's definition of research.

Another three proposed exclusions pertained to activities that are part of inherently governmental functions with purposes other than research, such as responsibilities to protect public health and welfare (i.e., criminal investigations, public health surveillance, and national security missions). It was proposed that these activities promote recognized specific goods that are crucial to the public welfare.

An additional four categories of proposed exclusions included human subjects research activities that were either considered low risk, or for which there were appropriate safeguards already in place independent of the Common Rule. These four categories pertained to: (1) Research that involves the use of educational tests, survey procedures, interview procedures, or observation of public behavior uninfluenced by the investigators; (2) research involving the collection or study of information that has been or will be acquired solely for non-research activities or were acquired for research studies other than the proposed research study; (3) research conducted by a federal government agency using federal government-generated non-research information when certain criteria are met; and (4) research regulated as “health care operations,” “public health activities,” or “research” under HIPAA. As noted in the NPRM, in these categories the principle of beneficence alone could support the conduct of these activities after considering the level of risk, potential benefits, and nature of human participation in these activities, without the need to add the protections of the Common Rule.

A final proposed exclusion would have applied to research involving the secondary use of nonidentified biospecimens when the research was limited to generating information about the subject that is already known by the subject (e.g., disease diagnosis). As such, this research would not need any additional protections provided by these regulations. This proposed exclusion was directly related to the proposed changes in the definition of “human subject” to include all biospecimens, regardless of whether they are identifiable (as discussed above in Section III, that proposal has not been adopted).

3. Public Comments, Response to Comments, and Description of the Final Rule: Definition of Research

a. Overview

Approximately 375 public comments discussed at least one aspect of the proposed NPRM exclusions. General concerns about the exclusions included that they added a layer of unnecessary complexity in determining what studies fall under the Common Rule, and that overlapping categories of exclusions and exemptions were proposed. Comments also expressed the concern about the lack of requirements on who would decide whether an activity met the criteria for an exclusion, including investigators, or whether those decisions would be documented in any way.

In response to the public comments, the NPRM's general approach of designating various categories of activities as excluded has not been adopted. Instead, the final rule reverts to the general structure of the pre-2018 rule and integrates some of the categories proposed for exclusion in the NPRM into that structure, with some changes to the categories.

The final rule retains the wording of the pre-2018 definition of research, and explicitly removes four categories of activities from activities that would meet that definition. These revisions are intended to make the rule simpler, more familiar to readers who are aware of the pre-2018 rule and its definition of research, and easier to understand.

The four categories of activities removed from the definition of research are set out in order to make clear that they are not within the jurisdiction of the rule. The four categories pertain to certain scholarly and journalistic activities, public health surveillance activities, criminal justice activities, and authorized operational activities in support of national security missions. These categories were proposed as exclusions in the NPRM; the final rule retains these categories, with some changes made in the wording for clarity, in response to public comments.

The category of certain scholarly or journalistic activities is removed from the definition in order to resolve long-standing debate and uncertainty about whether these activities are considered research in the sense of the regulatory definition. We believe that these activities should not be considered research in the context of the Common Rule, and that making this explicit in the final rule will help to resolve the uncertainty.

The final rule includes a simpler definition of national security missions not considered to be human subject research, as a response to concern that the earlier draft language in the NPRM could be interpreted too broadly or too narrowly due to the specific activities listed, such as surveys, interviews, surveillance activities and related analyses, and the collection and use of biospecimens. These authorized operational activities, as determined by each agency, do not include research activities as defined by the Common Rule, nor have they ever in the past been considered regulated by the Common Rule. This category of activity is removed from the definition of research to make explicit that the requirements of the final rule do not apply to authorized operational activities in support of national security missions.

The other two categories of activities deemed not to be research under the final rule (pertaining to public health surveillance activities and criminal justice activities) include many activities that under the pre-2018 rule do not fit the definition of research, and some activities that otherwise might. These categories are included in the final rule in order to make it explicit that the requirements of the final rule do not apply to them.

Three categories of activities proposed as exclusions have been eliminated from the final rule. The proposed exclusion for certain quality assurance/quality improvement (QA/QI) activities has been dropped because it could create more confusion than it resolved, and it might have inadvertently created inappropriate obstacles to those QA/QI activities that should not fall under the rule. The proposed exclusion for internal program improvement activities has been dropped due to similar considerations. The category regarding secondary research involving nonidentified biospecimens designed only to generate information about an individual that is already known has been dropped because it is no longer necessary given that the NPRM proposal to modify the definition of human subject to include all biospecimens regardless of identifiability is not included in the final rule. The discussion of the proposed exclusion for certain research activities with nonidentified biospecimens appears in additional detail in Section III.D.

The four exclusions proposed in the NPRM that are incorporated into the exemptions in the final rule are: (1) The proposed exclusion for certain educational tests, survey or interview procedures or observation of public behavior; (2) the proposed exclusion for secondary research use of information that is publicly available or recorded without identifiers; (3) the proposed exclusion regarding secondary research use of information collected by the Federal Government for other purposes and subject to certain privacy laws; and (4) the proposed exclusion regarding secondary research use of information covered by HIPAA protections.

b. Scholarly and Journalistic Activities (e.g., Oral History, Journalism, Biography, Literary Criticism, Legal Research, and Historical Scholarship) (§ __.102(l)(1))

i. Public Comments

Approximately 50 comments discussed the NPRM proposal to exclude scholarly and journalistic articles from coverage by the rule. The majority of these comments supported the intent of the exclusion, although several comments suggested possible changes. The minority of the comments expressed concerns. Those who opposed this exclusion generally opposed all exclusions, arguing that investigators should be required to get permission from subjects before engaging in these activities.

One commenter expressed concern about an exclusion that would permit oral history activities with tribal nations without oversight. This commenter noted that some oral history with tribal nations is tantamount to cultural appropriation, and the concern of tribal nations might not be adequately protected by the ethical standards of various professions.

Several commenters discussed that the wording of the NPRM regulatory text here might be more restrictive than necessary. Specifically, several commenters noted that in calling out specific disciplines and methodologies, the regulatory text seems counter to the NPRM policy goal of allowing this type of research (as opposed to research in these specific fields) to occur.

A few commenters discussed the need for ethnographic research to be explicitly called out in this exclusion. One commenter also raised cultural anthropology as another academic discipline that should be referenced in this exclusion.

Several commenters, including academic discipline advocacy groups, noted that the exclusion conflated broad disciplines (journalism) with methodologies (oral history), which could be confusing to those attempting to implement the exclusion.

Several commenters also questioned whether the provision “that focus directly on the specific individuals about whom the information is collected” applied only to historical scholarship activities or to all of the activities and disciplines noted in the exclusion. Several other commenters indicated that they supported a full exclusion of all oral history, journalism, biographical, and historical scholarship activities, suggesting that those several individuals do not presume that the provision “that focus directly on the specific individuals about whom the information is collected” served as a limitation on what activities were covered under this exclusion.

A minority of commenters—including accreditation bodies, human research protection experts, and research universities—suggested that an exclusion for these activities was not needed, and that this topic could be addressed through guidance. These comments also indicated that addressing this topic in guidance might be clearer to the regulated community as well. Others indicated that the exclusion is not warranted because the excluded activities are those that would not contribute to generalizable knowledge and thus already would not fall under the rule.

The NPRM also asked whether biospecimens should be included in this exclusion. Very few individuals answered this question, and those that did indicated that biospecimens should not be included.

One research university indicated that with respect to oral history, the exclusion should make a distinction between oral history projects that meet the definition of research and those that do not, suggesting that the exclusion should not exempt all projects that might fall under the “oral history” banner. One commenter noted that oral history should be defined in order to distinguish that activity from interviews.

ii. Response to Comments and Explanation of the Final Rule: Scholarly and Journalistic Activities

The final rule explicitly removes a category of activities consisting of certain scholarly and journalistic activities from the definition of research and the scope of the regulations. This category of activities concerns certain activities in various fields that focus directly on the specific individuals about whom information are collected. As described above, this category is removed from the definition in order to resolve long-standing debate and uncertainty about whether these activities are considered research in the sense of the regulatory definition. We believe that these activities should not be considered research in the context of the Common Rule, and that making this explicit in the final rule will help to resolve the uncertainty.

In these activities, the ethical requirement is to provide an accurate and evidence-based portrayal of the individuals involved, and not necessarily to protect them from public scrutiny. For example, a biographer might collect and present factual information to support the biographer's opinion about the character of an individual to show that the individual does not deserve the positive reputation he or she enjoys in society. These fields of research have their own codes of ethics, according to which, for example, consent is obtained for oral histories. We note that this consent standard should address the issue of oral histories of tribal members. For these reasons, we have determined that it is appropriate to remove these activities from the definition of research and from the scope of the Common Rule.

In response to public comments, § __.102(l)(1) refers to more fields and methodological traditions than were proposed in the NPRM. The final rule also explicitly cites those fields and traditions as examples, in order to clarify that the focus is on the specific activities that collect and use information about specific individuals themselves, and not generalizing to other individuals, and that such activities occur in various fields of inquiry and methodological traditions. Literary criticism has been added as an example because while a piece of literary criticism might focus on information about the author(s), it would typically focus on the specific author(s) in view. Legal research has been added as an example because it would often focus on the circumstances of specific plaintiffs or parties involved in a case. It is not the particular field that removes the activity from the definition, but rather the particular activity's focus on specific individuals.

Activities described in § __.102(l)(1) may sometimes be performed in the fields of anthropology or sociology, but not all activities characteristic of these fields are outside of the rule. Studies using methods such as participant observation and ethnographic studies, in which investigators gather information from individuals in order to understand their beliefs, customs, and practices, and the findings apply to the studied community or group, and not just the individuals from whom the information was obtained, fall within the scope of the definition of research of the final rule.

c. Public Health Surveillance (§ __.102(l)(2))

i. Public Comments

Approximately 80 comments discussed the proposed exclusion for certain public health surveillance activities. Public comments were generally mixed with many comments suggesting that the regulated community will need to see additional examples of activities that satisfy this exclusion and activities that fall outside its scope. Those who supported this exclusion generally said that this would streamline important public health surveillance activities.

Several comments discussed the importance of this exclusion with respect to residual newborn DBS screening programs. These comments generally expressed the opinion that most state mandated public health reporting of such program activities would fall under this exclusion. Commenters requested additional explanation of what aspects of these state newborn screening programs would be covered under this exclusion, and listed components of the program that should be covered, including validity testing and test development. Others suggested that this exclusion should also exclude minimal risk efforts to evaluate surveillance methods. Others suggested that this exclusion should also exclude minimal risk efforts to evaluate surveillance methods. Another comment suggested that a final rule address, in this exclusion or elsewhere, the issue of research that must be conducted during public health emergencies, citing the example of HHS's emergency use provision with a waiver of informed consent, which describes limited circumstances in which a patient is physically incapacitated or otherwise unable to give consent.

Those who opposed excluding these activities argued that in some cases, research activities for which informed consent should be sought and obtained are sometimes conducted under the auspices of public health surveillance; the importance of the activity itself should not be an argument to avoid seeking and obtaining consent. Others argued that consent should always be sought and obtained for research activities and that all of the exemptions and exclusions discussed in the NPRM should be covered activities. One institution indicated that this exclusion was simply not needed because the activities described did not meet the definition of “research” and thus were not subject to the Common Rule.

Another commenter indicated that while the intent of the exclusion seemed reasonable, implementation of the regulatory intent would be difficult, and there are many examples of modern public health surveillance activities where informed consent would have been appropriate.

A few comments that opposed the exclusion indicated concern that it might be abused, and cited the Tuskegee Syphilis study as an example of what they feared might be included under this exclusion category. We do not think that study would fall within this category, because it involved research interventions with the subjects, including the provision of substandard treatment and efforts to prevent subjects from obtaining effective treatment, which under no circumstances could be considered surveillance about a condition of public health importance.

The NPRM asked whether the parameters of this exclusion were sufficiently clear, and if not, how the exclusion could be clarified. In response, one private organization conducting public health research stated that it was unclear if this only applies to governmental entities like the Centers for Disease Control and Prevention (CDC), or if it applies to other organizations as well. Another institution suggested that the community needed additional clarification of what types of activities fall under this exclusion. One research university requested clarification on whether public health surveillance activities falling under this exclusion is subject to subpart B and C, that is, research involving pregnant women or prisoners, respectively. One organization indicated that it would be helpful for the examples used in the NPRM preamble to be published as a separate guidance document.

Another comment noted that the examples included in the preamble only addressed acute infectious disease surveillance and no other types of public health surveillance activities, specifically, chronic disease surveillance and biomonitoring for toxic chemical compounds and metabolites, which should be covered under this exclusion.

Another research organization noted that the regulatory text and examples provided might be too narrow, suggesting the exclusion be broadened to clarify that it applies to public health monitoring aimed at evaluating the degree to which affected individuals seek and obtain treatment, barriers to care, quality of care, treatment outcomes, and health disparities.

Commenters also requested additional explanation of what aspects of state newborn screening programs would be covered under this exclusion, and listed a variety of components of the program, including validity testing and development of new tests, that should be covered by the exclusion. Commenters asked that clarification of the parameters of the public health exclusion be provided so that state newborn screening programs can undertake the activities necessary for new test development. They added that if the parameters are not clarified, given the past controversies associated with the retention and secondary use of newborn DBS, many programs may not undertake activities for which they have not been given express permission to pursue.

ii. Response to Comments and Explanation of the Final Rule: Public Health Surveillance

The final rule adopts the NPRM proposal related to deeming certain public health surveillance activities as explicitly outside of the scope of the Common Rule. Several editorial modifications have been made to this category to improve readability. Additionally, the final rule explicitly specifies that the collection of information is permitted under this category of activities.

The final rule codifies the current interpretation that the definition of research does not include a category of activities that solely involve public health surveillance, including collecting and testing information or biospecimens in activities that are conducted, supported, requested, ordered, required, or authorized by a public health authority and that are limited to those necessary to allow the public health authority to identify, monitor, assess, or investigate potential public health signals, onsets of disease outbreaks, or conditions of public health importance. Such surveillance activities can include collecting information about trends, signals, risk factors, patterns in diseases, or increases in injuries from using consumer products. Such activities include those associated with providing timely situational awareness and priority-setting during the course of an event or crisis that threatens public health, including natural or man-made disasters.

This codification of public health surveillance activities as outside the definition of research is designed to remove uncertainty, but is not intended to change the scope of activities subject to or not subject to the Common Rule. When a public health authority conducts public health surveillance activities to fulfill its legal mandate to protect and maintain the health and welfare of the populations it oversees, the regulatory protections of the Common Rule should not impede that authority's ability to accomplish its mandated mission of promoting this recognized public good, in keeping with the principle of beneficence. Other protections independent of the Common Rule exist that serve to protect the rights and welfare of individuals participating in such activities, including federal and state policies to protect privacy, confidentiality, and security safeguards for the information collected.

Public health surveillance refers to collecting, analyzing, and using data to target public health and disease prevention. It is the foundation of public health practice. Surveillance uses data from a variety of sources, including mandatory reporting of certain conditions, routine monitoring, vital records, medical billing records, and public health investigations. The line between public health surveillance and epidemiological research can be difficult to draw, as the same epidemiological techniques may be used in both. Generally, the difference between the activities is the purpose or context in which the investigation is being conducted and the role of the public health authority.

The following are examples of public health surveillance activities being codified as outside of the definition of research in this regulation:

• Safety and injury surveillance activities designed to enable a public health authority to identify, monitor, assess, and investigate potential safety signals for a specific product or class of products (for example, the surveillance activities of the FDA's Adverse Event Reporting System, the Vaccine Adverse Event Reporting System, Manufacturer and User Facility Device Experience database, the Medical Product Safety Network, and the Sentinel Initiative);

• Surveillance activities designed to enable a public health authority to identify unexpected changes in the incidence or prevalence of a certain disease in a defined geographic region where specific public health concerns have been raised (e.g., the U.S. influenza surveillance system, which allows CDC to find out when and where influenza activity is occurring, track influenza-related illness, determine what strains of influenza virus are circulating, detect changes in influenza viruses, and measure the impact influenza is having on hospitalizations and deaths in the United States);
• Surveillance activities designed to enable a public health authority to identify the prevalence of known risk factors associated with a health problem in the context of a domestic or international public health emergency;
• Surveillance activities designed to enable a public health authority to locate the range and source of a disease outbreak or to identify cases of a disease outbreak;
• Surveillance activities designed to enable a public health authority to detect the onset of disease outbreaks or provide timely situational awareness during the course of an event or crisis that threatens the public health, such as a natural or man-made disaster; and,
• Surveillance activities designed to enable a public health authority to identify the prevalence of a condition of public health importance, known risk factors associated with a condition of public health importance, or behaviors or medical practices related to prevalence of a known condition of public health importance (e.g., surveillance of the prevalence of: tobacco use, exposure to secondhand smoke, lung cancer, or use of smoking cessation treatments).

On the other hand, subsequent research using information collected during a public health surveillance activity, for instance, genetic analysis of biospecimens, would not be removed from the definition.

This clarification of current interpretation would not remove the following activities from the definition of “research”: exploratory studies designed to better understand risk factors for chronic diseases, including genetic predisposition, for chronic diseases; exploratory studies designed to elucidate the relationships between biomarkers of exposure and biomarkers of disease; and exploratory studies of potential relationships between behavioral factors (e.g., diet) and indicators of environmental exposures. These types of activities would be considered research because they would not be conducted solely for the purposes described in § __.102(l)(2), and thus would be covered by the Common Rule if they involved human subjects, even if conducted by a federal agency with a public health mandate. Again, they might fall within an exemption, depending on how they are carried out.

We note that this provision does apply to some activities responding to emergencies, and that various department or agency activities, not just those of HHS, will be affected. Research evaluations of public health surveillance activities are not included in this category because the nature of such evaluations is to create generalizable knowledge. We also recognize that in some public health surveillance activities, it may be appropriate to obtain consent from the individuals from whom information or biospecimens are collected.

We recognize the public comments stating that the boundaries of public health surveillance activities being removed from the definition of research are not entirely clear. We recognize that some of the activities in this category are not research, but believe that the inclusion of this provision will help to resolve uncertainty in some circumstances about whether the rule applies. We believe that developing guidance in this area will be useful.

Finally, to clarify what public health surveillance activities are being removed from the definition of research, the final rule contains a new definition of “public health authority” at § __.102(k).

d. Criminal Justice Activities (§ __.102(l)(3)) and Authorized Operational Activities in Support of National Security Missions (§ __.102(l)(4))

i. Public Comments

Approximately 60 comments discussed the exclusion for certain criminal justice activities, the exclusion for intelligence surveillance activities, or both. The majority of commenters opposed these provisions.

Several commenters stated that the two exclusions seemed to contradict President Clinton's Memorandum of 1997, which stated that classified research activities are subject to the Common Rule and directed that the regulations be revised to include certain protections specific to classified research activities.

The majority of commenters discussing these provisions also expressed concern about what appeared to be an expansion of activities not covered by the Common Rule. These commenters also discussed concerns about how this exclusion would affect human subjects protections in classified research activities.

Those who supported these exclusions generally did not provide the rationale for why they supported them.

One research organization noted that additional clarification on the exclusion for certain criminal justice activities would be needed, and noted that such activities should continue to be subject to the Common Rule because this type of research often includes the collection of sensitive, identifiable information, which, if disclosed could present risks to the subjects.

ii. Response to Comments and Explanation of the Final Rule: Criminal Justice Activities

The final rule clarifies that, consistent with current practice, data collection and analysis that enables the conduct of certain activities carried out as part of the criminal justice system is not research. The scope of these activities is collection and analysis of information, biospecimens, or records by or for a criminal justice agency for activities authorized by law or court order solely for criminal justice or criminal investigative purposes. The activities are necessary for the operation and implementation of the criminal justice system. The final rule changes the wording of the category from that proposed in the NPRM only by substituting the word “information” for “data,” for consistency with other parts of the rule.

The provision essentially codifies current federal interpretation that such activities are not considered to be research under the Common Rule. Revising the regulations to explicitly remove such activities from the scope of research subject to the rule is designed to avoid the imposition of disparate requirements by IRBs with overlapping jurisdictions when information collection or analysis encompasses the development of methods required by law or court order for criminal justice or criminal investigative purposes. For example, the Federal Bureau of Investigation (FBI) is charged by law with setting standards governing the collection and processing of DNA biospecimens and information taken (forcibly if necessary) from certain federal and state criminal suspects or offenders incident to their arrest or conviction for prescribed offenses under the National DNA Identification Act of 1994 and other acts. Similarly, the FBI is charged by law with setting standards governing the collection and processing of fingerprints and related biographical information taken from federal and state criminal suspects or offenders and certain sensitive civil employment applicants. Many criminal law enforcement agencies routinely collect human biospecimens at crime scenes from or relating to victims, suspects, and offenders both known and unknown. Incident to these activities, the FBI is also charged with maintaining, and authenticating through identification processes, the criminal record history of criminal offenders for federal government agencies and for the overwhelming majority of state governments that elect to participate and share information through those systems. We have determined that this category of activities does not meet the definition of research in the final rule, so that these activities can be conducted in accordance with the legitimate goals of the criminal justice system.

We do not believe that this provision contradicts President Clinton's 1997 memorandum, which addressed the regulatory requirements for certain activities that are considered research under the regulations. This category pertains to activities that are outside of the regulatory requirements.

This category is also not intended to include social and behavioral studies of the causes of criminal behavior. Such studies would be considered research under the final rule.

iii. Response to Comments and Explanation of the Final Rule: Authorized Operational Activities in Support of National Security Missions

The final rule clarifies current federal practice that the definition of research does not include authorized operational activities (as determined by each agency) in support of intelligence, homeland security, defense, or other national security missions. This clarification codifies the interpretation of the pre-2018 Common Rule.

As described above, the final rule includes a simpler reference to authorized operational activities in support of national security missions not considered to be human subject research, as a response to concern that the NPRM proposal could be interpreted too broadly or too narrowly due to the specific activities listed, such as surveys, interviews, surveillance activities and related analyses, and the collection and use of biospecimens. These authorized operational activities, as determined by each agency, do not include research activities as defined by the Common Rule, nor have they ever in the past been considered regulated by the Common Rule. This category of activity is removed from the definition of research to make explicit that the requirements of the final rule do not apply to authorized operational activities in support of national security missions. This clarification is not intended to narrow the scope of the Common Rule.

We do not believe that this category contradicts President Clinton's Memorandum of 1997 regarding classified research, because this category is merely clarifying what activities are not considered to meet the definition of research. The Clinton Memorandum calls for a number of requirements to be added to protections for classified research activities, but it does not address activities that are not considered research.

4. NPRM Exclusions Not Included in the Final Rule

a. Certain Quality Assurance and Quality Improvement Activities

i. Public Comments

Approximately 90 comments discussed the proposed exclusion for certain QA/QI activities in the NPRM involving the implementation of an accepted practice. A majority of comments supported the concept of excluding some QA/QI activities from the Common Rule, although some stated that the QA/QI exclusion proposed in the NPRM was too narrow to cover what has evolved as current practice.

These commenters expressed concerns that: (1) The NPRM proposed to exclude only the QA/QI activities that met the exclusion, and that all other QA/QI activities would fall under the rule; or (2) the exclusion would be interpreted to mean that the activities described in the exclusion were the only QA/QI activities that could be considered not covered by the rule.

The most commonly discussed suggestions for expanding the scope of this exclusion included:

• Expanding the exclusion beyond “accepted practices”
• Permitting the collection of outcome measures in the category of activities proposed to be excluded by the NPRM

One hospital noted that QA/QI is not limited to implementation of an “accepted practice” and that limiting the exclusion in this way might impede innovation, for example, accessing an electronic medical record system for QA/QI to test incorporating clinical information to analyze and test best-practice pop-up alerts that signal important information for healthcare providers in caring for a patient. This commenter asserted that there is no current “accepted practice” for activities like this, yet they should be excluded from the definition of research to avoid confusion and to support ongoing innovation and care improvement activities. This commenter also suggested that any QA/QI exclusion should permit activities that allow medical centers to analyze how they deliver care, improve outcomes, and modify processes to achieve healthcare reform goals.

One commenter also noted that the “accepted practice” limitation would also be problematic in the social sciences. This commenter disagreed that the proposed exclusion for quality improvement or assurance practices should be limited to “an accepted practice,” and felt that it should apply to the evaluation of alternative practices. In social sciences research an “accepted practice” is generally not as well defined, can evolve rapidly, and vary by considerations such as timing, culture, geography, and nature of service. In social science research, this limitation could severely limit the use of this exclusion for research that is equally low in risk and therefore does not require review.

A few commenters explicitly referenced the importance of QA/QI activities in the context of a learning health care system, and discussed the need for a broader exclusion in order to achieve the goals of a learning health system.

A professional organization focused on advancing the fields of health services research and health policy noted that a basic tenet of the learning health system is the expectation of continuous learning from routine care, which often is accomplished by evaluating health outcomes. The intentional assessment of the outcomes related to a QI activity by itself should not make the activity subject to the Common Rule.

A medical education membership organization felt that routine evaluation of practices and continuous incorporation of knowledge learned into patient care is fundamental to a learning health system and should not be impeded by the regulatory framework. It stated that the current Common Rule provides insufficient guidance to distinguish research and improvement in care delivery in a consistent manner. The organization indicated that the revised Common Rule explicitly recognizes that efforts to improve care by evaluating an accepted practice and the resulting effects are not research that should be regulated under the Common Rule.

Commenters suggested many other QA/QI activities that should be explicitly excluded or exempted from the Common Rule, such as:

• Activities mandated by the Clinical Laboratory Improvement Amendments (CLIA)
• Evaluations of systems-level interventions to improve quality and safety
• Comparative assessment of alternative practices to determine relative effectiveness
• All QA/QI research for the purpose of health care operations, including patient-centered comparative effectiveness research
• Evaluation of competing QA/QI strategies for implementation of accepted medical practices, which should not be subject to IRB review
• Evaluation of competing low-risk interventions that would typically be implemented in a QA/QI framework without further research: these typically are not direct medical treatments but ancillary aspects of care.
• The use of other analytic assessment methods, such as interrupted time series analysis, or randomization of clusters (including stepped wedge designs)
• Dissemination of QA/QI results, or the intention to disseminate results, including by publication, which should not by itself make the activity subject to IRB review (consistent with current OHRP guidance)
• Multi-institution collaborations of otherwise routine QA/QI activities
• Public health-related QA/QI activities
• Comparative benchmarking

Others expressed approval for the proposed exclusion, but suggested that substantial guidance would be necessary for the regulated community to apply this exclusion appropriately. Specifically, several commenters asked about the extent to which OHRP's current guidance on QA/QI activities would still apply. Others asked for clarification about the extent to which the NPRM proposal would apply in situations where a hospital system with several hospitals implemented different accepted practices at different hospitals within the system, and compared outcomes to determine which accepted practice would be best for that hospital system.

Several comments did not support the NPRM's QA/QI proposal. Reasons included: believing that the activities excluded by the NPRM already did not meet the definition of research and thus did not need to be explicitly excluded; believing that these activities should be subject to some type of review because of concerns about investigator self-determination; and, believing that even in QA/QI activities, human subjects should be offered the opportunity to know that they are subjects in a research activity and should be offered the option to consent.

One patient advocacy group noted that because much research is done in the guise of administration or QI, this proposed exclusion might encourage researchers to evade human subjects protections while the projects may put primary subjects and third parties at risk. It stated that although some hospital-based projects might incur minimal risk to primary subjects, they might pose greater risk to other parties, for example, patients. Thus, the group argued that this exclusion should be stricken and that if personal information and biospecimens are to be collected and analyzed for purposes other than the individual patient's care, then that activity should be subject to the Common Rule.

One research institution felt that the proposed change suggests that patient consent will be necessary for many activities designed to ensure QA/QI in health care settings, and could interfere with the imperative to design and evaluate new approaches to enhance patient safety and clinical outcomes. The commenter added that the implications of this provision should be assessed by clinical practitioners and hospital administrators in addition to researchers and research institutions.

Another commenter noted that the proposed exclusion of QA/QI activities fails to exclude important activities that are considered “not research” under the current Common Rule, arguing that the new NPRM exclusion is more in line with evidence-based practice than with QI. Institutions are required under The Joint Commission to perform continuous QI activities, which typically are small, iterative changes to improve clinical care; these activities are seen as part of hospital operations rather than research. The commenter stated that the proposed limitations would make certain QI activities subject to IRB review and possible informed consent requirements, which could result in overregulating an activity that is currently not subject to the Common Rule.

Several of these commenters generally indicated that they interpreted the proposed exclusion as providing a definition of QA/QI, as opposed to excluding a specific type of QA/QI activity. Several of these commenters suggested deleting a QA/QI exclusion from the rule so that IRBs and investigators would not be confused. One hospital suggested eliminating quality activities from the NPRM since by specifying that certain quality activities are not research, the NPRM seems to designate all other quality activities as research by default.

ii. Response to Comments and Explanation of the Final Rule: Certain Quality Assurance and Quality Improvement Activities

The proposed exclusion for QA/QI activities is not included in the final rule. The degree of concern expressed by the public comments on this topic is significant. We recognize that human subject protections would be meaningful and appropriate for some QA/QI research activities, but not for others. However, to avoid increasing confusion and unnecessary obstacles to innovation, the final rule does not single out certain QA/QI activities as meeting or not meeting the definition of research.

b. Program Improvement Activities

i. Public Comments

Approximately 20 comments were received on this proposed exclusion regarding data collection and analysis for internal operational monitoring and program improvement purposes, with a strong majority in support. Commenters indicated that the proposed exclusion would require significant guidance because it was unclear what types of activities it might include and when. Several commenters supported the proposed exclusion, but noted that the exclusion should specifically reference QI activities instead of just program improvement activities. One commenter suggested that activities defined as “health care operations” under HIPAA also be included in this exclusion. One commenter opposed this exclusion because of the lack of specific reference to QI. Another opposed this exclusion because they felt it was too narrowly written.

One large private research firm indicated opposition to this proposal because it was too confusing. Further, this group questioned the need for an exclusion that seemed to only reference activities that would not be considered to fall under the rule because these activities would not satisfy the definition of research (specifically, these activities would not be designed to contribute to generalizable knowledge).

Of those who opposed this proposal, a minority suggested that the proposed exclusion could be abused by investigators, especially given that the NPRM did not propose to require any institutional oversight of exclusion determinations. One commenter noted that because many research activities might be conducted under the guise of internal improvement activities, this exclusion seemed to be giving investigators significant opportunities to conduct human research activities outside the confines of the rule.

One commenter who supported this provision suggested that it could be merged with the QA/QI exclusion proposed in the NPRM. This commenter also suggested that a definition of program improvement and operational monitoring be provided.

The NPRM asked whether the use of biospecimens should be permitted in this exclusion. Of those who answered this question, a majority indicated yes. This majority generally referenced a belief that many activities with residual newborn DBS (see Section III.D) would fall under this exclusion. One commenter who opposed the inclusion of biospecimens in this excluded category indicated that if the goal of the NPRM was to cover all nonidentified biospecimens, then this exclusion should not include the research use of biospecimens.

ii. Response to Comments and Explanation of the Final Rule: Program Improvement Activities

The proposed exclusion for program improvement activities is not included in the final rule. Based on the public comments it does not seem useful for this category of activities to be singled out as not meeting the definition of research. As with the NPRM proposed exclusion regarding QI/QA activities implementing accepted practices, public commenters raised concerns that this exclusion would have created more misunderstanding and confusion than it would have resolved. As with QI/QA activities, some program improvement activities involve research and deserve the protections of the rule, while others are not research and are not under the rule. We believe that this topic would be better addressed through other means.

I. Written or in Writing (§ __.102(m))

The final rule includes a definition that was not included in the NPRM nor in the pre-2018 rule. The definition of “written or in writing” is included at § __.102(m) to clarify that, in accordance with the longstanding interpretation of the pre-2018 rule, these terms include electronic formats, which are increasingly used to fulfill many of the documentation requirements that appear throughout the rule.

Although public comments did not directly address this issue, we are aware that some in the regulated community are uncertain of whether, for example, consent forms may be in electronic formats. This definition is intended to address this concern. Note that the definition of “written or in writing” does not preclude the possibility that consent forms could be in media other than paper or electronic formats and still meet the requirements of the Common Rule.

IV. Ensuring Compliance With This Policy (§ __.103)

A. Background and Pre-2018 Requirements

Requirements in the pre-2018 rule at § __.103 delineated procedural requirements for institutions and IRBs to follow to comply with the rule. The requirements pertained to written assurances (through FWAs) that institutions engaged in research are in compliance with the regulations and that the content of such assurances include: a statement of principles governing the institution in the discharge of its responsibilities to protect research subjects; designation of one or more IRBs; a detailed IRB membership roster; and written procedures for IRBs and reporting of unanticipated problems. A U.S. institution also was able to voluntarily pledge to conduct all of its nonexempt human subjects research, regardless of funding source, in compliance with the Common Rule or the Common Rule and subparts B, C, and D of 45 CFR part 46—often referred to as “checking the box” on the assurance form.

The pre-2018 rule also stated who will execute and evaluate assurances. Finally, the rule described the process by which institutions certify that nonexempt research has been reviewed and approved by an IRB. There has been concern expressed by some that the assurance process may have been unduly burdensome for institutions and did not provide meaningful protections for human subjects.

B. NPRM Proposals

The NPRM proposed a number of substantive and procedural modifications to § __.103 of the Common Rule. First, the NPRM proposed to move several requirements from § __.103 to § __.108, which pertains to IRB functions and operations: (1) The IRB recordkeeping requirements; (2) the requirement in the pre-2018 rule that IRBs have sufficient meeting space and staff to support IRB reviews and record keeping requirements; and (3) the pre-2018 requirement that an up-to-date list of the IRB members and their qualifications be included in an institution's assurance. The NPRM also proposed to modify the IRB membership requirement such that this up-to-date list would no longer be required as part of an institution's assurance. Instead, an IRB or an institution would be required to prepare and maintain a current list of IRB members.

The NPRM proposed to delete several requirements found in the pre-2018 rule: (1) The requirement that an institution provide a statement of ethical principles by which the institution will abide, as part of the assurance process; (2) the pre-2018 rule requirement that an institution designate one or more IRBs on its FWA; (3) the provision found in the pre-2018 rule that a department or agency head's evaluation of an assurance will take into consideration the adequacy of the proposed IRB(s) designated under the assurance, in light of the anticipated scope of the institution's activities and the types of subject populations likely to be involved, the appropriateness of the proposed initial and continuing review procedures in light of the probable risks, and the size and complexity of the institution; and (4) the requirement that grant applications undergo IRB review and approval for the purposes of certification.

Note that under the NPRM federal departments or agencies would retain the ability to ask for information about which IRBs review research conducted at an institution as part of the assurance process, even if providing this information is not explicitly mandated.

According to the NPRM, an additional, nonregulatory change was proposed for the assurance mechanism. The current option of “checking the box” on an FWA (described in section IV.A above) would be eliminated.

To further strengthen the proposed new provision at § __.101(a), giving Common Rule departments and agencies explicit authority to enforce compliance directly against IRBs that are not operated by an assured institution, language was proposed requiring that for nonexempt research involving human subjects that is covered by this policy and takes place at an institution in which IRB oversight is conducted by an IRB that is not operated by the institution, the institution and the organization operating the IRB shall establish and follow procedures for documenting the institution's reliance on the IRB for oversight of the research and the responsibilities that each entity will undertake to ensure compliance with the requirements of this policy (e.g., a written agreement between the institution and the IRB, or by implementation of an institution-wide policy directive providing the allocation of responsibilities between the institution and an IRB that is not operated by the institution).

The NPRM requested public comment on whether protection for human subjects in research would be enhanced if OHRP conducted routine periodic inspections to ensure that the membership of IRBs designated under FWAs satisfy the requirements of § __.107.

C. Public Comments

Very few comments were received on the proposals at § __.103. Four commenters expressed their views on the proposal to delete the requirement that an institution provide a statement of ethical principles as part of the assurance process, with three supporting the proposal and one opposing it.

Four commenters supported the proposal to eliminate the requirement that an institution designate one or more IRBs on its FWA.

Two comments were received, one in support and one opposed, on the proposed elimination of the requirement that an up-to-date list of the IRB members and their qualifications be included in an institution's assurance. Two comments, one for and one against, were received on the proposal to remove the requirement that a department or agency head's evaluation of an assurance take into consideration the adequacy of the proposed IRBs. Responses to the question about periodic inspections to ensure IRBs were compliant were mixed, with most commenters saying that it is not clear that ensuring IRBs are compliant would enhance human subjects protections. Others questioned the need for this requirement, given other incentives institutions have to ensure they have a duly constituted IRB, and still others asked what was meant by “periodic.”

Approximately 30 commenters supported the proposal to delete the requirement that the IRB review grant applications, with only one commenter opposed to the proposal.

D. Response to Comments and Explanation of the Final Rule: Assuring Compliance With the Policy

As proposed in the NPRM, the final rule eliminates the pre-2018 rule requirement that an institution provide a statement of ethical principles by which an institution will abide as part of the assurance process. We believe this requirement is unnecessary. Further, for international institutions that may receive federal funding for research activities, it creates the impression that these international institutions must modify their internal procedures to comport with the set of principles designated on the FWA for activities conducted at those institutions that receive no federal funding. OHRP has received many questions about the extent to which international institutions must adhere to the ethical principles designated as part of the assurance process for research activities conducted by the institution that receive no Common Rule department or agency funding. That such measures are not required will be made clear by deletion of this requirement in the final rule.

Additionally, as proposed in the NPRM, the final rule eliminates the requirement that appeared in the pre-2018 rule that an up-to-date list of the IRB members and their qualifications be included in an institution's assurance. Instead, §§ __.108(a)(2) and __.115(a)(5) in the final rule require that an IRB or the institution prepare and maintain a current list of IRB members. This eliminates the previous requirement that changes in IRB membership be reported to the department or agency head, or to OHRP when the existence of an assurance approved by HHS for federal-wide use is accepted. Of note, SACHRP recommended in March, 2008 that OHRP pursue harmonizing the Common Rule with FDA's human subjects protection regulations by eliminating the requirement to submit IRB membership lists.

The final rule, as proposed in the NPRM, also eliminates the requirement that appeared in the pre-2018 rule that an institution designate one or more IRBs on its FWA. Federal departments or agencies retain the ability to ask for information about which IRBs review research conducted at an institution as part of the assurance process, even if that requirement is not explicitly mandated in the regulations.

An additional, a nonregulatory change that was described in the NPRM will be made to the assurance mechanism. The prior option that enabled institutions with an active FWA to “check the box” (described in section IV.A above) is being eliminated. Importantly, institutions could, if they so desire, continue for purposes of their own internal rules to voluntarily extend the regulations to all research conducted by the institution, but this voluntary extension will no longer be part of the assurance process and such research will not be subject to OHRP oversight. We expect this change to have the beneficial effect of encouraging some institutions to explore a variety of flexible approaches to overseeing low-risk research that is not funded by a Common Rule department or agency, without reducing protection of human subjects, thus furthering the goal to decrease inappropriate administrative burdens.

In addition, as proposed in the NPRM, the final rule removes the provision found in the pre-2018 rule that a department or agency head's evaluation of an assurance will take into consideration the adequacy of the proposed IRB(s) designated under the assurance in light of the anticipated scope of the institution's activities and the types of subject populations likely to be involved, the appropriateness of the proposed initial and continuing review procedures in light of the probable risks, and the size and complexity of the institution. We believe this deletion aligns the regulations with changes made in December 2000 to OHRP's implementation of the FWA process. Those changes streamlined and simplified the assurance process and eliminated OHRP's institution-specific evaluation of the adequacy of each IRB designated under the assurance.

Each FWA-holding institution continues to have responsibility for ensuring that the IRBs on which it relies are registered with OHRP and are appropriately constituted to review and approve the institution's human subjects research, as required under §§ __.107 and __.108 of the final rule.

The final rule contains language at § __.103(e) requiring that for nonexempt research involving human subjects (or exempt research that requires limited IRB review) that takes place at an institution for which an IRB not operated by that institution exercises oversight, the institution and the organization operating the IRB must document the institution's reliance on the IRB for its research oversight. The final rule also requires that this documentation include the responsibilities of each entity to ensure compliance with the requirements of the rule.

The requirement included in the final rule for documenting an institution's reliance on an IRB that it does not operate is more flexible than what was proposed in the NPRM. The final rule only requires that the reliance agreement between the institution and the organization operating the IRB be documented. It does not include the NPRM proposal that the institution and the organization operating the IRB establish and follow procedures for documenting the institution's reliance on the IRB for oversight of the research and delineating the responsibilities that each entity would assume to ensure compliance with the requirements of the rule.

In considering the public comments, we determined that it was unnecessary to require that such reliance relationships be described in institutional procedures. Under the final rule, compliance with this provision could be achieved in a variety of flexible ways, for example, through a written agreement between the institution and a specific IRB, through language contained in a protocol of a multi-institutional study, or more broadly, by implementation of an institution-wide policy directive providing the allocation of responsibilities between the institution and all IRBs that are not operated by the institution. Documenting the responsibilities of the institution and the IRB is already a requirement under the terms of an FWA, but is now a regulatory requirement. An additional requirement has been added at § __.115(a)(9) that such documentation be part of the IRB records.

We acknowledge that the new requirement could increase administrative burden for some institutions, but believe that the examples cited above reflecting the various options an institution may use to document reliance on an IRB not operated by that institution are generally already standard practice in the regulated community.

Finally, the final rule eliminates the requirement in the pre-2018 rule at § __.103(f) that grant applications undergo IRB review and approval for the purposes of certification. The grant application is often outdated by the time the research study is submitted for IRB review and contains detailed information about the costs of a study, personnel, and administrative issues that go beyond the mission of the IRB to protect human subjects. Therefore, experience suggests that review and approval of the grant application is not a productive use of IRB time.

V. Exempt Research (§ __.104)

A. Applicability of Exemptions to Subparts B, C, and D

1. Background and Pre-2018 Requirements

In the pre-2018 rule, the application of the exemptions to research under subparts B, C, and D was specified through footnote 1, which stated that the exemptions do not apply to research involving prisoners, and are also limited in their application to research involving children. Regarding the latter issue, the pre-2018 exemption at § __.101(b)(2) for research involving educational tests, survey or interview procedures or observations of public behavior did not apply to subpart D (i.e., such research did not qualify for this exemption), except for research involving educational tests, or observations of public behavior when the investigator does not participate in the activities being observed. The pre-2018 exemptions did apply to subpart B.

2. NPRM Proposals

Although some of the exemptions proposed in the NPRM were based largely on exemptions in the pre-2018 rule, not all would have applied to subparts B, C, and D. Language in the NPRM explained how the proposed exemptions may have applied to the subparts. The NPRM proposed that all of the exemptions be applied to research conducted under subpart B, and that none of the exemptions may be applied to research conducted under subpart C, except for research aimed at a broader population that consists mostly of nonprisoners but that incidentally includes some number of prisoners. The NPRM proposed that some of the exemptions may be applied to research conducted under subpart D. Under the NPRM, the exemption at proposed § __.104(e)(1) (Research Involving Educational Tests, Surveys, Interviews, or Observation of Public Behavior if the Information is Recorded with Identifiers and even if the Information is Sensitive) could not be applied to research involving children under subpart D. This was because protections including IRB review and parental permission are appropriate for research involving educational tests, surveys or interview procedures, or observation of public behavior when the information collected may be individually identified and sensitive in nature.

Although the NPRM did not propose changes to the HHS regulations at 45 CFR part 46, subparts B, C and D, consideration was given to whether the proposed exemption categories should apply to research involving prisoners under subpart C, either if the research consists mostly of nonprisoners and only incidentally includes some number of prisoners, or if the research intends to involve prisoners as research subjects. Public comment was requested on whether the revised exemption categories should be permitted to apply to research involving prisoners. The NPRM explained considerations including the following: The history of HHS subpart C research certifications to date; the preponderance of low-risk, sociobehavioral research focused on prisoner welfare, substance abuse treatment, community reintegration, and services utilization; the occurrence of prisoner-subjects in databases or registries; and the broad interpretation of the subpart C “prisoner” definition that includes, for example, subjects in court-mandated residential substance abuse treatment.

The NPRM posed a question asking whether language in the final rule should resemble the 2003 waiver of the applicability of certain provisions of the rule for HHS-conducted or -supported epidemiologic research involving prisoners and state that the exemptions apply except for research where prisoners are a particular focus of the research. The language of the 2003 waiver criteria are broader than what was proposed in the NPRM, and already familiar to the research community. They apply to epidemiological research that presents no more than minimal risk and no more than inconvenience to the prisoner/subjects. A question was also asked whether the proposed application of the exemptions to subparts B and D was appropriate.

3. Public Comments

Approximately 50 comments were received on the applicability of the proposed exclusions and exemptions to the subparts of the rule. Eight comments addressed the applicability of the exemptions to subparts B and D. However, responses to the question, “Is the proposed application of the exemptions to subparts B and D appropriate?” uniformly agreed with the proposal. A strong majority of the comments addressed the applicability of the exemptions to subpart C.

The NPRM sought comment on the proposal to allow the exemptions to apply in research that only incidentally involves prisoners, but that is enrolling a primarily nonprisoner population. This would represent a policy shift in how the exemptions historically have been applied to subpart C. Comments regarding this proposal were mixed. Some responses claimed that the proposal expanded the application of the exemptions to all research under subpart C, rather than a small subset of subpart C research. Other comments opposed the proposal, pointing to the troubled history of research with prisoners, and suggesting that research involving prisoners, regardless of the risk level, should always go through subpart C IRB review. A narrow majority of comments responded that the exemptions should be permitted to apply to subpart C in a limited way. However, responses regarding the proposed language or which exemptions should be applicable to subpart C prisoners varied. Some felt a study should be exempted only if it offered some benefit to the prison population. Others felt it could be exempt so long as there was no identifiable sensitive information or biospecimens involved. Some who supported the proposal indicated that because the NPRM did not propose to expand the applicability of the exemptions to research targeting prisoners, the proposal seemed to be a reasonable expansion. One comment noted that permitting a broader interpretation might enable more prisoner-subjects to participate in potentially low-risk beneficial research. A few commenters addressed whether the language describing the applicability of the subparts to research involving subpart C should resemble the 2003 epidemiological waiver criteria. Of these, comments were mixed, with some indicating that the 2003 epidemiological waiver criteria would be too ambiguous, others indicating that it would be appropriate language to use, and a final minority reiterating their opinion that the exemptions should never be permitted in research conducted under subpart C.

4. Response to Comments and Explanation of the Final Rule: Applicability of Exemptions to Subparts

The NPRM proposal regarding how the proposed exemptions may be applied to the subparts is largely unchanged in the final rule. The language at § __.104(b)(2) regarding subpart C has been modified slightly to reduce ambiguity and potential administrative burden, and in response to public comment, to narrow the scope of exemption application. The final rule does not adopt the 2003 epidemiological waiver language due to concerns from public comments that such language would be ambiguous and difficult to interpret.

The final rule section__.104(b)(1) states that all of the exemptions at § __.104 may be applied to research conducted under subpart B if the conditions of the exemption are met. Language at § __.104(b)(2) states that none of the § __.104 exemptions may be applied to research conducted under subpart C, except for research aimed at involving a broader subject population that only incidentally includes prisoners. This is a modification of the NPRM language, which proposed that the exemptions could apply if research consisted “mostly of nonprisoners and only incidentally” included some number of prisoners. The language was changed in order to avoid the implied need (“mostly”) for institutions to project and track the percentage of prisoners participating in nonexempt research. The revision also more clearly describes and limits the circumstances in which exempt research may include prisoners. The language at § __.104(b)(3) relevant to subpart D has been modified to reflect the revised structure of the final rule, and now states that the exemptions at paragraphs (d)(1), and (d)(4)-(8) of this section may be applied to research that is subject to subpart D if the conditions of the exemption are met. Paragraphs (d)(2)(i) and (ii) of this section may apply only to research activities that are subject to subpart D involving educational tests or the observation of public behavior when the investigator(s) do not participate in the activities being observed. Paragraph (d)(2)(iii) of this section may not be applied to research that is subject to subpart D, because protections, including IRB review and parental permission, are appropriate for research involving children and educational tests, surveys or interview procedures, or observation of public behavior when the information collected may be individually identified and sensitive in nature.

The final rule does not make revisions to the HHS regulations at 45 CFR part 46, subparts B, C, and D. Throughout this rulemaking process, the intent has been to revise subpart A, and to address revisions to subparts B, C, and D at a later time. However, particular consideration has been given to the specific issue of whether the proposed exemption categories should apply in the context of research that is aimed at a broad population and only incidentally includes prisoners. We concur with the comments expressing support for this change.

In such instances, the specific protections required by subpart C are frequently not relevant to the research subjects. The permitted inclusion of this subset of prisoners under the exemptions at § __.104 is intended to allow an appropriate reduction in IRB administrative burden while preventing IRBs from necessarily prohibiting the participation of this group in exempt research activities, assuming the conditions of the exemptions are fully satisfied.

We believe this subpart C change is narrow in scope, affecting only a small subset of subjects who are prisoners. This change will permit, for example, the exempt secondary research use of information or biospecimens from subjects who are prisoners, if that analysis is not seeking to examine prisoners as a population and only incidentally includes prisoners in the broader study. Such inclusion would previously have required IRB review under subpart C, including review by an IRB prisoner representative, followed by certification to and authorization by OHRP. In addition, if the research did not fit into a § 46.306(a)(2) subpart C category of permissible research, prisoners could not be included as subjects in the study, thereby causing problems involving identifying and removing these subjects from the analysis of repositories and databases.

Similarly, the narrow expansion would allow a subject to continue participation in exempt research if he or she became a prisoner during the course of an exempt study, assuming the study was aimed at a broad nonprisoner population, without the need for subpart C IRB review and certification to OHRP. For example, an exempt study that recruited subjects from a local community center to participate in a comparison of HIV educational materials would continue to be exempt, and would not trigger the need for review under subpart C, even if some of the subjects became prisoners after enrollment. On the other hand, a study that recruited subjects from a jail or prison to participate in a comparison of HIV educational materials would continue to be nonexempt under the final rule and require both subpart A and subpart C review, including certification to OHRP.

B. Exemption Determination

1. Background and Pre-2018 Requirements

The pre-2018 rule did not specify who at an institution may determine that research is exempt. However, in the past, OHRP has recommended that because of the potential for conflict of interest, investigators not be given the authority to make an independent determination that their human subjects research is exempt. OHRP has recommended that institutions implement exemption policies that most effectively address the local setting and programs of research. OHRP has recognized that this may result in a variety of configurations of exemption authority, any of which were acceptable assuming compliance with the pre-2018 regulations. In addition, OHRP guidance provided that institutional policies and procedures should identify clearly who is responsible for making exemption decisions. We note that under the pre-2018 and final rule a Common Rule department or agency retains final authority as to whether a particular human subjects research study conducted or supported by that department or agency is exempt from the Common Rule.

2. NPRM Proposals

The NPRM proposed to adopt a requirement that exemption determinations be documented, and that such determinations could be made only in two specified ways. To assist investigators and institutions in making a timely and accurate determination of exemption status the NPRM proposed that federal departments or agencies would develop one or more exemption determination tools (the use of which would constitute one of the ways in which determinations could be made). Federal departments or agencies would create their own tool, or rely on a tool created by another department or agency (including a web-based tool created by HHS). Institutions would have discretion as to whether or not to implement such a tool. As proposed in the NPRM, it would be designed in such a way that if the person using the tool inputs accurate information about the study, the tool would produce a determination of whether the study is exempt. Institutions could rely on the use of the federally developed tool by investigators as a “safe harbor” for this determination. Use of the tool would be voluntary, and each institution and agency would decide whether to rely on the decision tool for their determinations, and if so, who would be allowed to use it. Institutions that chose not to use the tool for particular determinations would be required to have such determinations made by an individual who is knowledgeable about the exemption categories and who has access to sufficient information to make an informed and reasonable determination. In general, as envisioned in the NPRM, it was expected that investigators would not be allowed to make exemption determinations for themselves without the use of the decision tool, due to considerations of a conflict of interest.

The NPRM requested public comment on several aspects of the proposal to develop a decision tool: (1) The likelihood of an institution allowing investigators to use the tool; (2) the ease of investigators contriving answers in using the tool; (3) whether use of the tool should be restricted to certain exempt categories of research; (4) whether deployment of such a tool would erode public trust in research; and (5) what additional information should be required to be kept as a record other than the information submitted into the decision tool.

The NPRM also proposed that the institution or IRB be required to maintain records of exemption determinations, which records must include, at a minimum, the name of the research study, the name of the investigator, and the exemption category applied to the research study. As described in the NPRM, maintenance of the output of the completed decision tool would fulfill this recordkeeping requirement. Although the NPRM did not propose an auditing requirement for assessing the accuracy of exemption determinations, it sought public comment about the need for one.

3. Public Comments

This was one of the more commented-on provisions of the NPRM, receiving approximately 280 comments. Public comment was generally mixed, with approximately half supporting and half opposing this proposal. A large majority noted that they felt unable to adequately respond to this proposal without seeing the decision tool first. Many of those who indicated general support for this proposal noted substantial qualifications to their support, such as the need to see the tool before deciding. Some requested that this proposal not be included in a final rule, and that a separate NPRM be issued specific to this proposal. Many commenters said that for simplicity and consistency, one tool should be agreed on by all of the sponsoring departments and agencies and that the departments and agencies should involve research administration professionals in developing such a tool so that it would have field-friendly workability and produces trustworthy results. Further, they thought that the tool should be pilot tested and validated by institutions and investigators before being deployed. For those who supported the concept of a decision tool, they felt that its use would speed the review process for exempt research. Some cited long wait times to receive an exemption determination from their institution's IRB.

Some commenters stated that the tool should clearly indicate that although it determines exemption from federal regulations, state restrictions still apply. A large academic center argued that though the tool could be useful, for institutions that provide services, treatment, and care for vulnerable populations it might be prudent to have someone with expertise in human research protections independently review research proposals to determine whether they are exempt or excluded from IRB review, rather than rely on the tool.

One large research university questioned the need for such a tool, asserting that properly designed oversight and review of exempt research should take minimal time and ensure that only exempt research is conducted without IRB approval. This commenter preferred comprehensive guidance on exempt research to support IRBs in making efficient and expeditious exemption determinations. A large academic/research organization concurred, pointing out confusion among investigators about exempt categories, which requires careful conversation with IRB officers to understand how their project fits into the human protection framework. This organization believed that these conversations promote safe and effective research decision making and argued that use of the tool could fail to properly educate investigators about the complexities of exempt research determinations.

Some commenters noted that the decisions produced by the tool would be only as good as the tool and the materials and guidance that accompany it. Some commenters added that it is unlikely, however, that the use of a federal decision tool would shield the institution or investigator from liability in third-party actions. Still others went so far as to say that they doubted their institution would allow its use, at least for some time after which it was proven. To the extent institutions are not engaged in the exemption determination process through the tool, some argued that institutions should not be held accountable for any unintended outcomes.

Of those who commented on whether investigators should be allowed and trusted to use the exemption determination tool, some noted that it seemed inappropriate and a conflict of interest for investigators to be allowed to use the tool to generate exemption determinations for their own research activities. Others noted that an investigator might be able to use the tool, but that the proposed exemptions categories were so nuanced that experienced IRB staff might have difficulty determining what qualifies for an exemption. To that end, these comments noted that the tool would need to be accompanied with substantial guidance for an investigator to be able to accurately input information into it. Finally, some commenters expressed concern about the possibility that investigators might enter inaccurate or misleading information into the tool to “game the system,” while others noted that that possibility, although remote, exists in the current protocol submission process and that a well-developed tool could include a means for validating certain types of inputs to assess accuracy.

4. Response to Comments and Explanation of the Final Rule: Exemption Determination

The final rule does not adopt the NPRM proposal at this time. Therefore, the final rule does not require that exemption determinations be documented, as had been proposed in the NPRM, and continues to permit flexibility in how exemption determinations are made. We recognize it was difficult to provide detailed feedback in the absence of an exemption decision tool to evaluate. However, we continue to believe that a well-designed, tested, and validated exemption decision tool could offer an expedient mechanism for determining whether research studies are exempt. Thus, we will continue to explore development of an exemption decision tool. If and when an exemption decision tool is developed, we would issue a subsequent (separate) Federal Register notice for public comment. The notice would also give the public the opportunity to comment on whether the use of the tool would be appropriate in making exemption determinations under this final rule. Thus, members of the public would be afforded a sufficient opportunity to provide meaningful comments on such a proposed decision tool.

C. Categories of Exempt Research

The following sections describe the categories of exempt research found in the final rule. Note that several categories of activities proposed in the NPRM as exclusions appear in the final rule as exemptions.

1. Background and Pre-2018 Rule

Under the pre-2018 rule, a research activity qualified for exemption from the Common Rule if it fell into one or more of six categories at § __.101(b)(1)-(6). Such studies were fully exempt from the regulations. That is, so long as a study did indeed fall within a category, it did not need to satisfy any other regulatory requirements that it needed to satisfy under the pre-2018 rule.

2. NPRM Proposals

The NPRM proposed that all exemption language would be found at § __.104. The NPRM proposed retaining all of the exemption categories in the pre-2018 rule in one form or another except for the exemption pertaining to research involving the use of educational tests, survey or interview procedures or observation of public behavior if the subjects are elected or appointed officials, or if the confidentiality of the information were protected by statute. However, the NPRM proposed re-classifying some of the pre-2018 rule's exemptions as exclusions under the NPRM (and thus they would not have been subject to administrative or IRB review), while retaining some of the pre-2018 rule's exemptions as exemptions (versus exclusions).

The NPRM proposed eight exemptions divided into three categories: (1) Low-risk interventions for which there would have been no other requirement (e.g., informed consent and privacy safeguards) other than the determination and recording requirements; (2) research activities that would have required application of privacy safeguards; and (3) secondary research involving biospecimens and identifiable private information that would have required application of privacy safeguards, broad consent, and limited IRB review. The NPRM proposed to have some exempt studies meet certain other regulatory requirements while not having to meet other requirements, making them not “fully exempt” in the sense of the pre-2018 rule.

The NPRM proposed retaining exemption categories § __.101(b)(1), (5), and (6) from the pre-2018 rule. The NPRM proposed clarifying the exemption for research on public benefit programs or demonstration projects in the pre-2018 rule and explained that OHRP's guidance would be changed to include the applicability of the exemption to cover research on public benefit and service programs that an agency does not itself administer through its own employees or agents. The NPRM proposed requiring federal departments or agencies conducting such studies to publish a list of studies under this exemption.

The NPRM proposed that new exemptions would be created for:

• Certain research involving benign interventions;
• Certain research involving educational tests, survey or interview procedures, or observation of public behavior where identifiable private information was recorded, so long as data protection standards are met;
• Secondary research use of identifiable private information originally collected for nonresearch purposes;
• Activities relating to storing and maintaining biospecimens and identifiable private information for secondary research use, if subjects provided broad consent;
• Secondary research studies that would use the biospecimens and identifiable private information stored or maintained under the above exemption.

The NPRM asked for public comment on several aspects of these proposals, as they appeared as either exemptions or exclusions and whether their placement in the NPRM was appropriate with regard to protecting human subjects in research. Comment was requested on whether guidance would be needed to help make exemption determinations and whether the scopes of the proposed exemptions or proposed exclusions were appropriate. That is, whether particular exclusions or exemptions were either too narrow or too broad. For example, several questions were posed about whether research should be exempt if it involved psychological risks. The NPRM asked about whether notice should be given to subjects for any of the activities. The public was asked to comment on whether and how exempt activities could comply with the NPRM's proposed privacy safeguards.

The NPRM also inquired whether the exemption category related to research conducted in established or commonly accepted educational settings should apply only to research activities in which notice is given to prospective subjects or their legally authorized representatives as a regulatory requirement, when not already required under the Privacy Act of 1974. If so, comment was sought on the type of information to include in the notice and on how such notice should be delivered.

The NPRM asked for feedback on whether the proposed privacy safeguards should apply to research included in the proposed exempt category related to research conducted in established or commonly accepted educational setting, given that such research may involve risk of disclosing identifiable private information. The public was also asked to comment on whether the protections provided by the HIPAA Rules for identifiable health information used for health care operations, public health activities, and research activities are sufficient to protect human subjects involved in such activities, and whether the current process of seeking IRB approval meaningfully adds to the protection of subjects involved in such research studies.

The NPRM asked about the extent to which the HIPAA Rules and the Health Information Technology for Economic and Clinical Health (HITECH) Act adequately address the beneficence, autonomy, and justice considerations related to collecting new information and whether any exemption for such collection should be limited to data collected or generated in the course of clinical practice.

With regard to the proposed exemption related to research and demonstration projects conducted or supported by a federal department or agency, the public was asked to comment on: (1) Whether notice should be given to prospective subjects and the nature of such notice; (2) whether such activities can involve greater than minimal risk and whether they are appropriate as exemptions; and (3) whether existing privacy safeguards for such activities were sufficient.

A proposed new exemption category was intended to facilitate secondary research using identifiable private information that would have been or would be collected or generated for nonresearch purposes, when prior notice had been given and privacy safeguards and prohibitions on re-use of the information were in place. The public was asked to comment on what types of research should fall under this proposed exemption, whether it should be limited to research in which individuals have been informed of the potential for future research use of their information and given the opportunity to opt out, and whether the exemption would be appropriate for clinical data registries.

Finally, public comment was sought on two related proposed exemptions for research involving the use of biospecimens or identifiable private information that would have been stored or maintained for secondary research use, if consent for the storage and maintenance of the information and biospecimens had been obtained using a broad consent template that the NPRM proposed would be developed by the Secretary of HHS.

3. Public Comments, Response to Comments, and Explanation of the Final Rule: Exemption Categories

All exemption categories, of which there are eight, appear at § __.104 in the final rule. Four of the exemption categories were proposed as exclusions under the NPRM. In addition, the proposed exclusion concerning certain research involving educational tests, survey or interview procedures, or observation of public behavior has been combined with the exemption regarding additional research activities using the same research methods. The rule includes four exemptions for research involving normal educational practices, research involving benign behavioral interventions, research involving public benefit or service programs, and research involving taste and food quality, all of which were also proposed in the NPRM.

Three exemptions pertain to secondary research uses of identifiable private information or identifiable biospecimens. One exemption, at § __.104(d)(4), which concerns secondary research for which consent is not required, which consists of three of the proposals for exclusions in the NPRM. A second exemption, at § __.104(d)(7), pertains to storage or maintenance of identifiable private information or identifiable biospecimens for which broad consent is required, and a third exemption, at § __.104(d)(8), concerns secondary use of identifiable private information or identifiable biospecimens for which broad consent is required. As will be discussed in more detail below, some of the conditions associated with the finalized exemptions differ from what was proposed in the NPRM.

In the final rule, similar to what was proposed in the NPRM, “exempt” does not always mean exempt from all of the requirements of the Common Rule; the activity must fit the description of the exempt category and not include nonexempt research activities. For example, the exemption categories in the final rule at § __.104(d)(7) and (8) identify specific regulatory requirements that must be met (e.g., limited IRB review, the use of broad consent) as a condition of being exempt from other regulatory requirements.

Public comments, responses to comments, and explanations of the final rule for each exemption category follow.

a. Research Conducted in Established or Commonly Accepted Educational Settings When It Specifically Involves Normal Educational Practices (§ __.104(d)(1))

i. Public Comments

Approximately 50 comments discussed this exemption, which was a slight modification of an exemption that existed in the pre-2018 rule. The NPRM asked two questions about this exemption: (1) whether it should require some type of notice and if so, how notice should be delivered; and (2) whether the proposed privacy safeguards should apply to this exemption.

One commenter (a research dean from a university) suggested that the wording of the exemption be modified from “research conducted in established or commonly accepted educational settings” to “research conducted in established or commonly accepted educational or other settings” in order to allow more flexibility in how this exemption could be applied.

Other commenters noted a need for guidance on how this exemption should be interpreted. For example, one comment suggested that a wide array of “normal” educational practices exists, and the intention of this language was difficult to discern. Another comment noted that clarification was needed about permissible data collection methods under this exemption.

One commenter discussing the addition of the limitation that the study should not be likely to adversely affect students' opportunity to learn noted that it might be difficult to predict ahead of time if the research contemplated under this exemption might have this adverse impact.

Several commenters discussed whether notice should be required. The majority of these comments indicated that some type of notice should be required. A few specifically discussed the importance of notifying subjects of these activities (with one commenter stating that parental consent should be required), stating that lack of notice could erode public trust in research.

Groups representing AI/AN tribal interests argued that notice for this type of research should be required. Specifically, they asserted that transparency around research-related activities and policies, especially in school settings, can build trust among AI/AN populations and ensure that individual and community benefits of participation in research are achieved. They also noted that tribal consultation facilitates decisions about appropriate ways to implement such notices, and observed that the rural nature of many AI/AN communities requires the use of multiple modes of communication and more time spent reaching the intended audience. The commenter also noted that potential subjects should be given the opportunity to opt out of research activities.

One commenter argued that notice is generally an insufficient standard for this type of research and is not a suitable substitute for informed consent.

Approximately 20 comments discussed whether the proposed privacy safeguards that appeared at § __.105 in the NPRM should apply to this exclusion. Comments were generally mixed about whether this would be appropriate, with a small majority indicating that the privacy safeguards should not apply. These comments generally argued that if an activity is exempt, no additional requirements should be placed on that research activity.

A privacy advocacy organization that supported both notice and attaching the proposed privacy safeguards to this provision, stated that notice in this context is also important because other federal standards (e.g., Family Educational Rights and Privacy Act [FERPA; 20 U.S.C. 1232g; 34 CFR part 99], Protection of Pupil Rights Amendment [PPRA; 20 U.S.C. 1232h; 34 CFR part 98]) are not acceptable proxies for privacy protection. This commenter indicated that the notice should be robust with detailed information presented to parents directly. As justification for providing additional protections in this context, this group noted that the consequences for misuse of data are greater for children; that is, lost, misused, or leaked information about children could have lifelong consequences. The commenter argued that if an exemption is proposed for this class of research, then the lack of IRB oversight should require that researchers must comply with appropriate privacy safeguards.

ii. Response to Comments and Explanation of the Final Rule: Exemption for Certain Research Conducted in Certain Educational Settings

The final rule includes an exemption at § __.104(d)(1) for research conducted in established or commonly accepted educational settings that specifically involves normal educational practices, so long as the research is not likely to adversely affect students' opportunity to learn required educational content or the assessment of educators who provide instruction. This includes most research on regular and special education instructional strategies, and research on the effectiveness of, or the comparison among, instructional techniques, curricula, or classroom management methods.

This exemption is a revised version of the first exemption in the pre-2018 rule and a modified version of the exemption as proposed in the NPRM. This change is based on concerns about whether the conduct of some research projects of this type might draw enough time and attention away from the delivery of the regular educational curriculum that they could have a detrimental effect on student achievement. The wording of the exemption has been modified to include a condition that the research is not likely to have these adverse impacts. This was the original intent of the NPRM proposal, and it is an important qualification that should apply to any research activity that is exempt under this provision. It also drops the phrase “in that educational setting,” because that phrase is redundant.

The exemption is retained to allow for the conduct of education research that may contribute to the important public good of improving education, consistent with the principle of beneficence. The exemption retains the condition that the research activity takes place in established or commonly accepted educational settings, because otherwise IRB review would be warranted for such research activities being conducted in unconventional settings.

We recognize that providing notice for this type of research could involve a significant administrative burden and that it is not always appropriate, and therefore have decided not to include it as a regulatory requirement at this time. We note that making these activities exempt does not mean that there ought not to be tribal consultation about the research activities, and that such consultation may lead to a notice requirement. Where appropriate or mandated by tribal law, tribal consultation should take place irrespective of whether the activity has to meet the requirements of this final rule. Such consultation would represent a free-standing legal obligation, as is referred to in § __.101(f).When appropriate, investigators may provide notice in a manner that is appropriate to the research activity and the cultural context in which it occurs.

This exemption is largely unchanged from the pre-2018 rule, and does not add requirements for safeguarding privacy at this time.

b. Research That Includes Only Interactions Involving Educational Tests (Cognitive, Diagnostic, Aptitude, Achievement), Survey Procedures, Interview Procedures, or Observation of Public Behavior (Including Visual or Auditory Recording), If at Least One of Three Criteria Is Met (§ __.104(d)(2))

This exemption in the final rule is a revised version of an exemption in the pre-2018 rule, and is a combination of a provision proposed as an exclusion in the NPRM, and a provision proposed as an exemption in the NPRM. Thus, public comments on both of these proposals follow here.

i. Public Comments

Approximately 80 comments discussed this proposed exclusion, which was an exemption in the pre-2018 rule. Public comments were mixed. Some felt that moving these activities from the exemption to exclusion category would streamline this type of low-risk, common research activity and allow IRBs to focus time and attention on more complicated and higher risk activities. Others, including SACHRP and many research universities, argued that based on their experience, investigators have difficulty making the assessments required to determine whether an activity falls under this exemption. For example, investigators have a difficult time determining whether disclosure outside of the research context might put someone at risk of criminal or civil liability.

Commenters also expressed concern about whether the three statutes cited in the third prong of the proposed exclusion would provide a comparable level of protections to human subjects as does the Common Rule. Many of these commenters noted that they simply were not sure what types of protections would be afforded to subjects under the Privacy Act, the Paperwork Reduction Act, and the E-Government Act of 2002. Others noted that the main protections provided by these statutes involved notice and not ethics review.

The NPRM requested comment on the extent to which covering educational tests, survey procedures, interview procedures, or observation of public behavior under the Common Rule would substantially add to the protections provided to human subjects. Public comment was mixed, but the majority of commenters felt that these activities should be exempt rather than excluded. One commenter indicated that contrary to the primary justification for excluding these categories of research, these activities cannot always be considered to be low risk and could pose significant risks depending on the nature of the research and sensitivity of the data collected.

One commenter expressed strong opposition to excluding these activities from Common Rule protections, indicating that excluding them would compromise the rights and welfare of research subjects. The commenter emphasized that consent cannot be inherent to participation in the activity because researchers cannot know with certainty that participants are familiar with common forms of educational tests, surveys, and interview procedures and the potential risks inherent to information disclosure. In addition, the commenter pointed out, assuming that even vulnerable subjects know the risks associated with participation in surveys and interviews is contrary to the Belmont Report's assertion that vulnerable subjects need additional protection.

Some comments were mixed, for example, suggesting that observation of public behavior might be an acceptable exclusion, whereas surveys and interviews ought to remain exempt. One commenter indicated that it might be reasonable for these activities to be excluded if an exclusion determination tool was available to help investigators make the decision. Another commenter suggested that whether the activities are exempt or excluded, notice should be required, to indicate the purpose of the activity, describe privacy safeguards, state that participation is voluntary, and provide information on opting out.

Other commenters expressed concern that investigators might not be able to effectively make these determinations, and pointed out that IRBs, with a broad range of experience and expertise in data identifiability, provide a check for researchers' judgment and are better placed to make consistent and informed decisions about exemptions.

Even so, some other commenters felt that Common Rule protections do not substantially add to the protection of human subjects in these categories of activities. Thus, categorizing them as an exemption just adds administrative burden.

The NPRM asked whether this exclusion should apply only to research activities in which notice is given to prospective subjects or their legally authorized representatives as a regulatory requirement, and if so, what information should be included in the notice. Some commenters supported a requirement for notice or at a minimum, some sort of tracking system for these activities. One emphasized that the ethical principle of respect for persons demands some sort of notice. Some indicated that requiring notice prevents these activities from being excluded and might necessitate including them on the list of activities for expedited review rather than deeming them exempt activities.

Other commenters expressed concern about the proposed exclusion. For example, one indicated that it might not be correct to assume that people agree to participate, and understand that they can opt out, by virtue of their participation, and another reiterated concern about assuming that these activities are inherently low risk and expressed a desire to keep these activities in the exempt category to maintain a level of IRB oversight.

The NPRM asked whether it is reasonable to rely on investigators to make self-determinations for the types of research activities covered in this particular exclusion category, and if so, whether documentation of any kind should be generated and retained. One commenter expressed a strong opinion that investigators should be allowed make these self-determinations. However, the majority of comments responding to this question felt that investigators should not be solely responsible for making these determinations.

Some commenters felt that self-determination might work in certain cases or with certain groups but that there would be too much variability to allow it generally. One suggested a screening system that might check whether determinations were being made correctly.

Many commenters pointed out that it is unreasonable to expect investigators to be able to reliably discern levels of risk inherent to disclosure of information, and that what might seem innocuous to researchers could cause real harm to others. Other commenters expressed concern about conflicts of interest, and that investigators might be more likely to make a determination to not delay their research. Another commenter emphasized that oversight is necessary to avoid situations in which investigators inaccurately assume that subjects understand that they are participating in research, or that they are being recorded, for example.

The NPRM requested comment on whether some or all of these activities should be exemptions rather than exclusions. Response to this question was mixed. Some commenters felt that these activities should be excluded. Others felt that surveys and interview should be considered exempt while educational tests and observation of public behavior should be excluded. Still others felt that all should be exemptions except for observations of public behavior, which could be excluded.

The NPRM asked whether these exclusions should be narrowed such that studies with the potential for psychological risk are not included and whether certain topics that involve sensitive information should not be covered by this exclusion. There was general agreement among responses to this question that the exclusions should be narrowed so that studies with the potential for psychological risk were not included in the exclusion. Some commenters, however, indicated that it would be unrealistic to expect investigators to make this determination reliably, that it might be challenging to implement such a policy, and that guidance would be required from regulatory bodies.

Commenters felt that these activities should be exemptions rather than exclusions, to preserve a level of IRB oversight. One commenter pointed out that circumstances that occur in research for which psychological risks are possible are fairly common in this category of activities and that excluding them would leave the risk unaddressed. One professional organization emphasized that the “potential for serious psychological harms that may be associated with participation in nonbiological research . . . [is] not merely the result of inappropriate disclosure of information.” It also indicated that “the probability and magnitude of this risk may vary by characteristics of individual participants, clinical expertise of the interviewer(s), as well as the risk-minimizing protections that are in place.”

The NPRM requested comment on whether for activities captured under the third element of this exclusion, the statutory, regulatory, and other policy requirements cited provide enough oversight and protection that being subject to expedited review under the Common Rule would produce minimal additional subject protections. If so, the NPRM asked whether the exclusion should be broadened to also cover secondary analysis of information collected pursuant to such activities. Of the few responses to this question, one commenter felt that existing protections are sufficient if information is stored in a secure information technology (IT) infrastructure.

Other organizations expressed strong sentiments that neither the Paperwork Reduction Act nor the Privacy Act were protective in the research context and that current privacy protections are inadequate. They stressed the importance of safeguarding IT and cyber infrastructure and provided examples of large data breaches.

The NPRM asked about the extent to which excluding any of these research activities from the Common Rule could result in an actual or perceived reduction or alteration of existing rights or protections provided to human subjects. That is, does excluding these research activities from the Common Rule pose any risks to scientific integrity or public trust? Commenters who responded to this question generally felt that excluding any of these research activities could result in an actual or perceived reduction or alteration of existing rights or protections provided to human subjects. One indicated that reduction in oversight would lead to subjects being exposed to unintended risks that otherwise would be preventable. Other commenters felt that improper assumptions about low levels of risk in these activities and allowing for self-determination could lead to a reduction in protections for human subjects.

ii. Public Comments on the Proposed Exemption for Research Involving Educational Tests, Surveys, Interviews, or Observation of Public Behavior If the Information Is Recorded With Identifiers, and Even If the Information Is Sensitive

Approximately 50 comments discussed the proposal to exempt educational tests, surveys, interviews, or observation of public behavior if the information is recorded with identifiers and even if the information is sensitive. Public comment here was mixed, with some agreeing that by mandating privacy safeguards, the proposal effectively addresses the primary risk that occurs in this type of research. Others argued that this type of research still benefits from some type of IRB review and thus should be considered covered rather than exempted research. Yet other comments noted that it was impossible to make a determination about this proposed exemption without seeing the proposed privacy safeguards that were proposed in the NPRM.

Several commenters noted that the parameters of this exclusion might be acceptable if it excluded sensitive topics or if it excluded research studies that posed psychological harm to potential subjects. One comment by a professional organization of psychology professionals noted that IRBs often misunderstand and overstate psychological risks in research. Because of this, this group argued that the rule should not include a limitation based on psychological risks because IRBs are not able to effectively assess psychological risks.

The NPRM also asked whether this exemption should be extended to research involving children. The majority of those who responded to this question were opposed to such an extension.

iii. Response to Comments and Explanation of the Final Rule: Exemption for Certain Research Involving Educational Tests, Surveys, Interviews, or Observation of Public Behavior Under Specific Conditions

The final rule includes an exemption at § __.104(d)(2) that is a revised version of an exemption in the pre-2018 rule. The exemption applies to research that only includes interactions involving educational tests (cognitive, diagnostic, aptitude, achievement), survey procedures, interview procedures, or observation of public behavior (including visual or auditory recording) uninfluenced by the investigator if at least one of three criteria is met:

• The information obtained is recorded by the investigator in such a manner that the identity of the human subject cannot readily be ascertained, directly or through identifiers linked to the subjects;
• Any disclosure of the human subjects' responses outside the research would not reasonably place the subjects at risk of criminal or civil liability or be damaging to the subjects' financial standing, employability, educational advancement, or reputation; or
• The information obtained is recorded by the investigator in such a manner that the identity of human subjects can readily be ascertained, directly or through identifiers linked to the subjects, and an IRB conducts a limited IRB review to make the determination required by § __.111(a)(7) (which relate to there being adequate provisions for protecting privacy and maintaining confidentiality).

The final rule does not include the language proposed in the NPRM that offered as one prong of the exemption (proposed as an exclusion) that the research be subject to the Privacy Act, the Paperwork Reduction Act, or the E-Government Act of 2002. The final rule simply includes § __.104(d)(2)(iii), which requires limited IRB review as described at § __.111(a)(7) if identifiable private information will be obtained and recorded in such a way that the identity of human subjects can readily be ascertained, either directly or through identifiers linked to the subject.

This exemption is based on the assumption that the potential risks raised by this category are largely informational and that subjects are aware of them, and thus the most important role that an IRB might play with respect to reducing potential harms is to ensure the application of privacy safeguards. Under this assumption, the exemption is consistent with the principle of respect for persons and the preservation of autonomy. In the case of observation of public behavior, even if the subject does not know that an investigator is watching his or her actions, the subject's behavior is public and could be observed by others, and thus the research observation is not inappropriately intrusive.

The term “survey” as used here refers to information collected about individuals through questionnaires or similar procedures (e.g., the Current Population Survey conducted by the U.S. Census). “Human subjects” do not include organizations or businesses. “Survey,” as used here, does not include the collection of biospecimens. Thus, an activity that included the collection of a biospecimen (e.g., a cheek swab), in addition to collecting verbal or written responses to questions, could not qualify for this exemption.

This exemption includes the research activities that appeared at § __.101(b)(2) in the pre-2018 rule, as well as some additional information collection research activities using the same methods. As in the pre-2018 rule, this exemption includes research studies whose methods consist of the use of educational tests, survey or interview procedures, or observation of public behavior that does not involve an intervention, if the data are recorded anonymously, or the information is recorded with identifiers, but is not sensitive such that its disclosure could result in harm to the subjects. The exemption provides a list of the specific harms that must be considered, as did the pre-2018 rule, with the addition of the specific harm of potential damage to the subjects' educational advancement. This potential harm has been added because of the obvious relevance to the effects of the disclosure of responses in research involving educational tests.

This exemption has been expanded to include research using the same methods involving identifiable private information that might be sensitive or potentially harmful if disclosed, so long as the investigators adhere to the limited IRB requirements outlined in § __.111(a)(7), and the research is not subject to Subpart D. The limited IRB review requirements are designed to provide privacy safeguards to reduce the chances that the disclosure of identifiable private information will occur and lead to harm.

The wording of the exemption is clarified to indicate (consistent with the interpretation of § __.101(b)(2) in the pre-2018 rule) that the research cannot include interventions in addition to the educational tests, survey or interview procedures, or observation of public behavior. Research involving interventions that are distinct from those information collection methods allowable under this exemption do not satisfy the conditions of this exemption. For example, if a research study were to randomly assign students to take an educational test in a quiet room or in a room with a moderate level of noise, or to consume a snack (or not) before taking the test, this research would not be exempt under this exemption. It should be noted, however, that educational tests may include exposing test takers to certain materials as part of the test, and that such materials do not constitute interventions distinct from the test. For example, reading comprehension tests may direct test takers to read a passage, and a geography test may present test takers with a map, and ask them to draw information from that map. Likewise, survey procedures may contain some information that the respondents are asked questions about, which would not be considered distinct interventions. However, research in which the purpose of the research is to see whether respondents answer survey questions differently depending on the gender of the interviewer would not satisfy the conditions of the exemption, because the manipulation of the interviewer would be a distinct intervention. Research involving observation of public behavior does not qualify for this exemption if the investigator intervenes with subjects, for example, by offering them an ostensibly lost wallet to see if they will accept it.

Part of the rationale for exempting the research activities at § __.104(d)(2) from the Common Rule, even when the research is not otherwise subject to additional federal controls, is that for education tests, survey or interview procedures, agreement to participate is inherent in participation and that for much of this research the risks most likely to be experienced by subjects are related to disclosure of anonymous, nonsensitive information and are thus categorized as “low.” In general, it is reasonable to expect that individuals, including vulnerable populations (other than children), would understand that actively providing responses to educational tests, surveys, or interview procedures constitutes agreement to participate and that the risks associated with such participation would be related to disclosure of the information they provided. The exemption of this type of activity rests in large part on the idea that all individuals, regardless of the setting or context in which the activity will take place, are generally familiar with common forms of educational tests and survey and interview procedures that they experience in their daily lives, and do not need additional measures to protect themselves and their privacy from investigators who seek their involvement in research activities involving these procedures. They can decline to participate, or to answer some questions. In addition, if the information collected is both identifiable and sensitive or potentially harmful, the safeguards offered by the limited IRB review requirements at § __.111(a)(7) apply. This is accomplished through the added provision at § __.104(d)(2)(iii).

Concerns have also been raised about psychological risks of participating in surveys or interviews, and of situational risks where the simple awareness that someone was surveyed or interviewed poses a risk. We recognize that this is possible, but believe that this is rare enough that it does not warrant adding additional conditions to the exemption category.

With respect to applying this exemption to research with children, two subcategories of this exemption—concerning information recorded so that subjects cannot be identified (§ __.104(d)(2)(i)), and concerning disclosures of the subjects' responses that would not place them at certain kinds of risk or create certain kinds of damage (§ __.104(d)(2)(ii))—may apply to research involving children under subpart D if the research involves educational tests or observation of public behavior and the investigator does not participate in the activities being observed. The final subcategory of this exemption (§ __.104(d)(2)(iii)), which allows for obtaining and recording identifiable private information, may not be applied to research involving children under subpart D.

c. Research Involving Benign Behavioral Interventions in Conjunction With the Collection of Information From an Adult Subject (§ __.104(d)(3))

i. Public Comments

Approximately 50 comments discussed the NPRM proposed exemption involving benign interventions in conjunction with collecting information from an adult subject. Public comments here were mixed, with a majority favoring this exemption, and with the majority of commenters indicating that guidance will be needed for this exemption to be implemented properly. For example, one large research university stated, “The proposed category involving benign interventions needs further revision. While we are supportive of this category in general, the words `benign intervention' without definition leaves too much room for different interpretations and these terms are not easily applicable to social science research, a context in which these types of activities are likely to occur.” Those that favored this exemption generally agreed with the argument put forth in the NPRM that these activities were low in risk and IRB review did not provide subjects meaningful additional protections in this context.

Several comments requested clarification on the extent to which medical interventions might be covered under this exemption. For example, to what extent could proven diagnostic methods that introduce energy but are not invasive (e.g., magnetic resonance imaging, ultrasound, computerized tomography scan) be considered a “benign intervention” for the purpose of this exemption? Another comment asked whether the provision included the use of medical devices, such as blood pressure monitors or thermometers.

Those who did not support this exemption offered a variety of reasons. One comment from a research university indicated that it did not support this exemption because it could cause studies like the “Milgram Obedience Experiment” and the “Stanford Prison Study” to occur without IRB review. Another comment reiterated the general stance that all research activities should require IRB review and informed consent.

One comment from a research ethics, public education, and professional organization noted that if the final rule includes an expansion of exemption categories such as the proposed benign intervention exemption in the NPRM, then investigator education on human subjects protection should be mandated.

Another comment noted that it should be clarified in the regulatory text that withholding the investigator's hypothesis from subjects is not deception.

The majority of commenters indicated that no additional requirements, be it notice or the proposed privacy safeguards, should be applied to this exemption category. A minority of comments indicated that some kind of notice should be required with this provision, generally asking for that notice to include the purpose of the study, the privacy and confidentiality protections in place, a statement that participation is voluntary, information on how to opt out of the study, and information about who to contact for more information. Comments that favored notice suggested that the notice should be study-specific.

Although commenters generally felt the examples of activities that would satisfy this exemption included in the regulatory text were sufficient, commenters also indicated that many of the terms used in this exemption needed additional explanation, for example, “brief in duration,” “painless,” and “physically invasive.” A large research university noted that the proposed language raised questions about what sorts of impact are significant and how long is “lasting.”

One large professional organization representing research universities and organizations noted that the term “benign intervention” did not seem to encapsulate the types of activities that the NPRM contemplated. Specifically, this organization argued that “benign intervention” connotes a medical procedure, when the NPRM preamble suggested that this exemption encompasses nonmedical “benign interventions” generally. This organization also suggested that the activities contemplated by this exemption are more like interactions than interventions.

In response to a question about whether the decision tool could be relied on for making this exemption determination, a majority of those who responded indicated that it would be impossible to answer this question without first seeing the decision tool. Others indicated that without better definition of terms like “benign intervention,” “prospectively agree,” “long lasting,” and “significant impact,” it would be impossible for a tool to provide accurate determinations for this exemption.

ii. Response to Comments and Explanation of the Final Rule: Exemption for Certain Research Involving Benign Behavioral Interventions in Adults

This exemption at § __.104(d)(3) was not in the pre-2018 rule, but was proposed in the NPRM. In response to public comments that expressed concern over the need to further clarify the term “benign interventions,” the word “behavioral” has been inserted to modify the type of intervention which may be included. The intent of this change is to exclude the use of medical interventions (including medical tests, procedures and devices). The exemption being finalized is specifically for research involving benign “behavioral” interventions in conjunction with the collection of information from an adult subject through verbal or written responses (including data entry) or audiovisual recording if the subject prospectively agrees to the intervention and information collection and at least one of the following is met:

• The information obtained is recorded by the investigator in such a manner that the identity of the human subjects cannot readily be ascertained directly or through identifiers linked to the subjects;
• Any disclosure of the human subjects' responses outside the research would not reasonably place the subjects at risk of criminal or civil liability or be damaging to the subjects' financial standing, employability, educational advancement, or reputation; or
• The information obtained is recorded by the investigator in such a manner that the identity of the human subjects can readily be ascertained, directly or through identifiers linked to the subject, and an IRB conducts a limited IRB review to make the determination required by § __.111(a)(7).

For the purpose of this provision, the exemption describes benign behavioral interventions as being brief in duration, harmless, painless, not physically invasive, not likely to have a significant adverse lasting impact on the subjects, and the investigator has no reason to think the subjects will find the interventions offensive or embarrassing. Provided all such criteria are met, examples of such benign behavioral interventions include having the subjects play an online game, solve puzzles under various noise conditions, or decide how to allocate a nominal amount of received cash between themselves and someone else.

Unlike the exemption at § __.104(d)(2), this exemption allows for the intervention to be distinct from the data collection method; for example, a research study comparing test performance of test takers in quiet or noisy surroundings would qualify for this exemption. Also subjects could be asked to perform cognitive tasks, and audiovisual recording could be used to collect the data, without any educational test, survey or interview procedure occurring, and this research would qualify for this exemption.

If the research involves deceiving the subjects about the nature or purposes of the research, this exemption would not be applicable unless the subject authorizes the deception. For the purpose of this provision, authorized deception would be prospective agreement by the subject to participate in research where the subject is informed that he or she will be unaware of or misled regarding the nature or purposes of the research. The final rule allows this type of research to occur without the requirements of informed consent because the intervention is not likely to result in harm or offense to the subject, and the subject must prospectively agree to the intervention and the data collection.

Subjects must be adults, but the provision does not specify that they must be competent, and therefore tests of competency are not necessary. However, the presumption is that, in keeping with the principle of respect for persons, such subjects will not be exploited.

This new exemption category is added because respect for persons is accomplished through the prospective subject's forthcoming agreement or authorization to participate, the research activities pose little risk to subjects, and the use of this exemption for many social or behavioral studies will enable IRBs to devote more time and attention to research studies involving greater risks or ethical challenges. We note that the requirement for the agreement of the subject effectively serves as a kind of notice, because the subject is asked to agree to participate in the research, and the request will be tailored to the nature of the specific research study.

The final rule includes another condition that was not included in the NPRM, which broadens the type of research that may meet this exemption. The final rule at § __.104(d)(3)(i)(C) permits investigators to obtain and record information in such a manner that the identity of the human subjects can readily be ascertained, directly or through identifiers linked to the subject, provided the research has undergone limited IRB review in accord with § __.111(a)(7). This alternative condition was added to the final rule for reasons similar to the exemption at § __.104(d)(2), as a way of providing additional protections when investigators obtain and record information in such a manner that human subjects can be identified directly or through identifiers linked to the subject. Because the risk associated with enabling investigators to obtain and record identifiable private information can be addressed by requiring adherence to the privacy safeguards provided through limited IRB review, we believe it is appropriate to allow such research to be exempt.

In addition, the final rule permits the collection of data through audiovisual recording, not just video recording, as was proposed in the NPRM. We believe that broadening the exemption in this way provides more flexibility to the permissible data collection methods without creating greater risk of harm to research subjects.

We acknowledge that guidance may be useful for interpreting some of the terms in this exemption, and that some cases will be debatable. However, we also believe that a substantial number of research activities will plainly fit this exemption, and should be allowed to proceed without IRB review. We agree that investigator education is often desirable, but that the provisions of the exemption are not difficult to understand. We believe that Milgram's obedience experiments and the Stanford Prison Experiment would obviously not qualify for this exemption, because investigators had reason to think some subjects would find the interventions offensive or embarrassing. We acknowledge that in this exemption the word “deception” is used to include withholding the purpose of the research, which is consistent with how the term is often used in this context.

d. Secondary Research Use of Identifiable Private Information and Identifiable Biospecimens for Which Consent Is Not Required (§ __.104(d)(4))

i. Overview

The final rule exemption at § __.104(d)(4) is for secondary research use of identifiable private information and identifiable biospecimens for which consent is not required. This particular exemption combines several NPRM exclusion proposals. It exempts secondary research use of identifiable private information and identifiable biospecimens when:

• The identifiable private information or identifiable biospecimens are publicly available;
• The information is recorded by the investigator in such a way that the identity of subjects cannot readily be ascertained, and the investigator does not contact subjects or try to re-identify subjects;
• The secondary research activity is regulated under HIPAA; or
• The secondary research activity is conducted by or on behalf of a federal entity and involves the use of federally generated nonresearch information provided that the original collection was subject to specific federal privacy protections and continues to be protected.

By “secondary research,” this exemption is referring to re-using identifiable information and identifiable biospecimens that are collected for some other “primary” or “initial” activity. The information or biospecimens that are covered by this exemption would generally be found by the investigator in some type of records (in the case of information) or some type of tissue repository (such as a hospital's department for storing clinical pathology specimens).

It is important to recognize that this exemption does not cover any primary collections of either information or biospecimens. For example, if an investigator wants to collect information directly from research subjects by asking them to complete a questionnaire, that would not be covered by this exemption. If an investigator wants to collect biospecimens by having subjects swab their cheek, that would similarly not be covered by this exemption. On the other hand, an investigator who wants to use information that is in some databank, or use biospecimens that are in a pathology laboratory, or use the “excess” portion of blood that was drawn for clinical purposes, could use this exemption assuming all of the relevant conditions are met.

Also, note that unlike the pre-2018 rule's exemption relating to certain secondary uses of information and biospecimens, the final rule has no requirement that the information and biospecimens must be pre-existing at the time that the investigator begins a particular research study. For example, an investigator could start a study that involves using biospecimens from clinical pathology laboratories, and could include specimens that are added to the laboratories during the course of the study (again assuming that the other conditions of the exemption are met).

Public comments on each of the exclusions proposed in the NPRM and combined in this exemption follow.

(1) Public Comments on the Proposed Exclusion for Research Involving the Collection or Study of Identifiable Private Information or Identifiable Biospecimens That Are Publicly Available or Recorded by the Investigator Without Identifiers

Approximately 50 commenters discussed this proposed exclusion about identifiable private information or identifiable biospecimens that are publicly available or recorded by the investigator without identifiers. Public comments were mixed, with many indicating that investigators should not themselves be allowed to determine whether their research fits under this exclusion, and many indicating that this should be an exemption rather than an exclusion. A majority supported the clarifying language that this category of activities could include information that will be collected.

One commenter indicated that the prohibition on re-identification should apply to activities in publicly available data sets. This commenter also indicated that any research involving re-identification should undergo IRB oversight. Another commenter suggested that there should also be a prohibition in this category against the release or publication of information that would lead to re-identification.

One commenter indicated that the terminology used in this provision needed clarification. Specifically, the commenter wondered how one should interpret the term “recorded by the investigator” with respect to electronic data?

In response to a question posed in the NPRM about whether any of the exclusion categories should include biospecimens, a majority of those who responded to the question indicated that biospecimens should be included in this category.

The NPRM also asked whether this exclusion should apply to activities involving prisoners. Of those who responded to this question, responses were mixed with some indicating that this exclusion should apply to research with prisoners and others indicating that it would be inappropriate for research with prisoners to be allowed. One commenter indicated that allowing prisoners in this type of research would be a weakening of protections in activities involving vulnerable populations.

(2) Public Comments on the Proposed Exclusion for Certain Activities Covered by HIPAA

Approximately 50 comments discussed the NPRM proposal to exclude certain activities subject to HIPAA. Public comments were mixed, with many indicating that the protections required under HIPAA for “health care operations,” “research,” and “public health activities,” were sufficient, and that for the types of activities identified by the exclusion, review under the Common Rule did not provide meaningful protections. In contrast, others argued that because the scope of a privacy review board is narrower than for an IRB, these activities should not receive a blanket exclusion from the Common Rule.

Under the HIPAA Privacy Rule, health information is de-identified and thus exempt from that rule only if it neither identifies nor provides a reasonable basis to believe that the information can be used to identify an individual. The HIPAA Privacy Rule provides two ways to de-identify information: (1) A formal determination by a qualified expert that the risk is very small that an individual could be identified; or (2) the removal of all 18 specified identifiers of the individual and of the individual's relatives, household members, and employers, as long as the covered entity has no actual knowledge that the remaining information could be used to identify the individual (45 CFR 164.514(b)).

Otherwise, the HIPAA Privacy Rule addresses some informational risks by imposing restrictions on how individually identifiable health information collected by health plans, health care clearinghouses, and most health care providers (“covered entities”) may be used and disclosed, including for research. In addition, the HIPAA Security Rule (45 CFR parts 160 and subparts A and C of part 164) requires that these entities implement certain administrative, physical, and technical safeguards to protect this information, when in electronic form, from unauthorized use or disclosure. However, the HIPAA Rules apply only to covered entities (and in certain situations to their business associates). Not all investigators are part of a covered entity and thus some investigators are not required to comply with those rules. Moreover, the HIPAA Rules do not apply specifically to biospecimens in and of themselves.

One commenter proposed that the exclusion be expanded so that investigators from noncovered entities (as defined in the HIPAA Rules) would be eligible for the exclusion as well. Another commenter suggested that the HIPAA exclusion should be expanded to cover business associates and researchers that comply with HIPAA.

The NPRM asked whether the protections provided by the HIPAA Rules for identifiable health information used for health care operations, public health activities, and research activities are sufficient to protect human subjects involved in such activities, and whether the current process of seeking IRB approval meaningfully adds to the protection of human subjects involved in such research studies. Approximately half of the comments that addressed this question suggested that HIPAA protections are sufficient and that no additional safeguards were needed. Others expressed concern, and suggested that in some, if not all, of the categories in the HIPAA exclusion, HIPAA protections would not be sufficient.

One commenter suggested that this exclusion might be appropriate for health care operations or public health activities, but that the HIPAA rules were not sufficiently protective for research activities. Specifically, one commenter expressed concern that excluding from the Common Rule the use of PHI for research activities in HIPAA-covered entities would weaken protections for patients, because HIPAA's privacy safeguards were never intended to replace human subject protections and associated ethical and scientific review.

One commenter also noted that other HHS preambles to rules have discussed the differences between the Common Rule and HIPAA, and these preambles noted that HIPAA was not intended to replace the Common Rule. This commenter suggested that given the language included in previous HHS preambles, additional justification for this exclusion would be needed before being included in a final rule.

One commenter felt that the HIPAA rules and HITECH adequately address the Belmont Report principles with respect to these exclusions from the Common Rule, but felt the exclusion should not be limited to covered entities. The commenter suggested that the exclusion be extended to noncovered entities that receive PHI and are required to apply HIPAA safeguards in addition to institutions with equivalent protections. Others suggested that the HIPAA and HITECH standards are too protective for much research.

Other commenters felt that this set of exclusions violates the protective mandate because HIPAA's provisions are narrow and do not reflect research ethics concerns. They noted that HITECH addresses technical data security for covered PHI for health care use but not for research use, especially if the data are sent elsewhere. Commenters felt that data used for research should be subject to HITECH data security standards and should not be excluded from Common Rule coverage.

Few commented on whether additional collections (i.e., collections beyond what would ordinarily be collected through routine medical care) should be covered by this exclusion, and those that did suggested that they should be subject to the Common Rule unless those additional collections are covered by another exemption and exclusion.

The NPRM asked whether additional or fewer activities regulated under the HIPAA Privacy Rule should be included in this exclusion. One commenter expressed concern that the HIPAA Privacy Rule was not appropriate because it both underregulates and overregulates research. Another commenter felt that the exclusion creates confusion because HHS has, in other contexts, discussed the differences between the Common Rule and HIPAA and the differing needs in separate contexts.

(3) Public Comments on Research Conducted by a Government Agency Using Government-Generated or Government-Collected Data Obtained for Nonresearch Activities

Approximately 20 comments discussed this proposed exclusion. Public comment was mixed, with several commenters suggesting that they did not understand the full scope of the information generated or collected by the government that would fall under this exclusion. A minority of comments indicated that this category of activities should be exempt rather than excluded.

The NPRM also asked whether this or a separate exclusion should also include research involving information collected for nonresearch purposes by nonfederal entities where comparable privacy safeguards have been established by state law or regulation. Few responded to this question. Of these, several indicated that this exclusion should not be expanded to cover nonresearch data, and should not be expanded to cover activities conducted by nongovernmental investigators using government-generated or -collected data. Several comments indicated that this category was acceptable as an exclusion, with a few commenters suggesting that the category could be further broadened.

One commenter suggested that this provision should apply to nonfederal entities if state laws are as protective as the federal laws cited. This commenter indicated that for these types of activities, the Common Rule protections did not provide meaningful additional protections to subjects. In contrast, several other commenters expressed concern that the privacy safeguards identified in this exclusion were not as protective of subjects as the Common Rule. One commenter indicated that clarifying what constitutes appropriate nonfederal use of this exclusion would be needed.

One commenter suggested that this exclusion might be reasonable as an exclusion if there were a public posting requirement for activities conducted under this exclusion. If this were the case, this commenter indicated that investigator self-determination of whether an activity fit under this exclusion would be reasonable.

In response generally to the question of whether any of the exclusions should apply to activities involving prisoners, a small number of comments addressed this question in the context of this exclusion. Of these responses, comments were mixed.

ii. Response to Public Comments and Explanation of the Final Rule: Exemption for Secondary Research for Which Consent Is Not Required

This exemption at § __.104(d)(4) is for secondary research uses of identifiable private information or identifiable biospecimens when consent is not required, if at least one of the following criteria is met:

• The identifiable private information or identifiable biospecimens are publicly available;
• Information, which may include information about the biospecimens, is recorded by the investigator in such a manner that the identity of human subjects cannot readily be ascertained directly or through identifiers linked to the subjects, the investigator does not contact the subjects, and the investigator will not re-identify subjects;
• The research involves only information collection and analysis involving the investigator's use of identifiable health information when that use is regulated under 45 CFR parts 160 and 164, subparts A and E, for the purposes of “health care operations” or “research” as those terms are defined at 45 CFR 164.501 or for “public health activities and purposes” as described under 45 CFR 164.512(b); or
• The research is conducted by, or on behalf of, a federal department or agency using government-generated or government-collected information obtained for nonresearch activities, if the research generates identifiable private information that is or will be maintained on information technology that is subject to and in compliance with section 208(b) of the E-Government Act of 2002, 44 U.S.C. 3501 note, if all of the identifiable private information collected, used, or generated as part of the activity will be maintained in systems of records subject to the Privacy Act of 1974, 5 U.S.C. 552a, and, if applicable, the information used in the research was collected subject to the Paperwork Reduction Act of 1995, 44 U.S.C. 3501 et seq.

The criteria for this exemption were proposed in the NPRM as three exclusions. The final rule modifies the NPRM proposal to allow this exemption to apply to secondary research involving identifiable biospecimens, provided that the exemption's conditions are met. Note that because the NPRM proposal to alter the definition of a human subject to extend to research involving nonidentified biospecimens was not adopted, an exemption for research with such biospecimens is not needed. Accordingly, this exemption is only relevant to secondary research use of identifiable biospecimens.

The goal of the exemption at § __.104(d)(4) is to facilitate secondary research using identifiable private information or identifiable biospecimens that have been or will be collected or generated for nonresearch purposes or from research studies other than the proposed research study. Unlike two other new exemptions that also relate to secondary research (the ones at § __.104(d)(7) and § __.104(d)(8), discussed below), this exemption does not depend on any consent requirements imposed by the Common Rule being met.

The first two provisions of this exemption (§ __.104(d)(4)(i) and (ii)) are a modified version of the fourth exemption under the pre-2018 rule. The modified provisions allow the exemption to include research with information and biospecimens that do not yet exist when the research study is proposed for exemption (i.e., that could be collected, for purposes not related to the proposed research study, in the future).

The third and fourth provisions of the exemption have no precursors in the pre-2018 rule. The third provision applies the exemption to secondary research using identifiable private information covered under HIPAA, and the fourth provision applies the exemption to secondary research using identifiable private information collected for nonresearch purposes by the Federal Government, if compliant with the three cited federal statutes. These new rules will allow investigators to see identifiable private information, and also allow them to retain and record that information (including the identifiers) as part of their research records.

We also note that, according to new language at § __.104(b)(2) adopted as part of this final rule, this exemption permits the secondary research use of identifiable private information or identifiable biospecimens obtained from subjects who are prisoners, if the research is not designed in a way that seeks to recruit prisoners as a population but rather only incidentally (i.e., not intentionally) includes prisoners.

(1) Response to Public Comments and Explanation of the Final Rule: Research Involving the Collection or Study of Identifiable Private Information or Identifiable Biospecimens That Are Publicly Available

The exemption criterion at § __.104(d)(4)(i) is for secondary research if the identifiable private information or identifiable biospecimens are publicly available. This would apply to secondary research use of archives in a public library, for example, or to government or other institutional records where public access is provided on request, or from a commercial entity if the information is provided to members of the public on request or if the only requirement for obtaining the information is paying a user fee, registering or signing in as a visitor to an archive. It would also apply if a commercial entity made identifiable biospecimens publicly available to anyone on request or for a fee. This exemption effectively acknowledges that for secondary research with publicly available information or biospecimens, IRB review would not reduce the risk.

(2) Response to Public Comments and Explanation of the Final Rule: Research Involving the Collection or Study of Information (Which May Include Information About Biospecimens) That Has Been or Will Be Collected and Is Recorded Without Identifiers

The provision at § __.104(d)(4)(ii) exempts research involving identifiable private information, which may include information about biospecimens, if information is recorded by the investigator in such a manner that the identity of human subjects cannot readily be ascertained directly or through identifiers linked to the subjects, the investigator does not contact the subjects, and the investigator will not re-identify subjects. As with the provision at § __.104(d)(4)(i), this provision is related to an exemption that existed in the pre-2018 rule. In this instance, that prior exemption is being extended to now also cover research with information for which identifiers have been removed when the original collection of information or biospecimens occurs in the future.

(3) Response to Public Comments and Explanation of the Final Rule: The HIPAA Exclusion

The provision at § __.104(d)(4)(iii) permits the secondary research use of identifiable private information or identifiable biospecimens when the research involves only information collection and analysis involving the investigator's use of identifiable health information when that use is regulated under 45 CFR parts 160 and 164 (the HIPAA Privacy Rule), subparts A and E, for the purposes of “health care operations” or “research” as those terms are defined at 45 CFR 164.501, or for “public health activities” as described under 45 CFR 164.512(b).

With regard to the criterion at § __.104(d)(4)(iii), HIPAA also provides protections in the research context for the information that would be subject to this exemption (e.g., clinical records), such that additional Common Rule requirements for consent should be unnecessary in those contexts. Under HIPAA, these protections include, where appropriate, requirements to obtain the individual's authorization for future, secondary research uses of protected health information, or waiver of that authorization by an IRB or HIPAA Privacy Board. This provision introduces a clearer distinction between when the Common Rule and the HIPAA Privacy Rule apply to research in order to avoid duplication of regulatory burden. We believe that the HIPAA protections are adequate for this type of research, and that it is unduly burdensome and confusing to require applying the protections of both HIPAA and an additional set of protections.

This provision was not part of the pre-2018 rule, and was proposed as an exclusion in the NPRM. It is included as a component of an exemption in the final rule, consistent with public comments supporting the proposal.

(4) Response to Public Comments and Explanation of the Final Rule: Research Conducted by a Government Agency Using Government Generated or Government Collected Data Obtained for Nonresearch Activities

The provision at § __.104(d)(4)(iv) did not exist in the pre-2018 rule and was proposed as an exclusion in the NPRM. It appears as a component of an exemption in the final rule. The exemption permits the use of identifiable private information or identifiable biospecimens for secondary research conducted by, or on behalf of, a federal department or agency using government-generated or government-collected information obtained for nonresearch activities, if the information originally involved a collection that adheres to the federal standards for safeguarding privacy as described in this part of the exemption.

We believe that the privacy protections are adequate for this type of research, and that it is unduly burdensome and confusing to require these protections and an additional set of protections. This provision has been modified to apply the federal statutory privacy safeguards identified in the exemption provision to both the original collection of the information, and to the secondary research use of the information to which the exemption applies.

e. Research and Demonstration Projects Conducted or Supported by a Federal Department or Agency (§ __.104(d)(5))

i. Public Comments

Approximately 35 comments discussed the changes proposed in the public benefit or service program exemption. Few of the comments discussed the proposed expansion in OHRP's interpretation of this exemption to include the applicability of the exemption to cover research on public benefit and service programs that an agency does not itself administer through its own employees or agents, with a majority supporting the NPRM proposed expansion. One research university indicated that OHRP should not expand its interpretation of this exemption, and that it should be limited to “federally funded studies evaluating federal programs.” This institution did not offer justification for its comment.

Few comments were received about the proposed requirement for exemption designation of research or demonstration projects to be posted to a publicly available federal Web site. The comments discussing this proposed requirement supported it.

The majority of comments indicated that no additional requirements or limitations should be imposed on this exemption. These institutions argued that because this exemption represented a mechanism through which the Federal Government evaluated its own programs, additional limitations and restrictions in the Common Rule did not seem appropriate.

Specifically, with respect to whether or not some sort of notice should be required here, several commenters noted that any notice would need to be meaningful. One commenter indicated that because meaningful notice would be difficult, a notice requirement should not be imposed. One comment suggested that notice should only be required if opt-out would be permitted, and if not, no notice requirement should be imposed. Groups representing AI/AN populations supported the notice requirement and indicated that it should be required at a minimum.

ii. Response to Comments and Explanation of the Final Rule: Exemption for Certain Research and Demonstration Projects Conducted or Supported by a Federal Department or Agency

The final rule includes this exemption as a modified version of an exemption proposed in the NPRM. The exemption at § __.104(d)(5) in the final rule applies to research and demonstration projects involving public benefit or service programs, and is a slightly revised version of the exemption in the pre-2018 rule. This revision is designed to clarify the scope of the exemption so that more research studies would be eligible, and to make the exemption easier to apply. It is also designed to allow the Federal Government to carry out important evaluations of its public benefit and service programs to ensure that those programs are cost effective and provide the intended benefits or services, consistent with the principle of beneficence. The wording of the exemption has added “improve” to the purposes of these activities, to make more explicit the idea that the Federal Government conducts these activities in order to enable them to make the public benefit and service programs better, and not just to gauge their current quality.

This exemption is for research and demonstration projects that are conducted or supported by a federal department or agency, or otherwise subject to the approval of department or agency heads. It applies to activities that are designed to study, evaluate, improve, or otherwise examine public benefit or service programs, including, but not limited to: Procedures for obtaining benefits or services under those programs; possible changes in or alternatives to those programs or procedures; or possible changes in methods or levels of payment for benefits or services under those programs.

In addition, the final rule clarifies the language of the exemption to conform to OHRP's previous interpretation of public benefit and service programs that are being evaluated as part of the research. This interpretation includes public benefit or service programs that a Common Rule department or agency does not itself administer or conduct through its own employees or agents, but rather supports through a grant or contract program. Therefore, the exemption applies to research and demonstration projects supported through, for example, federal grants or cooperative agreements. These changes would bring the regulatory language into conformance with other provisions of the rule that refer to research “conducted or supported” by federal departments and agencies. These methods of administration are, of course, always subject to department or agency head approval, either directly or by delegation. In addition, some of these research and demonstration projects are conducted through waivers, interagency agreements, or other methods that also require agency head approval. Accordingly, both the previous and revised language allow for the full panoply of methods by which research and demonstration projects on public benefit or service programs can be carried out.

The wording of the exemption also is clarified to specifically include projects involving waivers of otherwise mandatory requirements using authorities such as sections 1115 and 1115A of the Social Security Act, in order to make it plain that such research projects on public benefit or service programs qualify for the exemption. The relevant sections of the Social Security Act were also cited when this exemption was published in 1983.

In the interest of transparency, as was proposed in the NPRM, the final rule requires that each federal department or agency conducting or supporting the research and demonstration projects must establish, on a publicly accessible federal Web site or in such other manner as the department or agency head may determine, a list of the research and demonstration projects the federal department or agency conducts or supports under this provision. The research or demonstration project must be published on this list before beginning the research involving human subjects. The department or agency head can determine what sort of information will be included on this list and maintains its oversight. Departments and agencies that already publish research and demonstration projects on a publicly accessible Web site could satisfy this proposed requirement if the existing Web site includes a statement indicating which of the studies were determined to meet this exemption.

The goal of this proposed requirement is to promote transparency of federally conducted or supported activities affecting the public that are not subject to oversight under the Common Rule. It should not cause any delay to the research. HHS will develop a resource that all Common Rule departments and agencies may use to satisfy the requirement at § __.104(d)(5)(i). Alternatively, an agency can create or modify its own Web site for this purpose.

The exemption is not modified to require notice, to apply only to minimal risk research activities, or to require the privacy safeguards, for reasons reflected in the public comments. We agree with the public comments that argued that in many cases notice would be difficult or impossible to achieve effectively, and that this exemption enables the Federal Government to conduct important evaluations of its own programs that provide significant benefits to the public. In addition, federal departments and agencies are already subject to other laws and policies that protect the interests of research subjects (e.g., the Privacy Act).

f. Taste and Food Quality Evaluation and Consumer Acceptance Studies (§ __.104(d)(6))

i. Public Comments

Approximately 20 comments discussed this exemption for taste and food quality evaluation and consumer acceptance studies. The NPRM did not propose changes to this exemption from what appeared in the pre-2018 rule. However, it did ask whether this exemption should be narrowed to apply only to activities for which prospective subjects have been given prior notice, and if so, how that notice should be issued. The NPRM further asked whether subjects should be allowed to opt out of exempt research.

A majority of comments received indicated that the final rule should maintain this exemption without any additional requirements. Commenters generally did not include explanation of this position. A small minority of commenters indicated that subjects should explicitly be provided the opportunity to opt out of this type of activity. In addition, a small minority of commenters indicated that subjects should be given notice before participation. One comment suggested that this exemption include “odor” evaluations as well.

ii. Response to Comments and Explanation of the Final Rule: Exemption for Taste and Food Quality Evaluation and Consumer Acceptance Studies

The final rule retains the exemption from the pre-2018 rule, which was proposed in the NPRM without any change, for taste and food quality evaluation and consumer acceptance studies. This exemption applies if wholesome foods without additives are consumed, or if a food is consumed that contains a food ingredient at or below the level and for a use found to be safe, or agricultural, chemical or environmental contaminant at or below the level found to be safe by FDA or approved by the Environmental Protection Agency or the Food Safety and Inspection Service of the U.S. Department of Agriculture. This exemption is retained unchanged from the pre-2018 rule.

g. Secondary Research Use of Identifiable Private Information or Identifiable Biospecimens (or Storage or Maintenance for Such Secondary Research Use) for Which Broad Consent Is Required (§ __.104(d)(7) and (8))

The final rule includes two exemptions related to the secondary research use (including storage or maintenance for such use) of identifiable private information and identifiable biospecimens that require a subject's broad consent.

The first of these exemptions is in the final rule at § __.104(d)(7), and applies to storing and maintaining identifiable private information or identifiable biospecimens for secondary research use.

The second of these exemptions is in the final rule at § __.104(d)(8) and applies to the secondary research use of identifiable private information and identifiable biospecimens for specific secondary research studies. Secondary research under this exemption would generally be conducted with the information or biospecimens stored and maintained under the exemption at § __.104(d)(7).

Both of these exemptions for the secondary use of identifiable private information and identifiable biospecimens require broad consent and are discussed in detail below. As with the secondary use exemptions that do not require the subject's broad consent (discussed above in Section V.3.d. of the preamble), the two exemptions at § __.104(d)(7) and (8) are also limited to “secondary research.” These exemptions pertain only to research that involves re-using information or biospecimens that were or will be collected for some other “primary” or “initial” activity distinct from using them in secondary research. These exemptions do not cover any primary collections of either information or biospecimens. In other words, if an investigator wants to collect information directly from research subjects, for example, by asking them to complete a questionnaire, that would not be covered by these exemptions. Or if an investigator wants to collect biospecimens by having subjects swab their cheeks, that collection would similarly not be covered by these exemptions. On the other hand, an investigator who wants to use information that is in some databank, or to use biospecimens that are in a pathology laboratory, could use these exemptions, assuming all of the relevant conditions of the exemptions were met.

i. Public Comments on the Proposed Exemptions for Secondary Research Use of Identifiable Private Information or Identifiable Biospecimens (or Storage or Maintenance for Such Secondary Research Use) for Which Broad Consent Is Required

In combination, approximately 150 comments discussed these proposals. Although commenters generally supported creating a pathway for low-risk research with biospecimens to occur without IRB review, a majority opposed the overarching proposal that these exemptions would, for the most part, be the only way (besides study-specific consent) for research with biospecimens to occur. Many of the arguments for and against these exemptions were outlined in section III.D, summarizing public comments received on the proposal to define “human subject” as including all biospecimens used in research, regardless of identifiability.

Many commenters opposed the idea that the exemption should allow specific secondary studies involving biospecimens retained with identifiers to occur without IRB review. These commenters noted that IRBs are required to assess more than privacy and confidentiality protections, and whether informed consent was sought and obtained. Other commenters noted that by effectively encouraging the retention of identifiers with biospecimens (which would likely be required to track which specimens could be used in research at an institution), the NPRM proposals effectively introduced new privacy and confidentiality risks to subjects that did not exist under the pre-2018 rule.

Some commenters who supported the expanded definition of human subject to include all biospecimens did not support these exemptions. These comments were mostly from members of the public and they generally argued that study-specific consent should be sought and obtained from subjects for every study involving that person's biospecimens. These comments expressed concern that, with broad consent, investigators could still engage in research activities without the individuals' knowledge.

Several commenters expressed opposition to the NPRM proposal that the exemption could not be used if the investigator intended to return research results to subjects. These commenters saw this as a disincentive to return research results and also noted that it seemed at odds with existing law (e.g., HIPAA) and policy. Specifically, they argued, because patients are entitled under HIPAA to the contents of their medical records, investigators must always be ready to return research results to subjects enrolled in their studies.

The NPRM inquired about whether the proposed exemption was the best option, or whether there is a better way to balance respect for persons with facilitating research. Responses to this question were mixed, with a majority indicating that the proposed exemptions were not the best option. One comment indicated that broad consent would be reasonable if the consent was meaningful.

Other commenters opposed the proposal as written. One felt it provided too little information and another found the language too complex and subject to misinterpretation. One institution asserted that the exemption would pose a burden on the research enterprise, would make a significant subset of studies impracticable, and would increase costs.

Still other commenters indicated that consent should not be required for secondary research with biospecimens, noting that it was contradictory to determine that a type of research was exempt but still require consent, or that this exemption should not apply to state-mandated newborn DBS programs. One commenter suggested, “A far better option would be to include an exemption for the secondary research use of de-identified or nonidentified biospecimens, without the caveat of requiring a broad consent.”

The NPRM requested public comment on whether and how the provision regarding the return of research results should be revised. Public comment was mixed in response to this question. Several comments indicated that the provision was too complex to follow.

Comments that supported the provision about the return of research results in the proposed exemption stressed the complexity of decisions around returning results and many indicated support for required IRB review of investigators' plans for returning research results. One professional organization also emphasized the need to communicate to potential participants during the informed consent process the policies concerning the return of individual research results. Many commenters also called for detailed OHRP guidance on this provision.

One commenter suggested that the broad consent required when biospecimens are collected for storage for future research use include an indication as to whether potential subjects would like to be re-contacted with individual research results if applicable.

Other commenters were opposed to the provision as written. One large health system indicated that the provision discourages researchers from returning research results to participants and from providing participants with easy access to their individual research data. The commenter emphasized that “Respecting research participants as partners obligates us to avoid the assumptions that researchers, an IRB, or even a panel of experts . . . know best.” The commenter went on to say: “While the NPRM suggests researchers cannot use the Common Rule as a shield from a request to deliver a designated record set upon request, the policy seems to discourage equitable research practices and allows informational disparities to continue. This does not serve the interest of justice.”

In addition, one professional organization indicated concern that the provision might be interpreted by some to say that IRBs should not allow return of results, which it felt would create a bad situation.

The NPRM sought comment on whether there should be an additional exemption that would permit the collection of biospecimens through minimally invasive procedures (e.g., cheek swab, saliva). A strong majority of commenters indicated no need for an additional exemption to permit the collection of biospecimens through minimally invasive procedures. One professional organization asserted that specimens should not be treated differently based on how they were collected. Other commenters indicated that obtaining specimens through minimally invasive procedures is similar to data collection and should be treated the same way.

ii. Explanation of the Final Rule: Exemptions for Secondary Research Use of Identifiable Private Information or Identifiable Biospecimens (or Storage or Maintenance for Such Secondary Research Use) for Which Broad Consent Is Required

(1) Exemption for the Storage or Maintenance for Secondary Use of Identifiable Private Information or Identifiable Biospecimens for Which Broad Consent is Required (§ __.104(d)(7))

Section __.104(d)(7) is an exemption for the storage or maintenance for secondary research use of identifiable private information or identifiable biospecimens. It requires that an IRB conduct limited IRB review to make the following determinations (required by § __.111(a)(8)):

• Broad consent for storage, maintenance, and secondary research use of identifiable private information or identifiable biospecimens is obtained in accordance with the requirements of § __.116(a)(1)-(4), and (a)(6), and (d);
• Broad consent is appropriately documented or waiver of documentation is appropriate, in accordance with § __.117; and
• If a change is made for research purposes in the way the identifiable private information or identifiable biospecimens are stored or maintained, adequate provisions must be in place to protect the privacy of subjects and to maintain the confidentiality of data.

This exemption is similar to the exemption proposed in the NPRM at § __.104(f)(1), but it has been modified in some respects, and the operation of this exemption is also affected by other changes in the final rule that are different from the NPRM. Namely, the exemption has been modified to apply only to storage or maintenance for secondary research use of identifiable private information or identifiable biospecimens, because the final rule does not incorporate the NPRM proposal to alter the definition of a human subject to extend to research involving biospecimens regardless of their identifiability. This exemption was also modified given the decision not to adopt the privacy safeguards proposed in the NPRM at § __.105.

In addition, the Secretary's template for broad consent is not being finalized for this exemption. Instead, institutions will have the flexibility to create their own consent forms that satisfy requirements at § __.116(a)(1)-(4), (a)(6) and (d) (see Section XIV). The consent form may be electronic.

Given these changes from the NPRM proposal, the limited IRB review requirement for this exemption provided at § __.111(a)(8) has been expanded in the final rule to require that the IRB make the following determinations, some of which are similar to those proposed in the NPRM.

The final rule requires that for the exemption to apply, the IRB must determine that broad consent for storage, maintenance, and secondary research use of identifiable private information or identifiable biospecimens is obtained in accordance with the requirements of § __.116(a)(1)-(4), (a)(6), and (d); This includes the requirement proposed in the NPRM that there be IRB review of the process through which broad consent will be obtained.

Also, given that we are not finalizing the proposed requirement to use the Secretary's template for broad consent, the final rule includes in this requirement that an IRB determine that the broad consent includes the requirements and elements of consent in accordance with § __.116(a)(1)-4), (a)(6), and (d).

The final rule also requires that the IRB determine that broad consent is appropriately documented or waived in accordance with § __.117. Although written broad consent generally will be required for this exemption to apply, the final rule also permits the exemption to apply when broad consent is obtained and an IRB has waived the documentation requirement for written informed consent under § __.117(c)(1).

And because the proposed privacy safeguards proposed in the NPRM at § __.105 are not included in the final rule, if a change will be made for research purposes in the way the identifiable private information or identifiable biospecimens are stored or maintained, the IRB must determine that when appropriate, adequate provisions are in place to protect the privacy of subjects and to maintain the confidentiality of data. This is the same IRB determination related to privacy and confidentiality that is required for nonexempt research. Importantly, this IRB determination is required only when a change is made for research purposes in the way the identifiable private information or identifiable biospecimens are stored or maintained, and only pertains to the aspects of storage and maintenance that are changed for research purposes. In this circumstance, the investigators are assuming responsibility for the manner in which the information and biospecimens are stored and maintained, and the IRB should be required to ensure that appropriate protections for the subjects are place with regard to the aspects of storage or maintenance that were changed for research purposes.

If, on the other hand, no changes are being made for research purposes to the storage or maintenance, then this IRB determination does not apply. The institution storing and maintaining the information or biospecimens of course still has its responsibility to determine what protections distinct from those required by the Common Rule are appropriate, which may include other legal or regulatory safeguards or institutional policies. In light of application of such additional safeguards, it appears unnecessary to require additional protections through a requirement of this final rule simply because the individuals providing broad consent have agreed that their biospecimens or information could be used for research at some point in the future. And of course this provision regarding changes made for research purposes applies only when a Common Rule department or agency supports or conducts the research activity.

Note that in many instances the only change that results from a person having signed a broad consent form for research relating to storing and maintaining that person's biospecimens or information is that the institution that is already holding the biospecimens or information (for clinical purposes, for example) merely creates a record indicating that this person has signed such a consent form. The biospecimens and information could remain stored in whatever way (and for whatever period of time) that the institution had previously been storing them, based on the legitimate nonresearch or research-related reasons that the institution has used for initially collecting and storing those biospecimens and information. Any privacy and security protections (outside of the Common Rule) that already may apply to the institution's information record-keeping or biospecimen preservation activities would continue to apply. The Common Rule's protections would not apply before a change in storage or maintenance occurs for research purposes, but rather the institution would continue to operate in accordance with its pre-existing legitimate reasons for having and storing the biospecimens and information. The fact that the broad consent form has been signed does not by itself mean that there needs to be any alteration of what the institution is already doing with the biospecimens or information.

Examples of changed aspects of storage or maintenance for research purposes that would require the IRB to find, before those changes go into effect, whether there are adequate provisions to protect the privacy of subjects and maintain the confidentiality of data include the following: If information or biospecimens are moved from one electronic or physical storage location to another due to considerations related to research plans; if information or biospecimens will be stored for longer than they otherwise would have been for the original purpose; if information or biospecimens are placed in a research registry or repository created to serve as a resource for investigators; or investigators are given electronic or physical access to the information or biospecimens. The relevant changes do not necessarily involve moving information or biospecimens from one location to another. Rather, the relevant changes include any change for research purposes that introduces or alters risks to the privacy or security of the stored information or biospecimens, including giving access to or transferring information or biospecimens for research purposes to someone who otherwise would not have access.

The rationale for this exemption is that with the requirement for limited IRB review and the specified required IRB determinations, including subjects' broad consent, this exemption respects subjects' autonomy and provides appropriate privacy safeguards. More specifically, we believe that broad consent provides some measure of autonomy for individuals to decide whether to allow the research use of their identifiable private information or identifiable biospecimens, without imposing the kind of burden on investigators that would result from a requirement for specific informed consent for each secondary research study. We believe that it is appropriate to create a mechanism for broad consent for secondary research use, even if it involves the potential risk of having identifiers associated with the identifiable private information or identifiable biospecimens. We believe the administrative burden is also acceptable in order to allow for broad consent for secondary research use.

(2) Exemption for Research Involving the Use of Identifiable Private Information or Identifable Biospecimens for Which Broad Consent is Required (§ __.104(d)(8))

Section __.104(d)(8) is an exemption that also requires that broad consent has been obtained, and is for research involving the use of identifiable private information or identifiable biospecimens. This exemption will frequently be paired with the exemption at § __.104(d)(7), which permits the storage and maintenance of identifiable private information and identifiable biospecimens for secondary research use. The exemption at § __.104(d)(8) would apply to a specific secondary research study, provided that the following criteria are met:

• Broad consent for the storage, maintenance, and secondary research use of the identifiable private information or identifiable biospecimens was obtained in accordance with § __.116(a)(1)-(4), (a)(6), and (d);
• Documentation of informed consent or waiver of documentation of consent was obtained in accordance with § __.117;
• An IRB conducts a limited IRB review to make the determination required by § __.111(a)(7), and to make the determination that the research to be conducted is within the scope of the broad consent; and
• The investigator does not include returning individual research results to subjects as part of the study plan. However, it is permissible under this exemption to return individual research results when required by law regardless of whether or not such return is described in the study plan.

This exemption could also apply if the investigator obtains appropriate broad consent from the subject in addition to the consent to an original specific study, and then proceeds to use the information or biospecimen in a secondary study.

The exemption at § __.104(d)(8) is similar to the exemption proposed in the NPRM, but it has been modified in some respects. As with the exemption at § __.104(d)(7), the operation of the exemption at § __.104(d)(8) is also affected by other provisions in the final rule that are different from what was proposed in the NPRM. Namely, the exemption has been modified to apply only to storage or maintenance for secondary research use of identifiable private information or identifiable biospecimens because the final rule does not incorporate the NPRM proposal to alter the definition of a human subject to extend to research involving biospecimens regardless of their identifiability.

Due to the decision not to adopt the proposed privacy and security safeguards proposed in the NPRM at § __.105, this exemption was also modified to require that limited IRB review include an IRB determination that, when appropriate, adequate provisions are in place to protect the privacy of subjects and the confidentiality of data (§ __.111(a)(7)). This is the same IRB approval criteria related to privacy and confidentiality that is required for nonexempt human subjects research.

In addition, because the final rule does not include a broad consent template when a specific study has been proposed, it is required that the study be reviewed by an IRB to determine whether the proposed secondary analysis fits within the parameters of the broad consent that was obtained for secondary research use.

We believe that the final rule's requirement for limited IRB review of the privacy and confidentiality protections and the adequacy of the broad consent is responsive to commenters who believe that IRB oversight should be retained for the secondary research use of identifiable private information and identifiable biospecimens.

We recognize commenters' point that this exemption does not provide an incentive to investigators to provide individual research results to subjects, but we believe that the challenges of how and when to return such results warrant consultation with the IRB. We note that with the other revisions to the NPRM proposals, other options for research involving identifiable private information and identifiable biospecimens exist, which would be consistent with having plans for returning individual results. Although broad consent may include a statement that clinically relevant research results might be returned to subjects, we believe that when specific secondary studies include such a plan to return research results, it would almost always be appropriate for the study to be reviewed by an IRB, in part to better ensure that research results are disclosed to subjects in an appropriate manner. The only exceptions would be if the research qualified for another exemption, an IRB waived informed consent under § __.116(e) or (f), or the research was carried out under a Secretarial waiver at § __.101(i). We expect that as part of the IRB's review, the IRB would consider what subjects were told in the broad consent regarding the return of research results.

It should be noted that the two exemptions in the final rule at § __.104(d)(7) and (8) create additional options for investigators to conduct secondary research studies with identifiable private information. The final rule retains, largely unchanged, the options previously available to investigators in the pre-2018 rule. For instance, the final rule retains the pre-2018 criteria for requesting a waiver of consent in order to carry out those studies without obtaining consent. Moreover, secondary research using nonidentified biospecimens would not have to meet these requirements, because the final rule does not finalize the NPRM proposal to alter the definition of a human subject to include research involving nonidentified biospecimens under the rule.

h. NPRM Proposal To Delete the Pre-2018 Rule's Exemption for Surveys and Interviews of Public Officials

The NPRM proposed to delete language found in the pre-2018 rule that exempted surveys and interviews with public officials. Approximately 100 comments discussed this proposed deletion and it was almost universally opposed. Political science professors, students, researchers, and academics from other disciplines generally addressed this deletion.

Comments argued that this deletion would have a chilling effect on political science research and might make political science researchers more vulnerable to law suits. Other comments noted that public officials are generally treated differently in numerous laws, and it is in fact appropriate for the Common Rule to have a different standard for surveys and interviews with public officials. Comments also suggested that this deletion could negatively affect the public's ability to hold public officials accountable for their actions. One commenter suggested that instead of deleting this exemption, a final rule might consider explicitly limiting this exemption to studies that relate to the public officials in their official capacity.

The final rule removes the exemption category in the pre-2018 rule at § __.101(b)(3)(i), which pertained to research involving the use of educational tests, survey procedures, interview procedures, or observation of public behavior, if the human subjects are elected or appointed public officials or candidates for public office, or if federal statute requires without exception that the confidentiality of the personally identifiable information will be maintained throughout the research and thereafter. We note that many of the public comment concerns are addressed by other provisions in the final rule. Almost all of the research activities in this category would already be exempted under the final rule at § __.104(d)(2), without needing to single out elected or appointed officials as being treated differently in this way. If the research is designed to provide sensitive generalizable knowledge about officials, then the identifiable private information obtained should be kept confidential as required by this final rule. If the purpose of the activity is in fact designed to hold specific elected or appointed officials up for public scrutiny, and not keep the information confidential, such an activity is not considered research under the provision at § __.102(l)(2).

Thus, the final rule adopts the NPRM proposal.

i. NPRM Proposal To Exempt Secondary Research Use of Identifiable Private Information Where Notice Was Given

One exemption proposed in the NPRM is not included in the final rule. Note that exclusions proposed in the NPRM and not included in the final rule also are described in Section III.I.4 of this preamble.

The NPRM proposed to exempt certain secondary research activities involving identifiable private information where notice of such use had been given. The proposed exemption was included, in part, to be responsive to section 511 of the Medicare Access and CHIP Reauthorization Act of 2015 (MACRA), which requires the Secretary to issue a clarification or modification with respect to the application of these regulations to certain activities involving clinical data registries. The preamble for the Common Rule NPRM noted “. . . this exemption category might allow certain research activities of these clinical data registries not otherwise covered by the proposed HIPAA-related exclusion (i.e., when the clinical data registries are not part of a HIPAA covered entity or acting as a business associate), such as when a clinical data registry may receive information from a health care entity for research purposes.”

Approximately 70 comments discussed this proposal, with the vast majority from institutions. A minority of commenters (14) supported the NPRM proposal as drafted. In addition, 11 commenters who did not indicate whether they supported the inclusion of this proposal in a final rule asked questions about implementation and the meaning of “notice” under this proposal.

A majority of commenters (41) opposed the proposal as drafted in the NPRM, citing a variety of conflicting reasons:

• Sixteen commenters felt that the NPRM proposal was too permissive as drafted, and that it would not provide adequate protections to prospective subjects. Many of these commenters also suggested that the proposal as drafted did not respect subject autonomy interests sufficiently in not providing subjects with an ability to opt out. They indicated that the exemption might be acceptable if additional requirements (such as subject opt out), or additional limitations (such as limiting the nonresearch information to which this exemption applies to data governed by certain privacy-oriented laws) were implemented.
• Fourteen commenters felt that the NPRM proposal was too restrictive, and that as drafted it would not achieve the stated goal of reducing administrative burden on IRBs. These commenters specifically discussed the implementation burdens involved in providing notice to prospective subjects. These commenters also noted that providing an option to opt out would be very burdensome to IRBs and investigators, an outcome that seemed counter to the justifications the NPRM provided for this exemption.
• Five commenters felt that the type of research encompassed by this proposal should not be exempted from the Common Rule, and that IRB review or informed consent should be required instead.

Approximately 25 comments discussed whether the NPRM proposal was necessary to enable activities involving qualified clinical data registries. A majority of these comments indicated that because the activities would be subject to the HIPAA regulations, protection of subjects would not be enhanced by the proposed NPRM exemption. Several commenters pointed out that qualified clinical data registries also might qualify for exclusion under the NPRM proposal at 101(b)(2)(ii). Additional comments suggested that other NPRM exemptions and exclusions would cover activities with qualified clinical data registries without commenting on which exemptions and exclusions applied.

The NPRM included the exemption at § __.104(e)(2), in part, to be responsive to section 511 of MACRA, but commenters expressed little support for this exemption, even for activities carried out by clinical data registries. Section 511 of MACRA has directed the Secretary of HHS to issue a clarification or modification with respect to the application of the Common Rule to activities involving clinical data registries, including quality improvement activities. With this final rule, the Secretary of HHS is providing that clarification here. Because clinical data registries are created for a variety of purposes, and are designed and used in different ways, there is no simple, single answer regarding how the Common Rule applies to clinical data registries. The Secretary of HHS has received advice from SACHRP on this topic, and SACHRP recommended that the pre-2018 rule was adequate to apply to clinical data registries without those registries being given any distinctive status. The Secretary of HHS believes that the same is true for the final rule, and so has not created a specific provision for clinical data registries.

The final rule does not impose any requirements on a large portion of the activities related to clinical data registries. The following points are important: First, the rule does not apply to clinical data registry activities not conducted or supported by a Common Rule department or agency. Second, many clinical data registry activities, including many quality improvement activities, do not meet the definition of research, and so the Common Rule does not apply. For example, the creation of a clinical data registry designed to provide information about the performance quality of institutional care providers, and whose design is not influenced or altered to facilitate research, is not covered by this rule even if it is known that the registry will be used for research studies. Third, the Common Rule does not apply to a clinical data registry research study that only involves obtaining and analyzing nonidentified information because that activity would not involve a “human subject” as defined by the rule. Fourth, some clinical data registry research activities may qualify for exemption under the proposed provision at § __.104(d). Fifth, if an institution solely releases identifiable private information that was obtained in the course of patient clinical care to a clinical data registry for research, that institution is considered to be not engaged in human subjects research, and no requirements of the rule apply to that institution.

In contrast, if investigators receive funding from a Common Rule department or agency to design a clinical data registry for research purposes and the registry includes identifiable private information, or involves interacting with individuals (e.g., a research survey), then such an activity involves human subjects research, but may be exempt if it meets one or more of the exemption categories under § __.104(d)(7). Similarly, if investigators use federal support to obtain identifiable private information from a clinical data registry to conduct a research study, then such secondary research use of clinical registry information would involve human subjects research and the requirements of the rule would apply, although the research may qualify for exemption under § __.104(d)(8). This is comparable to how the rule applies to a research study that involves chart review of identifiable private information drawn directly from hospital medical records.

VI. Protection of Identifiable Private Information and Identifiable Biospecimens

A. Background and Pre-2018 Requirements

Increasing research use of genetic information, information obtained from analysis of biospecimens, and the ability to more easily merge multiple sources of administrative and survey datasets (e.g., medical records, claims data, vital records, and information about lifestyle behaviors from surveys) are some examples of how advances in research have increased the risks of data breaches that reveal identifiable private information. For example, the unauthorized release or use of information about subjects such as the disclosure of Social Security or Medicare numbers may pose financial risks, and disclosure of illegal behavior, substance abuse, or chronic illness might jeopardize subjects' current or future employment, or cause emotional or social harm.

Based on questions from and conversations with members of the regulated community, we are aware that IRBs are not always equipped with the expertise needed to evaluate risks to privacy and confidentiality, specifically regarding sophisticated IT security. However, we note that no data suggest that IRBs are currently approving research without requiring appropriate privacy and confidentiality safeguards. Despite this, we recognized that setting standards could assure appropriate privacy and confidentiality consideration and consequent protections to all research subjects, without the administrative burden of needing a specific committee review of the privacy and confidentiality protections of each study. To that end, the 2011 ANPRM suggested establishing mandatory data security and information protection standards for all studies that involve the collection, generation, storage, or use of identifiable or potentially identifiable information that might exist electronically or in paper form or be contained in a biospecimen. It put forward the idea that these standards might adopt the categories used in the HIPAA Rules and asked a series of questions about how best to protect private information.

B. NPRM Proposal

A goal of the NPRM was to ensure that researchers protect the privacy of their participants and the security of the data, calibrated to the likelihood of identifiability and sensitivity of the information being collected. The NPRM proposed to require that investigators and institutions conducting research subject to the Common Rule implement reasonable safeguards for protecting against risks to the security or integrity of biospecimens or identifiable private information. Given the significant concerns of public commenters about an idea discussed in the 2011 ANPRM of adopting the standards solely modeled on certain standards of the HIPAA Rules, the NPRM proposed several sets of standards, and allowed a choice about which set to use.

First, the NPRM proposed that the Secretary of HHS could publish a list of specific measures that an institution or investigator could use to meet the security requirements. The list would be evaluated and amended, as appropriate, after consultation with other Common Rule departments and agencies. The proposed list would be published in the Federal Register, and public comment on the proposed list would be sought before the list was finalized.

The specific safeguards that would be identified by the Secretary would be designed so that they could be readily implemented by the individual investigator, and could build on existing safeguards already in place to protect research data. These standards would include security safeguards to assure that access to physical biospecimens or data is limited only to those who need access for research purposes. The standards would also assure that access to electronic information is authorized only for appropriate use. Finally, the safeguards, collectively referred to as “privacy safeguards,” would assure that information and biospecimens posing informational risks to subjects would be protected according to appropriate standards.

Second, the NPRM proposed that if an institution or investigator is currently required to comply with the HIPAA rules, then the safeguards required by the Common Rule would be satisfied. No additional requirements were proposed to protect information subject to the HIPAA Rules. The NPRM also proposed to clarify that the proposed provisions would not amend or repeal the requirements of 45 CFR parts 160 and 164 for the institutions or investigators to which these regulations apply pursuant to 45 CFR 160.102. Institutions or investigators that are not required to follow HIPAA could voluntarily implement the HIPAA Rules and be considered as satisfying the proposed requirements. The NPRM also proposed that for federal departments and agencies that conduct research activities that are or will be maintained on information technology that is subject to and in compliance with section 208(b) of the E-Government Act of 2002, 44 U.S.C. 3501 note, if all of the information collected, used, or generated as part of the activity will be maintained in systems of records subject to the Privacy Act of 1974, 5 U.S.C. 552a, and the research will involve a collection of information subject to the Paperwork Reduction Act of 1995, 44 U.S.C. 3501 et seq., the requirements would be satisfied.

For purposes of informing the development of the proposed privacy safeguards, the NPRM sought comment on the types of safeguards that would be appropriate for the Secretary's list. The NPRM also noted that additional statutes or acts mandate the protection of privacy and confidentiality of identifiable private information. It might be reasonable to include these as additional standards that would meet the proposed requirement if they were met in research that is subject to those standards or for which an investigator or institution has voluntarily elected to comply. Public comment was sought on whether any of these existing statutes or acts would serve the goals of proposed privacy safeguards.

The NPRM also included conditions for use and disclosure of research information to other entities. It required that protections be in place when a biospecimen or identifiable private information is shared for appropriate research or other purposes. Unless required by law, the NPRM proposed to limit the re-disclosure of identifiable private information or release of biospecimens obtained for research.

The NPRM asked for feedback on whether limiting re-disclosure to four specific circumstances unless such a disclosure was “required by law” would be too restrictive, or whether more permissive standards would better facilitate the NPRM goal of fostering the secondary research use of information. The NPRM also whether the proposed limitations on re-disclosure were more or less restrictive than necessary and whether there should be additional purposes for which release of biospecimens or re-disclosure of identifiable private information would be permitted should be allowed.

The NPRM justified this change by arguing that its benefit would be that IRBs would not be required to review the individual plans for safeguarding information and biospecimens for each research study. Although the NPRM presumed that the proposed privacy safeguards would be sufficient, an IRB could determine that a particular activity would require more than what was proposed. Once IRBs became familiar with standard institutional and investigator-adopted protections, the NPRM anticipated that they would become more comfortable with the fact that they need not review every protocol for privacy safeguards. In addition, it was expected that if the proposed privacy safeguards were adopted, overall reduction in regulatory burden would occur because IRBs would not have to review security provisions on a case-by-case basis.

Finally, as discussed in Section V, the NPRM contained proposed exemptions that would have permitted a larger number of protocols to proceed without IRB review if specific conditions were met, conditioned on investigators and institutions also meeting the proposed privacy and security requirements. Note that there was no requirement for an IRB to determine whether investigators were adhering to the privacy safeguards for such exempt research.

C. Public Comments

Approximately 130 comments addressed the privacy safeguards, with a majority generally supporting the proposal. Both those who supported the proposal and those who opposed it indicated that it was difficult to comment on the adequacy of privacy standards that had yet to be developed.

Those who supported the proposal stated that having standardized, minimum safeguards would create more consistency across IRBs in how biospecimens and identifiable private information are protected. Those who were opposed to the proposal stated that patient information is already covered by HIPAA security standards and student records are already covered by FERPA, arguing that these plus an array of other standards cover financial and various other types of sensitive information, making inclusion in the Common Rule redundant.

However, several comments asserted that the HIPAA standards, while appropriate for health information, would not be appropriate for other types of research data. Others noted that the wide range and nature of research makes it too challenging to develop a blanket standard. With regard to applying the standards to exempt research, one large association of research universities, medical centers, and independent research institutes argued that research covered by the proposed exempt or excluded categories should be low risk and therefore third party evaluation of privacy safeguards was not needed. Several academic research institutions urged that if the security and privacy requirements were included in the final rule, then the measures should be as simple as possible. For example, they suggested developing a single set of standards for all identifiable data rather than calibrating the safeguards to the sensitivity of the information to be collected.

A few comments addressed the proposed re-disclosure criteria. Of these, a majority indicated concerns with the NPRM redisclosure provision. Most of the opposition was specifically aimed at imposing the sharing criteria for nonidentified biospecimens. These commenters indicated that for sharing nonidentified biospecimens, imposing HIPAA-like privacy safeguards was unnecessary and would be extremely burdensome. Several comments suggested that the Common Rule adopt the same permissible uses and disclosures of information without authorization that exists under HIPAA.

One scientific professional organization and more than 60 institutions endorsing its comments noted that specific redisclosure considerations should exist for identifiable biospecimens, stating that redisclosure of the identity of the source of a biospecimen is appropriate in rare situations in which a confirmed research finding may have a significant impact on the health of the donor of the specimen. A large, private higher education institution noted that the limitations on use, release, and disclosure as proposed seemed at odds with the permissible uses and disclosures allowed under HIPAA.

Others suggested that the language stating that biospecimens or identifiable private information could be released for any lawful purpose with the consent of the subject was too open-ended and permissive. One data privacy and security advocacy group also noted that the introductory language to the proposed safeguards could be read as requiring an investigator to release research biospecimens or disclose identifiable private information upon receipt of a valid request, as opposed to simply permitting an institution to do so. One academic research organization suggested an alternative approach—that the Federal Government clarify that institutions and networks may designate specialized privacy and security boards to review safeguards.

D. Response to Comments and Explanation of the Final Rule: Privacy and Security Protections

The final rule does not adopt the privacy and security protections proposed in the NPRM, but rather retains and acknowledges the IRB's role in ensuring that privacy safeguards are appropriate for the research studies that require IRB review. To better ensure that appropriate privacy protections are required by IRBs, the final rule includes a new provision in the IRB review and approval criteria at § __.111(a)(7)(i) that requires the Secretary of HHS in consultation with OMB and the Common Rule departments and agencies to issue guidance o assist IRBs in assessing what provisions are adequate to protect the privacy of subjects and to maintain the confidentiality of data. This requirement is discussed in more detail in Section XI.

Although we continue to believe that appropriately protecting the privacy of human subjects who provide identifiable private information and identifiable biospecimens as well as preventing security breaches is critically important, we agree with the public's concerns about requiring adherence to privacy and security standards when the safeguards to be issued by the Secretary of HHS have yet to be developed. The federal privacy and security laws would apply only to certain federally conducted research. Rather than promulgate a regulation that lacked sufficient specificity, we determined it would be preferable to maintain the requirement that IRBs review research studies to ensure that appropriate privacy and security safeguards are in place to protect research subjects, but include a commitment that the Secretary of HHS will issue guidance to assist IRBs in appropriately protecting subjects' privacy and confidentiality. This guidance would take into consideration, among other things, the level of identifiability and sensitivity of the information being collected. Although IRBs were not specifically designed to evaluate risk to privacy and confidentiality and the adequacy of safeguards to protect against those risks, IRBs have been responsible for evaluating such risks under the pre-2018 rule. We believe that guidance in this complex and evolving area will assist IRBs to identify appropriate protections, and may be better able than standardized protections, to address the variety of privacy and confidentiality concerns that arise in the broad range of research studies that are being carried out now and those that will be conducted in the years to come.

As discussed in Section V, certain NPRM exemption proposals required the application of the NPRM's proposed safeguards in whole or in part. To accommodate the fact that the final rule does not include the privacy safeguards, exemption categories in the final rule that are predicated on the need for some type of privacy safeguards will instead require that an IRB conduct a limited review to ensure that adequate provisions are in place to protect the privacy of subjects and to maintain the confidentiality of data.

The final rule exemptions subject to this limited IRB review requirement are:

• The exemption for research that includes only interactions involving educational tests, survey procedures, interview procedures, or observations of public behavior regardless of the identifiability or sensitivity of the information collected/recorded (§ __.104(d)(2)(iii));
• The exemption for research involving benign behavioral interventions in conjunction with the collection of information from an adult subject through verbal or written responses or video recording (regardless of the identifiability or sensitivity of the information collected/recorded (§ __.104(d)(3)(i)(C));
• The exemption for the storage or maintenance of identifiable private information or identifiable biospecimens for which broad consent is required, when there is a change specific to the research activity in how the identifiable private information or identifiable biospecimens are stored and maintained (§ __.104(d)(7)); and
• The exemption for the secondary research use of identifiable private information or identified biospecimens for which broad consent is required (§ __.104(d)(8))

VII. IRB Membership and Modification to References to Vulnerability (§§ __.107(a), __.111(a)(3), and __.111(b))

A. Background and Pre-2018 Requirements

The pre-2018 rule stipulated a condition of IRB membership at § __.107(a) stating that IRBs should aim for membership that does not consist entirely of individuals of one gender, race, or cultural background. It referred again to the characteristics of IRB members at § __.107(b), stating that efforts should be made to ensure that no IRB consists entirely of members of one gender or one profession.

The pre-2018 rule also referred to the concept of vulnerability and consideration of vulnerable populations in three provisions, one of which pertained to IRB membership (§ __.107(a)), one with regard to selection of subjects (§ __.111(a)(3)), and one with regard to additional protections needed for subjects vulnerable to coercion or undue influence (at § __.111(b)). Under the pre-2018 rule, only § __.111(b) of the three provisions specifically referred to vulnerability to coercion or undue influence as the type of vulnerability that should be considered. In addition, of these same three provisions in the pre-2018 rule, only § __.107(a) identified “handicapped” individuals as a vulnerable category of subjects.

B. NPRM Proposal

The NPRM proposed eliminating the pre-2018 rule stipulation that IRBs should aim for membership that does not consist entirely of individuals of one gender or profession because the requirement that IRB membership reflect members of varying backgrounds and diversity, including gender, accomplishes the same goal.

Further, the NPRM proposed that the criterion at § __.111(a)(3) be revised to align with the language of § __.111(b) to reflect that the vulnerability of the populations in these research studies should be considered to be a function of the possibility of coercion or undue influence, and that this vulnerability alone should be the IRB focus of concern with respect to this criterion. The proposed change was intended to provide greater consistency and clarity in IRB consideration of vulnerability of subject populations in research activities and appropriate protections. A comparable change was also proposed at § __.107(a), pertaining to IRB membership.

In addition, the NPRM proposed that the term “handicapped” be changed to “physically disabled” individuals. Therefore, to enhance consistency and clarity among these three provisions, it was proposed that the term “physically disabled” be inserted at § __.111(a)(3) and (b). This would mean that physically disabled persons would be among the individuals that the IRB may consider in determining that the selection of subjects is equitable (§ __.111(a)(3)), and that the IRB may consider to be vulnerable to coercion or undue influence (§ __.111(b)). Public comment was sought on whether pregnant women and those with physical disabilities should be characterized as vulnerable to coercion or undue influence. Whether or not these subpopulations are considered vulnerable to coercion or undue influence would not affect the applicability of subpart B.

Finally, the NPRM proposed a change in § __.107(a), involving the insertion of “economically or educationally disadvantaged persons” as an example of a vulnerable population, and requiring an IRB to give consideration to membership expertise in this area. This language was already included in the pre-2018 rule at § __.111(a)(3) and § __.111(b). Adding this category of individuals to those who may be considered vulnerable to coercion or undue influence at § __.107(a) was intended to create greater consistency among these three provisions.

C. Public Comments

Between 40 and 50 NPRM comments discussed the language describing vulnerable populations found in §§ __.107(a), __.111(a)(3), and (b). A majority of these comments only discussed the inclusion of pregnant women as an example of a population that might be vulnerable. Typically, comments addressed only one of the three questions posed in the NPRM about these provisions. The questions asked whether the § __.111(a)(3) and (b) focus on issues related to coercion or undue influence in research with vulnerable populations, and no other considerations related to vulnerability, was appropriate; whether pregnant women and those with physical disabilities should be included in the category of subpopulations that may be vulnerable to coercion or undue influence; and, whether populations should be considered vulnerable for reasons other than vulnerability to coercion or undue influence.

A majority of the comments stated that the inclusion of pregnant women as an example of a group that might be vulnerable to coercion or undue influence was inappropriate. These commenters noted that to suggest that noncognitive limitations make individuals inherently vulnerable is insulting to those populations. Of those comments that addressed these proposals, a minority discussed whether individuals with physical disabilities should be included as an example of a group that might be vulnerable to coercion and undue influence. As with pregnant women, these commenters stated that the insinuation that groups with physical disabilities might be inherently vulnerable to coercion and undue influence was insulting. One commenter noted that a physical condition might make one vulnerable to coercion or undue influence in the research context, but typically only when the research activity targets that vulnerability (as opposed to those populations always being vulnerable).

In terms of whether other types of vulnerabilities should be considered by IRBs, public comment was mixed. Some commenters indicated that in the research context, the specific concerns with respect to vulnerable populations are limited to vulnerability to coercion and undue influence, while others noted that the regulations do not preclude an IRB from considering other types of vulnerability and that because of this flexibility, additional regulatory text was not necessarily needed. Groups specifically concerned with issues related to research involving Native American populations noted that there are issues broader than vulnerability to coercion and undue influence that should be considered, such as vulnerability to group harms; one commenter recommended that populations be considered vulnerable as a result of being historically marginalized, such as native/tribal communities; lesbian, gay, bisexual, and transgender (LGBT) individuals; and racial and ethnic groups.

Commenters who disagreed with this change generally felt that a history of societal marginalization, such as that experienced by LGBT groups or AI/AN tribes, should be a basis for determining vulnerability, and that a focus on only coercion or undue influence may be insufficient for IRB consideration.

Several comments discussed the fact that using the term mentally disabled is potentially patronizing. One commenter suggested that instead of listing mentally disabled individuals as a group that might be vulnerable to coercion and undue influence, the regulations should use the term “populations with impaired decision making ability.” This suggestion echoes a recommendation made by SACHRP in 2009 as well.

Another commenter stated that vulnerability status should be based on situational context, not on membership in a population, which potentially promotes stigmatization. Rather, focus should be more on the risk of the research and the situation of each subject when asked to participate in research. Finally, it was suggested that terminally ill patients who have exhausted all standard therapies, and possibly other research interventions, should be considered vulnerable.

D. Response to Comments and Explanation of the Final Rule: References to Vulnerability

A majority of comments agreed that the focus on issues related to coercion or undue influence, and no other considerations related to vulnerability, was appropriate. We agree with this assessment, and have retained this language in the final rule. We believe this change will help guide IRBs when assessing the type of vulnerability that should be the focus of review. We note that the § __.111(a)(3) approval criterion retains the reference to the purposes of the research and the setting in which it is conducted because these considerations are also relevant to the assessment of the equitable selection of subjects, and may include factors such as societal marginalization or discrimination.

The language at the three provisions (§ __.107(a), § __.111(a)(3), and § __.111(b)) has been made identical in referring to vulnerability as meaning vulnerability to coercion and undue influence, in recognition that coercion or undue influence refers to the ability to make an informed decision about participating in research.

We agree with comments that said that the list of example vulnerable populations listed in the pre-2018 rule is out of date.

In agreement with the majority of comments, the final rule no longer includes pregnant women or “handicapped” or physically disabled individuals as examples of populations that are potentially vulnerable to coercion or undue influence. Adopting a suggestion from public comment and SACHRP, the final rule uses the term “individuals with impaired decision-making ability” to replace the term “mentally disabled persons.”

VIII. IRB Functions and Operations (§ __.108)

A. Background and Pre-2018 Requirements

The pre-2018 rule outlined IRB functions and operations at §§ __.103 and __.108.

B. NPRM Proposals

The NPRM contained several proposals for changes in IRB functions and operations. Of relevance here, the requirements for recordkeeping by IRBs would no longer appear in § __.103 of the rule but in § __.108. Much of the discussion related to these changes appears in Section IV regarding the assurance process. The issues are summarized here.

The NPRM proposed that the requirement that a written assurance include a list of IRB members for each IRB designated under the assurance process be replaced. In its place, the NPRM proposed that the assurance include a statement for each designated IRB, prepared and maintained by the institution, or when appropriate the IRB, with a current detailed list of the IRB members including information sufficient to describe each member's chief anticipated contributions to IRB deliberation; and any employment or other relationship between each member and the institution. The regulatory requirement at § __.103(b)(3) that changes in IRB membership be reported to the department or agency head, or to OHRP when the existence of an HHS-approved assurance is accepted, would be deleted, eliminating the requirement. Instead, an institution would be required under proposed § __.108(a)(2) to maintain a current IRB roster, but such a roster would not need to be submitted to OHRP or other agency managing the assurance of compliance process.

The NPRM also proposed to eliminate the requirement in § __.103(b)(2) that an institution designate one or more IRBs on its FWA established in accordance with the Common Rule. The requirement in the pre-2018 Common Rule at § __.103(b)(2) that IRBs have sufficient meeting space and staff to support IRB reviews and record keeping requirements was moved in the NPRM to § __.108(a)(1). Note that under this proposal federal departments or agencies would retain the ability to ask for information about which IRBs review research conducted at an institution as part of the assurance process.

C. Public Comments

Approximately 10 comments were received on these proposals. Of those, all supported the NPRM proposal that changes in IRB membership no longer needed to be reported to the funding department or agency. All commenters supported the proposal that IRBs would simply need to prepare and maintain a current list of IRB members. Commenters agreed that the proposed changes to the IRB roster requirement would reduce administrative burden without having any significant impact on the protection of human subjects. Those who commented on the proposed deletion of the requirement to designate one or more IRBs on an institution's FWA generally supported the proposal.

No comments were received on the proposed movement of IRB policy and recordkeeping requirements from § __.103 to § __.108.

D. Explanation of the Final Rule: IRB Functions and Operations

The final rule adopts the NPRM proposals to move the IRB recordkeeping requirements from § __.103(b)(3), (4), and (5) to § __.108(a)(2), (3), and (4). (See Section IV regarding changes to § __.103 as well.) The final rule also adopts the NPRM proposal that IRBs must maintain an accurate list of IRB members but are not required to submit changes to that roster to the funding department or agency. The final rule also adopts the NPRM proposal to delete the requirement in the pre-2018 rule that institutions designate one or more IRBs on that institution's FWA.

IX. IRB Review of Research (§ __.109)

A. Background and Pre-2018 Requirements

The pre-2018 rule listed four areas of responsibility for IRBs in the review process concerning their authority to approve, request modification, or disapprove research activities; ensure informed consent requirements are met (including documentation or waiver, as relevant); notify investigators of their determinations; and conduct continuing review of research. The rule at § __.109(a) stated that IRBs have the authority to carry out these responsibilities for all research activities covered by the policy.

In particular, the pre-2018 rule at § __.109(e) required that IRBs conduct continuing review of research covered by this policy at intervals appropriate to the degree of risk, but not less than once per year. Except when an expedited review procedure was used, continuing review of research was to occur at convened meetings at which a majority of the IRB members are present, including at least one member whose primary concerns are in nonscientific areas.

An IRB could use an expedited review procedure to conduct continuing review of research for some or all of the research appearing on the list of research eligible for expedited review and found by the reviewer(s) to involve no more than minimal risk. The Common Rule departments and agencies could restrict, suspend, terminate, or choose not to authorize an IRB's use of the expedited review procedure (§ __.110(d)).

B. NPRM Proposals

The NPRM proposed clarifying that the Common Rule does not give IRBs the authority to review or approve, require modification in or disapprove research that qualifies for the exemptions proposed in the NPRM.

The NPRM also proposed to eliminate continuing review for many minimal risk studies (namely those that qualify for expedited review), unless the reviewer documents why continuing review should take place, which would be required according to the NPRM. Moreover, for studies initially reviewed by a convened IRB, continuing review would not be required, unless specifically mandated by the IRB, after the study reaches the stage where it involves only one or both of the following: (1) Analyzing data (even if it is identifiable private information); or (2) accessing follow-up clinical data from procedures that subjects would undergo as part of standard care for their medical condition or disease.

In addition, the NPRM proposed that continuing review would not be required for research involving certain secondary research using information and biospecimens that requires limited IRB review in order to qualify for an exemption proposed in the NPRM.

Further, the NPRM proposed that an IRB must receive annual confirmation that research is ongoing and that no changes have been made that would require the IRB to conduct continuing review (that is, the study still qualifies for expedited review because it still meets the criteria listed above and still involves no greater than minimal risk).

The NPRM also proposed a new requirement for IRBs to maintain records of continuing reviews. Because the NPRM proposed a new provision that eliminates the need for continuing review under specific circumstances, it also proposed that IRBs need to justify the need for continuing review in cases where it was not required. If an IRB chooses to conduct continuing review even when these conditions are met, the NPRM stated that the rationale for doing so must be documented.

C. Public Comments

Approximately four comments addressed the clarification proposed in the NPRM that IRBs were not authorized by this policy to review exempt research. All who commented opposed the proposed modification. Those who commented were concerned that IRBs and institutions would interpret the modifications to mean that IRBs were precluded from ever reviewing such research and pointed to the possibility, although rare, that there might be a need to do so, particularly if the initial exemption determination was flawed.

With regard to continuing review, approximately 120 comments discussed this proposal. A strong majority of comments (approximately 95) supported this proposal and approximately 15 opposed it. Other comments were mixed. Those who supported the proposal said that it would indeed alleviate IRB administrative burden without diminishing the protections afforded to human subjects. Those who did not support this proposal believed the continuing review process served an important role in allowing an institution to periodically re-evaluate the benefits, risks, methods, and procedures used in research activities, and whether the research had been modified without approval. Some commenters who supported the proposal were opposed to the requirement for annual confirmation to the IRB that such research is ongoing and that no changes have been made that would require the IRB to conduct continuing review. They stated that the burden alleviated by eliminating the need for continuing review was offset by the requirement to submit an annual confirmation.

D. Response to Comments and Explanation of the Final Rule: Review of Research

The final rule at § __.109(a) modifies the language of the pre-2018 rule to state that IRBs review and have the authority to approve, require modifications in, or disapprove all research activities covered by this policy, including exempt research activities under § __.104 for which limited IRB review is a condition of exemption (§ __.104(d)(2)(iii), § __.104(d)(3)(i)(C), § __.104(d)(7), and § __.104(d)(8)). Since the final rule requires limited IRB review for certain categories of exempt research, the provision at § __.109(a) has been modified to clarify that IRBs have the authority needed to conduct limited IRB review.

As proposed in the NPRM, and as generally supported in public comments, continuing review is eliminated for all studies that undergo expedited review, unless the reviewer explicitly justifies why continuing review would enhance protection of research subjects (§ __.109(f)(1)(i) and § __.115(a)(3)). For studies initially reviewed by a convened IRB, once certain specified procedures are all that remain for the study, continuing review would not be required, unless specifically mandated by the IRB. These activities include: (1) Research eligible for expedited review in accordance with § __.110; or (2) Research that has progressed to the point that it involves only one or both of the following, which are part of the IRB-approved study: (a) Data analysis, including analysis of identifiable private information or identifiable biospecimens, or (b) Accessing follow-up clinical data from procedures that subjects would undergo as part of clinical care (at § __.109(f)). In addition, the final rule states at § __.109(f)(1)(ii) that continuing review is not required for research reviewed in accordance with the limited IRB review procedure described in § __.104(d)(2)(iii), § __.104(d)(3)(i)(C), § __.104(d)(7), or § __.104(d)(8).

The final rule does not require investigators to provide annual confirmation to the IRB that such research is ongoing and that no changes have been made that would require the IRB to conduct continuing review. Institutions that choose to require some accounting of ongoing research not subject to continuing review have significant flexibility in how they implement their own requirements. Note that under the final rule, investigators would still have the current obligations to report various developments (such as unanticipated problems or proposed changes to the study) to the IRB.

X. Expedited Review Procedures (§ __.110)

A. Background and Pre-2018 Requirements

Under the pre-2018 rule, a research study could receive expedited review if the research activities to be conducted appear on the list of activities published by the Secretary of HHS that are eligible for such review, and was found by the reviewer(s) to involve no more than minimal risk. Under an expedited review procedure, the review could be carried out by the IRB chairperson or by one or more experienced reviewers designated by the chairperson from among the members of the IRB. Research that was eligible for expedited review required continuing review at least annually.

B. NPRM Proposals

The NPRM proposed changes regarding expedited review, to allow expedited review to occur for studies on the Secretary's list unless the reviewer(s) determine(s) that the study involves more than minimal risk. This was in contrast to the pre-2018 regulations, which required that an IRB use the expedited review procedure only if the reviewer determines (and documents) that the research involves no more than minimal risk. In addition, OHRP has indicated that the activities on the current list should not be deemed to be of minimal risk simply because they are included on the list. In a related change, the NPRM contained a requirement that IRBs document the rationale for an expedited reviewer's determination that research appearing on the expedited review list is more than minimal risk (i.e., an override of the presumption that studies on the Secretary's list are minimal risk).

The NPRM proposed that IRBs reviewing the consent process (and, when required, the privacy safeguards) for studies eligible for the proposed exemption at § __.104(f)(1) could use the expedited review procedure.

As discussed in Section III of this preamble, the NPRM did not propose to modify the definition of minimal risk, but rather proposed adding to the definition a requirement that the Secretary of HHS create and publish a list of activities that qualify as “minimal risk”. This Secretary's list would be re-evaluated periodically, but at least every 8 years, based on recommendations from federal departments and agencies and the public. Note that this would not be an exhaustive list of all activities that would be considered minimal risk under the Common Rule, but would allow IRBs to rely on the determination of minimal risk for activities appearing on the list. IRBs would still need to make minimal risk determinations about activities that do not appear on this list.

In addition, the NPRM proposed to eliminate the parenthetical phrase “of one year or less” when referring to the IRB approval period, since annual continuing review of research eligible for expedited review would no longer be required.

The NPRM also proposed that the regulations be revised to require evaluation of the list of expedited review categories every 8 years, followed by publication in the Federal Register and solicitation of public comment. A revised list would be prepared for public comment outside the scope of the NPRM.

C. Public Comments

Approximately 50 comments were received regarding the proposal to update the Secretary's list of expedited review categories every 8 years. A strong majority supported this proposal although some recommended that the mandatory period of review occur more frequently than every 8 years.

Approximately 10 comments discussed the NPRM proposal that an IRB may use the expedited review procedure to satisfy limited IRB review of the consent process as required under the proposed NPRM exemption. A strong majority of these comments supported this proposal.

D. Response to Comments and Explanation of the Final Rule: Expedited Review Procedures

Under the final rule, a study is deemed to be minimal risk and thus eligible for expedited review if the study only involves activities on the Secretary's list, unless the reviewer determines and documents that the study involves more than minimal risk (§ __.110(a) and (b)(1)). Thus, we anticipate that more studies that involve no more than minimal risk will undergo expedited review, rather than full review, which will relieve burden on IRBs.

Further, IRBs will be required to document their rationale when they override the presumption that studies on the Secretary's expedited review list involve greater than minimal risk (at § __.115(a)(8)). Although public comments argued that this documentation represented an unjustified burden on IRBs, we believe that such documentation could provide a basis for the Secretary's future determinations about the appropriateness of the list, and allow for greater consistency across institutions, and thus make the Common Rule more just.

At § __.110(b)(1)(iii) the final rule adopts the NPRM proposal that an IRB may use the expedited review process when conducting limited IRB review as required by the exemptions at § __.104(d)(2)(iii), § __.104(d)(3)(i)(C), § __.104(d)(7), and § __.104(d)(8).

Finally, as proposed in the NRPM, evaluation of the list of expedited review categories will occur every 8 years, followed by publication in the Federal Register and solicitation of public comment.

XI. Criteria for IRB Approval of Research (§ __.111)

A. Background and the Pre-2018 Requirements

The determinations that an IRB must make before it can approve a study were spelled out in the pre-2018 rule at § __.111. These relate, among other things, to minimizing risks to subjects, determining that an appropriate relationship exists between risks and benefits, and ensuring the equitable selection of subjects. The regulations generally required all of these determinations to be made for any study that must undergo IRB review.

B. NPRM Proposals

The NPRM proposed a number of changes regarding the criteria for IRB approval of research, including (1) creating a new form of IRB review for activities relating to storing or maintaining data and biospecimens for later secondary use; (2) revising two of the existing criteria for approval of research that have special considerations related to the involvement of vulnerable populations and for privacy and confidentiality of data provisions; and (3) adding a provision about plans to review the return of individual results to participants.

The first set of changes concerned updating the IRB review criteria for research activities relating to storing or maintaining information and biospecimens, and to the secondary use of such information and biospecimens. Paragraph (a)(9)(i) of proposed § __.111 would have applied to a proposed exemption at § __.104(f)(1) for storing or maintaining biospecimens or identifiable private information for use in secondary research. This provision would have eliminated the need for an IRB to make the usual determinations about such an activity. Instead, the IRB would have been required to determine that the procedures for obtaining broad consent to storing or maintaining the biospecimens or information were appropriate, and met the standards included in the introductory paragraph of § __.116. In addition, if these storage and maintenance activities involved a change for research purposes from the way the biospecimens or information had been stored or maintained, then the IRB would have needed to determine that the proposed biospecimen and privacy safeguards at § __.105 were satisfied for the creation of any related storage database or repository.

The second proposed change was related to the NPRM privacy safeguard proposal and clarified that it would not be an IRB responsibility to review the security plans for biospecimens and identifiable private information for every protocol (i.e., on a case-by-case basis). Also, as discussed in Section VII, the NPRM proposed changing how vulnerable populations are referred to in the regulatory language at § __.111(a)(3).

The third proposed change was the addition of section (a)(8) to § __.111 clarifying that if an investigator submits as part of the protocol a plan for returning clinically relevant research results to subjects, the IRB would have to evaluate the appropriateness of the plan. This criterion was proposed in response to public discussions, including SACHRP, recommending that IRBs consider returning individual results to subjects.

C. Public Comments

Approximately 20 comments discussed the proposed modifications in § __.111 related to the criteria for IRB approval of research. Of these comments, a majority discussed the proposal that an IRB be required to review the adequacy of plans to return research results, should a proposed study include such a plan. Comments on this proposal were mixed, with both those opposing and supporting the proposal indicating that HHS and other Common Rule departments and agencies would need to issue detailed guidance addressing what is considered an adequate plan in this context. Several commenters suggested deleting this provision due to the lack of clarity surrounding the IRB's role in such a review.

D. Response to Comments and Explanation of the Final Rule: Criteria for IRB Approval of Research

The final rule does not adopt all of the NPRM proposals. It does not include the NPRM proposal regarding IRB review of plans to review the return of clinically relevant results to subjects. This proposal was deleted due to concern over the criteria that would be required for an IRB to appropriately consider this area, the need for particular IRB expertise to appropriately assess the return of results, and ambiguity over the meaning of “clinically relevant.”

The final rule does, however, revise two of the existing criteria for approval of research: (1) Special considerations related to the involvement of vulnerable populations, and (2) privacy and confidentiality of data provisions.

As discussed in more detail in Section VII, the language regarding vulnerable populations at § __.111(a)(3) and (b) has been revised to reflect the current understanding of which populations should receive special consideration due to potential vulnerabilities specific to the purposes and context of human subjects studies and to parallel other references to vulnerable populations found at § __.107(a).

Section __.111(a)(7) in the final rule retains the pre-2018 language, but also adds an additional requirement, thereby serving a dual function as both the primary regulatory provision requiring IRB review of the adequacy of protections for the privacy of subjects and confidentiality of identifiable private information (including that obtained from the analysis of biospecimens), and as the primary limited IRB review requirement needed to satisfy certain exemption determinations in § __.104(d).

In § __.111(a)(7)(i) the Secretary of HHS commits to issuing guidance to assist IRBs in assessing what provisions are adequate to protect the privacy of subjects and to maintain the confidentiality of information, after consultation with OMB's privacy office and other federal departments and agencies that have adopted this policy. This modification is intended to serve a similar function as the privacy safeguards proposed in the NPRM (but not adopted in the final rule). The guidance might address the following considerations such as:

• The extent to which identifiable private information is or has been de-identified and the risk that such de-identified information can be re-identified;
• The use of the information;
• The extent to which the information will be shared or transferred to a third party or otherwise disclosed or released;
• The likely retention period or life of the information;
• The security controls that are in place to protect the confidentiality and integrity of the information; and
• The potential risk of harm to individuals should the information be lost, stolen, compromised, or otherwise used in a way contrary to the contours of the research under the exemption.

The final rule at § __.111(a)(8) modifies the NPRM proposal on the limited IRB review required by § __.104(d)(7). Section __.111(a)(8) specifies that for the purposes of conducting the limited IRB review required by § __.104(d)(7), the IRB must determine that broad consent for storage, maintenance, and secondary research use of identifiable biospecimens or identifiable private information is obtained in accordance with the requirements of § __.116(a)(1)-(4), (a)(6), and (d). As part of its review of these requirements for broad consent, the IRB would review the appropriateness of the process proposed for obtaining broad consent, and ensure that the required elements of broad consent were appropriately included in the broad consent form (or process, if broad consent is to be obtained orally). Additionally, the IRB must determine that consent is appropriately documented, or that a waiver of documentation is appropriate, in accordance with § __.117. Finally, if a change is made for research purposes in the way identifiable private information or identifiable biospecimens are stored or maintained, the IRB must determine that adequate provisions are in place to protect the privacy of subjects and to maintain the confidentiality of data. It is expected that the guidance to be developed by the Secretary of HHS about protecting the privacy of subjects and maintaining the confidentiality of data will also be applicable to the privacy and confidentiality considerations included in this limited IRB review requirement.

XII. Cooperative Research (§ __.114)

A. Background and Pre-2018 Requirements

The pre-2018 rule required that each institution engaged in a cooperative research study obtain IRB approval of the study, although it did not require that a separate local IRB at each institution conduct such review. In many cases, however, a local IRB for each institution would independently review the research protocol, and informed consent forms and other materials, often resulting in multiple reviews for one study. When any one of these IRBs would require changes to the research protocol that are adopted for the entire study, investigators would have to re-submit the revised protocol to all of the reviewing IRBs. This process could take many months and significantly delay the initiation of research projects and recruitment of subjects into studies. More importantly, little evidence has suggested that the time and effort put into these activities by investigators (in providing materials to IRBs) and IRBs have significantly increased the well-being of research subjects.

B. NPRM Proposals

Taking into consideration the history of public debate on this topic and various sources of public comments, the NPRM proposed a requirement mandating that all institutions located in the United States engaged in cooperative research rely on a single IRB as their reviewing IRB for that study. Under this proposal, this requirement would not apply to: (1) Cooperative research for which more than single IRB review is required by law; or (2) research for which the federal department or agency supporting or conducting the research determines and documents that the use of a single IRB is not appropriate for the particular study. Public comment was sought on whether it would be useful for this requirement to include criteria that federal departments or agencies would need to apply in determining whether to make exceptions to the use of a single IRB requirement and what those criteria might be. Further the public was asked whether the exceptions proposed were appropriate and sufficient, or whether this mandate should have additional exceptions for single IRB review than those proposed in the NPRM.

The change proposed by the NPRM would apply only to U.S.-conducted portions of studies because the flexibility to make use of local IRB reviews at international sites should be maintained. It might be difficult for an IRB in the United States to adequately evaluate local conditions in a foreign country that could play an important role in the ethical evaluation of the study.

This policy would apply regardless of whether the study underwent convened review or expedited review. Under the NPRM, the IRB of record would be expected to be selected either by the funding agency or, if there is no funding agency, by the lead institution conducting the study. An agency may, but is not required, to solicit input regarding which IRB would be most appropriate to designate as the IRB of record. Public comment was sought on how this would work in practice.

This policy would not relieve any site of its other obligations under the regulations to protect human subjects. Nor would it prohibit institutions from choosing, for their own purposes, to conduct additional IRB or other administrative reviews, though such reviews would no longer have any regulatory status in terms of compliance with the Common Rule.

Some concerns about a mandated single IRB review for cooperative research point to implementation logistics, and the time necessary to establish new policies, procedures, and agreements. Recognizing this concern, the proposed compliance date was 3 years from the publication of the final rule. Public comment was sought on whether this was a realistic timeframe.

The public was asked to comment on whether mandated single IRB review for all cooperative research was a realistic option, and what the likely costs and benefits to institutions might be. Further, the public was asked to comment on whether additional resources would be necessary to meet this requirement in the short term and whether savings might be anticipated in the long run. Finally, public comment was sought regarding in what areas guidance would be needed for institutions to comply with this requirement and whether the Common Rule departments and agencies could take actions to address concerns about institutional liability, such as developing model written agreements.

C. Public Comments

This proposal was one of the most commented on in the NPRM, receiving more than 300 comments. Public comment was divided on whether a final rule should implement the proposal to mandate one IRB of record in domestic cooperative research studies. Of those who commented on this proposal, approximately 130 supported the proposal, and approximately 140 opposed it. Others had mixed views.

Research institutions tended to oppose this proposal, while individuals (i.e., those who were not providing comment in an official institutional capacity) and scientific organizations tended to support the proposal. A strong majority of those who opposed the proposal indicated that the final rule should encourage, rather than mandate, a single IRB of record in cooperative research studies. Arguments against the proposal cited the need for local review and potential loss of accountability, as well as operational issues such as the increased administrative capacity and technological systems required for a site to function effectively as a single IRB. One comment stated that mandated single IRB review would not eliminate the challenges associated with multi-institutional trials. The commenter argued that it would shift the burden from sponsors to investigators and at the institutional level, centralized systems would have to be developed and sustained in order to manage single IRB reviews.

Some who supported the proposal stated that it would decrease administrative burdens and inefficiencies for investigators and institutions. Conversely, some commenters stated that the proposal should not be implemented because it would ultimately increase burdens and inefficiencies for investigators and institutions.

In addition to the broad themes for and against this proposal, some commenters such as SACHRP noted that the proposed requirement seems premature at this time and suggested that more data are needed before such a provision could be implemented. Others said the scope of the proposal seemed overly broad. Many cited the alternative, narrower approach discussed in SACHRP's public comment as a reasonable option. Further commenters stated that the lead institution likely would experience increased costs if this proposal were implemented because of the obligations it would have to assume. In addition, some commenters said that the proposal does not address risk of liability to institutions and IRBs that are not considered the lead.

Commenters also noted that long review times for prospective research studies are not solely related to the IRB review and approval itself. Rather, commenters noted that long review times are caused by the sum total of the many different types of reviews either mandated by other regulations or by institutional policy (e.g., radiation safety board review, privacy board review, departmental scientific review) that must be completed. These other reviews would likely not be affected by the NPRM proposal.

Several commenters expressed concern that according to the NPRM proposal, the supporting federal department or agency would select the IRB of record as required by the provision. These commenters were concerned that the provisions did not seem to allow for grantee or awardee input on what IRB should be the IRB of record nor did they seem to suggest that funding departments or agencies should consult with the institutions receiving funding about the IRB of record. Several public comments also expressed concern about the burden this provision would place on nonfederally supported studies subject to the rule solely based on the clinical trials expansion proposed in the NPRM.

Representatives of AI/AN tribes also provided comments emphasizing the sovereign status of their governments, and stating that nonlocal review would be inappropriate for their communities.

D. Response to Public Comments and Explanation of the Final Rule: Cooperative Research

The final rule adopts the NPRM proposal with modifications that are responsive to public comment. We agree with commenters who speculated that mandated single IRB review would ultimately decrease administrative burdens and inefficiencies for investigators and institutions, while acknowledging that the transition to this model would require significant time and an adjustment to institutional structures and policies. We concur that, rather than offering additional protections, in many cases multiple IRB approvals increase burden and frequently delay the implementation of studies, increasing the costs of clinical trials and potentially stalling access to new therapies. We note comments that expressed frustration with the frequent occurrence of central IRB participating sites insisting on separate institutional reviews. One comment noted that these additional IRB reviews generally reach the same conclusions, or conclusions with minor changes, that are then imposed solely on that site. When working optimally, we expect the central IRB model will work more efficiently and require less personnel time and fewer resources for tracking and implementing IRB changes and approvals, thereby eliminating the potential for unnecessarily duplicative reviews.

Although a large number of comments believed that single IRB review should be encouraged rather than mandated, we feel that this incentivized approach would ultimately fail to yield substantive positive change in the system. Rather, systematic efficiencies have the best chance of occurring if single IRB review is required for all review in domestic research involving more than one institution. We acknowledge that further guidance for this requirement will need to be developed and that initial cost projections may have been low. However, we feel this change supports the best interests of the research infrastructure through increasing efficiency. Note that the final rule permits appropriate flexibilities that will assist in implementation. Institutions may still choose to conduct additional internal IRB reviews for their own purposes, though such reviews would no longer have any regulatory status in terms of compliance with the Common Rule.

We agree with comments recommending that a greater role should be provided for grantee input on choosing the IRB of record, and have modified the language accordingly. The language at § __.114(b)(1) now states that the reviewing IRB (i.e., the IRB of record) will be identified by the federal department or agency supporting or conducting the research, yet allows lead institutions to propose the reviewing IRB, subject to the acceptance of the federal department or agency supporting the research. This provision is consistent with the NIH single IRB policy, which was published on June 21, 2016.

This final rule adopts (in § __.114(b)(2)(i)) the NPRM's proposal that cooperative research for which more than single IRB review is required by law is not subject to the requirements of § __.114. The rule also adds clarifying language providing that this provision extends to tribal laws passed by the official governing body of an AI/AN tribe. Thus, if the official governing body of an AI/AN tribe passes a tribal law that requires more than single IRB review for certain cooperative research, the requirement for single IRB review does not apply to such cooperative research. In addition, we highlight that § __.114(b)(2)(ii) allows a federal department or agency the flexibility to determine that the use of a single IRB is not appropriate for certain contexts, thereby permitting additional IRB review and consideration of local and regional variations in some circumstances.

Finally, the final rule adopts the NPRM proposal for this provision to have a delayed compliance date of 3-years from the date the final rule is published in the Federal Register. This transition period is intended to allow the regulated community appropriate time and flexibility in adjusting to this new model.

XIII. IRB Records (§ __.115)

A. Background and Pre-2018 Requirements

The pre-2018 rule at § __.115 outlined requirements for IRBs in preparing and documenting its activities and for maintaining records.

B. NPRM Proposals

As discussed in Section IV, the NPRM proposed to revise the pre-2018 requirement that an up-to-date list of the IRB members and their qualifications be included in an institution's assurance. Instead, the NPRM proposed the requirement that an IRB or the institution prepare and maintain a current list of IRB members.

As discussed in Section IX, the NPRM proposed a new requirement for IRBs to maintain, as part of their records of continuing reviews, the rationale for conducting continuing review of research that was deemed eligible for elimination of continuing review per proposed changes at § __.109(f)(1)(ii). Specifically, this would apply to research that had progressed to the point that it involves only one or both of the following, which are part of the IRB-approved study: (1) Conducting data analysis, including analysis of identifiable private information, or (2) accessing follow-up clinical data from procedures that subjects would undergo as part of standard care for their medical condition.

Also, as discussed in Section IX, the NPRM proposed eliminating continuing review for many minimal risk studies (namely those that qualify for expedited review), unless the reviewer finds and documents why continuing review should take place for the study. Finally, the NPRM contained a requirement that IRBs document the rationale for an expedited reviewer's determination that research appearing on the expedited review list is more than minimal risk (i.e., overturning the presumption that studies on the Secretary's list are minimal risk).

New in the NPRM was a proposal to require that an IRB maintain records of exemption determinations. Additionally, the NPRM proposed that the use of the proposed exemption determination tool would satisfy the proposed documentation requirement.

In addition, a new provision was proposed to require that the institution or IRB that retains IRB records should safeguard, if relevant, individually identifiable private information contained in those records in compliance with the proposed privacy safeguards.

Finally, the NPRM proposed a modification of the pre-2018 rule clarifying that IRB records may be maintained in print or electronic form.

C. Public Comment

The proposed modifications to § __.115 received approximately 25 comments. A majority focused on three proposed revisions. The NPRM proposed to require that reviewers document why an IRB required continuing review when continuing review was not required as proposed in the NPRM. The majority of commenters opposed this requirement stating that it merely shifted administrative burden from one activity to another with no increase in protections.

The NPRM also proposed to require that a reviewer document why a research activity appearing on the expedited review list is more than minimal risk, and thus should be subject to full IRB review. This was opposed by the majority of commenters who indicated that this proposal was an unjustified administrative burden.

One commenter stated that the proposed documentation requirements would be punitive to IRBs. Several others suggested that this requirement served as a disincentive to institutions who wanted to implement additional protections than those required by the Common Rule. These commenters noted that this seemed in contrast to the longstanding policy articulation that the Common Rule served as a “floor” for protections and that institutions could require additional protections for research conducted at their institutions.

D. Response to Comments and Explanation of the Final Rule: IRB Records

A majority of the changes proposed in the NPRM in § __.115 have been retained in the final rule without alteration. However, the final rule differs from the NPRM in a few ways. First, the NPRM included two provisions requiring documentation of continuing review activities; these have been merged into one provision in the final rule at § __.115(a)(3). Second, the NPRM required that the IRB keep records of the IRB reliance agreements between an institution and the IRBs not operated by that institution that review said institution's nonexempt research activities. Instead, the final rule includes language at § __.115(a)(9) that requires each institution to maintain adequate documentation of the responsibilities that each entity will undertake to ensure compliance with this policy. This provision differs from the NPRM proposal to correspond to the more flexible provision included at § __.103(e), which does not require the creation of a written agreement between an institution and a reviewing IRB that said institution does not operate.

Because the final rule does not include an exemption determination requirement, the exemption documentation requirement proposed in the NPRM is not included in the final rule. Additionally, because the final rule does not include specified privacy safeguards, the NPRM proposal for an IRB to safeguard records as required by the proposed privacy safeguards is not included.

The final rule includes the NPRM proposal that IRBs document decisions to require continuing review or full board review even in circumstances when such review is not required because we believe it is important to document why an IRB is making a determination that differs from the regulatory baseline. This also helps to promote the principle of justice (as applied to IRB operations). Note that nothing in these regulations prevents an institution from authorizing an IRB to apply standards that exceed those in the regulations, if indeed the institution has chosen to do so.

In addition, while the NPRM proposed to require that IRB records that contain identifiable private information be safeguarded through compliance with the proposed privacy safeguards, the final rule does not require such safeguards. Although no public comments were received on this provision, in deciding not to include the NPRM's proposed privacy safeguard requirements in the final rule, we determined that it was unnecessary for the Common Rule to impose additional privacy requirements on IRB records as we are unaware of instances in which IRB records were breached. In addition, IRB records are not the regulatory equivalent of research records, which should be adequately secured or safeguarded against inappropriate uses or disclosures of identifiable private information. IRB records will generally be secured for a variety of reasons. These include not only protecting identifiable private information, but also, for example, protecting discrete information and intellectual property that might be included in a protocol. There are other means for ensuring institutions and IRBs protect their records beyond what is required by the Common Rule.

XIV. General Requirements for Informed Consent (§ __.116)

The final rule contains several major revisions to the requirements for informed consent, specifically with respect to: (1) New requirements relating to the content, organization, and presentation of information included in the consent form and process to facilitate a prospective subject's decision about whether to participate in research; (2) the basic and additional elements of consent; (3) the elements of broad consent for the storage, maintenance, or secondary research use of identifiable private information and identifiable biospecimens; (4) attendant changes in the waiver or alteration criteria for consent; (5) a new provision that allows IRBs to approve a research proposal for which investigators obtain information or biospecimens without individuals' informed consent for the purpose of screening, recruiting, or determining the eligibility of prospective human subjects of research, provided certain conditions are met; and, (6) a new requirement to post to a federal Web site a copy of an IRB-approved version of the consent form that was used for enrollment purposes for each clinical trial conducted or supported by a federal department or agency. Each of the final rule provisions are discussed separately below.

A. General Requirements for Informed Consent (§ __.116(a))

1. Background and Pre-2018 Requirements

Under the pre-2018 rule, many fundamental requirements applicable to all informed consents were set forth in an introductory (and unnumbered) paragraph at the beginning of § __.116.

In considering changes to the general requirements set forth in § __.116(a), we considered arguments put forth by some that consent forms have evolved to protect institutions rather than to provide potential research subjects with the most important pieces of information that a person would need in order to make an informed decision about whether to enroll in a research study. Instead of presenting the information in a way that is most helpful to prospective subjects—such as explaining why someone might want to choose not to enroll—these individuals argued the forms may function more as sales documents or as a means to protect against institutional liability. We also considered a growing body of literature that suggests informed consent forms have grown too lengthy and complex, adversely affecting their ability to effectively convey the information needed for prospective participants to make an informed decision about participating in research.

2. NPRM Proposals

The NPRM proposed adding new language to the introductory text of § __.116 to emphasize the need to first provide essential information that a reasonable person would want to know in order to make an informed decision about whether to participate in research, and to provide an opportunity to discuss that information. Furthermore, in recognition of complaints that consent forms are too often complicated documents primarily used to protect sponsors from legal liability, the NPRM proposed requiring that the information in these forms be organized and presented in a way that does not merely provide lists of isolated facts, but rather facilitated the prospective subject's or representative's understanding of the reasons why one might or might not want to participate in the research.

The NPRM also proposed that an investigator seeking to obtain informed consent be required to present first the information required by § __.116, which has been recognized by the Common Rule departments and agencies as the most fundamental and required content of informed consent, before providing other information, if any, to the subject. As proposed under the NPRM, the main portion of a consent document could include only the elements of informed consent that were required by the Common Rule, with any other information included in an appendix. This change was intended to lead to substantially shorter “core” sections of consent forms, with prospective subjects receiving the most important information in the body of these relatively short forms, instead of that key information being buried in long and overly complex documents. As proposed, additional information could be set forth in appendices to consent forms.

Given the consensus that informed consent forms should be written in appropriate language, this proposal reinforced the need to include information using language understandable to the subject. This goal was consistent with Federal Plain Language guidelines and the Federal Plain Writing Act of 2010. The NPRM proposed that the Secretary publish guidance at a later time to explain how consent forms could be written to comply with this regulatory requirement. Public comments were sought on what topics should be addressed in future guidance on improving the understandability of informed consents. As explained in the NPRM, it was not envisioned that the revised Common Rule would require a formal assessment to evaluate an individual's competency, but we acknowledged that such a practice might be appropriate for certain populations or studies.

In addition, the NPRM proposed to clarify in the introductory language at § __.116 that if a HIPAA authorization is combined with a consent form, the authorization elements required by 45 CFR 164.508 (part of the HIPAA Privacy regulations) must be included in the consent document and not the appendices. In other words, when informed consent for research under the Common Rule is combined with a HIPAA authorization, the NPRM proposed that the authorization elements would be considered to constitute one of the required elements of informed consent.

3. Public Comments

Approximately 200 comments discussed the proposal to include information required by the Common Rule in the consent form and place other information in appendices. A majority of those (approximately 140) supported the proposal and approximately 35 commenters opposed this proposal. Those who expressed support for this proposal generally noted agreement with the NPRM's rationale for the proposed revisions. Even those who supported the proposal stated that guidance would be needed for the proposal to be implemented and for the proposal to have the desired effect. Among those who opposed this proposal, all indicated support for the intention behind it. Reasons for opposing this proposal included:

• Concern that having a “dual document” system (with a primary consent form and appendices) would not actually improve subjects' understanding specifically and the informed consent process generally.
• Concerns that in some circumstances, the information that one might require to make an informed decision about research participation may not always be information required under the Common Rule when seeking and obtaining informed consent.
• Concern that the proposed language for the § __.116 introductory paragraph should not be promulgated as regulatory text (and would be more appropriate as guidance).
• Concern that because the proposed language does not include specific standards and specific criteria, the provision would ultimately be impossible to implement and enforce.
• Concern that the language as proposed would not reduce the complexity and length of consent forms because much of the information generally contained in an informed consent document is required by various regulatory agencies. To this end, several commenters noted that the NPRM proposed an additional four required elements of consent, which would add to the quantity of information that is required to be discussed in an informed consent document.

Some comments noted that although they liked the general idea of the proposal for the introductory paragraph of § __.116, they felt that the proposal should not focus on the length of a consent form, but rather on clarity and understandability. One comment expressed a need for guidance on how to implement the proposed language in the introductory paragraph of § __.116 and the requirement at § __.109(b) of the pre-2018 rule. The NPRM did not propose changing the latter item, which mandated that IRBs require that information given to subjects as part of informed consent conform with the requirement. However, the NPRM also permitted IRBs to require additional information if it would meaningfully add to the protection of the rights and welfare of subjects. This comment was made in light of the NPRM's proposal that information not required as an element of consent at § __.116 must be provided after providing the required elements of consent.

The NPRM asked about what topics should be addressed in future guidance on improving the understandability of informed consent. Approximately 35 commenters answered this question, a majority of which were universities and research institutions. Several commenters questioned whether the proposals in the introductory paragraph of § __.116 would be enforceable, and how Common Rule departments and agencies would assess and enforce compliance.

Several commenters indicated that mandating the order in which the content of consent forms should be presented may not always facilitate increased understanding by potential subjects because the best way to facilitate understanding is likely to be study specific. In other words, the order of importance of issues could be dependent on unique aspects of a given study. Others noted that most information in consent forms is there because the regulations require it to be included. Thus, the proposal to include the information required by the regulations up front, with all other information included as an appendix, is not a requirement that will inherently improve consent forms. Some commenters suggested that more research was needed on the informed consent process before prescribing specific approaches.

Many commenters asked that future guidance be developed to assist in drafting consent forms that addresses language level, literacy, risk communication, and best practices in use of alternative media in the informed consent process (e.g., interactive presentation on a tablet, comic strips for pediatric populations). In this regard, some comments objected to the singular focus on a “form” in the proposed language, stating that this sends the message that alternative and innovative approaches to improving the informed consent process would be discouraged. Others noted that future guidance should include topics of interest to tribal groups, such as acknowledgement of community-level implications of research and clarification about the handling of biospecimens in a study.

Several commenters noted that guidance should focus on how to foster understanding rather than focusing on mandatory length limitations on consent forms. However, a few comments endorsed a recommended page length maximum, citing it as perhaps the only way to force investigators and institutions to be brief and concise in the presentation of relevant information.

4. Response to Comments and Explanation of the Final Rule: General Requirements for Informed Consent

Before addressing how the general requirements for informed consent proposed in the NPRM have been adopted and altered in the final rule, it is important to note that the structure for this regulatory text has been altered. In the pre-2018 rule, the general requirements were included in an unnumbered introductory paragraph. The NPRM proposed the same approach. To emphasize the fact that this paragraph includes multiple independent and important regulatory requirements, and to enable stakeholders and Common Rule departments and agencies to more easily reference particular requirements, these general requirements have been redesignated into a new § __.116(a). In addition, the general requirement for consent in the final rule at § __.116(a)(6) removes the reference to oral or written consent that was in the pre-2018 rule. This is the provision that addresses the prohibition on including exculpatory language through which the subject or the legally authorized representative is made to waive or appear to waive any of the subject's legal rights, or releases or appears to release the investigator, the sponsor, the institution, or its agents from liability for negligence. The reference to oral or written consent was removed from this provision in the final rule. In its place, a similar reference was included in to § __.116(a) to clarify that all the requirements set forth in § __.116(a) apply to written and oral consent.

Another change made in the final rule, as compared with the pre-2018 rule and the language proposed in the NPRM, is that § __.116(a) contains introductory language summarizing each paragraph of § __.116 and the relationship between those paragraphs. Given that the framework for informed consent has been altered and reorganized through this regulation, this introductory language is intended to explain the overall approach set forth in revised § __.116, as well as the significance of each paragraph. This introductory language is also intended to explain the role of broad consent under revised § __.116. The introductory paragraph explains that the general requirements for informed consent are now set forth in § __.116(a) and that these general requirements apply with respect to informed consent obtained pursuant to § __.116(b), (c), and (d) (except, as described later, § __.116(a)(5) does not apply to broad consent obtained under § __.116(d)). This introductory language also explains that the basic elements of informed consent (which were described in § __.116(a) of the pre-2018 rule) are included in § __.116(b) of this final rule and that additional elements of informed consent that pertain only to certain studies (which were described in § __.116(b) of the pre-2018 rule) are included in § __.116(c) of this final rule.

In addition, this introductory language explains that the requirements for broad consent (a concept not specifically addressed in the pre-2018 rule) are described in § __.116(d) of this final rule. As discussed below, broad consent under this final rule differs from the broad consent approach proposed for § __.116(c) in the NPRM. The introductory language of § __.116(a) explains that broad consent may be obtained in lieu of informed consent obtained under § __.116(b) and § __.116(c) (which describe basic elements of informed consent as a general matter and additional elements of informed consent that apply only to certain studies, respectively) for certain purposes. Specifically, in lieu of obtaining study-specific informed consent in accordance with § __.116(b) and (c), broad consent may be obtained under § __.116(d) for the use of identifiable private information or identifiable biospecimens collected for either research studies other than the proposed research or nonresearch purposes for: (1) storage and maintenance for secondary research use; and (2) secondary research. For those purposes (and no others), broad consent under § __.116(d) may be obtained instead of specific consent under § __.116(b) and (c).

New introductory language at § __.116(a) also summarizes the provisions describing circumstances in which waiver or alteration of the requirements of informed consent are permitted. These circumstances pertain to research involving public benefit and service programs conducted by or subject to the approval of state or local officials at § __.116(e), and to research more generally at § __.116(f) (see below).

Another change reflected in the final rule is that specific requirements for informed consent have been included in subparagraphs for clarity and emphasis. For example, the requirement that information that is given to the subject or the legally authorized representative shall be in language understandable to such subject or representative is no longer included as part of a general introductory paragraph and is instead included as § __.116(a)(3). Except as noted here, these requirements remain the same as they were under the pre-2018 rule.

The final rule adopts, almost verbatim, all of the proposals made in the NPRM to improve and clarify the general requirements for informed consent. For example, the final rule adopts the proposed requirement specifying that the information provided in an informed consent form must be presented in sufficient detail relating to the research, and must be organized and presented in a way that does not merely provide lists of isolated facts, but rather facilitates the prospective subject's or legally authorized representative's understanding of the reasons why one might or might not want to participate. The final rule also adopts new language clarifying that this requirement applies to the informed consent as a whole. In addition, the final rule adopts the NPRM's proposal that prospective subjects or legally authorized representative must be provided with key information that is most likely to assist a prospective subject or legally authorized representative in making a decision about participating in research, and to provide an opportunity to discuss that information. Moreover, the final rule adopts an approach, consistent with many public comments, emphasizing efforts to foster understanding overall rather than imposing specific length limitations on the entire consent forms.

The final rule also includes language slightly different from that proposed in the NPRM for clarity or for conformance with other language in the final rule. For example, the final rule replaces references to a subject's representative with references to a subject's legally authorized representative (a term defined in § __.102) for clarity.

As discussed above, a significant proposal in the NPRM was that in obtaining informed consent, investigators would first have to present the information required by § __.116, before presenting any other information, if any. In addition, the NPRM proposed mandating that consent forms must include only the required information under § __.116 and that any other information be included in appendices. The final rule does not adopt a requirement that certain information be included only in appendices. This approach is responsive to public comments expressing concerns that such a mandate might sometimes undermine the informed consent process. The final rule adopts a slight variation of that approach in response to public comments about perceived lack of flexibility in the proposed language. Whereas the NPRM referred to the “body” of the consent form as opposed to appendices to the consent form, the final rule replaces those concepts with references to material that must be at the beginning of the consent form, versus material that can appear after that beginning section. The final rule does not limit the information that can be provided in the beginning of a consent form to only the § __.116 requirements, but instead offers a more flexible and meaningful approach in response to public concerns that the NPRM proposal was too prescriptive. Moreover, the approach recognizes public comments that expressed concerns about creating a “dual document” system. As such, the final rule does not address appendices to the informed consent. However, the NPRM's references to the appendices of the consent form have in general been conceptually replaced by references to the material in a consent form that follows the “beginning” section.

In particular, the final rule imposes a new requirement (set forth in § __.116(a)(5)(i)) that the informed consent begin with a concise and focused presentation of the key information that is most likely to assist a prospective subject or legally authorized representative in understanding the reasons why one might or might not want to participate in the research. This provision further requires that this beginning portion of the informed consent must be organized and presented in a way that facilitates comprehension. This requirement applies to all informed consents, except for broad consents obtained pursuant to § __.116(d), which may warrant a different presentation.

This new requirement included at § __.116(a)(5)(i) is somewhat similar to the proposal advanced in the NPRM insofar as both emphasize the importance of presenting the information that would be most important to a subject (or a legally authorized representative) before presenting other information. However, the requirement included in § __.116(a)(5)(i) is more specific, detailed, and flexible. First, this provision requires that key information be included in the beginning of the informed consent in a concise and focused presentation. We recognize that how this requirement applies will depend on the nature of the specific research study and the information presented in the informed consent and believe that this requirement strikes an appropriate balance between facilitating the comprehension of subjects of key issues and allowing study-specific flexibilities. In general, our expectation is that this initial presentation of the key pieces of information will be relatively short. This section of the consent could, in appropriate circumstances, include a summary of relevant pieces of information that are explained in greater detail later in the consent form.

The requirement that key information be presented in a concise and focused way will require an assessment that is specific to a study and its informed consent. For example, for most complicated clinical trials involving cancer patients with long (e.g., 20- to 25-page) consent documents, our expectation would be that the concise and focused presentation referred to in § __.116(a)(5)(i) would be no more than a few pages, and would provide the key pieces of information about the trial in such a manner that facilitates a person's comprehension of why they might or might not want to participate in the research.

In such cases, for example, we would not consider a 10-page description of elements such as potential risks, accompanied by lengthy and complex charts and graphs, to satisfy the “concise and focused” requirement of § __.116(a)(5)(i). With regard to risks in the type of cancer trial mentioned above, for example, instead of needing to mention every reasonably foreseeable risk, which would be required by § __.116(b)(2), this beginning section of the consent form should identify the most important risks, similar to the information that a doctor might deliver in the clinical context in telling a patient how sick the chemotherapy drugs will make them, but with a particular emphasis on how those risks are changed by participating in the study.

We recognize the advantages of allowing institutions to design informed consents, consistent with § __.116(a)(5)(i), that are tailored to particular research studies to assist prospective subjects in understanding the most fundamental aspects of the informed consent. For this reason, the final rule does not strictly specify the types of information that should or should not be included to satisfy § __.116(a)(5)(i), or the length of such concise and focused presentations. This flexibility is responsive to public comments recommending against a rigid approach to enable institutions and individuals to tailor informed consents to the circumstances of particular studies. A discussion of the key information to be included in the beginning section of the consent form, and how it will operate in practice, may be further clarified in future guidance.

We also recognize that for some relatively simple research studies with limited risks or benefits, the entire informed consent document may be relatively brief and still satisfy § __.116. In such circumstances, an institution may determine that virtually all of the information required by § __.116 would also satisfy § __.116(a)(5)(i). In such cases, the informed consent document could include the concise and focused presentation of § __.116(a)(5)(i) at the beginning of the informed consent document, followed by limited additional information required to satisfy § __.116.

In all circumstances (those involving lengthy and complex informed consents as well as short and relatively simple informed consents), if information included at the beginning of the informed consent satisfies both § __.116(a)(5)(i) and the elements of informed consent under § __.116(b) and § __.116(c) more generally, the information included at the beginning need not be repeated later in the body of the informed consent. Thus, with respect to the example provided above concerning a clinical trial with cancer patients, the most important reasonably foreseeable risks to subjects would be summarized at the beginning of the informed consent as part of § __.116(a)(5)(i)'s concise and focused presentation, but that a more comprehensive and detailed description of reasonably foreseeable risks to subjects would be included later in the body of the informed consent. In contrast, with respect to a relatively simple research study with limited risks, we would expect that all of the information provided to potential subjects concerning such risks might satisfy both § __.116(a)(5)(i) (as part of a concise and focused presentation of key information) and § __.116(b)(2) (a description of any reasonably foreseeable risks or discomforts to the subject). In such circumstances, the information provided at the beginning of the informed consent would not need to be repeated or further detailed in the informed consent and the entire informed consent could be relatively short.

In general, we would expect that to satisfy § __.116(a)(5)(i), the beginning of an informed consent would include a concise explanation of the following: (1) the fact that consent is being sought for research and that participation is voluntary; (2) the purposes of the research, the expected duration of the prospective subject's participation, and the procedures to be followed in the research; (3) the reasonably foreseeable risks or discomforts to the prospective subject; (4) the benefits to the prospective subject or to others that may reasonably be expected from the research; and (5) appropriate alternative procedures or courses of treatment, if any, that might be advantageous to the prospective subject. As a general matter, a brief description of these five factors would encompass the key information most likely to assist a reasonable person (or legally authorized representative) in understanding the reasons why one might or might not want to participate in research, as required by § __.116(a)(5)(i) and § __.116(a)(4). However, we recognize that this determination is necessarily fact-specific and that IRBs and institutions may require that somewhat different (or additional) information be presented at the beginning of an informed consent to satisfy § __.116(a)(5)(i).

The NPRM also proposed adding a new requirement to the general introductory paragraph of § __.116, which would provide that if an authorization required by 45 CFR parts 160 and 164 (parts of the HIPAA Privacy Rule) is combined with a consent form, the authorization elements required by 45 CFR 164.508 must be included in the consent form (and not the appendices). Because this final rule does not incorporate the distinction proposed in the NPRM between the informed consent and appendices, the final rule does not incorporate this language.

We are satisfied that the approach adopted in this final rule will enable regulated entities and individuals to pursue different and innovative approaches to obtaining informed consent, as recommended in some public comments, while ensuring that the important aspects of informed consent are clearly communicated to prospective subjects and subjects.

B. Basic Elements of Informed Consent (§ __.116(b))

1. Background and Pre-2018 Requirements

Under the pre-2018 rule, investigators were generally required to obtain the subjects' informed consent to participate in research. The regulations required that the consent form include at least eight specific items of information, including: (1) an explanation of the purposes of the research, its duration, and procedures involved, and identification of any procedures which are experimental; (2) a description of the reasonably foreseeable risks; (3) a description of any potential benefits; (4) a disclosure of appropriate alternative procedures or courses of treatment, as relevant; (5) information about confidentiality of records, compensation, and treatments if injury occurs; (6) for research involving more than minimal risk, an explanation as to whether any compensation or medical treatments are available if injury occurs; (7) contact information; and (8) a statement that participation is voluntary, and that refusal to participate or decision to withdraw will involve no penalty or loss of benefits to which the subject is otherwise entitled.

2. NPRM Proposals

In the NPRM it was proposed that research with nonidentified data continue to be considered not to involve “human subjects.” However, to better ensure that subjects are informed of the possibility that identifiers collected as part of a research study could be removed from the data and then be used for secondary research studies without the protections provided by this policy, it was proposed that a new element of informed consent be required. The new basic element of consent proposed in the NPRM at § __.116(a)(9) would apply to all research collecting identifiable private information. Based on the investigator's plans, the informed consent form and process would need to inform subjects either that: (1) identifiers might be removed from the data and that the nonidentified data could be used for future research studies or distributed to another investigator for future research studies without additional informed consent from the subject or the representative, if this might be a possibility; or (2) the subject's data collected as part of the research, from which identifiers are removed, would not be used or distributed for future research studies.

3. Public Comments

Approximately 40 public comments were received on the proposed new required element of informed consent found in the NPRM at proposed § __.116(a)(9). A large majority favored this proposal. Those who supported this proposal indicated that it provided useful information to prospective subjects about how private information obtained from a study might be used in the future. They also commented that it enhanced transparency in research, providing potential subjects with the information they need to decide whether to participate. Those who opposed this proposal suggested that it would increase the length of consent forms without appreciably improving potential subjects' understanding of a specific research activity.

4. Response to Comments and Explanation of the Final Rule: Basic Elements of Informed Consent

The final rule, at § __.116(b)(9), adopts the NPRM proposal to inform potential subjects about the possible use of their identifiable private information with two clarifying changes. First, because the final rule at § __.102(e)(1) now states that the definition of human subject, in part, includes research in which an investigator obtains, uses, studies, analyzes, or generates identifiable biospecimens or identifiable private information, this new element of informed consent has been clarified to specifically apply to any research that involves the collection of identifiable biospecimens, rather than all biospecimens, in addition to research that involves the collection of identifiable private information. In addition, a change to what was proposed in the NPRM has been made to the new element of consent in the final rule at § __.116(b)(9)(ii), to clarify that it is intended to inform subjects that their information or biospecimens collected as part of the research will not be used or distributed for future research, even if identifiers are removed.

We agree with the public comments that indicated this new element of consent will provide useful information to prospective subjects about whether their identifiable private information or identifiable biospecimens might be stripped of identifiers and used for future research studies or distributed to another investigator for future research studies without additional informed consent from the subject or the legally authorized representative.

We expect that this information can usually be provided in a brief statement, and disagree with the commenters that suggested that this new basic element of consent would increase the length of consent forms without appreciably improving potential subjects' understanding of a specific research activity. This new requirement is intended to give the potential subject a right to know that identifiers might be removed from information or biospecimens and be used for future research without additional consent, when such a possibility exists, so he or she can make a fully informed decision about whether to participate in the research. If subjects' identifiable private information or identifiable biospecimens will not be used for future research studies, even if identifiers are removed, this new element of consent requires that subjects be informed of this as well. Finally, if a specific technology or technique determined to be capable of generating identifiable private information or identifiable biospecimens through the consultative process described at § __.102(e)(7) will be used, that information should be included in the description of the research at § __.116(b)(1).

C. Additional Elements of Informed Consent (§ __.116(c))

1. Background and Pre-2018 Requirements

The pre-2018 rule contained six additional elements of consent required when appropriate: (1) A statement that the particular treatment or procedure may involve risks to the subject (or to the embryo or fetus, if the subject is or may become pregnant) which are currently unforeseeable; (2) anticipated circumstances under which the subject's participation may be terminated by the investigator without regard to the subject's consent; (3) any additional costs to the subject that may result from participation in the research; (4) the consequences of a subject's decision to withdraw from the research and procedures for orderly termination of participation by the subject; (5) a statement that significant new findings developed during the course of the research which may relate to the subject's willingness to continue participation will be provided to the subject; and (6) the approximate number of subjects involved in the study.

2. NPRM Proposals

The NPRM proposed adding three additional elements of consent that, when appropriate, would be required to be included in the informed consent form and process. These proposed additional elements of consent pertain to issues that have become more relevant in recent years as science has advanced and the nature of research has changed. One proposed new element would require that prospective subjects be informed that their biospecimens may be used for commercial profit and whether the subject will or will not share in this commercial profit. A second proposed element would require that prospective subjects be informed of whether clinically relevant research results, including individual research results, will be disclosed to subjects, and if so, under what conditions. A third proposed new element would provide subjects or their legally authorized representatives with an option to consent, or refuse to consent, to investigators re-contacting the research subject to obtain additional information or biospecimens, or for future research.

3. Public Comments

Each of the proposed additional elements of informed consent found in the NPRM at § __.116(b)(7)-(9) received approximately 50 comments. All three proposals were generally favored by the public. With respect to the proposed element of consent at § __.116(b)(7), requiring that prospective subjects be informed that their biospecimens may be used for commercial profit and whether the subject will or will not share in this commercial profit, comments, especially from individual members of the public not identified with any institution or organization, indicated that the extent to which an investigator might profit from information or biospecimens collected or used during a study was an important decision point as to whether a prospective subject would want to participate in a study. In response to proposed element § __.116(b)(8)—requiring that prospective subjects be informed of whether clinically relevant research results, including individual research results, will be disclosed to subjects, and if so, under what conditions—several public comments stated that knowing whether or not research results would be returned to them was an important piece of information for them to know and understand in deciding whether to participate in a study.

Finally, comments discussing § __.116(b)(9) regarding the potential to be contacted for future studies noted that allowing an individual to indicate whether or not he or she might be contacted for future research studies respected subject autonomy. Those who opposed the provision noted that while the intent of the provision was laudable, the ensuing tracking system that would need to be developed by institutions to track who had said “yes” or “no” to being re-contacted, and in what circumstances, would be difficult to develop and maintain, and would also represent significant costs to institutions without a corresponding tangible increase in the protections afforded to human subjects.

4. Response to Comments and Explanation of the Final Rule: Additional Elements of Consent

The final rule contains two of the three proposed additional elements of consent. The final rule does not include the additional element proposed in the NPRM relating to providing subjects or their legally authorized representatives the option to consent or refuse to consent to being re-contacted to obtain additional information or biospecimens, or for future research.

New additional elements included in the final rule are: (1) A statement that the subject's biospecimens (even if identifiers are removed) may be used for commercial profit and whether the subject will or will not share in this commercial profit (§ __.116(c)(7)); and (2) a statement regarding whether clinically relevant research results, including individual research results, will be disclosed to subjects, and if so, under what conditions (§ __.116(c)(8)). Because many public comments addressed a desire to share in the profits of successful products developed using their biospecimens, we believe that investigators, when appropriate, should inform prospective subjects about whether they might or might not benefit commercially from future products resulting from the research, should that possibility be important in their decision making process. Also, several comments received from individuals who reported participation in research studies described disappointment that research results were not returned to them. We believe that potential subjects should be aware of the possibility that they might not receive research results, as well as the possibility that they might, so that they can factor that information into their decision about whether to consent to research. This provision is intended to pertain to all clinically relevant research results, including general or aggregate research findings and individual research results.

We are also including in the final rule an additional element that when appropriate for research involving biospecimens, subjects be informed of whether the research will (if known) or might include whole genome sequencing (WGS) (§ __.116(c)(9)). This provision of the final rule describes WGS as the sequencing of a human germline or somatic specimen with the intent to generate the genome or exome sequence of that specimen. WGS generates an extremely large amount of information about people, including factors that will contribute to their future medical conditions. As was recognized in the NPRM's Alternative Proposal A to expand the definition of “human subject” to include WGS (discussed in Section III), data obtained through WGS can provide important insights into the health of individuals as well as their biological family. It is also possible that WGS data gathered for one purpose may reveal important information, perhaps unanticipated and unplanned for, years later. Given the unique implications of the information that can be developed through WGS, if it is either known that a specific research study will include this technique, or might include it, we believe that this aspect of the research must be disclosed to prospective subjects as part of the informed consent process. It is recognized that under the pre-2018 rule, if a research study were to involve WGS, this research procedure would have almost always been included in the description of the research. However, to remove any ambiguity about whether such information would need to be included in the informed consent, the final rule makes this requirement explicit through this new element of consent.

The information that would have to be disclosed under these additional elements of consent is often relevant to an individual's decision of whether to participate in a research study. Such information may have been included in informed consent forms under the pre-2018 rule. However, the final rule now requires inclusion of these additional elements, when appropriate.

The additional element of consent proposed in the NPRM that was not included in the final rule would have required providing subjects or their legally authorized representatives with an option to consent, or refuse to consent, to investigators re-contacting the subject to seek additional information or biospecimens or to discuss participation in another research study. Although for some research studies, it will be desirable to inform prospective subjects about investigators' plan to re-contact subjects for certain purposes, and give them the option to agree or disagree to such re-contact, we agree with the public comments that questioned the importance of requiring that such information be included in the consent form. Although the final rule does not include this additional element of consent, this information can be included in the consent form.

D. Elements of Broad Consent for the Storage, Maintenance, and Secondary Research Use of Identifiable Private Information or Identifiable Biospecimens (§ __.116(d))

1. Background and Pre-2018 Requirements

Under the pre-2018 rule, if identifiers are removed from information and biospecimens such that the identity of the subject could not be readily ascertained by an investigator or associated with the information or biospecimens, then such information and biospecimens that have been collected for purposes other than the proposed research could be used without any requirement for informed consent. Similarly, under the HIPAA Privacy Rule, if data are de-identified or HIPAA identifiers do not accompany biospecimens, then the Privacy Rule does not apply. When identifiers have not been removed, under the pre-2018 rule investigators were allowed in certain situations to obtain a consent that is broader than for a specific research study, such as for creating a research repository that involves obtaining biospecimens from living individuals for use in future research studies. In these cases, an IRB could determine that the original consent for the creation of the research repository satisfied the requirements of the Common Rule for the conduct of the future research, provided that the elements of consent continue to be satisfied for the future research. Despite this flexibility in the Common Rule, stakeholders and the Common Rule departments and agencies believe that the elements of consent required under § __.116 of the pre-2018 rule often were not satisfied in the case of broad consent for future unspecified research use of identifiable private information or identifiable biospecimens.

With respect to HIPAA, HHS's pre-2013 interpretation of the HIPAA Privacy Rule was that authorizations for research needed to be study-specific, and thus, that such authorizations could not authorize certain future unspecified research. However, in January 2013, the Office for Civil Rights modified its prior interpretation. Under the new interpretation, an authorization now may be obtained from an individual for uses and disclosures of protected health information for future research purposes, so long as the authorization adequately describes the future research such that it would be reasonable for the individual to expect that his or her protected health information could be used or disclosed for the future research purposes.

Because biospecimens and information that have been collected for clinical use or purposes other than for the proposed research are often an important source of information and material for investigators, and the re-use of existing information and materials can be an efficient mechanism for conducting research without presenting additional physical or psychological risks to the individual, it seemed prudent to consider changes to current regulations relating to those issues.

2. NPRM Proposals

The NPRM proposed to allow broad consent to cover the storage or maintenance for secondary research use of all biospecimens (regardless of identifiability) and identifiable private information. Broad consent would be permissible for the storage or maintenance for secondary research of such information and biospecimens that were originally collected for either research studies other than the proposed research or nonresearch purposes. The broad consent document would also meet the consent requirement for the use of such stored biospecimens and information for individual research studies. The NPRM made a separate case for nonidentified private information than it did for biospecimens, stating that consent would not be required for the secondary research use of nonidentified private information, such as the research use of medical records that have had all identifiers removed. Because the NPRM proposed that the definition of human subject be expanded to include all biospecimens, it also proposed to facilitate research using biospecimens by permitting broad consent to be obtained for their storage or maintenance for secondary research.

It was envisioned that the proposed broad consent provision would be used by institutions and investigators to give individuals the choice to either allow or disallow the use of their biospecimens and identifiable private information for secondary research. In some cases, institutions would be expected to seek broad consent as part of a research protocol to create a research repository of biospecimens or information. However, in other cases it was expected that institutions, particularly those that do not typically conduct human subjects research, might not develop a research protocol to create a research repository, but still choose to seek broad consent from individuals for the research use of their biospecimens or identifiable private information. In such cases, these institutions might simply “tag” biospecimens and information as either available or not available for secondary research.

Because broad consent is a different form of consent than the consent that is obtained for a specific research study, the NPRM proposed required elements for broad consent that would include several of the basic and additional elements of informed consent, but not all, and would include several additional required elements. The NPRM proposed to require that the information included in broad consent describe the biospecimens and identifiable private information that would be covered by the consent, recognizing that the biospecimens and information to be used in future research studies might be collected after the consent was obtained. Further, the NPRM proposed that broad consent for the research use of biospecimens or identifiable private information obtained for nonresearch purposes would be limited to covering either or both of the following: (1) Biospecimens or identifiable private information that exist at the time at which broad consent is sought; and (2) biospecimens or identifiable private information that will be collected up to 10 years after broad consent is obtained for adult subjects, and, for research involving children as subjects, biospecimens or identifiable private information that will be collected up to 10 years after broad consent is obtained or until the child reaches the legal age of consent to the treatments or procedures involved in the research, whichever comes first.

The NPRM proposed to include the standard concerning who is a child based upon the definition of “children” as defined at 45 CFR 46.402(a). At the time the child becomes an adult, the broad consent or permission would no longer be valid and either broad consent would need to be sought from the child-turned-adult, or the investigator would need to seek a waiver of informed consent in order to use the individual's biospecimens or identifiable private information for research, unless one of the exclusions or exemptions were applicable.

A proposed element of broad consent in the NPRM included a requirement that subjects be informed that they may withdraw consent, if feasible, for research use or distribution of the subject's information or biospecimens at any time without penalty or loss of benefits to which the subject is otherwise entitled. However, information that has been stripped of identifiers might not be traceable. Thus, it might not be feasible to withdraw consent for future use or distribution in this case. If, however, an investigator committed to permitting a subject to discontinue the use of such information, it was expected that the investigator would honor this commitment by not stripping identifiers and using the information or biospecimens in research. The proposed regulations would not require investigators to make such a commitment.

Another proposed element of broad consent in the NPRM related to the public posting of nonidentified data about a subject. This proposed element of broad consent would include an option, when relevant, for an adult subject or the subject's legally authorized representative to consent or refuse to consent to the inclusion of the subject's data with removal of the identifiers listed in the HIPAA Privacy Rule at 45 CFR 164.514(b)(2)(i)(A) through (Q), in a database that is publicly available and openly accessible to anyone. This provision was proposed in the context of increasing interest in inviting study participants to allow their study data, in some cases including genomic data, to be made publicly available in order to maximize the potential for research that spurs increased understanding of disease processes. Under this provision, the consent document would be required to prominently note the option for the participant to allow the investigator to publically post (e.g., on a Web site) the participant's genomic or other potentially identifiable sensitive information, and to include a description of the risks associated with public access to the data.

To facilitate the use of broad consent, the NPRM proposed that the Secretary of HHS would publish in the Federal Register templates for broad consent that would contain all of the required elements of consent in these situations. It was envisioned that at least two broad consent templates would be developed: one for information and biospecimens originally collected in the research context, and another for information and biospecimens originally collected in the nonresearch context.

Public comment was sought on whether broad consent to secondary research use of information and biospecimens collected for nonresearch purposes should be permissible without a boundary, or whether a time limitation or some other type of limitation should be imposed on information and biospecimens collected in the future that could be included in the broad consent as proposed in the NPRM. If a time limit should be required, public comment was sought on whether the NPRM proposal of up to 10 years was a reasonable limitation and whether a limitation related to an identified clinical encounter would better inform individuals of the clinical information and biospecimens that would be covered by a broad consent. Public comment was also sought on whether all of the elements of broad consent proposed in the NPRM should be required for the secondary use of biospecimens or identifiable private information originally collected as part of a research study that was conducted without consent because (1) either the original research study met an exclusion or exempt category of research, or (2) a waiver of consent was approved by an IRB.

Public comment was sought on how likely investigators are to seek broad consent for the use of identifiable private information (as contrasted with biospecimens), given that provisions within the NPRM would make it easier to do such research without consent. In this regard, the NPRM proposal to prohibit waiver of consent by an IRB if a person has been asked for broad consent and refused to provide it could create a disincentive on the part of investigators from choosing to seek broad consent for research involving secondary use of identifiable private information. Given the costs and time and effort involved in implementing the system for obtaining broad consent for the use of identifiable private information and tracking when people provide consent or refuse to do so, the public was asked to comment on whether the benefits to the system were likely to outweigh the costs, and if so, whether the broad consent provisions should be limited to obtaining broad consent for research use of biospecimens.

3. Public Comments

Approximately 475 comments addressed broad consent, a majority of which expressed opposition to broad consent as proposed and discussed in the NPRM. The basis of this opposition was largely related to the NPRM proposal that some type of consent (broad or specific) would be required for research with nonidentified biospecimens. A smaller number of comments (approximately 150) addressed the adequacy or inadequacy of broad consent as a concept, or the proposed broad consent templates to be created by HHS.

Public comment on the proposed, but not yet developed, broad consent templates was mixed, with a majority of comments stating that it was impossible to comment on a template that had not yet been created. Even among those who supported the use of broad consent, some had questions about whether broad consent provided at one institution would be sufficient for research ultimately conducted at another institution. Many comments further noted that the entire regulatory schema around broad consent (e.g., exemptions dependent on broad consent, prohibition on an IRB waiving broad consent if broad consent had been sought and someone declined) required additional study and discussion and recommended that the department issue another NPRM on these issues following some form of systematic analysis and broader public consultation. A professional investigative pathology association and many of its members endorsed the concept of broad consent and the development of templates by the Federal Government, writing that they would be less burdensome but still a functional way of promoting ethically conducted biomedical research with biospecimens.

Several commenters suggested that institutions needed to retain the ability to create and amend broad consent forms tailored to a variety of situations rather than rely on a federal template. These comments also generally stressed the importance of retaining an IRB's active role in reviewing the broad consent process and specific secondary research studies to ensure that interests other than autonomy and concerns other than those related to privacy were considered in a proposed study. A minority of commenters additionally expressed concern with the Federal Government's ability to develop broad consent templates that the regulated community might feel were sufficiently informative.

Public comments were also mixed on whether or not broad consent as proposed in the NPRM would constitute meaningful consent. Many comments noted that a consent form sufficiently broad to cover all potential future secondary research uses of biospecimens or identifiable private information might be so broad and vague as to be not meaningful or informative to prospective research subjects. Others doubted the meaningfulness of broad consent obtained in the clinical setting. One academic research institution questioned whether it was really consent at all, but rather an agreement or permission, and another commenter questioned whether broad consent would increase subjects' autonomy.

Many of the commenters who opposed broad consent also argued against any requirement to obtain consent for the use of nonidentified biospecimens. One academic research institution raised serious concerns about obtaining meaningful broad consent, which undermines existing privacy and other protections for subjects in research. Others noted that requiring broad consent for all secondary use of all biospecimens would require that there always be a link or code between the biospecimen and the subject's identity, which ultimately would result in an overall increase in privacy risks. Many commenters favored an opt-out system for broad consent (especially with respect to broad consent for use of nonidentified biospecimens). An AI/AN organization expressed overall concern about the concept of broad consent, noting that many AI/AN people believe that specimens and blood are considered sacred and recommending that all secondary uses of collected specimens and data should require an additional consent process, including tribal consent when specimens and data are obtained from AI/AN populations.

Few comments were received on the actual proposed elements of broad consent. Of these, a majority expressed confusion with the proposals related to the duration of the consent and the scope of the biospecimens and identifiable information that could be collected.

The NPRM also asked whether broad consent to secondary research use of information and biospecimens collected for nonresearch purposes should be permissible without a boundary, or whether a time limitation or some other type of limitation should be imposed on information and biospecimens collected in the future that could be included in the broad consent. If a time limit should be required, the NPRM asked whether up to 10 years was a reasonable limitation. It also asked whether a limitation related to an identified clinical encounter would better inform individuals of the clinical information and biospecimens that would be covered by a broad consent document. Approximately 65 commenters specifically answered this question.

Most who commented were opposed to the 10-year limitation on the period of time that an institution could collect biospecimens and information from an individual once broad consent had been sought and obtained. They stated that the limitation was arbitrary, not supportable by anything discussed in the NPRM, and presented an administrative burden for institutions and investigators to time stamp and track the 10-year limit for each subject. A few commenters stated that a 10-year limit is a reasonable boundary, but were concerned about the need to re-consent people once they reach the legal age of consent. In large data sets, identifying such people could be very challenging as people often move locations during such lengths of time, which would create an administrative barrier. A few commenters suggested that 10-year boundary was too long and one research institution commented that in its experience individuals seem to prefer shorter time limits tied to specific periods (e.g., a series of clinical encounters, participation in an ongoing study).

A few comments stated that any time limit could have a negative effect on rare disease research as the numbers of affected people are so small and, as discoveries are made, there is often a need to go back to years' worth of information or stored biospecimens to search for markers, mutations, or clinical information that is related to the new discovery. Such commenters expressed concern that this could be deleterious to individuals with rare disease seeking a diagnosis.

Some commenters were confused about how the 10-year boundary proposed in the NPRM was supposed to function. Some comments assumed that one could only use the biospecimens or data for a 10-year period and after that period one would be required to get consent again for the use of those items. Others assumed that investigators would have to re-consent people every 10 years, but the information and biospecimens could be used indefinitely. For these reasons, many comments on the 10-year boundary said it was unreasonable and unworkable operationally. Some suggested that instead of 10-year boundary, patients could be routinely reminded that they gave consent and can be reminded that they can opt out at any time. Several large research institutions commented that the time limit would necessitate a lot of tracking for institutions and could lead to smaller health care institutions ceasing their collection of biospecimens for research, which would ultimately have a negative impact on research.

The NPRM also asked whether all of the elements of consent proposed at § __.116(c) should be required for the secondary use of biospecimens or identifiable private information originally collected as part of a research study that was conducted without consent because either the original research study met an exclusion or exempt category of research, or a waiver of consent was approved by an IRB. Approximately 30 comments answered this question. Responses ranged from those saying the elements are not as relevant as the burden of having to seek consent every 10 years. Many stated that the elements of consent appeared to be growing in the proposed rule at the same time that the rule was requiring simpler and shorter consent forms. As such, efforts should not be made to include all of the elements required in specific consent to broad consent; otherwise the intent of broad consent would be lost.

The NPRM also asked whether oral consent should be permissible in limited circumstances as proposed under the exemption for the storage and maintenance of biospecimens and identifiable private information. More than 60 pathologists, pathology departments, and pathology organizations suggested that oral consent should not be allowed in this context because it raises too many administrative challenges and may undermine public trust. A few commenters felt oral consent should be permitted but generally did not provide a rationale.

Finally, some comments indicated that broad consent as a concept should not be included in a final rule, and that the standards that exist under the pre-2018 rule for secondary research (i.e., either that an investigator obtains study specific consent or a waiver of informed consent from an IRB) should be maintained in a final rule.

4. Response to Comments and Explanation of the Final Rule: Elements of Broad Consent

The final rule includes an option to obtain broad consent for the storage, maintenance, and secondary research use of identifiable private information or identifiable biospecimens, as defined at § __.102(e)(5) and (6), but several significant changes were made in response to public comments. Although in some ways the final rule's broad consent provision resembles the provision that was proposed in the NPRM, it is important to recognize a very fundamental difference between the role that this provision will play under the final rule, as compared to the role it was intended to play under the NPRM. This key difference relates to the fact that the provisions in the NPRM that would have generally required consent for secondary research use of nonidentified biospecimens, including imposing narrow stringent criteria for IRB waiver of consent with respect to such research, are not being implemented because the NPRM's proposal that all biospecimens, regardless of their identifiability, be covered under the Common Rule has not been adopted. Importantly, under the final rule, broad consent is permissible only for secondary research and no other types of research.

Thus, had all of those NPRM provisions been implemented, investigators who wanted to conduct secondary research with biospecimens would in most instances have found themselves essentially forced to use the new broad consent provisions as their only practical option for conducting such research. This is because generally, under the NPRM proposals, they would no longer have had the option to de-identify information or biospecimens, or to use them in coded form, to avoid application of the Common Rule's requirements. Under the NPRM's proposals, had investigators not obtained broad consent, they would often not practicably be able to meet the informed consent requirements relating to such research (which would have been covered under the Common Rule). Therefore, it would generally have been the case that they would have had little choice but to obtain broad consent, assuming they did not want to undertake the alternative of obtaining study-specific consent from subjects each and every time they conducted a study involving secondary use of biospecimens.

Given that we did not adopt the NPRM's proposal to cover all biospecimens regardless of their identifiability under the Common Rule, the final rule also does not adopt proposed consent requirements for secondary research with nonidentified biospecimens. For this reason, the final rule's provisions relating to broad consent now play a very different role from those proposed in the NPRM. In most instances, these provisions will be providing new options—that is, new flexibility—to an investigator, in addition to those options that an investigator would have had under the pre-2018 rule. An investigator wishing to do secondary research with biospecimens will continue to have the option of doing secondary research with nonidentifiable biospecimens, as was the case in the pre-2018 rule. An investigator also could continue to use biospecimens that are coded, thus allowing the collection of additional information about the subjects over time. In both of those instances, no additional consent would be required because the research would not involve human subjects as defined by the final rule. Furthermore, even if the investigator wanted to use the biospecimens with identifiers attached, he or she would still have the option of asking an IRB to waive the requirement to obtain informed consent: the waiver criteria are in most respects unchanged under the final rule.

For these reasons, the broad consent provisions at § __.116(d) afford investigators wishing to conduct secondary research on identifiable private information or identifiable biospecimens an additional alternative to obtaining an IRB waiver of consent or to obtaining study-specific consent. Given that these new broad consent provisions are essentially a new alternative to other options that are very similar to those that existed under the pre-2018 rule, these provisions are not increasing any regulatory burden or making it more difficult to do research. Indeed, just the opposite is the case. The changes made in the final rule are responsive to the significant criticisms expressed by many of the commenters about what the NPRM proposed, under which obtaining broad consent would have imposed substantial new burdens on a vast amount of secondary research with biospecimens. In contrast, when investigators choose to use the broad consent provisions under the final rule, they will presumably be doing so because this new option is less burdensome to them than their other (largely unchanged) options for conducting such research.

Although we recognize public commenters' concern that broad consent might not be as meaningful or informative as study-specific consent, it is also important to note that when an investigator chooses to use this new option, doing so will generally provide increased protection to the autonomy of research subjects. It will give them a choice to say no to such research, in contrast to most of the other routes by which an investigator might generally choose to conduct this type of research, such as with a waiver of informed consent, which allows research to take place regardless of the wishes of the person whose information or biospecimens are being studied, and without their knowledge. In addition, in response to the public's concerns that broad consent would not be meaningful, some of the elements of broad consent have changed from what was proposed in the NPRM to require more specific information about the research that may be conducted. As discussed in the NPRM, one of the main purposes of the final rule is to facilitate the conduct of minimal risk research, while enhancing subjects' autonomy. We believe that the option to obtain broad consent furthers this goal.

It is important to recognize that broad consent is a permissible option only for secondary research. Secondary research is limited to research using identifiable private information or identifiable biospecimens that are collected for either research studies other than the proposed research or nonresearch purposes. It is not permissible to obtain broad consent for any other type of research (e.g., research involving the collection of information or biospecimens through a research interaction or intervention with a subject). The informed consent requirements in § __.116(b) and (c) will be applicable to all human subjects research for which broad consent is not an option. However, it is envisioned that research requiring study-specific consent, such as research involving the collection of information or biospecimens through a research interaction or intervention with a subject, will sometimes also involve seeking subjects' broad consent for the secondary research use of identifiable private information or identifiable biospecimens obtained as part of the original research study.

When broad consent is obtained, the general requirements for informed consent in § __.116(a) apply, except that the requirements at § __.116(a)(5) (imposing certain requirements concerning the presentation of information for informed consent and prescribing the order in which consent information is presented) do not apply to broad consent.

We expect that, given the different requirements set forth for study-specific consent and broad consent, some institutions and investigators may elect to pursue study-specific consents for the storage, maintenance, and secondary research uses of identifiable private information and identifiable biospecimens (or for some subset of such research) whereas other institutions and investigators may elect to pursue broad consent for the same types of research (or for some subset of such research). For instance, with regard to the public comments raising concern about broad consent being sought from AI/AN peoples, it is expected that institutions, investigators, and IRBs will consider these concerns when determining when it might be appropriate to seek study-specific consent for the secondary research use of identifiable biospecimens, as well as the need for tribal consent, when appropriate.

Perhaps even more commonly, however, given that the NPRM proposal regarding generally requiring consent for research use of nonidentifiable biospecimens has not been adopted, many investigators may choose to use the routes that previously existed under the pre-2018 rule, and will continue to exist, for conducting such research without informed consent under the Common Rule. Those options include using nonidentifiable biospecimens, including perhaps having a code maintained that will allow the investigator to obtain additional information about the subjects, or obtaining a waiver from an IRB of the need to obtain informed consent.

The broad consent provision in the final rule is different in three main ways from what was proposed in the NPRM. First, consistent with the decision not to revise the definition of human subject to include biospecimens regardless of identifiability, the broad consent provision in § __.116(d) only applies to secondary research using identifiable private information and identifiable biospecimens.

Second, the elements of broad consent have been strengthened and simplified in response to public comments. The final rule strengthens the element of broad consent proposed in the NPRM regarding the need to provide a general description of the types of research that may be conducted with identifiable private information and identifiable biospecimens. It does this by requiring that this description must include sufficient information to allow a reasonable person to expect that the broad consent would permit the types of research conducted. This “reasonable person” standard is consistent with the interpretation that the Office for Civil Rights provided for authorization obtained from an individual for the use or disclosure of protected health information for future research purposes. In addition, the final rule has been strengthened to require that when subjects will not be informed about the details for any specific research studies that might be conducted using their identifiable private information or identifiable biospecimens, the broad consent must disclose this fact and inform subjects that they might have chosen not to consent to some of those specific research studies. It is envisioned that for certain types of research, such as research for which there is reason to believe some subjects will find the research controversial or objectionable, a more robust description of the research will be required in order to meet this “reasonable person” standard. This requirement has been included in the final rule in recognition of the concerns raised by some public commenters that broad consent would not be meaningful because it will not provide detailed information about specific research studies that might be conducted with the individual's identifiable private information or identifiable biospecimens.

As proposed in the NPRM, the final rule permits broad consent to be sought for either a narrow type of research to be conducted in the future (e.g., cancer research), or a broader scope of research. Given this flexibility, while the final rule includes an exemption for secondary research for which broad consent is required, the exemption is contingent on several criteria being satisfied, including that an IRB determines that the research to be conducted is within the scope of the broad consent (§ __.104(d)(8)). This exemption is further discussed in Section V. For research that is not exempt, the IRB is expected to assess whether the description of the research included in the broad consent form is adequate to permit a reasonable person to expect that they were providing consent for the currently proposed secondary research study.

While strengthening the broad consent requirements, the final rule also adopts simplified and more flexible elements of broad consent than what was proposed in the NPRM. For example, the final rule requires that the broad consent include a description of the identifiable private information or identifiable biospecimens that might be used in research, whether sharing of such information or biospecimens might occur, and the types of institutions or investigators that might conduct research with such information or biospecimens. However, the final rule does not adopt the NPRM's proposed limitations on the research use of biospecimens or identifiable private information obtained for nonresearch purposes, that would have only permitted a broad consent to cover either or both of the following: (1) Biospecimens or identifiable private information that exist at the time at which broad consent is sought; and (2) biospecimens or identifiable private information that will be collected up to 10 years after broad consent is obtained or until the child reaches the legal age of consent to the treatments or procedures involved in the research, whichever comes first. We were persuaded by the public comments that raised concerns about the complexity and tracking burden that such limitations would impose, without clearly offering individuals a more meaningful way to control the use of their information or biospecimens.

In addition, the broad consent requirements have been simplified to avoid creating redundant requirements with the basic elements of informed consent under § __.116(b) that must also be included in broad consent obtained under § __.116(d). For example, in the final rule, it is required that broad consent include a statement that participation is voluntary, refusal to participate will involve no penalty or loss of benefits to which the subject is otherwise entitled, and the subject may discontinue participation at any time without loss of benefits to which the subject is otherwise entitled ((§ __.116(d)(1), incorporating § __.116(b)(8) for broad consent). Therefore, the comparable element of broad consent that was proposed in the NPRM is not included in the final rule.

As discussed in the NPRM, we expect that, when appropriate, this element of broad consent will inform subjects that information that has been stripped of identifiers might not be traceable, and thus it might not be feasible to withdraw consent for future use or distribution in this case. However, if an investigator commits to permitting a subject to discontinue use of the subject's identifiable private information or identifiable biospecimens, it is expected that the investigator will honor this commitment by not removing identifiers.

Similarly, the final rule also does not include the element of broad consent proposed in the NPRM that, when relevant, would have required the broad consent to include an option for an adult subject or the representative to consent, or refuse to consent, to the inclusion of the subject's data, with removal of the identifiers listed in 45 CFR 164.514(b)(2)(i)(A) through (Q), in a database that is publicly and openly accessible to anyone, and that this option be prominently noted and include a description of the risks of public access to the data. We believe this proposed requirement is unnecessary because it overlaps with the broad consent elements included in the final rule requiring a statement describing the extent, if any, to which confidentiality of records identifying the subject will be maintained (§ __.116(d)(1), incorporating § __.116(b)(5) for broad consent), and a description of any reasonably foreseeable risks or discomforts to the subject (§ __.116(d)(1), incorporating § __.116(b)(2) for broad consent).

The final rule includes a slightly different provision relating to the return of research results than that proposed in the NPRM. As set forth in § __.116(d)(6) of the final rule, unless it is known that clinically relevant research results, including individual research results, will be disclosed to the subject in all circumstances, a statement that such results may not be disclosed to the subject must be included in the broad consent. This element of broad consent differs from the related requirement in § __.116(c)(8) that pertains when an investigator is seeking consent for a specific study, since unlike the circumstances under which broad consent is likely to be sought, investigators seeking consent for a specific study will know if the study includes a plan to return research results to subjects. The NPRM proposed that a general element of informed consent be included as part of a broad consent, namely that the consent include a statement regarding whether clinically relevant research results, including individual research results, would be disclosed to subjects, and if so, under what conditions. The language adopted in the final rule is intended to provide transparency, but is tailored to the broad consent context as those seeking broad consent may not know whether clinically relevant research results, including individual research results, will always be disclosed to subjects, and if so, under what conditions. Nonetheless, unless investigators know that such results will be disclosed to subjects in all circumstances, subjects will be informed through a broad consent of the possibility that such results will not be disclosed to them. This provision is intended to pertain to all clinically relevant research results, including general or aggregate research findings and individual research results. This element of broad consent will affect the applicability of the exemption set forth at § __.104(d)(8), for secondary research for which broad consent is required. This exemption applies only if the investigator does not include returning individual research results to subjects as part of the study plan (noting, however, that this provision does not prevent an investigator from abiding by any legal requirements to return individual research results). Although it is envisioned that broad consent will often be sought with the expectation that specific secondary research studies using identifiable private information or identifiable biospecimens will be exempt under § __.104(d)(8), this will not always be the case. Broad consent can also be obtained for secondary research that will not qualify for this exemption, such as secondary research that will involve returning clinically relevant research results to subjects. In these cases, the specific secondary research study will need to undergo IRB review and approval under § __.111, and we expect that the IRB would consider what subjects were told in the broad consent regarding the return of research results. The only exception to the requirement for IRB review of such research, if covered by this policy, is if the research qualifies for another exemption or the research is carried out under a Secretarial waiver at § __.101(i).

Finally, the third main difference between the NPRM and final rule provision on broad consent is that the final rule does not include broad consent templates to be established by the Secretary of HHS. We agree with the public comments that favored allowing institutions to create their own broad consent forms that could be tailored to a variety of circumstances. Therefore, under the final rule, investigators and institutions may develop broad consent forms, which, provided specified conditions are satisfied, would meet the exemption for the storage and maintenance for secondary research use of identifiable biospecimens or identifiable private information (§ __.104(d)(7)). This exemption is further discussed in Section V. At a later time, the Secretary of HHS expects to develop guidance on broad consent, which could include broad consent templates.

In addition, we are also including in the final rule an element that for research involving biospecimens, when appropriate, the broad consent must state whether the research will (if known) or might include whole genome sequencing (WGS) (§ __.116(d)(1), incorporating § __.116(c)(9)). The reasons for requiring this element in the broad consent are similar to those discussed above regarding the addition of this requirement in the additional elements of consent at § __.116(c)(9). WGS generates an extremely large amount of data, which when analyzed can yield information about an individual, including factors that could contribute to their future medical conditions. Therefore, given the implications of WGS information for an individual and his or her biological family, if it is known that the broad consent will or might permit the use of individuals' biospecimens for WGS, we believe that this aspect of the research must be disclosed to prospective subjects as part of the broad consent process. The broad consent must include a general description of the types of research that may be conducted with the identifiable private information or identifiable biospecimens, with sufficient information to allow a reasonable person to expect that the broad consent would permit the types of research conducted (§ __.116(d)(2)). Including an additional element of broad consent that specifically addresses WGS makes it clear that such information must be disclosed to prospective subjects.

Under the final rule, if the subject or the subject's legally authorized representative is asked to provide broad consent, the broad consent must satisfy the general informed consent requirements at § __.116(a)(1)-(4), and (a)(6), and must include all of the following 12 elements that are applicable:

• A description of any reasonably foreseeable risks or discomforts to the subjects (§ __.116(d)(1), incorporating basic elements of informed consent in § __.116(b)(2));
• A description of any benefits to the subject or to others that may reasonably be expected from the research ((§ __.116(d)(1), incorporating basic elements of informed consent in § __.116(b)(3);
• A statement describing the extent, if any, to which confidentiality of records identifying the subject will be maintained ((§ __.116(d)(1), incorporating basic elements of informed consent in § __.116(b)(5));
• A statement that participation is voluntary, refusal to participate will involve no penalty or loss of benefits to which the subject is otherwise entitled, and the subject may discontinue participation at any time without penalty or loss of benefits to which the subject is otherwise entitled ((§ __.116(d)(1), incorporating basic elements of informed consent in § __.116(b)(8));
• If applicable, a statement that the subject's biospecimens (even if identifiers are removed) may be used for commercial profit and whether the subject will or will not share in this commercial profit ((§ __.116(d)(1), incorporating additional elements of consent in § __.116(c)(7));
• When appropriate, for research involving biospecimens, whether the research will (if known) or might include WGS (i.e., sequencing of a human germline or somatic specimen with the intent to generate the genome or exome sequence of that specimen.) ((§ __.116(d)(1), incorporating the additional element of consent in § __.116(c)(9));
• A general description of the types of research that may be conducted with identifiable private information or identifiable biospecimens. This description must include sufficient information to permit a reasonable person to expect that the broad consent would permit the types of research conducted (§ __.116(d)(2));
• A description of the identifiable private information or identifiable biospecimens that might be used in research, whether sharing of such information or biospecimens might occur, and the types of institutions or investigators that might conduct research with such information or biospecimens (§ __.116(d)(3));
• A description of the period of time allowed that the identifiable private information or identifiable biospecimens may be stored and maintained (which period of time could be indefinite), and a description of the period of time that such information or biospecimens may be used for research purposes (which period of time could be indefinite (§ __.116(d)(4));
• Unless the subject or legally authorized representative will be provided details about specific research studies, a statement that they will not be informed of the details of any specific research studies that might be conducted using the subject's identifiable private information or identifiable biospecimens, including the purposes of the research and that they might have chosen not to consent to some of those specific research studies (§ __.116(d)(5));
• Unless it is known that clinically relevant research results, including individual research results, will be disclosed to the subject in all circumstances, a statement that such results may not be disclosed to the subject; (§ __.116(d)(6)); and
• An explanation of whom to contact for answers to questions about the subject's rights about storage and use of the subject's identifiable private information or identifiable biospecimens, and whom to contact in the event of a research-related harm (§ __.116(d)(7)).

The elements of broad consent described in the first six bullet points above are not unique to broad consent, while the elements described in the last six bullet points are specific to the requirements of broad consent.

E. Waiver or Alteration of Informed Consent Involving Public Benefit and Service Programs (§ __.116(e))

1. Background and Pre-2018 Requirements

The pre-2018 rule permitted an IRB to waive the requirements for obtaining informed consent, or to alter such requirements, under two sets of circumstances described at § __.116(c) or (d) of the pre-2018 rule. The first set of circumstances, described at § __.116(c) of the pre-2018 rule was more narrow and was limited to certain research or demonstration projects conducted by or subject to the approval of state or local government officials. These projects are similar in some ways to the projects identified in the exemption at § __.104(d)(5) of this final rule. The broader provisions concerning waivers or alterations of the requirements of informed consent that apply beyond the circumstances described in § __.116(c) of the pre-2018 rule are discussed below in the section concerning § __.116(f).

2. NPRM Proposal

The NPRM proposed retaining the waiver and alteration of informed consent provisions included in the pre-2018 rule with respect to research involving public benefit and service programs conducted by or subject to the approval of state or local officials, with two exceptions. First, the NPRM proposed (for proposed § __.116(e)(2)), additional criteria for waiver or alteration of consent for biospecimens. This was tied to the NPRM's proposal that all biospecimens, regardless of their identifiability, be covered under the Common Rule. Under these proposed criteria, IRBs would be able to approve waivers or alterations of the required informed consent elements only if an IRB found and documented both that there were compelling scientific reasons to conduct the research and that the research could not be conducted with other biospecimens for which informed consent was obtained or could be obtained. Second, the NPRM proposed new language (for proposed § __.116(e)(3)), providing that if an individual was asked to consent to the storage or maintenance for secondary research use of biospecimens or identifiable private information in accordance with the proposed broad consent provisions and that individual refused to consent, the IRB would be prohibited from waiving consent for the storage, maintenance, or the secondary research use of the biospecimens or information.

3. Response to Comments and Explanation of the Final Rule: Waiver or Alteration of Informed Consent Involving Public Benefit and Service Programs

Public comments on this proposal are described in section F below because the comments submitted generally addressed the waiver and alteration criteria under both proposed § __.116(e) and § __.116(f).

The final rule adopts one of the two proposals made in the NPRM for proposed § __.116(e). The final rule adopts (in § __.116(e)(1)) the language proposed in the NPRM providing that if an individual was asked to consent to the storage or maintenance for secondary research use of identifiable private information or identifiable biospecimens in accordance with the proposed broad consent provisions and such individual refused to consent, the IRB would be prohibited from waiving consent for the storage, maintenance, or the secondary research use of such biospecimens or information. The references in this provision to biospecimens are changed to refer specifically to identifiable biospecimens as the final rule does not apply to the research use of nonidentifiable biospecimens. This change is intended to honor the autonomy of individuals and to further the Belmont Report principle of respect for persons, in that this provision will prevent an individual's refusal to consent to additional research use of information or biospecimens from being overridden.

The final rule does not incorporate the NPRM's proposed additional waiver criterion to apply to research involving the use of biospecimens. This change is not necessary given that the proposal in the NPRM that the Common Rule extend to all biospecimens has not been adopted in the final rule. We determined that the waiver and alteration criteria included in the final rule are appropriately protective of identifiable biospecimens, as defined at § __.102(e)(6) and that an additional waiver criterion for such biospecimens is not warranted. For example, § __.116(e)(3)(ii) mandates that an IRB may not waive or alter the requirements of informed consent with respect to research under this category unless the research could not practicably be carried out without the waiver or alteration.

The format and organization of § __.116(e) in the final rule is different from that included in the pre-2018 rule or proposed in the NPRM. These changes were implemented to be clearer about the effect of each requirement. Most significantly, § __.116(e) in the final rule provides separate paragraphs concerning the applicable criteria for waiver and the applicable criteria for alteration of the requirements for informed consent. This differs from the approach proposed in the NPRM, and the approach included in the pre-2018 rule, that did not separate those discussions. We concluded that separating the discussion of waiver and the discussion of alteration would help clarify the applicable criteria, particularly given that the final rule addresses broad consent.

Section __.116(e)(1) describes the general framework for an IRB to waive the requirements for informed consent. This paragraph explains that an IRB may waive the requirement to obtain informed consent under § __.116(a) (general requirements for informed consent), § __.116(b) (basic elements of informed consent), or § __.116(c) (additional elements of informed consent that apply to certain research) if the IRB satisfies the criteria set forth at § __.116(e)(3) (discussed below). As explained above, the ability to satisfy the requirement to obtain informed consent of a subject or a subject's legally authorized representative through use of a broad consent in particular circumstances is a flexibility offered to institutions, but institutions are never required to obtain informed consent through a broad consent process. For this reason, § __.116(e)(1) does not provide that an IRB may waive the requirement to obtain informed consent under § __.116(d) (broad consent) because use of broad consent is not a requirement. As noted above, and to honor the autonomy of individuals, § __.116(e)(1) prohibits an IRB from waiving consent for the storage, maintenance, or secondary research uses of identifiable private biospecimens or identifiable private information if an individual was asked to provide broad consent for such purposes and refused to provide such consent.

Section __.116(e)(2) describes the general framework for an IRB to alter the requirements for informed consent. An IRB may omit or alter some or all of the elements of informed consent under § __.116(b) (basic elements of informed consent) or § __.116(c) (additional elements of informed consent that apply to certain research) if the IRB satisfies the criteria set forth at § __.116(e)(3) (discussed below). This is consistent with the proposal made in the NPRM. This paragraph further explains that an IRB may not omit or alter any of the requirements described in § __.116(a) (general requirements for informed consent). This is also consistent with the proposal made in the NPRM (which proposed permitting an IRB to omit or alter elements of informed consent, but did not propose permitting omissions or alterations of the general requirements of informed consent that were included in the unnumbered introductory paragraph in the pre-2018 rule at § __.116). This paragraph also specifies that if a broad consent is used, an IRB may not omit or alter any of the elements required under § __.116(d). We determined that it would not be appropriate to permit the omission or alteration of any of the broad consent elements given the fact that the required elements of broad consent are limited and given our view that each of these elements (described at § __.116(d)) is critical for the purpose of soliciting broad consent that is both informed and ethically appropriate. This approach is different from what was proposed in the NPRM because of the NPRM's different approach to broad consent than that adopted in the final rule.

Section __.116(e)(3) sets forth the specific criteria that an IRB must find and document to waive or alter the requirements for informed consent, consistent with the limitations set forth in § __.116(e)(1) and § __.116(e)(2). These criteria are the same as those proposed in the NPRM. First, the IRB must find and document that the research or demonstration project is to be conducted by or subject to the approval of state or local government officials and is designed to study, evaluate, or otherwise examine public benefit or service programs; procedures for obtaining benefits or services under those programs; possible changes in or alternatives to those programs or procedures; or possible changes in methods or levels of payment for benefits or services under those programs. Second, the IRB must find and document that the research could not practicably be carried out without the waiver or alteration.

F. General Waiver or Alteration of Informed Consent (§ __.116(f))

1. Background and Pre-2018 Requirements

Beyond the circumstances addressed in § __.116(c) of the pre-2018 rule (which is limited to certain research conducted by or subject to the approval of state or local government officials), the pre-2018 rule includes a more general provision that is not limited to any particular type of research and that permits an IRB to either waive the requirements for obtaining informed consent, or to alter such requirements. Waiver or alteration of the requirements of informed consent under this general provision requires that the following four criteria be satisfied: (1) the research involves no more than minimal risk to the subjects; (2) the waiver or alteration will not adversely affect the rights and welfare of the subjects; (3) the research could not practicably be carried out without the waiver or alteration; and (4) whenever appropriate, the subjects will be provided with additional pertinent information after participation.

Concerns have been expressed that requirements for obtaining waivers of informed consent or waivers of documentation of informed consent were confusing and inflexible, resulting in inconsistent application and a lack of uniformity in interpretation, which led to the proposals in the NPRM.

2. NPRM Proposals

The NPRM offered three substantive proposals related to the general waiver or alteration of informed consent provisions. First, the NPRM proposed to add a new waiver criterion that would require that for research involving access to or use of identifiable biospecimens or identifiable private information, the requirements of informed consent could only be waived or altered if the research could not practicably be carried out without accessing or using identifiers. This criterion was modeled on the comparable criterion in the HIPAA Privacy Rule, which requires as a condition of waiver of the requirement to obtain an individual's authorization that the research could not practicably be conducted without access to and use of protected health information. The principle embodied in this additional proposed criterion was that nonidentified information should be used whenever possible in order to respect subjects' interests in protecting the confidentiality of their data and biospecimens.

Second, the NPRM proposed two additional waiver criteria for research involving the use of biospecimens. For such research, the NPRM proposed that the requirements of informed consent could only be waived or altered if an IRB found and documented that: (1) there were compelling scientific reasons for the research use of the biospecimens; and (2) the research could not be conducted with other biospecimens for which informed consent was or could be obtained.

Third, the NPRM proposed that the Common Rule prohibit IRBs from waiving informed consent if individuals were asked and refused to provide broad consent to the storage and maintenance for secondary research use of biospecimens and identifiable private information. If a subject refused to provide broad consent, it was proposed that this refusal would need to be recorded by the investigator to better ensure that the subject's wishes would be honored.

3. Public Comments

Approximately 975 public comments discussed the NPRM proposals found at § __.116(f) either directly, or as related to linked provisions related to the definition of human subject, the broad consent proposal, or proposed exemptions. A majority of these discussed the NPRM proposals related to the more stringent waiver criteria for research involving biospecimens. A majority of these comments were from patients (including family members of patients) and other individuals who commented anonymously. Patients tended to oppose these proposals because they believed they would severely restrict access to biospecimens, which would slow research. Some commenters were opposed to waiver of consent under any conditions, whether specific or broad consent.

Approximately 40 comments were received on the NPRM's proposal to prohibit an IRB from waiving consent for the storage, maintenance, or secondary research uses of identifiable biospecimens or identifiable private information if an individual was asked to provide broad consent for such purposes and refused to provide such consent. Public comment was mixed. Those who supported it indicated that this requirement made sense in order to respect subject autonomy. Those who opposed the proposal indicated that it would be impossible for an IRB to know the reasons why an individual refused to sign a broad consent form. Thus, these individuals argued, the prohibition on waiver of consent did not seem appropriate given the difficulty in understanding why someone refused to sign a broad consent form. Several commenters noted that it would be reasonable to prohibit an IRB from waiving a subject's refusal to provide consent to a specific study, but that such a prohibition in the context of broad consent seemed unduly burdensome.

The NPRM sought comments concerning language in the pre-2018 rule (that the NPRM proposed retaining) that waiver or alteration of informed consent only occur if the IRB finds that the research could not practicably be carried out without the requested waiver or alteration. Several commenters recommended further defining or clarifying the meaning of “practicably.” Some members of the public felt that this criterion was too open-ended and that greater emphasis should be placed on respect for persons over other ethical concerns and scientific validity. Several commenters favored SACHRP's recommendations on this topic, including that this requirement be interpreted to mean that it would be impracticable to perform the research, not impracticable to obtain consent due to financial or administrative burdens, without the waiver or alteration. Another commenter argued that because of a lack of clarity as to the meaning of terms including “minimal risk,” “practicably,” and “the rights and welfare of subjects,” as well as the potential that IRBs may not apply the criteria uniformly, IRBs should not be able to waive or alter consent. The following suggestions were offered as replacement language: “reasonably done without excessive time or financial constraints to the researcher that would delay the project so significantly as to make it impossible to conduct the research,” “capable of being done or accomplished with available means or resources,” “reasonably feasible,” “capable of being effective,” and “could practicably be obtained.” Several commenters favored retaining the term “practicably” and were satisfied that it was clear.

Other comments raised different issues about waiver or alteration. Many commenters who opposed all classified research conducted without consent recommended that waivers be prohibited with respect to classified research involving humans. One commenter recommended a reorganization of the waiver and alteration provisions to clarify the different standards that apply to waivers and alterations. Another commenter expressed concern that the NPRM's proposed waiver provision would unreasonably limit the flexibility of IRBs. One commenter believed that the § __.116(f) alteration criteria were too rigid and that the final rule should incorporate a notion of risk adjustment. Another commenter (a professional medical organization) supported SACHRP's proposed revisions to the waiver criteria at § __.116(f) to allow an IRB to approve the storage, maintenance, and secondary research use of identified data.

The NPRM sought public comment on the proposed differences between the criteria for waiving informed consent for the research use of biospecimens versus identifiable information. Approximately 60 comments stated that no justification exists for treating biospecimens and information differently. Some also noted that the proposed criteria for waiver of consent for use of biospecimens is so high as to be virtually impossible to meet and asked why biospecimens should have a higher standard than information (which theoretically could be more easily identifiable). One commenter noted that the proposed waiver criteria promotes “biospecimen exceptionalism” and that data and biospecimens should be treated the same.

A request in the NPRM for public comment on whether the proposal to permit an IRB to waive consent for research involving the use of biospecimens should be included in the regulations received few comments. One commenter noted that it seemed incongruous to include biospecimens in the definition of “human subject,” but then allow waiver based on different criteria. Others stated that IRBs should continue to have the ability to waive consent.

The NPRM sought public comment regarding how likely investigators are to seek broad consent for the use of identifiable private information (as contrasted with biospecimens), given that the NPRM contains provisions that would make it easier to do such research without consent (such as the new exemption proposed for § __.104(e)(2)). Approximately 30 commenters responded to this question. A majority said they would not use the broad consent mechanism for secondary use of information if other options were available. Some said that they suspected that investigators would continue to seek consent waivers for secondary use of identifiable private information instead of seeking broad consent.

The NPRM also sought public comment on several aspects of the proposed prohibition on waiving consent when an individual has been asked to provide broad consent and refused, including the following questions: In particular, how would this prohibition on waiving consent affect the secondary research use of identifiable private information? If an individual was asked to provide such consent, should the absence of a signed secondary use consent be considered a refusal? Does this prohibition on waiving consent for the secondary use of identifiable private information create a disincentive for institutions to seek broad consent for secondary use and instead seek a waiver of consent from an IRB? Under what circumstances, if any, would it be justified to permit an IRB to waive consent even if an individual declined or refused to consent?

Approximately 35 comments were received on this set of questions. Approximately half of these stated that “no means no.” If someone was asked to give broad consent and the person specifically said no, researchers should not be allowed to obtain a waiver of consent. Those who opposed the idea of a prohibition on waiver argued that it would be very difficult for institutions to understand why someone said no to providing broad consent. In other words, a blanket prohibition does not accurately address all the issues that can occur in this situation.

A majority of the responses did not address the questions of how a broad consent form with no indication either way should be treated. The responses we received to this question suggested that absence of a signed form should not be treated as if the individual explicitly said no to broad consent (i.e., that in those situations, waiver should be permitted).

A majority of the responses that we received on the question of whether the prohibition on waiver in the broad consent context created a disincentive for the use of broad consent with identifiable private information answered in the affirmative.

4. Response to Comments and Explanation of the Final Rule: General Waiver of Alteration of Consent

Overall, two of the three proposals made in the NPRM for proposed § __.116(f) have been retained. The final rule adopts (in § __.116(f)(3)(iii)) a new waiver criterion very similar to that proposed in the NPRM, which now mandates that for research involving access to or use of identifiable private information or identifiable biospecimens, the requirements of informed consent can be waived or altered only if the research could not practicably be carried out without using such information or biospecimens in an identifiable format. The minor wording change made in the language of this provision, as compared with that proposed in the NPRM, is intended for clarity. This change is intended to protect the privacy of individuals, while not unduly inhibiting research. After considering the diversity of opinions expressed in the public comments on this issue, including many comments seeking further guidance concerning the proper interpretation of the “practicably” language, the final rule does not define this language (which was also included in the pre-2018 rule). We have concluded that the requirements for waiver and alteration in § __.116(e) and (f) appropriately honor respect for persons and balances this with other ethical principles.

The final rule also adopts (in § __.116(f)(1)) the language proposed in the NPRM (for § __.116(f)(3)) prohibiting IRBs from waiving informed consent if individuals were asked and declined to provide broad consent to the storage and maintenance for secondary research use of identifiable private information or identifiable biospecimens (except that the final rule's formulation is limited to identifiable biospecimens, consistent with changes made in the final rule). We considered public comments that opposed this prohibition and understand that IRBs may not always understand the reason that individuals refused to sign a consent form and that the effects of this broad prohibition could be significant in the context of broad consent (given the broad scope of research that such a broad consent could potentially extend to). Nonetheless, we determined that it is important to prevent an individual's refusal to consent to additional research use of such information or biospecimens from being overridden. This change to the Common Rule is intended to honor the autonomy of individuals and to further the Belmont Report principle of respect for persons.

The final rule does not incorporate the NPRM's proposed additional waiver criteria (proposed for § __.116(f)(2)) to apply to research involving the use of biospecimens. This change is not necessary given that the proposal in the NPRM that the Common Rule extend to all biospecimens regardless of their identifiability has not been adopted in the final rule. We determined that the waiver and alteration criteria included in the final rule are appropriately protective of identifiable biospecimens and that an additional waiver criterion for such biospecimens is not warranted. For example, § __.116(f)(3)(iii) in the final rule is a research criterion specific to research that involves using identifiable private information or identifiable biospecimens. Under this criterion, an IRB may not waive or alter requirements of informed consent with respect to such research unless the IRB finds and documents that the research could not practicably be carried out without using such information or biospecimens in an identifiable format.

The format and organization of § __.116(f) in the final rule are different from the proposed § __.116(f) described in the NPRM. We made these changes in an effort to be clear about the effect of each requirement. Most significantly, § __.116(f) in the final rule provides separate paragraphs concerning the applicable criteria for waiver and the applicable criteria for alteration of the requirements for informed consent. This differs from the approach proposed in the NPRM, and the approach included in the pre-2018 rule that did not separate those discussions. We conclude that separating the discussion of waiver and alteration will help clarify the applicable criteria, particularly given that the final rule addresses the application of the waiver and alteration provisions in the context of broad consent.

Section __.116(f)(1) describes the general framework for an IRB to waive the requirements for informed consent. This paragraph explains that an IRB may waive the requirement to obtain informed consent under § __.116(a) (general requirements for informed consent), § __.116(b) (basic elements of informed consent), or § __.116(c) (additional elements of informed consent that apply to certain research) if the research satisfies the criteria set forth at § __.116(f)(3) (discussed below). As explained above, the ability to satisfy the requirement to obtain informed consent of a subject or a subject's legally authorized representative through use of a broad consent in particular circumstances is a flexibility offered to institutions, but institutions are never required to obtain informed consent through a broad consent process. For this reason, § __.116(f)(1) does not provide that an IRB may waive the requirement to obtain informed consent under § __.116(d) (broad consent) because use of broad consent is a regulatory flexibility, and not a requirement. Consistent with the proposal made in the NPRM (proposed § __.116(f)(3)), § __.116(f)(1) provides that if an individual was asked to provide broad consent for the storage, maintenance, and secondary research use of identifiable private information or identifiable biospecimens and refused to consent, an IRB cannot waive consent for either the storage, maintenance, or secondary research use of such biospecimens or information.

Section__.116(f)(2) describes the general framework for an IRB to alter the requirements for informed consent. This paragraph explains that an IRB may omit or alter some or all of the elements of informed consent under § __.116(b) (basic elements of informed consent) or § __.116(c) (additional elements of informed consent that apply to certain research) if the IRB satisfies the criteria set forth at § __.116(f)(3) (discussed below). This is consistent with the proposal made in the NPRM. This paragraph further explains that an IRB may not omit or alter any of the requirements described in § __.116(a) (general requirements for informed consent). This is also consistent with the proposal made in the NPRM (which proposed permitting an IRB to omit or alter elements of informed consent, but did not propose permitting omissions or alterations of the general requirements of informed consent that were included in the unnumbered introductory paragraph in the pre-2018 rule at § __.116). This paragraph also specifies that when reviewing a broad consent, an IRB may not omit or alter any of the elements required under § __.116(d). As with § __.116(e)(2), we determined that it would not be appropriate to permit the omission or alteration of any of the broad consent elements in § __.116(f). The elements of broad consent reflected in this NPRM are limited. We have concluded that each of these elements (which are included at § __.116(d)) is critical to the solicitation of an informed and ethically appropriate broad consent. For that reason, none of the elements of broad consent may be omitted or altered if broad consent is solicited. This prohibition is different than the NPRM's proposal given the different formulation of broad consent represented in this final rule.

Section 116(f)(3) sets forth the specific criteria that an IRB must find and document in order to waive or alter the requirements for informed consent. These criteria are the same as those proposed in the NPRM, except that the third criterion includes minor wording changes that were made for clarity: (1) the research involves no more than minimal risk to the subjects; (2) the research could not practicably be carried out without the requested waiver or alteration; (3) if the research involves using identifiable private information or identifiable biospecimens, the research could not practicably be carried out without using such information or biospecimens in an identifiable format; (4) the waiver or alteration will not adversely affect the rights and welfare of the subjects; and (5) whenever appropriate, the subjects will be provided with additional pertinent information after participation.

G. IRB Approval of Research Involving Screening, Recruiting, or Determining Eligibility of Prospective Subjects (§ __.116(g))

1. Background and Pre-2018 Requirements

The pre-2018 rule required an IRB to determine that informed consent can be waived under § __.116(d) before investigators could record identifiable private information for the purpose of identifying and contacting prospective subjects for a research study. This requirement to waive informed consent has been viewed as burdensome and unnecessary for protecting subjects, and is not consistent with FDA's regulations, which do not require informed consent or a waiver of informed consent for such activities.

2. NPRM Proposal

The NPRM proposed a new provision at § __.116(g) that would authorize an IRB to approve a research proposal in which investigators obtain identifiable private information without individuals' informed consent for the purpose of screening, recruiting, or determining the eligibility of prospective human subjects of research. The IRB would be permitted to approve a research proposal only in such circumstances if the proposal included an assurance that the investigator would implement standards for protecting the information obtained, in accordance with and to the extent required by proposed § __.105. This proposal was intended to address concerns that the pre-2018 rule required an IRB to determine that informed consent can be waived before investigators could record identifiable private information for the purpose of identifying and contacting prospective subjects for a research study.

3. Public Comments

Few comments were received regarding this proposal. All were generally supportive. One academic institution noted that “This review is unnecessary considering the low potential risk to subjects and will expedite research endeavors and ensure harmonization between FDA`s expectations and the Common Rule.” However, one commenter thought that prospective subjects should be notified that this might be a possibility. Another commenter said that it should be clear that this is not an IRB waiver of consent, but rather it is an exception to the consent requirement.

4. Response to Comments and Explanation of the Final Rule: Approval of Research Involving Screening, Recruiting, or Determining Eligibility of Prospective Subjects

The final rule adopts the NPRM proposal at § __.116(g), with minor changes made for clarity, and without a requirement that investigators adhere to the proposed privacy safeguards at § __.105, since this provision is not included in the final rule. The provision at § __.116(g) addresses concerns that the pre-2018 regulations required an IRB to determine that informed consent can be waived before investigators may record identifiable private information for the purpose of identifying and contacting prospective subjects for a research study. This change is intended to address these concerns by eliminating the requirement for the IRB to waive informed consent for these activities. In response to public comments, we are clarifying that this is not a waiver of the consent requirement but rather an exception to the requirement. This change is also responsive to SACHRP's recommendation regarding how the Common Rule should apply to activities that are conducted before subjects provide consent to participate in research, such as identifying potential subjects, contacting subjects, and recruiting subjects.

The final rule includes some minor changes from the NPRM proposal, to clarify the circumstances in which the IRB may approve the investigator's proposal to obtain information directly from a prospective subject, or to obtain already collected identifiable private information or identifiable biospecimens by accessing records or stored biospecimens, for purposes of screening, recruiting, or eligibility assessment, without the informed consent of the prospective subject or the subject's legally authorized representative. The final rule also adds a reference to the subject's legally authorized representative at § __.116(g)(1) to clarify that this exception to informed consent will also apply in circumstances in which the prospective subject has a legally authorized representative who will provide information about the prospective subject through oral or written communication with the investigator.

We note that in approving this exception to informed consent for the purpose of screening, recruiting, or determining the eligibility of prospective subjects, the IRB will be reviewing and approving the entire research proposal. Therefore, all of the IRB approval criteria at § __.111 will need to be satisfied, including that when appropriate, there are adequate provisions to protect the privacy of subjects and to maintain the confidentiality of data (§ __.111(a)(7)). Thus, as part of its review and approval of the research, the IRB must determine that there are adequate privacy and confidentiality safeguards for information obtained by investigators for these preparatory-to-research activities.

We believe that these preparatory-to-research activities are critical means by which to identify subjects that do not involve additional risks, given their limited nature. If prospective subjects are identified through these “screening” activities, then all other relevant requirements of this rule must be met if they are subsequently recruited to participate in the research.

H. Posting of Consent Forms (§ __.116(h))

1. Background and Pre-2018 Requirements

The pre-2018 rule did not have a requirement to post consent forms from clinical trials.

2. NPRM Proposal

The NPRM proposed a new provision that would require that a copy of the final version of the consent form (absent any signatures) for each clinical trial conducted or supported by a Common Rule department or agency be posted on a publicly available federal Web site that will be established as a repository for such consent forms. The name of the protocol and contact information would be required to be included with the submission of the consent form. Under the NPRM proposal, the consent form would have to be published on the Web site within 60 days after the trial is closed for recruitment.

3. Public Comments

The NPRM proposal received approximately 130 comments, most of which opposed the proposal in whole or in part. Many commenters expressed concern that the proposal represented administrative burden without a corresponding increase in protections to human subjects or benefit to the research community. Some commenters felt that the proposal represented a waste of resources that would not increase compliance with the regulations, and might result in longer consent forms if researchers felt the need to include an abundance of additional information to protect against perceived regulatory noncompliance or legal challenge. These commenters expressed concern that the repository of posted consent forms might be used to seek out instances of noncompliance. For example, one large medical school indicated that the posting requirement creates a rich environment for litigation and represents an effort to publicly shame investigators to improve quality of documents that will not work.

Other commenters, including some private research firms, were concerned that the proposal as drafted would not allow for the redaction of proprietary or institutionally sensitive information from consent forms before they would be posted to the Web site, and allow competing research entities access to detailed information about investigational drug or research programs beyond what is publicly available already. Additional concern was expressed about the proposed timeframe in which consent forms needed to be posted. Some felt that more time was needed. Other commenters felt it would be more beneficial to research participants if consent forms were posted before or during recruitment. In addition, some commenters felt that researchers should be allowed or encouraged to update posted consent forms if they are updated for the study. Others felt that requiring that consent forms be posted once (even if the forms were updated after being posted) would lead to potential confusion among research participants. For example, several commenters noted that should a subject participating in a trial see a consent form for a particular study that differed from the form that he or she originally signed, that discrepancy could cause unnecessary concern and confusion.

Still other commenters expressed concern that the high volume of consent forms that would be posted as a result of this requirement would make the collection cumbersome and difficult to use, negating any potential benefit gained by increased transparency. Others expressed a concern that requiring all studies to post consent forms might lead to the perpetuation of poorly written forms, as researchers might use poor examples from the database to write their own informed consent documents in addition to excellent ones. A few major research universities suggested that guidance, best practices, or exemplary informed consent forms should be selected and shared publicly, rather than all informed consent forms. Some commenters suggested limiting the posting requirement to a subset of research studies, for example, to only high risk or large multi-institution studies.

Those who supported the proposal agreed that it would help increase accountability and promote transparency in informed consent forms. To that end, a minority of commenters said that this proposal should be extended to all research that is subject to the Common Rule, not just to studies meeting the definition of a clinical trial. Some commenters supported the idea of publicly sharing informed consent documents but felt it would be best accomplished through guidance or optional posting. One federal level advisory committee supported the proposal and recommended the creation of robust guidance with the goal of minimizing confusion and misuse of the posted documents, and facilitating the use of the posted forms to educate investigators, institutions, and regulators to improve future informed consent documents and the informed consent process generally. Others felt it would be helpful to post additional information and documents along with consent forms. For example, one investigator suggested that copies of IRB proposals and decisions be made public along with approved informed consent documents to provide additional transparency and accountability. Another commenter suggested that investigators be given the option to post assessment tools for evaluating prospective subjects' understanding of important study information.

Both those who supported and opposed the proposal indicated that in terms of implementing this proposal, consent forms should be posted to ClinicalTrials.gov as opposed to creating a new federal Web site in order to limit the additional administrative burden that this proposal would impose.

4. Response to Comments and Explanation of the Final Rule: Posting of Consent Forms

The final rule adopts the NPRM proposal with some modifications and clarifications. The primary purpose of this provision is to improve the quality of consent forms in federally funded research by assuring that—contrary to current practices, under which it is often very difficult to ever obtain a copy of these documents—they eventually would become subject to public scrutiny and that they will provide useful models for others. The consent form plays a key role in making sure that someone asked to enter a clinical trial receives the information they need to be making an informed decision about whether to enroll in that trial. Accordingly, it also plays a key role in supporting and justifying the public's trust in the integrity of our clinical trial enterprise.

We are not persuaded by the arguments of those commenters who suggest that potential negative consequences of this proposal outweigh its benefits. Fundamentally, this proposal is about increasing the transparency of one of the most important aspects of our human subjects protection system. Increased transparency is in general a good thing, and in this instance, as in many others, it offers multiple benefits—including increased trust—at very low cost. This provision is not a form of shaming, but rather an effort to ask people to work together to create a system that will improve the quality of informed consent. Moreover, the new standards for determining the acceptable content of a consent form—including § __.116(a)(5), which will require a concise presentation of key information at the beginning of the consent form—should counter any consequences of attempts to pad consent forms with additional information as a response to the posting requirement.

We agree with the conclusions of SACHRP that implementing this proposal will indeed result in better consent forms. Having a repository of such forms freely available for analysis and public discussion will create multiple opportunities for improving these forms. In an era in which we have previously unheard of capabilities for analyzing textual material and processing large amounts of data, the fact that there will be a high volume of consent forms posted should be a minor impediment, if any, to the ability to learn from the content of this database.

With regard to those who suggested that it would indeed be desirable to make consent forms more public, but that posting should be optional, we note that nothing in the pre-2018 rule prevents the people in charge of research from making their consent forms public, yet that is rarely done. In order to significantly increase the transparency of this portion of our system for protecting subjects, we are finalizing this proposal.

With regard to the commenters who were concerned that posting consent forms would create a rich environment for litigation, it is noteworthy that the existing evidence fails to suggest that there has been much of a problem with regard to inappropriate litigation over clinical trials. Whatever disincentives currently exist for such litigation, it seems unlikely that the mere fact that consent forms would now be more available will dramatically alter such disincentives. With regard to the commenters who were concerned about the added regulatory burden, we note that this change, compared to the traditional costs of clinical trials, will add a relatively small amount of additional burden, one that is well justified in comparison to the likely increase in transparency. This new provision has specifically been designed to minimize that burden. And the final rule has been modified in a number of respects from the NPRM proposal in response to public comments. As discussed below in detail, the time by which a consent form must be posted has been greatly extended. That change would also address the concerns of some commenters that the posted consent forms might create confusion among research subjects. Furthermore, provisions have been added that allow for redaction, as necessary, of portions of consent forms.

As a means of increasing transparency and facilitating the development of more informative consent forms, the final rule accordingly requires at § __.116(h)(1) that for clinical trials conducted or supported by a Common Rule department or agency, a copy of an IRB-approved version of a consent form that was used to enroll subjects would need to be posted by the awardee or the federal department or agency conducting the trial on a publicly available federal Web site that will be established as a repository for such forms. Unlike the NPRM, which required that the “final version” of the consent form be posted, the final rule adds flexibility in merely requiring that it be an IRB-approved consent form that was used for enrollment purposes. There is accordingly no further restriction as to which version of a consent form (which might have been subject to many modifications over the course of time) must be posted. The final rule also gives greater flexibility than the NPRM proposal in terms of when that posting needs to be done. It can take place any time after the trial is closed to recruitment, so long as the posting is no later than 60 days after the last study visit by any subject (as required by the protocol). If the federal department or agency supporting or conducting the clinical trial determines that certain information should not be made publicly available on a federal Web site (e.g., confidential commercial information), the department or agency may permit appropriate redactions to the information posted. In rare instances, it could be the case that the federal department or agency would determine that the very existence of a particular clinical trial should not be publicly disclosed, in which case no posting relating to such a trial would be required.

The final rule differs from the NPRM proposal in that it no longer specifies that certain information needs to be posted in addition to the consent form. This change eliminates the need for mandatory posting of information that might not be justified by the purposes of this provision.

Only one posting would be required for each multi-institution study. There is accordingly no expectation that a version would need to be posted for each class of subjects in the study (for example, a posting both for adults and for minors), nor for each study site.

We also note that this provision applies only to those clinical trials that are conducted or supported by a federal department or agency.

A Web site will be developed by HHS, which could be used by other federal departments or agencies, or the other federal departments or agencies could create their own Web sites for the posting of these consent forms. Public posting of consent forms is intended to increase transparency, enhance confidence in the research enterprise, increase accountability, and inform the development of future consent forms. It is anticipated that the Web site will be searchable. With regard to the comments suggesting that ClinicalTrials.gov might be an appropriate choice as the Web site, we agree that such a choice has the possibility of minimizing administrative burdens. Using ClinicalTrials.gov has another advantage, in addition to what some of the commenters said. Many clinical trials funded by HHS have records in ClincialTrials.gov due to requirements that certain clinical trials register and submit results information to that database (section 402(j) of the Public Health Service Act and 42 CFR part 11, and other policies that incentivize trial registration and results submission, such as the NIH Policy on Dissemination of NIH-Funded Clinical Trial Information). The fact that these trials already have a record in the database will mean that the burden of submission of the informed consent document will be substantially lower. Accordingly, we will take these points into consideration as we determine what federal Web site will be used to implement this provision.

XV. Documentation of Informed Consent (§ __.117)

A. Background and Pre-2018 Requirements

The pre-2018 rule at § __.117 described the requirements for documenting informed consent and when the waiver for obtaining a written and signed consent form was allowable.

B. NPRM Proposals

The NPRM proposed to alter the language at § __.117(b)(1) to specify that the consent document should include only the language required by § __.116, with appendices included to cover any additional information.

In addition, the NPRM would make it explicit in the regulatory language at proposed § __.117(c)(1)(iii) that if the subjects are members of a distinct cultural group or community for whom signing documents is not the norm, so long as the research presents no more than minimal risk of harm to subjects and provided there is an appropriate alternative mechanism for documenting that informed consent was obtained, the requirement to obtain a signed consent form may be waived. Documentation must include a description as to why signing forms is not the norm for the distinct cultural group or community.

Additionally, to facilitate the tracking of broad consent to storage or maintenance for secondary research use of biospecimens or identifiable private information, and to provide information to IRBs should IRB review be required, the NPRM proposed that waiver of documentation of consent for the research use of such biospecimens would not be allowed based upon a new provision at § __.117(c)(3).

The NPRM also introduced the term “oral consent” in the context of the various provisions related to the broad consent for the storage, maintenance, and secondary use of biospecimens and identifiable private information. As a general matter, under the pre-2018 rule, individuals wanting to obtain oral consent from subjects in a nonexempt research activity needed to seek a waiver of documentation of informed consent under § __.117(c). Therefore, the NPRM proposed to permit investigators to obtain oral broad consent for the storage, maintenance, and secondary research use in limited circumstances. Specifically, the NPRM proposals would allow an investigator to obtain oral broad consent if:

• An investigator used the proposed broad consent template;
• Investigators only sought oral broad consent only for the storage, maintenance, and secondary research use context for the use of identifiable private information, not for biospecimens;
• If broad consent for the storage, maintenance, and secondary research use was obtained only as part of a separate, primary research study; and
• The oral broad consent was sought as part of the consent process in a study eligible for one specific exclusion or three specific exemptions related to the collection of identifiable information.

Finally, the regulatory language proposed at § __.117(c)(4) was intended to clarify that waivers of documentation may not be permitted for research subject to regulation by FDA.

C. Public Comments

Approximately 15 comments were received on the proposals found in the NPRM at § __.117. Several commenters discussing the proposed requirement at § __.117(b)(1) indicated that even if consent forms are split into a primary document and appendices, there should be an expectation that the content included in the appendices are discussed with prospective subjects as part of the informed consent process. Although very few comments discussed the requirements of proposed § __.117(b)(1) specifically, many of the comments discussing the NPRM proposal found in the introductory paragraph of § __.116 discussed the concept of including only the required information in the main body of a consent form, and all additional information in appendices.

Few comments were received on the proposal found in § __.117(c)(1)(iii) that documentation of informed consent may be waived if consent is being sought amongst subjects who are members of a distinct cultural group or community in which signing forms is not the norm. Comments received on this proposal were generally favorable.

Those who commented on the proposals related to oral broad consent indicated that the provisions were confusing and difficult to understand. We note that these proposals were found in the NPRM through a series of interrelated cross references in §§ __.116(d), __.117(c), and __.104(f)(1)-(2).

Several commenters discussed the statement found in § __.117(c)(4) that waiver of documentation of consent is generally not permitted for research subject to regulation by the FDA. These commenters noted that this would be true regardless of whether this was included in the Common Rule. Additionally, commenters noted that if the FDA regulations ever permitted waiver of documentation of consent, the existence of this provision in the Common Rule might result in confusion and contradictory requirements for dually regulated research.

D. Response to Comments and Explanation of the Final Rule: Documentation of Informed Consent

The language at § __.117(b)(1) and (2) are altered in the final rule to conform to the requirements included at § __.116, which are discussed above. The goal in §§ __.116 and __.117 of the final rule is to facilitate a prospective subject's or legally authorized representative's understanding of the reasons why one might or might not want to participate in the research, in part by requiring that only the key information essential to decision making receive priority by appearing at the beginning of the consent document. In the final rule, these requirements also apply when a short form written informed consent process is used, or the requirement for written informed consent is waived.

We agree with the majority of public comments that favored adding a new provision allowing a waiver of the requirement for a signed consent form if the subjects are members of a distinct cultural group or community for whom signing documents is not the norm, provided that the research presents no more than minimal risk of harm to subjects and there is an appropriate alternative method for documenting that informed consent was obtained. Therefore, this new provision is added at § __.117(c)(1)(iii). The final rule includes a reference to the subject's legally authorized representative to clarify that this provision applies when a subject has a legally authorized representative who is a member of a distinct cultural group or community in which signing forms is not the norm.

The final rule does not include the NPRM's proposal at § __.117(c)(3) to prohibit a waiver of documentation of broad consent for the storage, maintenance, or secondary research use of biospecimens.

Some of those who commented on the NPRM proposals related to oral broad consent found it to be unnecessarily confusing. In response to these comments, the final rule permits waiver of documentation of informed consent under § __.117(c) when a broad consent procedure is used. No additional criteria or special restrictions apply. Additionally, the final rule removes all NPRM references to “oral consent” to reduce confusion.

However, we expect that it will rarely be permissible to waive documentation of broad consent for the secondary research use of medical records or stored biospecimens because there will likely be a need to track which individuals have provided broad consent and which have not, so the informed consent would not be the only record linking the subject and the research as required for a waiver under § __.117(c)(1)(i). Additionally, when identifiable information and identifiable biospecimens are shared for a nonresearch purposes, the person's consent is usually required, so we expect that documentation of consent often could not be waived under § __.117(c)(1)(ii), which requires that the research involves only procedures for which written consent is not normally required outside of the research context.

One instance when we believe it may be appropriate for the IRB to waive the requirement for a signed broad consent form is when the initial activity involved obtaining information from a person through oral communication, such as a phone survey, because there might not be an opportunity to obtain written broad consent from such individuals for the secondary research use of their information. In this scenario, documentation of broad consent could be waived under § __.117(c)(1)(ii) if the research presents no more than minimal risk of harm to subjects and involves no procedures for which written consent is normally required outside of the research context. In addition, it might be appropriate for an IRB to waive the requirement for a signed broad consent document under the provision included in the final rule related to when the subjects or their legally authorized representatives are members of a distinct cultural group or community for whom signing documents is not the norm, provided that the research presents no more than minimal risk of harm to subjects and an appropriate alternative method is available for documenting that informed consent was obtained (§ __.117(c)(1)(iii)).

The final rule also does not include the NPRM's proposed clarification that waivers of documentation may not be permitted for research subject to regulation by FDA. Because this is not the only difference between what is permitted under the Common Rule and the FDA regulations, we determined that clarifying only this specific difference in the final rule is likely to create more confusion rather than provide clarification.

XVI. Applications and Proposals Lacking Definite Plans for Involvement of Human Subjects (§ __.118)

A. Background and Pre-2018 Requirements

This provision of the pre-2018 rule stated that while an award or grant may be made for a project with indefinite plans to involve human subjects, that project must be reviewed by an IRB before human subjects may be involved.

B. NPRM Proposals

The NPRM language clarified that IRB review and approval was required before human subjects could be involved in a study unless the study was excluded under § __.101(b), waived under § __.101(i), or exempted under § __.104(d), (e) or (f)(2).

C. Public Comments

No comments were received.

D. Explanation of the Final Rule

The final rule adopts the language of the NPRM, with updated citations. This provision makes explicit that it applies only to nonexempt human subjects research.

XVII. Research Undertaken Without the Intention of Involving Human Subjects (§ __.119)

A. Background and Pre-2018 Requirements

This provision of the regulations outlines the process that an institution must undergo when a federally funded research project that was designed without the intention of involving human subjects later involves human subjects as defined by this policy.

B. NPRM Proposals

The NPRM proposed to add language to make clear that this provision applies only to nonexempt human subjects research. It also clarifies its reference to department or agency to mean a federal department or agency component supporting the research.

C. Public Comments

No comments were received.

D. Explanation of the Final Rule

The final rule adopts the language of the NPRM, with updated citations. This provision makes explicit that it applies only to nonexempt human subjects research, and clarifies the reference to department or agency to be a federal department or agency component supporting the research.

XVIII. Conditions (§ __.124)

A. Background and Pre-2018 Requirements

This provision of the regulations allows departments and agencies to impose additional requirements on human subjects research when such requirements are deemed necessary for the protection of human subjects.

B. NPRM Proposals

The NPRM provided more specific language at § __.124, stating that with respect to any research project or any class of research projects the department or agency head of either the conducting or the supporting federal department or agency may impose additional conditions prior to or at the time of approval when in the judgment of the department or agency additional conditions are necessary for the protection of human subjects.

C. Public Comments

One commenter discussed this NPRM proposal, arguing that this would increase variance in implementation of the Common Rule, rather than promote harmonization as the NPRM suggested.

D. Explanation of the Final Rule

The final rule adopts the NPRM language, which clarifies the pre-2018 rule by stating that the head of either the conducting or the supporting federal department or agency may impose additional conditions on research, when necessary for the protection of human subjects.

XIX. Regulatory Impact Analyses

A. Introduction

HHS has examined the impacts of this final rule under Executive Order 12866 on Regulatory Planning and Review (September 30, 1993); Executive Order 13563 on Improving Regulation and Regulatory Review (January 18, 2011); the Regulatory Flexibility Act of 1980, Pub. L. 96-354 (September 19, 1980); the Unfunded Mandates Reform Act of 1995, Pub. L. 104-4 (March 22, 1995); and Executive Order 13132 on Federalism (August 4, 1999).

Executive Order 12866 directs agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects; distributive impacts; and equity). Executive Order 13563 is supplemental to and reaffirms the principles, structures, and definitions governing regulatory review as established in Executive Order 12866. HHS expects that this rule will have an annual effect on the economy of $100 million or more in any one year and therefore is a significant regulatory action as defined by Executive Order 12866.

The Regulatory Flexibility Act (RFA) requires agencies that issue a regulation to analyze options for regulatory relief for small businesses if a rule has a significant impact on a substantial number of small entities. The RFA generally defines a “small entity” as (1) a proprietary firm meeting the size standards of the Small Business Administration (SBA); (2) a nonprofit organization that is not dominant in its field; or (3) a small government jurisdiction with a population of less than 50,000 (states and individuals are not included in the definition of “small entity”). HHS considers a rule to have a significant economic impact on a substantial number of small entities if at least 5 percent of small entities experience an impact of more than 3 percent of revenue. HHS anticipates that the rule will not have a significant economic impact on a substantial number of small entities. Supporting analysis is provided in Section XIX.F below.

Section 202(a) of the Unfunded Mandates Reform Act of 1995 requires that agencies prepare a written statement, including an assessment of anticipated costs and benefits, before proposing “any rule that includes any Federal mandate that may result in the expenditure by State, local, and tribal governments, in the aggregate, or by the private sector, of $100,000,000 or more (adjusted annually for inflation) in any one year.” The current threshold after adjustment for inflation is $146 million, using the most current (2015) implicit price deflator for the gross domestic product. HHS expects this rule to result in expenditures that will exceed this amount.

Executive Order 13132 establishes certain requirements that an agency must meet when it promulgates a rule that imposes substantial direct requirement costs on state and local governments or has federalism implications. HHS has determined that the rule will not contain policies that would have substantial direct effects on the States, on the relationship between the Federal Government and the States, or on the distribution of power and responsibilities among the various levels of government. The changes in the rule represent the Federal Government regulating its own program. Accordingly, HHS concludes that the rule does not contain policies that have federalism implications as defined in Executive Order 13132 and, consequently, a federalism summary impact statement is not required.

B. Need for the Final Rule and Summary

This final rule is being issued to modernize, strengthen, and make more effective the regulations for protecting human subjects in research. Although professional organizations have codes of conduct and guidelines for members conducting research, only the Federal Government has the authority to regulate the activities of institutions using public funds for human subjects research. Since the Common Rule was developed, the volume of research has increased, evolved, and diversified.

Thus, the final rule includes a number of measures to address the issues described above. Provisions that strengthen the requirements for informed consent and promote transparency in the informed consent process include: (1) Requiring that the informed consent form be designed and presented in such a way that facilitates a prospective subject's understanding of why one would want to participate in a research study or not; (2) revising and adding to the required elements of consent; (3) requiring for certain clinical trials the posting of a copy of at least one version of a consent form on a publicly available federal Web site; and (4) clarifying the conditions and requirements for waiver or alteration of consent to remove ambiguity, including a new provision that, under specific conditions, an IRB may approve a research proposal in which investigators obtain information without individuals' informed consent for the purpose of screening, recruiting, or determining eligibility of prospective human subjects of research.

Provisions that strengthen the extent to which regulations promotes the principle of respect for persons include: (1) Requiring that informed consent forms present the key information to potential subjects at the beginning of a consent process; (2) allowing investigators the option of obtaining broad consent from a potential subject for future, unspecified research use of identifiable private information and identifiable biospecimens; and (3) adding a provision that would prohibit a waiver of consent if someone has been asked to provide their broad consent for the storage, maintenance, and secondary research use of identifiable biospecimens or identifiable private information and refused to do so.

New provisions that would allow IRBs greater flexibility to focus resources on higher-risk research include: (1) Distinguishing categories of activities that are deemed not to be research; and (2) expanding and clarifying categories of exempt research.

Provisions that streamline or reduce burden for IRBs or institutions include: (1) Requiring consultation among the Common Rule agencies for the purpose of harmonizing guidance (to the extent appropriate); (2) eliminating an administrative requirement for reporting IRB membership; (3) removing the requirement that IRBs must review and approve grant applications; (4) eliminating, under certain circumstances, continuing review; (5) mandating the use of a single IRB for multi-institutional studies; and (6) holding IRBs not operated by an FWA-holding institution directly responsible for compliance when appropriate.

1. Accounting Table

Table 1 summarizes the quantified and nonquantified benefits and costs of all changes to the Common Rule. Over the 2017-2026 period, present value benefits of $1,904 million and annualized benefits of $223 million are estimated using a 3 percent discount rate; present value benefits of $1,494 million and annualized benefits of $213 million are estimated using a 7 percent discount rate. Present value costs of $528 million and annualized costs of $62.0 million are estimated using a 3 percent discount rate; present value costs of $474 million and annualized costs of $67.0 million are estimated using a 7 percent discount rate. Nonquantified benefits include improved human subjects protections in research; enhanced oversight of research reviewed by IRBs not operated by an FWA-holding institution; and increased uniformity in regulatory requirements among Common Rule departments and agencies. Nonquantified costs include the time needed for consultation among Common Rule agencies before federal guidance is issued.

Table 2 summarizes the quantified present value benefits and costs of each change to the Common Rule using a 3 percent discount rate.

C. Public Comments and Response to Public Comments

1. General Comments

Approximately 50 comments discussed the specific cost estimates provided in the NPRM's Regulatory Impact Analyses (RIA). Several commenters strongly suggested that the final rule eliminate the proposals related to biospecimens, cooperative research, and expanding coverage to nonfederally funded clinical research because the NPRM failed to appreciate the cost and burden that would result from implementing these proposals. Although a majority of the comments received on the RIA suggested that several of the cost estimates were significantly underestimated, few commenters described specific changes to the cost and benefit estimates included in the NPRM RIA.

One commenter noted that the NPRM cost estimates are derived from a 1998 NIH-sponsored evaluation of the implementation of Section 491 of the Public Health Service Act and “because of the lack of available data about IRB effectiveness and how IRBs function operationally, many of the estimations in this analysis are based on anecdotal evidence.” This commenter stated that reliance on outdated and anecdotal “evidence” means that the NPRM assumptions seriously underestimate predictable costs, such as those derived from current salary data for health care workers who would have at least some background sufficient to explain consent, and the time needed to obtain consent. They also claimed that the NPRM analysis also seriously overestimates cost savings because excluding an activity from the Common Rule does not necessarily remove it from the purview of the IRB pursuant to other laws, such as the HIPAA regulations, and may simply shift the economic burden of responsible oversight to personnel elsewhere within the organization. This commenter also noted that the initial transition costs estimated in the NPRM are staggering, mostly due to costs related to biospecimen provisions.

One commenter stated that a review of the tables indicates that the costs used for hourly wages of individuals affected by the proposed changes may be underestimated by as much as 12 to 139 percent. Similarly, the hours associated with the proposed changes are substantially underestimated.

One commenter stated that an institutional official must be administratively high enough to insist on any necessary institutional changes, most likely a Vice President or higher, and felt that such an official would make at least $250 per hour. This commenter stated that the $48.20 estimate in the proposed rules may apply to liberal arts colleges, but the proportion of medical research conducted at such institutions is small and strongly recommends that salary data from medical institutions (published for public institutions) be used to generate a revised cost estimate. One commenter stated that the estimates of the salary rates presented in the NPRM for institutional officials, IRB members and staff, and investigators are far below the national average for these roles. Likewise, they state that the anticipated benefits of the new proposed rule appear to be grossly overstated.

One commenter stated that the rule as proposed was officially estimated to add $1.4 billion a year to the cost of the current system, but the true cost increase will be at least triple that due to egregious underestimates of wage costs, substantial underestimates of time spent on red tape by investigators, and many underestimated or omitted costs, as well as some estimates that misrepresent the effects of the rule. They claim that the rule is likely to impose about $5 billion a year in needless costs, while reducing rather than improving protection of human subjects. One commenter stated that, at their institution, analysts average far greater pay levels than $15 per hour, and many of the tasks will have to be borne by faculty whose salaries exceed what is identified in the current cost analyses.

One commenter proposed to mandate instead that institutions sufficiently resource their IRBs so as to protect 10 percent of their IRBs' and IRB administrators' time (about 1 meeting/year for an IRB that meets monthly; about 200 hours/year for a full-time equivalent IRB administrator with 2 weeks' vacation and 40-hour work weeks) to devote to finding efficiencies and innovations in the IRB review process.

a. Response to General Comments

We note that the NPRM discussed the fact that data about IRB effectiveness and how IRBs function operationally is generally unavailable. The NPRM further noted that many of the NPRM RIA assumptions were based on anecdotal evidence; the NPRM requested comment on the accuracy of the assumptions presented and on whether better data sources might be available to support the analyses. RIA comments did not provide the evidence necessary to improve our estimates, and thus, limited changes have been made.

We note that the NPRM RIA used a national average for the salary estimates. We received no compelling evidence to change cost estimates because we must account for the fact that personnel and salaries in affected categories vary widely.

2. Extension of the Common Rule to Certain Nonfederally Funded Clinical Trials

One commenter stated that coverage of this subset of projects will extend requirements, such as the single IRB requirement, without any consideration or mechanism for how to implement or fund this requirement and they do not believe that they should be required to accept added cost and burdens without any meaningful or measureable benefit to the welfare of human subjects.

One commenter stated that the inclusion of nonregulated, unfunded trials under the regulations for the subset of organizations that receive federal grants would lead to a significant increase in burden, delay, ambiguity, and cost, and a loss of valuable research without increasing protections for human subjects.

One commenter stated that an unintended burden would be the increased administrative costs of requiring reporting of all clinical trial Unanticipated Problems Involving Risks to Subjects or Others (unanticipated problems) to OHRP. They estimated requiring all unanticipated problems to be reported would increase their institution's necessary reporting by 25 percent.

a. Response to Comments on Extension of the Common Rule to Certain Nonfederally Funded Clinical Trials

The final rule does not adopt this proposal.

3. Biospecimens

With respect to expanding the definition of human subject to include nonidentifiable biospecimens and creating an exemption for secondary research on these specimens and identifiable information, many commenters claimed the NPRM significantly underestimated the cost of including nonidentified biospecimens under human subjects regulations and the consequent requirement for informed consent. Comments of a professional association, which were endorsed by numerous other commenters, stated that the NPRM has underestimated the financial impact of the Common Rule changes by a factor of at least 10, failing to account for the significant volume of specimens gathered outside of the federally funded environment, vastly underestimating the required time commitment and the requirements of administering a database to track consents, failing to include the expense incurred should an individual withdraw his or her consent for future research, and not including the potential expenditures required to develop a robust database that may be queried by researchers to identify biospecimens for use in future research projects. This association, and the numerous commenters who endorsed their comments, also felt that the increased administrative and cost burden to obtain informed consent for nonidentified biospecimens will disproportionately affect departments of pathology and laboratory medicine and will further increase indirect costs, which will eventually be built into the cost recovery rate from NIH, thereby reducing funds available for research when the NIH budget is fixed. One commenter stated that a major operations issue, and the one most necessary to ensure compliance with such a change, is the appropriate cataloging of biospecimens. Inherent in this new process are costs that will vary greatly based on the size of the stock of biospecimens held. Another commenter stated that the estimate for these costs was not plausible given the costs of developing or re-designing electronic systems.

a. Response to Comments on Biospecimens Proposals

As noted above in the preamble, the provisions relating to making nonidentified biospecimens subject to the Common Rule have been entirely eliminated. The final rule RIA does include impact estimates related to this proposal in Section XIX.E of this preamble, discussing the impact of regulatory alternatives considered.

4. Broad Consent

One commenter wrote that the NPRM stated that institutions would need to obtain broad consent from only a third of the 30 million individuals who are estimated to provide research and clinical biospecimens each year.

Several commenters stated that this assertion fails to recognize that broad consent would need to be obtained from most individuals, not just those identified as research subjects, and underestimates the amount of time needed to revise consent processes and obtain such consent. For one institution, assuming staff time to obtain broad consent averages 20 minutes and the minimal staff salary is $25 per hour, this cost alone would be $2.54 million per year. Several commenters noted that the NPRM estimates that, per subject, the investigator or dedicated health care professional will spend 5 to 10 minutes obtaining broad consent, but this institution believes that a more appropriate standard for obtaining broad consents, particularly in the initial years, would be 20 to 30 minutes. One commenter stated that literally hundreds of employees would need extensive training and periodic retraining in research ethics to obtain broad consent, and they calculate that every procedure that involves any tissue collection should take a minimum of 10 to 15 minutes of additional staff time to be able to even attempt to make the process meaningful.

Many other commenters stated that tracking broad consent would impose significant costs, and require significant resources and infrastructure restructuring, given the complicated framework proposed by the NPRM.

One of these commenters also stated that a significant cost absent from the NPRM analysis is the potential need for rebuilding existing biorepositories and databanks that may be invalidated under the NPRM because: (1) The samples were collected without initial broad consent; (2) the samples are coded and thus not eligible for the transition provisions; (3) consenting all human sources would not be feasible; and (4) the revised and limited waiver mechanism would not be available. One commenter estimated that it will require millions of dollars to build and support the necessary IT and infrastructure required to keep track of the consents. One commenter stated that, if the NPRM's concern for “respect for persons” is really sincere, then the cost estimates involved should be increased by a factor of 4 to 10 times what is estimated in the NPRM. One commenter stated estimates that the biospecimen changes alone will cost their institution close to half a million U.S. dollars just in system changes to allow for the added administrative consent processes followed by the tracking mechanisms that will have to be put into place to accommodate the regulatory changes.

a. Response to Comments on Broad Consent

As noted above in the preamble, the provisions relating to making nonidentified biospecimens subject to the Common Rule have been entirely eliminated. Eliminating that proposal largely addresses the concerns regarding costs of the Broad Consent proposal. Note that in response to public comments, we have modified our estimates of the time it would take to seek, obtain, and document broad consent under the regulatory alternatives section of the RIA.

5. Exemptions

One commenter stated that even if a decision tool is used, IRBs will likely still need to review protocols to confirm the exempt classification, which will therefore not result in any cost savings.

a. Response to Comments on Exemptions

The final rule does not include the exemption determination and documentation requirement proposed in the NPRM.

6. Privacy Safeguards

One commenter stated that mandatory use of HIPAA or alternative, but yet-to-be determined, data security provisions would lead to a significant increase in burden, delay, ambiguity, and cost; this commenter also asserted that these safeguards might result in a loss of valuable research without increasing protections for human subjects.

One commenter noted that a large component of the data security safeguards is only necessary because of the 10-fold increase in the number of identified biospecimens due to tracking informed consent and that this adds significantly to the cost of this requirement, well beyond what was represented in the NPRM RIA.

a. Response to Comments on Privacy Safeguards

The final rule does not adopt the NPRM's proposal to implement standardized privacy safeguards.

7. Continuing Review

One commenter applauded the NPRM for recognizing the cost-benefit value of eliminating continuing review for many studies. This will have a positive impact on the workload of investigators and IRBs.

8. Single IRB Review

Several commenters stated that mandated single IRB review would not decrease the burden for investigators but would, in fact, increase the burden in both the long and short term. They stated that investigators who currently work only with a single IRB (their institution's IRB) will now have to work with multiple IRBs, adding to burden. Further, the resources needed to use a commercial IRB would be beyond the capacity of small trials, which often have limited resources. One of these commenters estimated that, an investigator who has 50 protocols and currently two IRBs of record, would have a minimum of 10 different IRBs of record under the regulations proposed in the NPRM. As a result, the investigator would need to work with at least an additional 8 IRBs (10 in total), each with unique and complex requirements.

One commenter stated that the NPRM grossly underestimates in its assumption that a central IRB administrator would cost $15 per hour.

One commenter stated that developing the infrastructure to support this effort will involve significant financial costs. Although using single IRBs for multi-institutional studies has the potential for long-term cost savings and reduction of burden when implemented well, reaching that point requires a substantial initial investment. Many other commenters agreed that the NPRM underestimated these initial costs. They stated that these “start-up costs” include but are not limited to: The creation of electronic management systems that are interoperable among institutions; the adaptation of automated processes to multiple institutions; the communications tools necessary to link investigators and IRBs; the staff time necessary to develop agreements, consensus documents, or standard operating procedures; and the interaction necessary to build and maintain trusting relationships among institutional officials. One university received an estimate from the vendor of such a system that costs to accommodate this change would be in excess of $220,000 for the initial changes, with increased maintenance costs thereafter. In addition, the university would need to hire at least one full-time-equivalent (FTE) to handle the interface with all of the potential central IRBs and this position has a salary mid-point of $54,000, to which would be applied fringe benefits costs of $19,500. Several commenters noted that, even for institutions not serving as the IRB of record, there are real financial implications of participating in the centralized process in terms of adapting existing software systems and protocols.

One commenter noted that the RIA section of the NPRM assigned nearly one-third of the total financial benefit of the revised Common Rule to savings achieved by the use of single IRBs for cooperative research. The RIA arrived at its estimate by assuming that when a single IRB of record reviews a protocol, all institutional costs are eliminated. The commenting institution uses numerous single IRBs, and they say they know from experience that the assumptions in the RIA are erroneous and no net savings accrue for IRB staff when using single IRBs of record. This same commenter noted that the NPRM states that its authors believe that, over time, standardization of agreements will occur so that all issues that currently take weeks or months to negotiate will be resolved. This commenter stated that no data to support this assumption and that, with each new single IRB required by NIH, they find a new set of requirements that requires the negotiation of hundreds of agreements with other institutions. They believe that study initiation will often be delayed because of this requirement and will result in additional software system needs and costs that are not even contemplated in the NPRM. They also stated that the vast majority of research-intensive universities are already over the federal mandated 26 percent facilities and administrative cap. Therefore, the commenter noted, the universities have no mechanism for funding the additional costs of serving as a central IRB because IRB costs are included in the portion of the facilities and administrative costs.

One commenter estimated the costs of ensuring an appropriate data flow between an institution and each new IRB of record, with respect to research studies conducted, to require an extra 200 hours of IRB administrator time, in addition to software customization, configuration, and development costs. This commenter estimated the true costs far exceed those included in the NPRM by a factor of 1433 percent (2150 hours required in total for 10 IRBs of record, versus 150 hours). Even splitting the difference to only a factor of 767 percent (1150 hours required in total for 10 IRBs of record versus 150 hours), the true costs of this approach virtually eclipse any possible quantified benefits estimated in the NPRM.

Two commenters cautioned that the costs to implement single IRB review in multi-institutional studies should not be factored into the overall cost breakdown of a contract or grant. In other words, federal departments and agencies supporting research should make additional funds available to cover the costs associated with implementing § __.114.

a. Response to Comments on Single IRB Review

We agree with commenters who felt that mandated single IRB review will ultimately decrease administrative burdens and inefficiencies for investigators and institutions, while acknowledging that the transition to this model will require time and an adjustment to institutional structures and policies. To incorporate this into our estimates, we assume that investigators for which multi-institutional reviews are eliminated will face a reduction in burden associated with the elimination of the site-specific protocol review, but will face increased burden in the form of coordination with investigators at other sites, for example to ensure that the results of the IRB review are effectively communicated. Specifically, we assume that the elimination of multi-institutional reviews will result in investigators spending half as much time engaging with the review process as they would have if IRB review had taken place at all sites. As a result, the estimated quantified benefits associated with the elimination of multi-institutional review have been revised downward by 27 percent.

9. Posting of Clinical Trial Informed Consent Forms

Several commenters stated that they do not see the utility of the proposed provision to publish consent forms to a public Web site as it creates a new administrative burden without providing any clear additional protection for research subjects or benefit to the public at large. One commenter stated that the cost estimates that the NPRM attaches to this proposed requirement are unrealistically low. One commenter stated that if the site is either ClinicalTrials.gov or some future site that is of equal difficulty to use, the cost estimates for investigators and institutions to upload to the site are greatly underestimated. This institution has found that their investigators have found ClinicalTrials.gov sufficiently difficult that they have had to add and train staff devoted solely to meet this requirement.

a. Response to Comments on Posting of Consent Forms

We note that this change, compared to the huge costs of clinical trials, will add a relatively small amount of additional burden. The time by which a consent form must be posted has been greatly extended. Furthermore, provisions have been added that allow for redaction of certain portions of consent forms, including the entire form in appropriate instances. We estimate that the revised rule will not affect the quantified and nonquantified costs summarized in the NPRM.

D. Analysis of Benefits and Costs

In this section, we present the analysis of the quantified and nonquantified benefits and costs of the changes to the Common Rule. First, we discuss the common assumptions of the analysis. Then we present the estimated quantified and nonquantified benefits and costs of the specific changes. As discussed above and in the NPRM, because of the lack of available data about IRB effectiveness and how IRBs function operationally, many of the estimations in this analysis are based on anecdotal evidence.

1. Analytic Assumptions

The analysis relies on common data elements and assumptions, detailed below, concerning the domestic entities, individuals, and IRB reviews affected by the changes to the Common Rule. Many of the estimates are derived from a 1998 NIH-sponsored evaluation of the implementation of Section 491 of the Public Health Service Act, which involved nationally representative surveys of IRBs, institutions, and investigators. Based on a review of the literature, this study contains the best available data on the time spent on protocol reviews as well as the characteristics of the reviews themselves. Additionally, OHRP processes the majority of FWAs and IRB registrations for all Common Rule departments or agencies. Thus, using information from the OHRP database of assured institutions and registered institutions or organizations and their IRBs is a reasonable way to estimate the number of institutions and IRBs regulated by all Common Rule departments or agencies that will be affected by these changes. OHRP's IRB registration process requires institutions and organizations to provide information about the approximate number of active protocols reviewed by IRBs during the preceding 12 months. Thus, OHRP's IRB database is the best source for determining the total number of protocols reviewed by IRBs at this time.

According to the OHRP database of assured institutions and registered institutions or organizations and their IRBs, approximately 8,035 institutions in the United States have an FWA, of which 2,871 have an IRB. Some institutions have multiple IRBs and some IRBs are not affiliated with an institution with an FWA. In total, 3,499 registered IRBs are in the United States.

The OHRP database of assured institutions and registered institutions or organizations and their IRBs shows that 675,390 annual reviews of nonexempt protocols involving human subjects are conducted. It is estimated that of this total, 324,187 are initial protocol reviews (48 percent) and 351,203 are continuing protocol reviews (52 percent) based on estimates reported in Bell et al. In each category, it is estimated that 69 percent of these reviews are convened and 31 percent are expedited based on estimates reported in Bell et al.

It is estimated that 472,773 reviews of single-site protocols (70 percent) and 202,617 reviews of multi-institutional protocols (30 percent) take place, based on estimates reported in Bell et al. This analysis also assumes that, on average, 5 IRB reviews take place per multiple-site protocol. This implies 472,773 single-site protocols and 40,523 multi-institutional protocols, for a total of 513,296 protocols. The above also implies approximately 246,382 new protocols each year.

Based on queries of ClinicalTrials.gov, we estimated that HHS supports 909 new clinical trials annually, of which 575 are regulated by FDA. In addition, based on queries of ClinicalTrials.gov, non-HHS Common Rule departments and agencies support approximately 5,270 studies.

Many individuals in various occupations would be affected by the changes to the Common Rule. We estimated that an average of one institution official at each institution with an FWA would be affected by these changes, for a total of 2,871 institution officials. The OHRP database of registered IRBs shows that IRBs have 10,197 full-time equivalents (FTEs) staff persons working as administrators or administrative staff, and that 89.8 percent of IRBs have an administrator. It is assumed that these individuals work full-time, implying a total of 3,193 IRB administrators and 7,004 IRB administrative staff. The OHRP database of IRB membership rosters contains 3,359 individuals who serve as IRB chairs and an additional 32,518 voting members. The number of IRB chairs is less than the number of IRBs because some individuals chair multiple IRBs. It is assumed that 439,968 investigators conduct human subjects research in the United States.

We estimated the hourly wages of individuals affected by the changes to the Common Rule using information on annual salaries provided by the U.S. Bureau of Labor Statistics and the U.S. Office of Personal Management. The salary of postsecondary education administrators is used as a proxy for the salary of institution officials; the salary of lawyers is used as a proxy for the salary of institution legal staff and IRB administrators; the salary of office and administrative support workers is used as a proxy for the salary of IRB administrative staff; the salary of postsecondary health teachers is used as a proxy for the salary of IRB chairs and IRB voting members; the salary of postsecondary teachers is used as a proxy for the salary of investigators; the salary of database and systems administrators and network architects is used as a proxy for the salary of database administrators; and the salary of all occupations, as a proxy for the salary of prospective human subjects. The federal employees affected by the changes to the Common Rule are assumed to be Step 5 within their GS-level and earn locality pay for the District of Columbia, Baltimore, and Northern Virginia. Annual salaries are divided by 2,087 hours to derive hourly wages. To project wages over 2017-2026, wages are adjusted for growth over time using the average annual per capita growth in real wage income over 1929-2012 reported by the U.S. Bureau of Economic Analysis, which is 2.1 percent. The total dollar value of labor, which includes wages, benefits, and overhead, is assumed to be equal to 200 percent of the wage rate.

We calculated person-hours by occupation per initial protocol review and per continuing protocol review based on each occupation's share of total person-hours reported in Bell et al. In particular, Bell et al. reports that institution officials account for 4 percent, IRB administrators account for 28 percent, IRB administrative staff account for 30 percent, IRB chairs account for 7 percent, and IRB voting members account for 31 percent of total person-hours. We assumed that the average number of person-hours spent per review equals the weighted average of the person-hours spent per convened review and the person-hours spent per expedited review. We further assumed that convened review requires twice as many person-hours as expedited review.

Table 3 shows the number of entities affected by the changes to the Common Rule and other common assumptions of the analysis (described above).

2. Analysis of Changes

We present below an analysis of the quantified and nonquantified benefits and costs of the changes to the Common Rule. For each change, we describe the change, provide a qualitative summary of the anticipated benefits and costs, describe the methods we use to quantify benefits and costs, and then present estimates.

a. Costs for the Regulated Community To Learn New Requirements and Develop Training Materials; Costs for OHRP To Develop Materials and Guidance

Domestic institutions, IRBs, and investigators would need to spend time learning the changes to the Common Rule once training materials become available to them. In addition, IRBs and OHRP would need to update training materials for investigators. OHRP also would need to develop guidance, templates, and a number of electronic resources.

We estimate that institution officials, IRB administrators, IRB administrative staff, IRB chairs, IRB voting members, and investigators would each spend 5 hours to learn the changes to the Common Rule. We also estimate that institution officials would spend 2 hours to learn new procedures, IRB administrators would spend 20 hours, and administrative staff would spend 80 hours. Based on the estimates presented in Table 3, the dollar value of their time is calculated by multiplying hours by their estimated 2016 wages and adjusting for overhead and benefits. For example, to calculate the dollar value of time spent by institution officials to learn the changes to the Common Rule in 2017, we multiply the number of institution officials (2,871) by the number of hours spent per institutional official (5), by the projected hourly wage of institution officials ($49.17), and by the adjustment factor for benefits and overhead (2).

In order to develop the resources required by the final rule, we anticipate that OHRP would need:

• Three staff people at the GS-14 level and three staff people at the GS-13 level to: (1) Promote harmonization efforts to issue guidance across Common Rule agencies and departments; (2) develop guidance for the regulated community; (3) develop template agreements for use by the regulated community; (4) manage the administrative transition to the new processes in the final rule; and, (5) develop web-based posting portals.
• One staff person at the GS-13 level to manage process changes in the final rule, and assist with implementation for the web-based portals.
• One staff person at the GS-11 level to provide technical support for the web-based portals in the final rule.

In addition, the first year after the final rule is published staffing resources beyond what is described above would be necessary:

• Three staff people at the GS-14 level to draft new guidance and revise old guidance.
• One staff person at the GS-14 level to conduct educational seminars.

OHRP also anticipates the following in nonpersonnel costs:

• Technical development of two Web-based portals for investigators to post final consent forms for HHS-funded clinical trials, and for investigators who conduct certain types of demonstration projects to post information about said projects ($350,000)
• Developing five educational seminars (including travel) to educate the public about the requirements of the new rule ($150,000)
• Upgrading equipment for education activities ($50,000)

We also note that additional staff time throughout the Common Rule departments and agencies will be needed to fulfill the consultation requirement found in § __.102(e)(7). As we assume that this consultation will not involve the hiring of additional personnel to fulfill, we consider this a nonquantified cost.

Present value costs of $214 million and annualized costs of $25.0 million are estimated using a 3 percent discount rate; present value costs of $204 million and annualized costs of $29.1 million are estimated using a 7 percent discount rate. Table 4 summarizes the quantified and nonquantified benefits and costs to learn new requirements and develop training materials.

b. Extending Oversight to IRBs Unaffiliated With an Institution Holding an FWA (§ __.101(a))

As outlined in the NPRM, and as generally supported by public commenters, the final rule includes a new provision at § __.101(a) that gives Common Rule departments and agencies the authority to enforce compliance directly against IRBs that are not operated by an assured institution. We anticipate that this change will encourage institutions to rely on IRBs not operated by an FWA-holding institution more often and also will assist in the implementation of the requirements at § __.114. Here, we estimate the impact that this proposal will have on IRBs that are not operated by an FWA- holding institution. The estimated impact of this and other related proposals on FWA- holding institutions is addressed in Section XIX.D.2.f of this RIA.

The OHRP database of assured institutions and registered IRBs shows that approximately 449 IRBs not affiliated with an institution holding an FWA will now be subject to oversight. These IRBs will develop an estimated average of 10 written agreements with other institutions each year as a result of this rule. It is further estimated that each agreement will require an average of 10 hours of institution legal staff time and 5 hours of IRB administrator time to complete.

The estimated costs to institution officials, IRB administrators, IRB administrative staff, IRB chairs, IRB voting members, and investigators of conducting these reviews are based on the estimates presented in Table 3. The dollar value of their time is calculated by multiplying hours by their estimated 2017-2026 wages and adjusting for overhead and benefits.

Present value costs of $85.6 million and annualized costs of $10.0 million are estimated using a 3 percent discount rate; present value costs of $70.0 million and annualized costs of $10.0 million are estimated using a 7 percent discount rate. Table 5 summarizes the quantified and nonquantified benefits and costs of extending oversight to IRBs unaffiliated with an institution holding an FWA.

c. Explicit Carve-Outs of Activities From the Definition of Research (§ __.102(l))

The final rule includes four categories that are explicitly deemed to be not research (final rule at § __.102(l)(1)-(4)). These categories include: (1) Scholarly and journalistic activities (e.g., oral history, journalism, biography, literary criticism, legal research and historical scholarship), including the collection and use of information that focuses directly on the specific individuals about whom the information is collected; (2) certain public health surveillance activities; (3) certain collection and analysis activities conducted by a criminal justice agency; and (4) certain activities conducted by a defense, national security, or homeland security authority.

Institutions, investigators, and IRBs involved in supporting, conducting, or reviewing these activities will no longer incur the costs of IRB review and approval and continuing review. Activities that were not intended to be subject to the regulations will clearly be removed from the definition of research, allowing such activities to proceed without delays caused by the need for IRB submission, review, and approval.

We estimate that 3,376 annual reviews of protocols (0.5 percent) will no longer be conducted as a result of the activities deemed not to be research in § __.102(l)(1)-(4). Of these reviews, 1,118 will have undergone convened initial review, 502 will have undergone expedited initial review, 1,212 will have undergone convened continuing review, and 544 will have undergone expedited continuing review based on the distribution of reviews presented in Table 3.

The estimated costs to institution officials, IRB administrators, IRB administrative staff, IRB chairs, IRB voting members, and investigators of conducting these reviews are based on the estimates presented in Table 3. The dollar value of their time is calculated by multiplying hours by their estimated 2017-2026 wages and adjusting for overhead and benefits.

Present value benefits of $36.2 million and annualized benefits of $4.24 million are estimated using a 3 percent discount rate, and present value benefits of $29.6 million and annualized benefits of $4.22 million are estimated using a 7 percent discount rate. Table 6 summarizes the quantified and nonquantified benefits and costs of excluding these activities from the requirements of the Common Rule.

d. Clarifying and Harmonizing Regulatory Requirements and Agency Guidance (§ __.101(j))

The final rule at § __.101(j) requires consultation among the Common Rule departments and agencies for the purpose of harmonization of guidance (to the extent appropriate) before federal guidance on the Common Rule is issued, unless such consultation is not feasible.

As this change likely will not affect staffing requirements in the Federal Government, no costs are quantified here. It is possible however, that the harmonization requirement could result in it taking longer for Common Rule department or agency guidance to be approved and issued to the public. Similarly, as the extent to which this change will reduce the time IRBs spend on reviewing protocols is unclear, benefits are also not quantified. Table 7 summarizes the nonquantified benefits and costs of clarifying and harmonizing regulatory requirements and agency guidance.

e. Modifying the Assurance Requirements (§ __.103)

The final rule modifies the requirements of the assurance process in the following ways. First, the final rule does not include the pre-2018 requirement of identifying a statement of principles governing all research at an institution. The requirement for institutions to designate a set of ethical principles by which that institution will abide in all research activities was generally not enforced. Further, for international institutions that received U.S. Government funding for research activities, it created the impression that these international institutions must modify their internal procedures to comport with the set of principles designated on the FWA for activities conducted at those institutions that received no U.S. Government funding. This provision was deleted from the final rule to provide clarity to these international institutions that such measures are not required for activities that receive no Common Rule department or agency support.

The requirement in the pre-2018 rule that a written assurance include a list of IRB members for each IRB designated under the assurance has been moved to § __.108(a)(2) and modified. The final rule requires that an institution, or when appropriate the IRB, prepare and maintain a current detailed list of the IRB members with information sufficient to describe each member's chief anticipated contributions to IRB deliberation, and any employment or other relationship between each member and the institution. The final rule also deletes the pre-2018 requirement that changes in IRB membership be reported to the department or agency head, or to OHRP when the existence of an HHS-approved assurance is accepted.

The changes to the IRB roster requirement are expected to reduce administrative burden without having any significant impact on the protection of human subjects:

Finally, the requirement in the pre-2018 rule that a department or agency head's evaluation of an assurance take certain factors into consideration has been deleted. These factors include the adequacy of the proposed IRB in light of the anticipated scope of the institution's activities and the types of subject populations likely to be involved, the appropriateness of the proposed initial and continuing review procedures in light of the probable risks, and the size and complexity of the institution. Deletion of that provision eliminates an administrative process that was no longer meaningful given the purpose and design of the FWA and OHRP's processes for reviewing IRB registrations and reviewing and approving FWAs. This change also harmonizes the Common Rule with FDA's human subjects protection regulations by eliminating the requirement to submit IRB membership lists.

We estimate that administrative staff at each IRB would spend 5 fewer hours complying with the assurance requirements. Based on the estimates presented in Table 3, the dollar value of their time is calculated by multiplying hours by their estimated 2017-2026 wages and adjusting for overhead and benefits.

Present value benefits of $5.93 million and annualized benefits of $0.69 million are estimated using a 3 percent discount rate; present value benefits of $4.18 million and annualized benefits of $0.60 million are estimated using a 7 percent discount rate. Table 8 summarizes the quantified and nonquantified benefits and costs of the proposed change to the IRB roster requirement.

f. Requirement for Documenting Reliance on IRBs Not Operated by the FWA-Holding Institution (§§ __.103(e) and __.115(a)(9))

The final rule contains a requirement at § __.103(e) that, to ensure compliance with the requirements of the Common Rule, nonexempt human subjects research subject to this policy that takes place at an institution in which IRB oversight is conducted by an IRB that is not operated by the institution, the institution and the organization operating the IRB shall document the institution's reliance on the IRB for oversight of the research and the responsibilities that each entity will undertake. This requirement could be satisfied, for example, by: (1) Developing a written agreement between the institution and the IRB; (2) implementing an institution-wide policy directive providing the allocation of responsibilities between the institution and an IRB that is not affiliated with the institution; or (3) describing the allocation of responsibilities in a research protocol. In addition, a requirement is added at § __.115(a)(9) of the final rule that institutions or IRBs retain this written agreement or other procedures undertaken to ensure compliance with the requirements of this policy, as described in § __.103(e).

Initially, costs would be involved in drafting, revising, and conducting managerial review of agreements to ensure they satisfy these new requirements. Anticipated benefits include greater reliance on IRBs not operated by the institutions as the IRB of record for cooperative research.

Table 3 shows that 5,164 FWA-holding institutions do not have an IRB and 2,871 FWA-holding institutions have an IRB. We assume that the 5,164 FWA-holding institutions without an IRB have an average of 1 IRB authorization agreement that will need to be modified as a result of the new requirements for agreements between institutions and IRBs not operated by the institutions in 2017. In addition, we assume that the 2,871 FWA-holding institutions with an IRB have an average of 0.20 IRB authorization agreements that would need to be modified in 2017. We estimate that each agreement will require an average of 10 hours of institution legal staff time and 5 hours of IRB administrator time to complete. The dollar value of their time is calculated by multiplying hours by their estimated 2017 wages and adjusting for overhead and benefits.

Present value costs of $11.4 million and annualized costs of $1.33 million are estimated using a 3 percent discount rate; present value costs of $10.9 million and annualized costs of $1.56 million are estimated using a 7 percent discount rate. Table 9 summarizes the quantified and nonquantified benefits and costs of the requirement for written procedures and agreements for reliance on IRBs not operated by the FWA-holding institution (§§ __.103(e) and __.115(a)(9) in the final rule).

g. Eliminating the Requirement That the Grant Application Undergo IRB Review and Approval (Pre-2018 Rule at § __.103(f))

The final rule eliminates the requirement in the pre-2018 rule that grant applications undergo IRB review and approval for the purposes of certification. The grant application is often outdated by the time the research study is submitted for IRB review and contains detailed information about the costs of a study, personnel, and administrative issues that go beyond the mission of the IRB to protect human subjects. Therefore, experience suggests that review and approval of the grant application is not a productive use of IRB time, and the change likely will not reduce protections for human subjects or impose other costs.

We estimate that 324,187 initial reviews of protocols occur annually, of which 223,689 involve convened review and 100,498 involve expedited review based on the distribution of reviews presented in Table 3. For the purpose of this analysis, we assume that each protocol reviewed by an IRB is associated with one grant application or other funding proposal. We estimate that investigators spend an average of 15 minutes compiling their grant applications when they submit a protocol for initial review. Further, we estimate that IRBs typically use two primary reviewers for convened review and one primary reviewer for expedited review, and that primary reviewers spend an average of 30 minutes reviewing the grant application. Based on the estimates in Table 3, the dollar value of their time is calculated by multiplying hours by their estimated 2017-2026 wages and adjusting for overhead and benefits.

Present value benefits of $326 million and annualized benefits of $38.2 million are estimated using a 3 percent discount rate and present value benefits of $230 million and annualized benefits of $32.7 million are estimated using a 7 percent discount rate. Table 10 below summarizes the quantified and nonquantified benefits and costs of eliminating the requirement that the grant application undergo IRB review and approval.

h. Expansion of Exemption Categories (§ __.104(d))

The final rule includes eight exemption categories. Some of these categories include subcategories of exemptions.

We note that one pre-2018 exemption does not appear in the final rule (exemption for educational tests, survey procedures, interview procedures, or observation of public behavior where a statute requires confidentiality of the information collected, or where the human subjects involved in the activity are public figures). We also note that several of the final rule exemptions were proposed in the NPRM as exclusions. Finally, we note that only one pre-2018 exemption has been unmodified in the final rule (the exemption for taste and food quality evaluations).

The exemptions included in the final rule are:

• Certain research involving normal educational practices
• Certain research that involves the use of educational tests, survey procedures, interview procedures, or observation of public behavior
• Research involving benign behavioral interventions in conjunction with the collection of information from an adult subject through verbal or written responses or video recording
• Research involving the secondary use of identifiable private information or identifiable biospecimens provided that:

○ The sources are publicly available

○ The information is recorded in such a manner that the identity of subjects is not readily ascertainable by the investigator

○ The research is regulated as “health care operations,” “public health activities,” or “research” under HIPAA

○ The research is conducted by or on behalf of a federal department or agency using government-generated or government-collected nonresearch information, provided that certain conditions are met

• Research and demonstration projects conducted or supported by a federal department or agency

○ In addition to OHRP's interpretation of this exemption expanding under the final rule, and language being modified in this exemption to reflect that expanded interpretation, the final rule also includes a requirement that federal departments or agencies conducting or supporting demonstration projects post information about these studies on a publicly accessible federal Web site

• Taste and food quality evaluation and consumer acceptance studies
• The storage and maintenance of identifiable biospecimens or identifiable private information for unspecified secondary research studies
• The secondary research use of identifiable biospecimens or identifiable private information where broad consent has been sought and obtained

The goal of the posting requirement in the exemption for research and demonstration projects (final rule at § __.104(d)(5)) is to promote transparency in federally conducted or supported activities affecting the public that are not subject to oversight under the Common Rule. It should not create any delay in research. HHS will develop a resource that all Common Rule departments and agencies may use to satisfy the posting requirement (accounted for in Section XIX.D.2.a of this RIA). Alternatively, an agency can create or modify its own Web site for this purpose. Thus, increased transparency in federally funded or supported demonstration projects is a non-quantified benefit of the final rule modifications.

Other nonquantified benefits of the expansion to the modifications of exempt research include clearer instructions to the regulated community about the extent to which creating a system for storing and maintaining identifiable biospecimens and identifiable private information for future, unspecified secondary research activities is governed by this rule. Additionally, by reducing the IRB burden associated with approving this type of activity, the new exemption for storing and maintaining identifiable biospecimens and identifiable private information also incentivizes the creation of institution-wide, comprehensive systems for storing and maintaining such biospecimens and information. We anticipate that this will, in turn, foster research while also giving human subjects increased control over how their identifiable biospecimens and identifiable private information will be used (promoting the principle of respect for persons).

Consistent with the NPRM, we estimate that 70,916 annual reviews of protocols (10.5 percent) would no longer be conducted as a result of the changes at § __.104(d). Of these reviews, 23,487 will have undergone convened initial review, 10,552 will have undergone expedited initial review, 25,445 will have undergone convened continuing review, and 11,432 will have undergone expedited continuing review based on the distribution of reviews presented in Table 3.

Further, we estimate that that 1,000 exempt research and demonstration studies are currently conducted each year. We further estimate that due to the change in OHRP's interpretation of the research and demonstration project exemption at § __.104(d)(5), an additional 3,376 annual reviews of protocols (0.5 percent) will no longer be conducted. Of these 3,376 reviews, 1,118 would have undergone convened initial review, 502 would have undergone expedited initial review, 1,212 would have undergone convened continuing review, and 544 would have undergone expedited continuing review based on the distribution of reviews presented in Table 3. The 4,376 estimated annual studies conducted under this exemption will need to be posted on a federal Web site as required by § __.104(d)(5)(i). We anticipate that it will take individuals at the IRB administrative staff level 15 minutes per study to post the study on the Web site.

Present value benefits of $798 million and annualized benefits of $93.6 million are estimated using a 3 percent discount rate, and present value benefits of $653 million and annualized benefits of $93.0 million are estimated using a 7 percent discount rate. Present value costs of $0.37 million and annualized costs of $0.04 million are estimated using a 3 percent discount rate; present value costs of $0.30 million and annualized costs of $0.04 million are estimated using a 7 percent discount rate. Table 11 summarizes the quantified and nonquantified benefits and costs of amending an exempt category.

i. Elimination of Continuing Review of Research Under Specific Conditions (§§ __.109(f) and __.115(a)(3))

The final rule eliminates continuing review for many minimal risk studies, as detailed at § __.109(f). Unless an IRB determines otherwise, continuing review of research is not required if: (1) The research is eligible for expedited review in accordance with § __.110; (2) the research is reviewed by the IRB in accordance with the limited IRB review procedure described in several of the exemption categories (specifically, § __.104(d)(2)(iii), § __.104(d)(3)(i)(C), § __.104(d)(7), or § __.104(d)(8)); or (3) the research has progressed to the point that it only involves data analysis (including analysis of identifiable information or identifiable biospecimens) or access to follow-up clinical data from procedures that subjects would undergo as part of clinical care. If an IRB chooses to conduct continuing review even when these conditions are met, the rationale for doing so must be documented according to a new provision at § __.115(a)(3).

We estimate that 108,873 expedited continuing reviews of protocols occur annually, based on the distribution of reviews presented in Table 3. Of these reviews, we further estimate that 81,546 reviews (75 percent) will not be eliminated by other changes to the Common Rule (such as the modifications at § __.104(d)). It is estimated that 40,773 of these 81,546 reviews (50 percent) will be discontinued under § __.109(f), and the remaining 40,773 reviews (50 percent) will still require documentation of the rationale for doing so (as required under § __.115(a)(3)). We also estimate that IRB voting members will spend 1 hour per review providing the necessary documentation. In addition, administrative staff at each IRB will spend an estimated 10 hours in 2017 updating their communication systems to no longer send continuing review reminders to affected investigators.

The estimated costs to institution officials, IRB administrators, IRB administrative staff, IRB chairs, IRB voting members, and investigators of conducting these reviews are based on the estimates presented in Table 3. The dollar value of their time is calculated by multiplying hours by their estimated 2017-2026 wages and adjusting for overhead and benefits.

Present value benefits of $148 million and annualized benefits of $17.4 million are estimated using a 3 percent discount rate, and present value benefits of $121 million and annualized benefits of $17.3 million are estimated using a 7 percent discount rate. Present value costs of $41.0 million and annualized costs of $4.80 million are estimated using a 3 percent discount rate; present value costs of $33.7 million and annualized costs of $4.80 million are estimated using a 7 percent discount rate. Table 12 summarizes the quantified and nonquantified benefits and costs of the elimination of continuing review of research under specific conditions.

j. Expedited Review Procedures (§§ __.110 and __.115(a)(8))

The final rule changes the default position such that any research activity appearing on the expedited review list is presumed to be minimal risk. Additionally, the final rule requires that, in consultation with other Common Rule departments or agencies, the expedited review categories be reviewed every 8 years and amended as appropriate, followed by publication in the Federal Register and solicitation of public comment. Finally, the final rule contains a new requirement at § __.115(a)(8) concerning IRB records, requiring that IRBs document the rationale for an expedited reviewer's determination that research activities appearing on the expedited review list are more than minimal risk (i.e., an override of the presumption that studies on the Secretary's list of expedited review activities are minimal risk). We note that because the final rule does not include a proposal to develop guidance with a list of activities presumed to be minimal risk, cost estimates in the final rule have been modified accordingly.

Changes to the expedited review procedures are expected to reduce IRB workload by decreasing the amount of time IRB voting members spend making minimal risk determinations and documenting such determinations. Nonquantified benefits include a reduction in the number of studies that require full, convened IRB review should more categories of activities be added to the expedited review list.

According to the estimates presented in Table 3, 209,371 protocols undergo expedited review each year. For these protocols, we estimate that, as a result of these changes, IRB voting members will spend an average of 15 fewer minutes per protocol developing and documenting a rationale for why certain activities that are permitted to be reviewed under the expedited review procedure are minimal risk.

The dollar value of IRB voting member time is calculated by multiplying hours by their estimated 2017-2026 wages and adjusting for overhead and benefits.

Present value benefits of $51.0 million and annualized benefits of $5.98 million are estimated using a 3 percent discount rate, and present value benefits of $41.7 million and annualized benefits of $5.94 million are estimated using a 7 percent discount rate. Table 13 summarizes the quantified and nonquantified benefits and costs of amending expedited review procedures.

k. Cooperative Research (§ __.114))

The final rule requires under § __.114 that any institution located in the United States that is engaged in cooperative research shall rely on approval by a single IRB for that portion of the research that is conducted in the United States. This policy has two exceptions (detailed in § __.114(b)(2)): (1) Cooperative research for which more than single IRB review is required by law (including tribal law passed by the official governing body of a American Indian or Alaska Native tribe); and (2) research for which any federal department or agency supporting or conducting the research determines and documents that the use of a single IRB is not appropriate for the particular study. Nonquantified benefits of this change include standardization of human subjects protections in multi-institutional studies.

Ultimately, these revisions are expected to lower costs associated with multiple reviews for investigators, institutions, and IRBs. Some cost shifting may occur as certain IRBs assume the role of reviewing IRB. However, these will be offset by savings at other IRBs that are no longer required to conduct additional reviews of the same research study. Initially, IRBs and institutions will have to draft and revise their policies regarding their reliance on single IRBs. It is expected that, over time, reliance agreements and other methods of documenting external reliance will become standardized, which will result in reduced costs associated with multiple reviews and time savings for investigators who no longer must wait for multiple reviews.

The OHRP database of registered institutions and IRBs shows that 8,035 institutions have an FWA. We estimate that these institutions will develop an average of 10 written joint review agreements with other institutions in 2019 before the first year of compliance. We further estimate that each agreement will require an average of 10 hours of institution legal staff time and 5 hours of IRB administrator time to complete. The dollar value of their time is calculated by multiplying hours by their estimated wages and adjusting for overhead and benefits.

We estimate that 202,617 annual reviews of multi-institutional protocols take place, and an average of 5 reviews per multi-institutional protocol, implying that 40,523 multi-institutional protocols are reviewed each year. We further estimate that 16,209 (40 percent) of these multi-institutional studies are funded by NIH and thus will already be subject to NIH's single IRB review policy. Accordingly, we estimate that approximately 97,256 annual reviews of protocols will no longer be conducted as a result of these proposed changes. Of these reviews, 32,211 would have undergone convened initial review, 14,472 would have undergone expedited initial review, 34,896 would have undergone convened continuing review, and 15,678 would have undergone expedited continuing review based on the distribution of reviews presented in Table 3.

In response to comments on the NPRM RIA, we have modified our assumptions of how much time would ultimately be saved by the implementation of this proposal (see Section XIX.C of this RIA). We assume that investigators for whom multi-institutional reviews are eliminated will face a reduction in burden associated with the elimination of the site-specific protocol review, but will face increased burden in the form of coordination with investigators at other sites, for example, to ensure that the results of the IRB review are effectively communicated. Specifically, we assume that the elimination of multi-institutional reviews will result in investigators spending half as much time engaging with the review process as they would have if IRB review had taken place at all sites.

The estimated costs to institution officials, IRB administrators, IRB administrative staff, IRB chairs, IRB voting members, and investigators of conducting these reviews are based on the estimates presented in Table 3, adjusted accordingly to account for our assumption that the time savings for these eliminated reviews is reduced by half for investigators. The dollar value of their time is calculated by multiplying hours by their estimated 2020-2026 wages and adjusting for overhead and benefits.

Present value benefits of $538 million and annualized benefits of $63.1 million are estimated using a 3 percent discount rate, and present value benefits of $414 million and annualized benefits of $59.0 million are estimated using a 7 percent discount rate. Present value costs of $157 million and annualized costs of $18.3 million are estimated using a 3 percent discount rate; present value costs of $140 million and annualized costs of $19.9 million are estimated using a 7 percent discount rate. Table 14 summarizes the quantified and nonquantified benefits and costs of cooperative research.

l. Changes in the Elements of Consent, Including Documentation (§§ __.116(a)(5), (b)(9), (c)(7)-(9), and __.117(b))

The final rule imposes a new requirement at § __.116(a)(5)(i) that informed consent must begin with a concise and focused presentation of the key information that is most likely to assist a prospective subject or legally authorized representative in understanding the reasons why one might or might not want to participate in the research. This provision further mandates that this part of the informed consent must be organized and presented in a way that facilitates comprehension. This requirement applies to all informed consent processes, except for broad consent obtained pursuant to § __.116(d), which may warrant a different presentation.

The final rule includes a new element of consent at § __.116(b)(9) that requires one of the following statements be included for any research that involves the collection of identifiable private information or identifiable biospecimens:

• A statement that identifiers might be removed from the identifiable private information or identifiable biospecimens and that, after such removal, the information or biospecimens could be used for future research studies or distributed to another investigator for future research studies without additional informed consent from the subject or the legally authorized representative, if this might be a possibility; or
• A statement that the subject's information or biospecimens collected as part of the research, even if identifiers are removed, will not be used or distributed for future research studies.

This new requirement is intended to give the potential subject the knowledge that identifiers might be removed from information or biospecimens for their use in future research without additional consent, when such a possibility exists, so he or she can make a fully informed decision about whether to participate in the research. If subjects' identifiable private information or identifiable biospecimens will not be used for future research studies, even if identifiers are removed, this new element of consent requires that subjects be informed of this as well.

The final rule's three additional elements of consent are in § __.116(c)(7), (8), and (9). These require that a subject be informed of the following, when appropriate:

• That the subject's biospecimens (even if identifiers are removed) may be used for commercial profit and whether the subject will or will not share in this commercial profit;
• Whether clinically relevant research results, including individual research results, will be disclosed to subjects, and if so, under what conditions.
• For research involving biospecimens, whether the research will (if known) or might include whole genome sequencing (i.e., sequencing of a human germline or somatic specimen with the intent to generate the genome or exome sequence of that specimen.

These three additional elements of consent will promote respect for persons and greater transparency in the research enterprise. Additionally, including the information referenced in these provisions in a consent form will help ensure that prospective subjects are given information necessary for understanding why one might want to participate (or not) in a research study.

The language at § __.117(b)(1) in the final rule was modified to reference § __.116(a)(5)(i) and state that if a short form consent process is used, the key information required by § __.116(a)(5)(i) must be presented first to the prospective subject, before other information, if any, is provided.

We estimate that 246,382 new protocols annually use identifiable information. For each protocol, we estimate that investigators will spend an average of 15 minutes in 2017 updating consent forms to comply with the new requirements found in the final rule at § __.116(a)(5), (b)(9), (c)(7), (c)(8), or (c)(9). Based on the estimates presented in Table 3, the dollar value of investigators' time is calculated by multiplying hours by their estimated 2017 wages and adjusting for overhead and benefits.

We assume that few additional investigators will elect to offer the second option at § __.116(b)(9), and that the investigators who currently offer equivalent options already track the permissible and impermissible uses of information in line with the requirements discussed above. As a result, we estimate that no additional costs are associated with tracking.

Present value costs of $4.62 million and annualized costs of $0.54 million are estimated using a 3 percent discount rate; present value costs of $4.32 million and annualized costs of $0.62 million are estimated using a 7 percent discount rate. Table 15 summarizes the quantified and nonquantified benefits and costs of changes in the basic elements of consent, including documentation.

m. Obtaining Consent to Secondary Use of Identifiable Biospecimens and Identifiable Private Information (§ __.116(d))

Because the final rule does not adopt the NPRM proposal to consider all biospecimens as human subjects regardless of identifiability, the costs associated with seeking, obtaining, and tracking broad consent are reduced significantly. As noted above, comments on the NPRM suggest that the costs associated with building systems to track broad consent are very burdensome. Therefore, we expect that broad consent and institution-wide tracking systems will be pursued only in situations where it generates net benefits. As a result, in the short term, we are unsure of the extent to which institutions will adopt institution-wide mechanisms to seek, obtain, and track broad consent. We anticipate in the short term that broad consent (and the attendant tracking and maintenance obligations) will be a system used and managed by investigators or teams of investigators in their research portfolios. However, we believe that it will be adopted more over time at an institutional level as IT systems evolve at research institutions through normal practice. We lack data to estimate the number of research studies for which this option will be adopted. Each of these studies will have some variable costs (e.g., consent, tracking) and fixed costs (IT infrastructure). Because this is optional, we believe that it will be pursued only if private benefits exceed private costs. Therefore, we anticipate benefits, in terms of improvements in the quality and efficiency of human subjects research, proportional to the adoption of broad consent. We note that the voluntary nature of adoption implies that broad consent may not be sought in some situations where its social benefit exceeds its social cost.

n. Allowing IRBs To Approve a Research Proposal for Subject Recruitment Activities Without Granting a Waiver of Consent (§ __.116(g))

The final rule will allow an IRB to approve a research proposal in which investigators obtain information or biospecimens without individuals' informed consent for the purpose of screening, recruiting, or determining the eligibility of prospective human subjects of research in certain circumstances.

This addresses concerns that the pre-2018 regulations required an IRB to determine that informed consent could be waived before investigators could record identifiable private information for the purpose of screening, recruiting, or determining the eligibility of prospective subjects for a research study. The pre-2018 rule requirement was viewed as burdensome without providing meaningful protections to subjects.

The policy adopted in the final rule should result in time and cost savings for investigators and IRBs, but they likely will be small. The savings will come from IRBs no longer needing to consider whether informed consent can be waived for such preparatory-to-research activities. Savings will accrue for investigators who can proceed with such activities in less time.

We estimate that 1,620 annual initial reviews of protocols (0.5 percent) involve a waiver of consent for recruitment activities that will not be required as a result of these changes. Of these reviews, 1,118 will have undergone convened initial review and 502 will have undergone expedited initial review based on the distribution of reviews presented in Table 3. We estimate that investigators spend an average of 15 minutes requesting a waiver of consent for recruitment activities when they submit a protocol for initial review. We further estimate that IRBs typically use two primary reviewers for convened review and one primary reviewer for expedited review, and that primary reviewers spend an average of 15 minutes determining whether informed consent can be waived. Based on the estimates in Table 3, the dollar value of their time is calculated by multiplying hours by their estimated 2017-2026 wages and adjusting for overhead and benefits.

Present value benefits of $1.25 million and annualized benefits of $0.15 million are estimated using a 3 percent discount rate, and present value benefits of $0.88 million and annualized benefits of $0.13 million are estimated using a 7 percent discount rate. Table 17 summarizes the quantified and nonquantified benefits and costs of eliminating the requirement to waive consent in certain subject recruitment activities.

o. Requirement for Posting of Consent Forms for Common Rule Department or Agency-Supported Clinical Trials (§ __.116(h))

The final rule requires that for each clinical trial conducted or supported by a Federal department or agency, one IRB-approved form used to recruit subjects must be posted by the awardee or the federal department or agency component conducting the trial on a publicly available federal Web site that will be established as a repository for such informed consent forms. The consent form must be posted after the clinical trial is closed to recruitment and no later than 60 days after the last study visit by any subject, as required by the protocol. This provision permits federal departments or agencies to require or permit redactions to these consent forms. As described in Section XIV.H, federal departments or agencies have great latitude in what they may permit or require be redacted.

We believe that public posting of consent forms will increase transparency, enhance confidence in the research enterprise, increase accountability, and inform the development of future consent forms, possibly resulting in future savings in time for investigators developing consent forms. Costs to the Federal Government in creating and maintaining such a repository are described in Section XIX.D.2.a of this RIA.

According to queries of ClinicalTrials.gov, estimated 5,270 clinical trials are conducted or supported by Common Rule agencies, of which an estimated 575 are regulated by provisions in the Federal Food, Drug, and Cosmetic (FD&C) Act and Trade Secrets Act based on the information presented in Table 3. For the purpose of this analysis, it is assumed that each clinical trial is associated with one consent form that must be submitted to the federal system by an investigator.

It is unknown at this time in what other circumstances federal departments or agencies might permit or require redaction, thus the RIA calculates redaction time only in those studies for which the FD&C Act and Trade Secrets Act applies. For the 575 clinical trials regulated by provisions in the FD&C Act and Trade Secrets Act, it is estimated that investigators will spend an average of 30 minutes redacting information before submission. We estimate that investigators will spend an average of 15 minutes submitting each consent form.

Based on the estimates presented in Table 3, the dollar value of investigator time is calculated by multiplying hours by their estimated 2017-2026 wages and adjusting for overhead and benefits.

In addition, submitted consent forms must be reviewed and made accessible to persons with disabilities in compliance with Section 508 Amendment to the Rehabilitation Act of 1973. We estimate that each consent form contains an average of 10 pages and that making each page 508-compliant costs an average of $30 per page.

Present value costs of $15.4 million and annualized costs of $1.80 million are estimated using a 3 percent discount rate; present value costs of $11.0 million and annualized costs of $1.56 million are estimated using a 7 percent discount rate. Table 18 summarizes the quantified and nonquantified benefits and the requirement for posting of consent forms for Common Rule department or agency-supported clinical trials.

p. Alteration in Waiver for Documentation of Informed Consent in Certain Circumstances (§ __.117(c)(1)(iii))

The final rule adds a provision allowing a waiver of the requirement to obtain a signed informed consent form if the subjects are members of a distinct cultural group or community in which signing documents is not the norm. This will be allowed only if the research presents no more than minimal risk of harm to subjects and provided an appropriate alternative method is available to document that informed consent was obtained.

Under the pre-2018 rule, IRBs could waive the requirement for the investigator to obtain a signed consent form for some or all subjects. The pre-2018 criteria for such a waiver may not have been flexible enough for dealing with a variety of circumstances, such as when federally sponsored research is conducted in an international setting where, for example, cultural or historical reasons suggest that signing documents may be viewed as offensive and problematic.

This should not involve cost as its intent is to improve the informed consent process by providing more flexibility regarding the documentation of consent (an ethical gain) while reducing administrative requirements for investigators and research subjects in specific circumstances. Thus, benefits and costs of this new provision are not quantified. Table 19 summarizes the nonquantified benefits and costs of alteration in waiver for documentation of informed consent in certain circumstances.

E. Alternative Approaches to the Definition of Human Subject (NPRM at § __.102(e)) and Related Provisions

1. Overview

We carefully considered the option of not pursuing regulatory action. However, because of shifts in science, technology, public engagement, and public expectations in the past 2 decades, a wide range of stakeholders have raised concerns about the limitations of the existing ethical framework in research, arguing for a re-evaluation of how the fundamental principles that underlie the Common Rule—respect for persons, beneficence, and justice—are applied in practice to the myriad new contexts in which U.S. research is conducted in the 21st century.

The final rule addresses these concerns through three aims. The first aim is to increase human subjects' ability and opportunity to make informed decisions. The second aim is to reduce potential for harm and promote justice by increasing the uniformity of human subject protections. The third aim is to facilitate current and evolving types of research that offer promising approaches to treating and preventing medical and societal problems by reducing ambiguity in interpretation of the regulations, increasing efficiencies in the review system, and reducing requirements on investigators when said requirements do not appear to provide meaningful protections to human subjects. We hope that these changes will also build public trust in the research system. We estimate that the benefits of this regulatory action exceed its costs, and as a result we have chosen to pursue this regulatory action.

The NPRM proposed to expand the definition of human subjects to include research in which an investigator obtains, uses, studies or analyzes a biospecimen. This would have applied regardless of the identifiability of the biospecimen. Generally, investigators would not have been allowed to remove identifiers from biospecimens without obtaining informed consent or a waiver of consent. The NPRM also proposed to modify the criteria for waiver of consent in research involving biospecimens such that a waiver would be very rare. Written consent would generally have been required for such activities. Thus, this change would have significantly expanded the amount of research subject to the Common Rule. This requirement would not have applied to biospecimens and information already collected at the time the final rule is published. The NPRM proposed to exclude from its scope research activities involving nonidentified biospecimens where no new information about an individual is generated. Although activities such as developing new testing assays could have been excluded under this provision, it is anticipated that under the NPRM proposals, most research with biospecimens would have come under the rule.

In addition to promoting respect for persons in the research enterprise, the alternative regulatory structure for research with biospecimens (whereby consent is sought for almost all research activities involving biospecimens) would have encouraged investigators to retain identifiers, which can enhance research by preserving the ability to link biospecimens to important additional information about the subject. Additionally, members of the regulated community have reported situations where, even though not currently required by regulation, investigators were told by an IRB that they needed to obtain study-specific consent for research activities involving nonidentified biospecimens. Under the NPRM proposals, such a situation would not occur because consent—be it broad or study-specific—would always be obtained for research involving biospecimens.

Though this proposal would promote the ethical principle of respect for persons, it also would have significantly increased the volume of studies for which investigators must seek and document informed consent (unless more stringent waiver criteria were met). Additionally, the NPRM acknowledged, and the regulated community reiterated, during the public comment period, that the majority of the studies that the NPRM proposal would have newly regulated were studies involving no more than minimal risk to human subjects.

As an example of the tradeoffs between the NPRM proposal and the ultimate position taken in the final rule, some commenters noted that the proposal to cover all biospecimens under the Common Rule regardless of identifiability might privilege the Belmont Report's principle of autonomy over the principle of justice. Because the NPRM would have required investigators to obtain informed consent in all but rare circumstances for research involving biospecimens, concern was expressed that this could result in lower representation rates in research of minority groups, marginalized members of society, and citizens receiving care in community health clinics (which would be less able to cover the costs of tracking consent status over time). We note that although the available literature suggests that minority consent rates are generally high, minority consent rates in some cases may be lower than for nonminorities. This discrepancy in turn could create issues in the applicability of research discoveries on the population as a whole. Respecting persons is a worthy goal, but the need to achieve representative samples (and thus helping to ensure the applicability of research findings across a population) also must be taken into consideration. In addition, the principle of beneficence requires that all reasonable efforts be made to improve the public good. To balance these sometimes competing interests, the final rule incentivizes asking potential subjects for permission in minimal risk activities (even if a waiver of informed consent could be sought from an IRB), while still allowing other avenues for this research to occur should compelling reasons exist or not obtaining informed consent.

2. Estimated Impact of Alternative Approaches to the Final Rule

The benefit and cost estimations presented below are based upon the proposals and structure presented in the NPRM, not the provisions included in the final rule.

a. Estimating How Many Studies Involving Nonidentified Biospecimens Occur Each Year

We estimate that each year 250,000 studies are not currently subject to oversight by either the Common Rule or FDA regulations because they use biospecimens that have been stripped of identifiers. Extrapolations from 1999 data suggest that biospecimens are collected from as many as 30 million individuals each year and are stored for both clinical and research purposes. Based on conversations with experts in this area, this 1999 report represents the most recent, comprehensive analysis of the volume of nonidentified biospecimens used in research activities.

Approximately 9 million individuals' biospecimens (30 percent of those collected) are collected for research purposes. Approximately 6.3 million individuals' biospecimens (30 percent) could potentially be used in future research studies. Thus, it is possible that investigators would have had to seek consent to secondary use of biospecimens or a waiver of consent for an additional 15 million individuals annually for secondary use of biospecimens.

In the absence of comprehensive data, to calculate the number of protocols that would have been covered, we proposed two approaches. Under method one, we estimated that approximately 50 biospecimens would have been used on average per research protocol involving biospecimens. This gave a potential 300,000 new research protocols using nonidentified biospecimens. This estimate of 300,000 new research protocols was rounded down to 250,000 new studies based on ANPRM comments and industry data, because it seemed reasonable to assume that the number of new biospecimen studies covered by the alternative proposal would equal the total number of new protocols conducted each year (i.e., the number of new biospecimen studies was likely close to the estimate of 246,382 new annual studies each year).

Under method two, biospecimen repository representatives reported that roughly 90 percent of their collections were used in nonidentified form in research activities that did not fall under the pre-2018 rule. Thus, only 10 percent of biospecimen studies were covered under the pre-2018 rule, representing a 9:1 ratio of studies involving nonidentified biospecimens to studies involving identifiable biospecimens. Of the 246,382 new protocols each year that were nonexempt (Table 3), we assumed that 10 to15 percent used identifiable biospecimens. This equated to between 24,638 and 36,957 new studies each year using identifiable biospecimens. We estimated that the number of biospecimen studies that occurred on nonidentified biospecimens each year was approximately 9 times the number of studies using identifiable biospecimens, or between 221,742 and 332,613 studies each year. Thus, under method two, an estimate of 250,000 new studies on nonidentified biospecimens each year was also reasonable.

To facilitate research with biospecimens, the NPRM proposed to create separate elements of broad consent such that investigators and institutions could seek, and individuals could grant, consent for future unspecified research activities. The NPRM also proposed an exemption that relied on obtaining broad consent for future, unspecified research studies. To be eligible for the proposed exemption for specific secondary studies, broad consent must have been sought and obtained using the proposed Secretary's template for broad consent, and the investigator must not have anticipated returning individual research results to subjects.

b. Facilitating Research With Nonidentified Biospecimens Under the NPRM: Exemption for Specific, Secondary Studies When Broad Consent Had Been Sought and Obtained

The NPRM proposed to allow broad consent to secondary research use of biospecimens or identifiable private information for unspecified research purposes. Such broad consent would have specified elements and limitations, and could have been obtained in both the research and nonresearch setting.

The proposed exemption was specifically for secondary research studies involving biospecimens and identifiable private information that had been or would have been acquired for purposes other than the currently proposed research study. If a secondary research study did not meet the requirements of this exemption, the investigator would have needed to seek IRB review of the study, and would have needed to obtain either study-specific consent or a waiver of informed consent. Note that for biospecimens, an IRB would have applied the more stringent waiver criteria under which waiver of informed consent in research involving biospecimens would have been rare. For identifiable private information, an IRB would have applied the waiver criteria almost identical to the criteria in the pre-2018 rule.

We anticipated that a majority of studies that would have used this exemption would have been biospecimen studies. The extent to which individuals conducting secondary research studies involving identifiable private information would have used this exemption is unknown, given the proposed rule provided additional pathways to facilitate such studies. To that end, the benefits and costs associated take into consideration only secondary research involving biospecimens. We further anticipated that the NPRM proposals would have resulted in higher value research with biospecimens being conducted with subjects' consent and without the need for full IRB review, or the need to go back to subjects to obtain consent for every secondary research study, as long as certain conditions were met.

Because the estimated 250,000 biospecimen studies each year that would have been newly covered under the rule as a result of the proposed modification to the definition of human subject would likely have been minimal risk, we assume that all of these would have been eligible for the exemption for secondary use as long as broad consent had been sought and obtained.

Benefits and costs associated with obtaining and tracking broad consent under this alternative proposal are discussed below.

Because the compliance date for the expansion to the definition of human subject would have been 3 years after the date of publication of a final rule, the benefits and costs described below assume a start date of 2020. In the absence of the proposed exemption for secondary research studies, but taking into consideration the expansion to the definition of human subject, we estimate that each year, all 250,000 of these studies would undergo convened initial review. In subsequent years, we estimate that 120,000 protocols would undergo convened initial review, 89,700 would undergo convened continuing review, and 40,300 would undergo expedited continuing review based on the distribution of reviews presented in Table 3. The estimated costs to institution officials, IRB administrators, IRB administrative staff, IRB chairs, IRB voting members, and investigators conducting these reviews are based on the estimates presented in Table 3. The dollar value of their time is calculated by multiplying hours by their estimated 2017-2026 wages and adjusting for overhead and benefits.

c. Facilitating Research With Nonidentified Biospecimens Under the NPRM: Seeking and Obtaining Broad Consent

To facilitate secondary research using biospecimens and identifiable private information, the NPRM also proposed an exemption for storing and maintaining biospecimens and identifiable private information for future, unspecified, secondary research activities. Given the creation of this exemption, the NPRM envisioned that institutions would need to develop tracking systems to monitor which biospecimens or information could be used in secondary research by investigators. Because both the exemption for secondary research use described above, and the exemption required using the proposed Secretary's broad consent, the NPRM assumed that a majority of investigators and institutions would employ the Secretary's consent template. Thus, the NPRM anticipated that minimal time would have been spent updating consent forms or drafting new broad consent forms.

We estimate that 6,428 FWA-holding institutions (80 percent) would have stored and maintained clinical and nonclinical biospecimens and identifiable private information for unspecified future research studies in the manner prescribed under the NPRM. As also discussed previously, extrapolations from 1999 data suggest that biospecimens are collected from as many as 30 million individuals each year and stored for both clinical and research purposes. Approximately 9 million individuals' biospecimens (30 percent) are collected for research purposes, and thus consent would be sought in the research context for the secondary use of these biospecimens. For these 9 million individuals per year, an investigator would spend an estimated 20 minutes per person conducting the consent process specific to seeking broad consent, and the subjects would spend an estimated 20 minutes engaging in the process of having their broad consent for future research uses of their biospecimens or information sought. This estimate of the investigator's time also includes the time for the investigator to log the information into the appropriate database. We note that the NPRM RIA estimated that it would take 5 minutes for an investigator to seek broad consent in the research setting, and that prospective subjects would spend 5 minutes having their broad consent sought. Based on public comments, we have revised this estimate to better reflect experience in the regulated community about how long it takes to seek and obtain consent. We further estimate that investigators would spend 10 minutes of time per protocol updating their study specific consent form to include the language from the Secretary's consent template.

In the clinical setting, approximately 21 million individuals' biospecimens (70 percent of the estimated 30 million individuals' biospecimens collected each year) are collected for clinical purposes. In the first year that the proposed changes would have been implemented, as many as 21 million broad, secondary use consent forms could have been collected from individuals. We anticipate 30 minutes of a subject's time to engage in the consent process. We further anticipate 30 minutes of an institutional employee's time at the IRB Administrative Staff level to seek consent and put the information in the appropriate tracking system. As with the estimate for seeking and obtaining broad consent in the clinical setting, we have increased the estimate of how long it would take institutional employees to seek broad consent and how long prospective subjects would spend participating in the broad consent process based on public comments.

The NPRM proposed that once an individual gave broad consent to use his or her biospecimens in future, unspecified research studies, that consent could cover any biospecimen collected from that individual over the course of a 10-year period. Note that an institution could retain and use the biospecimens collected indefinitely. This provision merely stated that every 10 years an institution must ask people whether or not they may use newly collected biospecimens in research. Given that an institution needed to seek broad consent from an individual only once over the course of a 10-year period, we assumed that after the first year the NPRM was implemented, the number of individuals from whom an institution would seek broad consent would decrease.

To account for this, the RIA alternative approach assumes that after the first year, a fraction of the clinical subjects from whom broad consent was sought in year one would be sought in subsequent years. We anticipate that in year two, secondary use consent would be sought in the clinical context from 10.5 million subjects (50 percent of the number of individuals involved in the year one estimates). We anticipate that in year three and after, secondary use consent would be sought in the clinical context from approximately 6.3 million subjects each year (30 percent of the number of individuals involved in the year one estimates). As in year one, we assume that a prospective subject would spend 30 minutes of time undergoing the consent process and that an institutional employee at the IRB Administrative Staff level would spend 30 minutes of time conducting the consent process with an individual and updating the appropriate tracking system.

d. Estimating the Cost of the Broad Consent Tracking System

To appropriately track biospecimens or identifiable private information for which broad consent had been sought and obtained on an institutional level, an institution would need to develop an institution-wide repository-like schema. The costs include the design, implementation, and operation of the informatics system that would be required to document and keep current thousands of consent documents per year. In addition, the institution would have to come up with a system to mark or otherwise flag which biospecimens and pieces of identifiable private information could be used in future unspecified secondary research studies.

Under the NPRM proposal, we estimate that 80 percent of the 8,035 institutions with FWAs would develop these informatics systems (or modify existing systems) to facilitate research with nonidentified biospecimens. We estimate that under this proposal, institutions on average would require 1.0 database administrator FTE to develop and maintain these systems. We note that as this estimate is a nationwide average, and we expect some institutions would require more database administrators, and others would require fewer.

For all of the estimates described above, the estimated costs to institution officials, IRB administrators, IRB administrative staff, IRB chairs, IRB voting members, database administrators, and investigators of are based on the estimates presented in Table 3. The dollar value of their time is calculated by multiplying hours by their estimated 2017-2026 wages and adjusting for overhead and benefits.

For the alternative proposal (i.e., the NPRM proposal to treat all biospecimens regardless of identifiability as covered under the Common Rule), present value costs of $19.7 billion and annualized costs of $2.31 billion are estimated using a 3 percent discount rate; and present value costs of $14.2 billion and annualized costs of $2.02 billion are estimated using a 7 percent discount rate. Table 20 summarizes the quantified and nonquantified benefits and costs of amending the definition of human subject and obtaining consent to secondary use of biospecimens and identifiable private information.

F. Regulatory Flexibility Analysis

As discussed above, the RFA requires agencies that issue a regulation to analyze options for regulatory relief of small entities if a rule has a significant impact on a substantial number of small entities. HHS considers a rule to have a significant economic impact on a substantial number of small entities if at least 5 percent of small entities experience an impact of more than 3 percent of revenue.

We calculate the costs of the proposed changes to the Common Rule over 2017-2026 to institutions with an FWA. The estimated annualized cost to institutions with an FWA, on average, is $2,516 using a 3 percent discount rate. The U.S. Small Business Administration establishes size standards that define a small entity. According to these standards, colleges, universities, and professional schools with revenues below $27.5 million and hospitals with revenues below $38.5 million are considered small entities. It is not anticipated that a majority of institutions with an FWA are in any of these categories.

XX. Environmental Impact

We have determined under 21 CFR 25.30(k) that this action is of a type that does not individually or cumulatively have a significant effect on the human environment. Therefore, neither an environmental assessment nor an environmental impact statement is required.

XXI. Paperwork Reduction Analysis

This final rule contains collections of information that are subject to review and approval by the Office of Management and Budget (OMB) under the Paperwork Reduction Act (PRA), as amended (44 U.S.C. 3501-3520). A description of these provisions is given in this document with an estimate of the annual reporting and recordkeeping burden.

Title: Federal Policy for the Protection of Human Subjects.

Description: In this document is a discussion of the regulatory provisions we believe are subject to the PRA and the probable information collection burden associated with these provisions. In general, the following actions trigger the PRA: (i) Reporting; (ii) Recordkeeping.

Description of Respondents: The reporting and recordkeeping requirements in this document are imposed on institutions, institutional review boards, and investigators involved in human subjects research conducted or supported or otherwise subject to regulation by any federal department or agency that takes administrative action that makes the policy applicable to such research.

§ __.101(a)(1) Extending Oversight to IRBs-Not Operated by an Institution Holding an FWA (OMB Control No 0990-0260)

Section __.101 is amended, as described in § __.101(a), to give Common Rule departments and agencies the authority to enforce compliance directly against IRBs that, are not operated by an assured institution. It is anticipated that institutions using an IRB that it does not operate will be reassured because compliance actions can be taken directly against the IRB responsible for the regulatory noncompliance, rather than the institutions that relied on that review. As a result of this change, we anticipate that FWA-holding institutions will increase their reliance on IRBs not operated by an FWA-holding institution when appropriate.

The OHRP database of assured institutions and registered IRBs shows that approximately 449 IRBs not operated by an institution holding an FWA will now be subject to oversight. These IRBs will develop an estimated average of 10 written agreements with other institutions each year as a result of this rule. We further estimate that each agreement will require an average of 10 hours of institution legal staff time and 5 hours of IRB administrator time to complete. We note that elsewhere in the final rule (specifically §§ __.103(e) and __.115(a)(9)) requires that IRBs document the specific responsibilities that an institution and an organization operating an IRB each will undertake, when an institution relies on an IRB that it does not operate. The impact of these provisions on FWA-holding institutions is described below.

§ __.103(e) Documentation of IRB Oversight Reliance Requirement for Institution and Organization Operating the IRB (OMB Control No 0990-0260)

To further strengthen the compliance enforcement authority provision in § __.101(a) and provide a record for oversight and compliance purposes, the final rule contains a requirement at § __.103(e), that for nonexempt research involving human subjects covered by this policy (or exempt research for which limited IRB takes place pursuant to § __.104(d)(2)(iii), § __.104(d)(3)(i)(C), § __.104(d)(7), or § __.104(d)(8)) that take place at an institution in which IRB oversight is conducted by an IRB that is not operated by the institution, the institution and the organization operating the IRB shall document the institution's reliance on the IRB for oversight of the research and the responsibilities that each entity will undertake to ensure compliance with the requirements of this policy. This might be accomplished through a written agreement between the institution and the IRB, or by implementing an institution-wide policy directive providing the allocation of responsibilities between the institution and an IRB that is not affiliated with the institution, or as set forth in a research protocol). In addition, a requirement is included at § __.115(a)(9) that an institution include documentation of such arrangements in the IRB records.

Table 3 of the RIA section of the preamble shows that 5,164 FWA-holding institutions do not have an IRB and 2,871 FWA-holding institutions have an IRB. We assume that the 5,164 FWA-holding institutions without an IRB have an average of 1 IRB authorization agreement that will need to be modified as a result of the new requirements for agreements between institutions and IRBs not operated by the institutions in 2017. In addition, we assume that the 2,871 FWA-holding institutions with an IRB have an average of 0.20 IRB authorization agreements that will need to be modified in 2017. We estimate that each agreement will require an average of 10 hours of institution legal staff time and 5 hours of IRB administrator time to complete. The dollar value of their time is calculated by multiplying hours by their estimated 2017 wages and adjusting for overhead and benefits.

§ __.104(d)(5)(i) Posting of Information About Federally Funded or Supported Demonstration Projects

Section 104(d)(5)(i) requires each federal department or agency conducting or supporting the research or demonstration projects covered under this exemption to establish, on a publicly accessible federal Web site or in such other manner as the department or agency head may determine, a list of the research and demonstration projects that the federal department or agency conducts or supports under this provision. We estimate that under the pre-2018 rule, approximately 1,000 demonstration projects occurred each year. Under the modifications to this exemption in the final rule, we estimate that an additional 3,376 studies will fall under this exemption. Thus, approximately 4,376 studies will be subject to this posting requirement each year. We anticipate that investigators will spend approximately 15 minutes per study submitting information about these studies to the federal Web site.

§ __.114 Cooperative Research (OMB Control No 0990-0260)

The final rule requires any institution located in the United States that is engaged in cooperative research to rely upon approval by a single IRB for that portion of the research that is conducted in the United States, as detailed in § __.114 (b)(1). The following research is not subject to the requirements of this provision, as described in § __.114 (b)(2): (1) Cooperative research for which more than single IRB review is required by law (including tribal law passed by the official governing body of a Native American or Alaska Native tribe); or (2) research for which any federal department or agency supporting or conducting the research determines and documents that the use of a single IRB is not appropriate for the particular study.

The OHRP database of assurances shows that 8,035 institutions in the United States have an FWA. We estimate that these institutions will develop an average of 10 written joint IRB review agreements with other institutions or organizations in 2019 before the first year of compliance. We further estimate that each agreement will require an average of 10 hours of institution legal staff time and 5 hours of IRB administrator time to complete.

We estimate that 202,617 annual reviews of multi-institutional protocols take place, and an average of 5 reviews per multi-institutional protocol, implying that 40,523 multi-institutional protocols are reviewed each year. We further estimate that 16,209 (40 percent) of these multi-institutional studies are funded by NIH and thus will already be subject to NIH's single IRB review policy. Accordingly, we estimate that approximately 97,256 annual reviews of protocols will no longer be conducted as a result of these proposed changes. Of these reviews, 32,211 would have undergone convened initial review, 14,472 would have undergone expedited initial review, 34,896 would have undergone convened continuing review, and 15,678 would have undergone expedited continuing review based on the distribution of reviews presented in Table 3 in the RIA section of the preamble.

§ __.115(a)(3) Documenting the Rationale for Conducting Continuing Review of Research That Otherwise Would Not Require Continuing Review(OMB Control No 0990-0260)

The final rule eliminates continuing review for many minimal risk studies, as detailed at § __.109(f). Unless an IRB determines otherwise, continuing review of research is not required if: (1) The research is eligible for expedited review in accordance with § __.110; (2) the research is reviewed by the IRB in accordance with the limited IRB review procedure described in several of the exemption categories (specifically, § __.104(d)(2)(iii), § __.104(d)(3)(i)(C), § __.104(d)(7), or § __.104(d)(8)); or (3) the research has progressed to the point that it involves data analysis (including analysis of identifiable information or identifiable biospecimens) or access to follow-up clinical data from procedures that subjects would undergo as part of clinical care. If an IRB chooses to conduct continuing review even when these conditions are met, the rationale for doing so must be documented according to a new provision at § __.115(a)(3).

We estimate that 40,773 reviews will require documentation of the rationale for doing so (as required under § __.115(a)(3)). We also estimate that IRB voting members will spend 1 hour per review providing the necessary documentation.

§§ __.116(a)(5), (b)(9), (c)(7)-(9) and __.117(b) Changes in the Elements of Consent, Including Documentation (OMB Control No 0990-0260)

The final rule imposes a new requirement at § __.116(a)(5)(i) informed consent must begin with a concise and focused presentation of the key information that is most likely to assist a prospective subject or legally authorized representative in understanding the reasons why one might or might not want to participate in the research. This part of informed consent must be organized and presented in a way that facilitates comprehension. This requirement applies to all informed consent process, except for broad consent obtained pursuant to § __.116(d), which may warrant a different presentation.

The final rule includes a new element of consent at § __.116(b)(9) that requires one of the following statements be included for any research that involves the collection of identifiable private information or identifiable biospecimens: (1) A statement that identifiers might be removed from the identifiable private information or identifiable biospecimens and that after such removal, the information or biospecimens could be used for future research studies or distributed to another investigator for future research studies without additional informed consent from the subject or the legally authorized representative, if this might be a possibility; or (2) a statement that the subject's information or biospecimens collected as part of the research, even if identifiers are removed, will not be used or distributed for future research studies.

The final rule's three additional elements of consent are in § __.116(c)(7), (8), and (9). These require that a subject be informed of the following, when appropriate:

• That the subject's biospecimens (even if identifiers are removed) may be used for commercial profit and whether the subject will or will not share in this commercial profit;
• Whether clinically relevant research results, including individual research results, will be disclosed to subjects, and if so, under what conditions;
• For research involving biospecimens, whether the research will (if known) or might include whole genome sequencing (i.e., sequencing of a human germline or somatic specimen with the intent to generate the genome or exome sequence of that specimen.

These additional elements of consent will promote respect for persons and greater transparency in the research enterprise. Additionally, including the information referenced in these provisions in a consent form will help ensure that prospective subjects are given information necessary for understanding why one might choose whether to participate in a research study.

The language at § __.117(b)(1) in the final rule was modified to reference § __.116(a)(5)(i) and state that if a short form consent process is used, the key information required by § __.116(a)(5)(i) must be presented first to the prospective subject, before other information, if any, is provided.

We estimate that 246,382 new protocols annually will use identifiable private information. For each protocol, we estimate that investigators will spend an average of 15 minutes in 2017 updating consent forms to comply with the new requirements found in the final rule at § __.116(a)(5), (b)(9), (c)(7), (c)(8), or (c)(9) (in Table 3 in the RIA section).

We assume that few additional investigators will elect to offer the second option at § __.116(b)(9), and that the investigators who currently offer equivalent options already track the permissible and impermissible uses of information in line with the requirements discussed above. As a result, we estimate that tracking will have no additional associated impacts.

§ __.116(h) Requirement for Posting of Consent Forms for Common Rule Department or Agency-Supported or Conducted Clinical Trials (OMB Control No 0990-0260)

A new provision in the final rule, § __.116(h), requires that, for each clinical trial conducted or supported by a federal department or agency, one IRB-approved informed consent form used to enroll subjects must be posted by the awardee or federal department or agency component conducting the trial on a publicly available federal Web site that is established as a repository for such informed consent forms. The informed consent form must be published on the federal Web site after the trial is closed to recruitment, and no later than 60 days after the last study visit by any subject, as required by the protocol.

If the federal department or agency supporting or conducting the clinical trial determines that certain information should not be made publicly available on a federal Web site (e.g., confidential commercial information), such Federal department or agency may permit or require redactions to the information posted.

We believe that public posting of consent forms will increase transparency, enhance confidence in the research enterprise, increase accountability, and inform the development of future consent forms, possibly resulting in future savings in time for investigators developing consent forms.

According to queries of ClinicalTrials.gov, an estimated 5,270 clinical trials are conducted or supported by Common Rule agencies, of which an estimated 575 are regulated by provisions in the FD&C Act and Trade Secrets Act based on the information presented in Table 3 in the RIA section of the preamble. We assume that each clinical trial is associated with one consent form that must be submitted to the HHS system by an investigator. We estimate that investigators will spend an average of 15 minutes submitting each consent form. In addition, for the 575 clinical trials regulated by provisions in the FD&C Act and Trade Secrets Act, we estimate that investigators will spend an average of 30 minutes redacting information before submission.

The total estimated burden imposed by these information collection requirements is 1,422,968 burden hours.

It should be noted that the burden estimates for the Common Rule include approved information requirements in OMB No. 0990-0260, Protection of Human Subjects: Compliance with Federal Policy/IRB Recordkeeping/Informed Consent/Consent Documentation, approved through May 31, 2018. As such, it will be amended and submitted to OMB as revisions to currently approved collections once the rule is finalized and the collections are due for renewal.

In compliance with the Paperwork Reduction Act of 1995 (44 U.S.C. 3507(d)), the information collection provisions of this rule will be submitted to OMB for review. These requirements will not be effective until OMB approves them.

XXII. Tribal Consultation Statement

We are committed to consulting with AI/AN tribes and tribal leadership to the extent practicable and permitted by law before promulgating any regulation that has tribal implications. As we developed this rule, we engaged with tribes through tribal consultation and the public comment process. The requirements in this final rule were informed by consultations with and comments from tribal representatives.

On January 5, 2016, HHS conducted a tribal consultation through conference call in accordance with the HHS Tribal Consultation Policy with tribal representatives to obtain comments on the proposed changes to the Common Rule. This conference call was moderated by Elizabeth Carr, a Tribal Affairs Specialist within HHS and a federal representative of HHS's American Indian and Alaska Native Health Research Advisory Council. Tribal leaders and other interested parties were informed of this consultation through written communication. The written invitation included a solicitation for formal comments and information on how to submit a formal comment to the public docket. Public comments were also solicited during the consultation conference call. A transcript of this call was posted to the Regulations.gov public docket for the Common Rule on January 13, 2016.

During the tribal consultation conference call, participants discussed:

• Concern about the NPRM not acknowledging the role of tribal governments in research oversight of research occurring on tribal land or with tribal citizens;
• Concern about the pre-2018 rule and the NPRM not explicitly acknowledging tribal sovereignty. HHS representatives acknowledged an outstanding legal question about whether rules created by tribal governments were encompassed by the provision in the pre-2018 rule and the NPRM's statement that the policy does not affect any state or local laws or regulations that may otherwise be applicable and that provide additional protections for human subjects;
• Concern about the NPRM not acknowledging the unique and significant impact that the proposed changes would have on American Indian and Alaska Native populations;
• Concern that the NPRM does not address risks of research to communities and only addresses individual risks;
• Concern that the NPRM proposals seem to reduce institutional responsibility but increase investigator responsibility. This presents a unique challenge when institutions have entered into agreements with tribal governments or tribal representatives, as opposed to individual investigators entering into these arrangements. The exemption decision tool was cited as an example of the proposals placing more responsibility on the investigators while perhaps reducing responsibility on the institutions; and
• Concern about the single IRB review mandate for multi-institutional studies affecting the ability of tribal communities to conduct local reviews of research involving tribal citizens or research that takes place on tribal land. One commenter noted that a one size fits all approach to addressing American Indian and Alaska Native concerns in human subjects protections might not be appropriate as needs and concerns might vary from tribe to tribe.

HHS reiterated its commitment to engaging in an ongoing dialogue with tribal communities and tribal representatives, and welcomed ongoing discussion and comment on how the Common Rule affects these groups.

In addition to the January 2016 tribal consultation, we reviewed public comments from tribal representatives, and individuals and groups representing tribal interests to the ANPRM and NPRM. We received one comment on the ANPRM from a group representing tribal interests. This group noted “the long and challenging history” of research involving AI/AN populations, and how this history informs current research activities involving these groups. This comment argued that, for research involving AI/AN populations:

• Continuing review should be required;
• IRBs, not investigators or other parties, should determine whether a prospective study is exempt or excluded from the Common Rule;
• IRBs should be required to consider potential harms to populations or groups, not just individuals, when reviewing research activities;
• Incorporating tribal IRBs into the process for multi-institutional studies is a crucial aspect of respecting these populations and ensuring human subjects protections;
• Study-specific informed consent forms should be required, and general, multi-purpose consent forms should be avoided;
• Mandated information and biospecimen privacy safeguards would be a welcome improvement to the current research landscape and would help prevent harm to human subjects; and
• Consultation with tribal representatives would be crucial should a proposed rule or final rule mandate single IRB review for multi-institutional studies.

We received approximately 15 comments on the NPRM from groups representing tribal interests. As described in Section II.E of this preamble, overarching concerns raised by these groups in comments to the NPRM included:

• Lack of group consent requirements proposed in the NPRM;
• Concern about the allowance for broad consent for future unspecified research uses;
• Lack of consideration for research activities involving research with biospecimens or information from individuals who are no longer alive;
• Mandating the use of single IRB review in multi-institutional research activities undermining the ability of tribal groups to conduct local review of studies; and
• Concern about the breadth and depth of exclusions and exemptions proposed in the NPRM exempting or excluding activities that tribal populations might find sensitive and requiring IRB review.

Commenters also raised concerns about the timing of the tribal consultation call and noted that the tribal consultation call occurred one day before the closing of the extended comment period for the NPRM. When HHS received notice that tribal representatives desired to consult on this proposed rule, a consultation was immediately scheduled in accordance with HHS policy.

The final rule includes a modification to the provision requiring single IRB review, and several clarifications specifying that regulatory references to state and local law are intended to include tribal law, in response to concerns raised during the tribal consultation and in the NPRM public comments. As described in this preamble, the final rule clarifies in § __.101(f) that tribal governments can develop laws related to the protection of human subjects that are more protective than the Common Rule, and that these laws must be followed by federally funded researches in activities involving these populations. Section __.114 now provides that if a tribal government requires review by more than one IRB by law in multi-institutional research, the single IRB review requirement in § __.114 does not apply. Additional clarification has also been made to § __.116(i) that tribal governments can develop their own informed consent standards that provide additional protections to subjects and that investigators conducting research involving populations under the jurisdiction of the tribal governments would have to follow these rules. Finally, additional language has been added to § __.116(j) noting that nothing in § __.116 is intended to limit the authority of a treating physician to the extent the authority is granted by tribal law.

Additional details of public comments from individuals representing tribal interests are included above in the relevant public comment summaries for the various final rule provisions discussed in Sections II through XVIII of this preamble.

For the reasons set forth in this preamble, the Federal Policy for the Protection of Human Subjects is amended.

Text of the Final Common Rule

The text of the final common rule appears below:

1. Part/subpart __is amended/revised/added to read as follows:

PART __—PROTECTION OF HUMAN SUBJECTS

§ __.101 To what does this policy apply?

(a) Except as detailed in § __.104, this policy applies to all research involving human subjects conducted, supported, or otherwise subject to regulation by any Federal department or agency that takes appropriate administrative action to make the policy applicable to such research. This includes research conducted by Federal civilian employees or military personnel, except that each department or agency head may adopt such procedural modifications as may be appropriate from an administrative standpoint. It also includes research conducted, supported, or otherwise subject to regulation by the Federal Government outside the United States. Institutions that are engaged in research described in this paragraph and institutional review boards (IRBs) reviewing research that is subject to this policy must comply with this policy.

(b) [Reserved]

(c) Department or agency heads retain final judgment as to whether a particular activity is covered by this policy and this judgment shall be exercised consistent with the ethical principles of the Belmont Report.

(d) Department or agency heads may require that specific research activities or classes of research activities conducted, supported, or otherwise subject to regulation by the Federal department or agency but not otherwise covered by this policy comply with some or all of the requirements of this policy.

(e) Compliance with this policy requires compliance with pertinent federal laws or regulations that provide additional protections for human subjects.

(f) This policy does not affect any state or local laws or regulations (including tribal law passed by the official governing body of an American Indian or Alaska Native tribe) that may otherwise be applicable and that provide additional protections for human subjects.

(g) This policy does not affect any foreign laws or regulations that may otherwise be applicable and that provide additional protections to human subjects of research.

(h) When research covered by this policy takes place in foreign countries, procedures normally followed in the foreign countries to protect human subjects may differ from those set forth in this policy. In these circumstances, if a department or agency head determines that the procedures prescribed by the institution afford protections that are at least equivalent to those provided in this policy, the department or agency head may approve the substitution of the foreign procedures in lieu of the procedural requirements provided in this policy. Except when otherwise required by statute, Executive Order, or the department or agency head, notices of these actions as they occur will be published in the Federal Register or will be otherwise published as provided in department or agency procedures.

(i) Unless otherwise required by law, department or agency heads may waive the applicability of some or all of the provisions of this policy to specific research activities or classes of research activities otherwise covered by this policy, provided the alternative procedures to be followed are consistent with the principles of the Belmont Report. Except when otherwise required by statute or Executive Order, the department or agency head shall forward advance notices of these actions to the Office for Human Research Protections, Department of Health and Human Services (HHS), or any successor office, or to the equivalent office within the appropriate Federal department or agency, and shall also publish them in the Federal Register or in such other manner as provided in department or agency procedures. The waiver notice must include a statement that identifies the conditions under which the waiver will be applied and a justification as to why the waiver is appropriate for the research, including how the decision is consistent with the principles of the Belmont Report.

(j) Federal guidance on the requirements of this policy shall be issued only after consultation, for the purpose of harmonization (to the extent appropriate), with other Federal departments and agencies that have adopted this policy, unless such consultation is not feasible.

(k) [Reserved]

(l) Compliance dates and transition provisions:

(1) For purposes of this section, the pre-2018 Requirements means this subpart as published in the 2016 edition of the Code of Federal Regulations.

(2) For purposes of this section, the 2018 Requirements means the Federal Policy for the Protection of Human Subjects requirements contained in this subpart. The compliance date for § __.114(b) (cooperative research) of the 2018 Requirements is January 20, 2020.

(3) Research initially approved by an IRB, for which such review was waived pursuant to § __.101(i), or for which a determination was made that the research was exempt before January 19, 2018, shall comply with the pre-2018 Requirements, except that an institution engaged in such research on or after January 19, 2018, may instead comply with the 2018 Requirements if the institution determines that such ongoing research will comply with the 2018 Requirements and an IRB documents such determination.

(4) Research initially approved by an IRB, for which such review was waived pursuant to § __.101(i), or for which a determination was made that the research was exempt on or after January 19, 2018, shall comply with the 2018 Requirements.

(m) Severability: Any provision of this part held to be invalid or unenforceable by its terms, or as applied to any person or circumstance, shall be construed so as to continue to give maximum effect to the provision permitted by law, unless such holding shall be one of utter invalidity or unenforceability, in which event the provision shall be severable from this part and shall not affect the remainder thereof or the application of the provision to other persons not similarly situated or to other dissimilar circumstances.

§ __.102 Definitions for purposes of this policy.

(a) Certification means the official notification by the institution to the supporting Federal department or agency component, in accordance with the requirements of this policy, that a research project or activity involving human subjects has been reviewed and approved by an IRB in accordance with an approved assurance.

(b) Clinical trial means a research study in which one or more human subjects are prospectively assigned to one or more interventions (which may include placebo or other control) to evaluate the effects of the interventions on biomedical or behavioral health-related outcomes.

(c) Department or agency head means the head of any Federal department or agency, for example, the Secretary of HHS, and any other officer or employee of any Federal department or agency to whom the authority provided by these regulations to the department or agency head has been delegated.

(d) Federal department or agency refers to a federal department or agency (the department or agency itself rather than its bureaus, offices or divisions) that takes appropriate administrative action to make this policy applicable to the research involving human subjects it conducts, supports, or otherwise regulates (e.g., the U.S. Department of Health and Human Services, the U.S. Department of Defense, or the Central Intelligence Agency).

(e)(1) Human subject means a living individual about whom an investigator (whether professional or student) conducting research:

(i) Obtains information or biospecimens through intervention or interaction with the individual, and uses, studies, or analyzes the information or biospecimens; or (ii) Obtains, uses, studies, analyzes, or generates identifiable private information or identifiable biospecimens.

(2) Intervention includes both physical procedures by which information or biospecimens are gathered (e.g., venipuncture) and manipulations of the subject or the subject's environment that are performed for research purposes.

(3) Interaction includes communication or interpersonal contact between investigator and subject.

(4) Private information includes information about behavior that occurs in a context in which an individual can reasonably expect that no observation or recording is taking place, and information that has been provided for specific purposes by an individual and that the individual can reasonably expect will not be made public (e.g., a medical record).

(5) Identifiable private information is private information for which the identity of the subject is or may readily be ascertained by the investigator or associated with the information.

(6) An identifiable biospecimen is a biospecimen for which the identity of the subject is or may readily be ascertained by the investigator or associated with the biospecimen.

(7) Federal departments or agencies implementing this policy shall:

(i) Upon consultation with appropriate experts (including experts in data matching and re-identification), reexamine the meaning of “identifiable private information,” as defined in paragraph (e)(5) of this section, and “identifiable biospecimen,” as defined in paragraph (e)(6) of this section. This reexamination shall take place within 1 year and regularly thereafter (at least every 4 years). This process will be conducted by collaboration among the Federal departments and agencies implementing this policy. If appropriate and permitted by law, such Federal departments and agencies may alter the interpretation of these terms, including through the use of guidance.

(ii) Upon consultation with appropriate experts, assess whether there are analytic technologies or techniques that should be considered by investigators to generate “identifiable private information,” as defined in paragraph (e)(5) of this section, or an “identifiable biospecimen,” as defined in paragraph (e)(6) of this section. This assessment shall take place within 1 year and regularly thereafter (at least every 4 years). This process will be conducted by collaboration among the Federal departments and agencies implementing this policy. Any such technologies or techniques will be included on a list of technologies or techniques that produce identifiable private information or identifiable biospecimens. This list will be published in the Federal Register after notice and an opportunity for public comment. The Secretary, HHS, shall maintain the list on a publicly accessible Web site.

(f) Institution means any public or private entity, or department or agency (including federal, state, and other agencies).

(g) IRB means an institutional review board established in accord with and for the purposes expressed in this policy.

(h) IRB approval means the determination of the IRB that the research has been reviewed and may be conducted at an institution within the constraints set forth by the IRB and by other institutional and federal requirements.

(i) Legally authorized representative means an individual or judicial or other body authorized under applicable law to consent on behalf of a prospective subject to the subject's participation in the procedure(s) involved in the research. If there is no applicable law addressing this issue, legally authorized representative means an individual recognized by institutional policy as acceptable for providing consent in the nonresearch context on behalf of the prospective subject to the subject's participation in the procedure(s) involved in the research.

(j) Minimal risk means that the probability and magnitude of harm or discomfort anticipated in the research are not greater in and of themselves than those ordinarily encountered in daily life or during the performance of routine physical or psychological examinations or tests.

(k) Public health authority means an agency or authority of the United States, a state, a territory, a political subdivision of a state or territory, an Indian tribe, or a foreign government, or a person or entity acting under a grant of authority from or contract with such public agency, including the employees or agents of such public agency or its contractors or persons or entities to whom it has granted authority, that is responsible for public health matters as part of its official mandate.

(l) Research means a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge. Activities that meet this definition constitute research for purposes of this policy, whether or not they are conducted or supported under a program that is considered research for other purposes. For example, some demonstration and service programs may include research activities. For purposes of this part, the following activities are deemed not to be research:

(1) Scholarly and journalistic activities (e.g., oral history, journalism, biography, literary criticism, legal research, and historical scholarship), including the collection and use of information, that focus directly on the specific individuals about whom the information is collected.

(2) Public health surveillance activities, including the collection and testing of information or biospecimens, conducted, supported, requested, ordered, required, or authorized by a public health authority. Such activities are limited to those necessary to allow a public health authority to identify, monitor, assess, or investigate potential public health signals, onsets of disease outbreaks, or conditions of public health importance (including trends, signals, risk factors, patterns in diseases, or increases in injuries from using consumer products). Such activities include those associated with providing timely situational awareness and priority setting during the course of an event or crisis that threatens public health (including natural or man-made disasters).

(3) Collection and analysis of information, biospecimens, or records by or for a criminal justice agency for activities authorized by law or court order solely for criminal justice or criminal investigative purposes.

(4) Authorized operational activities (as determined by each agency) in support of intelligence, homeland security, defense, or other national security missions.

(m) Written, or in writing, for purposes of this part, refers to writing on a tangible medium (e.g., paper) or in an electronic format.

§ __.103 Assuring compliance with this policy—research conducted or supported by any Federal department or agency.

(a) Each institution engaged in research that is covered by this policy, with the exception of research eligible for exemption under § __.104, and that is conducted or supported by a Federal department or agency, shall provide written assurance satisfactory to the department or agency head that it will comply with the requirements of this policy. In lieu of requiring submission of an assurance, individual department or agency heads shall accept the existence of a current assurance, appropriate for the research in question, on file with the Office for Human Research Protections, HHS, or any successor office, and approved for Federal-wide use by that office. When the existence of an HHS-approved assurance is accepted in lieu of requiring submission of an assurance, reports (except certification) required by this policy to be made to department and agency heads shall also be made to the Office for Human Research Protections, HHS, or any successor office. Federal departments and agencies will conduct or support research covered by this policy only if the institution has provided an assurance that it will comply with the requirements of this policy, as provided in this section, and only if the institution has certified to the department or agency head that the research has been reviewed and approved by an IRB (if such certification is required by § __.103(d)).

(b) The assurance shall be executed by an individual authorized to act for the institution and to assume on behalf of the institution the obligations imposed by this policy and shall be filed in such form and manner as the department or agency head prescribes.

(c) The department or agency head may limit the period during which any assurance shall remain effective or otherwise condition or restrict the assurance.

(d) Certification is required when the research is supported by a Federal department or agency and not otherwise waived under § __.101(i) or exempted under § __.104. For such research, institutions shall certify that each proposed research study covered by the assurance and this section has been reviewed and approved by the IRB. Such certification must be submitted as prescribed by the Federal department or agency component supporting the research. Under no condition shall research covered by this section be initiated prior to receipt of the certification that the research has been reviewed and approved by the IRB.

(e) For nonexempt research involving human subjects covered by this policy (or exempt research for which limited IRB review takes place pursuant to § __.104(d)(2)(iii), (d)(3)(i)(C), or (d)(7) or (8)) that takes place at an institution in which IRB oversight is conducted by an IRB that is not operated by the institution, the institution and the organization operating the IRB shall document the institution's reliance on the IRB for oversight of the research and the responsibilities that each entity will undertake to ensure compliance with the requirements of this policy (e.g., in a written agreement between the institution and the IRB, by implementation of an institution-wide policy directive providing the allocation of responsibilities between the institution and an IRB that is not affiliated with the institution, or as set forth in a research protocol).

(Approved by the Office of Management and Budget under Control Number 0990-0260)

§ __.104 Exempt research.

(a) Unless otherwise required by law or by department or agency heads, research activities in which the only involvement of human subjects will be in one or more of the categories in paragraph (d) of this section are exempt from the requirements of this policy, except that such activities must comply with the requirements of this section and as specified in each category.

(b) Use of the exemption categories for research subject to the requirements of subparts B, C, and D: Application of the exemption categories to research subject to the requirements of 45 CFR part 46, subparts B, C, and D, is as follows:

(1) Subpart B. Each of the exemptions at this section may be applied to research subject to subpart B if the conditions of the exemption are met.

(2) Subpart C. The exemptions at this section do not apply to research subject to subpart C, except for research aimed at involving a broader subject population that only incidentally includes prisoners.

(3) Subpart D. The exemptions at paragraphs (d)(1), (4), (5), (6), (7), and (8) of this section may be applied to research subject to subpart D if the conditions of the exemption are met. Paragraphs (d)(2)(i) and (ii) of this section only may apply to research subject to subpart D involving educational tests or the observation of public behavior when the investigator(s) do not participate in the activities being observed. Paragraph (d)(2)(iii) of this section may not be applied to research subject to subpart D.

(c) [Reserved.]

(d) Except as described in paragraph (a) of this section, the following categories of human subjects research are exempt from this policy:

(1) Research, conducted in established or commonly accepted educational settings, that specifically involves normal educational practices that are not likely to adversely impact students' opportunity to learn required educational content or the assessment of educators who provide instruction. This includes most research on regular and special education instructional strategies, and research on the effectiveness of or the comparison among instructional techniques, curricula, or classroom management methods.

(2) Research that only includes interactions involving educational tests (cognitive, diagnostic, aptitude, achievement), survey procedures, interview procedures, or observation of public behavior (including visual or auditory recording) if at least one of the following criteria is met:

(i) The information obtained is recorded by the investigator in such a manner that the identity of the human subjects cannot readily be ascertained, directly or through identifiers linked to the subjects;

(ii) Any disclosure of the human subjects' responses outside the research would not reasonably place the subjects at risk of criminal or civil liability or be damaging to the subjects' financial standing, employability, educational advancement, or reputation; or

(iii) The information obtained is recorded by the investigator in such a manner that the identity of the human subjects can readily be ascertained, directly or through identifiers linked to the subjects, and an IRB conducts a limited IRB review to make the determination required by § __.111(a)(7).

(3)(i) Research involving benign behavioral interventions in conjunction with the collection of information from an adult subject through verbal or written responses (including data entry) or audiovisual recording if the subject prospectively agrees to the intervention and information collection and at least one of the following criteria is met:

(A) The information obtained is recorded by the investigator in such a manner that the identity of the human subjects cannot readily be ascertained, directly or through identifiers linked to the subjects;

(B) Any disclosure of the human subjects' responses outside the research would not reasonably place the subjects at risk of criminal or civil liability or be damaging to the subjects' financial standing, employability, educational advancement, or reputation; or

(C) The information obtained is recorded by the investigator in such a manner that the identity of the human subjects can readily be ascertained, directly or through identifiers linked to the subjects, and an IRB conducts a limited IRB review to make the determination required by § __.111(a)(7).

(ii) For the purpose of this provision, benign behavioral interventions are brief in duration, harmless, painless, not physically invasive, not likely to have a significant adverse lasting impact on the subjects, and the investigator has no reason to think the subjects will find the interventions offensive or embarrassing. Provided all such criteria are met, examples of such benign behavioral interventions would include having the subjects play an online game, having them solve puzzles under various noise conditions, or having them decide how to allocate a nominal amount of received cash between themselves and someone else.

(iii) If the research involves deceiving the subjects regarding the nature or purposes of the research, this exemption is not applicable unless the subject authorizes the deception through a prospective agreement to participate in research in circumstances in which the subject is informed that he or she will be unaware of or misled regarding the nature or purposes of the research.

(4) Secondary research for which consent is not required: Secondary research uses of identifiable private information or identifiable biospecimens, if at least one of the following criteria is met:

(i) The identifiable private information or identifiable biospecimens are publicly available;

(ii) Information, which may include information about biospecimens, is recorded by the investigator in such a manner that the identity of the human subjects cannot readily be ascertained directly or through identifiers linked to the subjects, the investigator does not contact the subjects, and the investigator will not re-identify subjects;

(iii) The research involves only information collection and analysis involving the investigator's use of identifiable health information when that use is regulated under 45 CFR parts 160 and 164, subparts A and E, for the purposes of “health care operations” or “research” as those terms are defined at 45 CFR 164.501 or for “public health activities and purposes” as described under 45 CFR 164.512(b); or

(iv) The research is conducted by, or on behalf of, a Federal department or agency using government-generated or government-collected information obtained for nonresearch activities, if the research generates identifiable private information that is or will be maintained on information technology that is subject to and in compliance with section 208(b) of the E-Government Act of 2002, 44 U.S.C. 3501 note, if all of the identifiable private information collected, used, or generated as part of the activity will be maintained in systems of records subject to the Privacy Act of 1974, 5 U.S.C. 552a, and, if applicable, the information used in the research was collected subject to the Paperwork Reduction Act of 1995, 44 U.S.C. 3501 et seq.

(5) Research and demonstration projects that are conducted or supported by a Federal department or agency, or otherwise subject to the approval of department or agency heads (or the approval of the heads of bureaus or other subordinate agencies that have been delegated authority to conduct the research and demonstration projects), and that are designed to study, evaluate, improve, or otherwise examine public benefit or service programs, including procedures for obtaining benefits or services under those programs, possible changes in or alternatives to those programs or procedures, or possible changes in methods or levels of payment for benefits or services under those programs. Such projects include, but are not limited to, internal studies by Federal employees, and studies under contracts or consulting arrangements, cooperative agreements, or grants. Exempt projects also include waivers of otherwise mandatory requirements using authorities such as sections 1115 and 1115A of the Social Security Act, as amended.

(i) Each Federal department or agency conducting or supporting the research and demonstration projects must establish, on a publicly accessible Federal Web site or in such other manner as the department or agency head may determine, a list of the research and demonstration projects that the Federal department or agency conducts or supports under this provision. The research or demonstration project must be published on this list prior to commencing the research involving human subjects.

(ii) [Reserved]

(6) Taste and food quality evaluation and consumer acceptance studies:

(i) If wholesome foods without additives are consumed, or

(ii) If a food is consumed that contains a food ingredient at or below the level and for a use found to be safe, or agricultural chemical or environmental contaminant at or below the level found to be safe, by the Food and Drug Administration or approved by the Environmental Protection Agency or the Food Safety and Inspection Service of the U.S. Department of Agriculture.

(7) Storage or maintenance for secondary research for which broad consent is required: Storage or maintenance of identifiable private information or identifiable biospecimens for potential secondary research use if an IRB conducts a limited IRB review and makes the determinations required by § __.111(a)(8).

(8) Secondary research for which broad consent is required: Research involving the use of identifiable private information or identifiable biospecimens for secondary research use, if the following criteria are met:

(i) Broad consent for the storage, maintenance, and secondary research use of the identifiable private information or identifiable biospecimens was obtained in accordance with § __.116(a)(1) through (4), (a)(6), and (d);

(ii) Documentation of informed consent or waiver of documentation of consent was obtained in accordance with § __.117;

(iii) An IRB conducts a limited IRB review and makes the determination required by § __.111(a)(7) and makes the determination that the research to be conducted is within the scope of the broad consent referenced in paragraph (d)(8)(i) of this section; and (iv) The investigator does not include returning individual research results to subjects as part of the study plan. This provision does not prevent an investigator from abiding by any legal requirements to return individual research results.

(Approved by the Office of Management and Budget under Control Number 0990-0260)

§ __.105 [Reserved.]

§ __.106 [Reserved]

§ __.107 IRB membership.

(a) Each IRB shall have at least five members, with varying backgrounds to promote complete and adequate review of research activities commonly conducted by the institution. The IRB shall be sufficiently qualified through the experience and expertise of its members (professional competence), and the diversity of its members, including race, gender, and cultural backgrounds and sensitivity to such issues as community attitudes, to promote respect for its advice and counsel in safeguarding the rights and welfare of human subjects. The IRB shall be able to ascertain the acceptability of proposed research in terms of institutional commitments (including policies and resources) and regulations, applicable law, and standards of professional conduct and practice. The IRB shall therefore include persons knowledgeable in these areas. If an IRB regularly reviews research that involves a category of subjects that is vulnerable to coercion or undue influence, such as children, prisoners, individuals with impaired decision-making capacity, or economically or educationally disadvantaged persons, consideration shall be given to the inclusion of one or more individuals who are knowledgeable about and experienced in working with these categories of subjects.

(b) Each IRB shall include at least one member whose primary concerns are in scientific areas and at least one member whose primary concerns are in nonscientific areas.

(c) Each IRB shall include at least one member who is not otherwise affiliated with the institution and who is not part of the immediate family of a person who is affiliated with the institution.

(d) No IRB may have a member participate in the IRB's initial or continuing review of any project in which the member has a conflicting interest, except to provide information requested by the IRB.

(e) An IRB may, in its discretion, invite individuals with competence in special areas to assist in the review of issues that require expertise beyond or in addition to that available on the IRB. These individuals may not vote with the IRB.

§ __.108 IRB functions and operations.

(a) In order to fulfill the requirements of this policy each IRB shall:

(1) Have access to meeting space and sufficient staff to support the IRB's review and recordkeeping duties;

(2) Prepare and maintain a current list of the IRB members identified by name; earned degrees; representative capacity; indications of experience such as board certifications or licenses sufficient to describe each member's chief anticipated contributions to IRB deliberations; and any employment or other relationship between each member and the institution, for example, full-time employee, part-time employee, member of governing panel or board, stockholder, paid or unpaid consultant;

(3) Establish and follow written procedures for:

(i) Conducting its initial and continuing review of research and for reporting its findings and actions to the investigator and the institution;

(ii) Determining which projects require review more often than annually and which projects need verification from sources other than the investigators that no material changes have occurred since previous IRB review; and

(iii) Ensuring prompt reporting to the IRB of proposed changes in a research activity, and for ensuring that investigators will conduct the research activity in accordance with the terms of the IRB approval until any proposed changes have been reviewed and approved by the IRB, except when necessary to eliminate apparent immediate hazards to the subject.

(4) Establish and follow written procedures for ensuring prompt reporting to the IRB; appropriate institutional officials; the department or agency head; and the Office for Human Research Protections, HHS, or any successor office, or the equivalent office within the appropriate Federal department or agency of

(i) Any unanticipated problems involving risks to subjects or others or any serious or continuing noncompliance with this policy or the requirements or determinations of the IRB; and

(ii) Any suspension or termination of IRB approval.

(b) Except when an expedited review procedure is used (as described in § __.110), an IRB must review proposed research at convened meetings at which a majority of the members of the IRB are present, including at least one member whose primary concerns are in nonscientific areas. In order for the research to be approved, it shall receive the approval of a majority of those members present at the meeting.

(Approved by the Office of Management and Budget under Control Number 0990-0260)

§ __.109 IRB review of research.

(a) An IRB shall review and have authority to approve, require modifications in (to secure approval), or disapprove all research activities covered by this policy, including exempt research activities under § __.104 for which limited IRB review is a condition of exemption (under § __.104(d)(2)(iii), (d)(3)(i)(C), and (d)(7), and (8)).

(b) An IRB shall require that information given to subjects (or legally authorized representatives, when appropriate) as part of informed consent is in accordance with § __.116. The IRB may require that information, in addition to that specifically mentioned in § __.116, be given to the subjects when in the IRB's judgment the information would meaningfully add to the protection of the rights and welfare of subjects.

(c) An IRB shall require documentation of informed consent or may waive documentation in accordance with § __.117.

(d) An IRB shall notify investigators and the institution in writing of its decision to approve or disapprove the proposed research activity, or of modifications required to secure IRB approval of the research activity. If the IRB decides to disapprove a research activity, it shall include in its written notification a statement of the reasons for its decision and give the investigator an opportunity to respond in person or in writing.

(e) An IRB shall conduct continuing review of research requiring review by the convened IRB at intervals appropriate to the degree of risk, not less than once per year, except as described in § __.109(f).

(f)(1) Unless an IRB determines otherwise, continuing review of research is not required in the following circumstances:

(i) Research eligible for expedited review in accordance with § __.110;

(ii) Research reviewed by the IRB in accordance with the limited IRB review described in § __.104(d)(2)(iii), (d)(3)(i)(C), or (d)(7) or (8);

(iii) Research that has progressed to the point that it involves only one or both of the following, which are part of the IRB-approved study:

(A) Data analysis, including analysis of identifiable private information or identifiable biospecimens, or

(B) Accessing follow-up clinical data from procedures that subjects would undergo as part of clinical care.

(2) [Reserved.]

(g) An IRB shall have authority to observe or have a third party observe the consent process and the research.

(Approved by the Office of Management and Budget under Control Number 0990-0260)

§ __.110 Expedited review procedures for certain kinds of research involving no more than minimal risk, and for minor changes in approved research.

(a) The Secretary of HHS has established, and published as a Notice in the Federal Register, a list of categories of research that may be reviewed by the IRB through an expedited review procedure. The Secretary will evaluate the list at least every 8 years and amend it, as appropriate, after consultation with other federal departments and agencies and after publication in the Federal Register for public comment. A copy of the list is available from the Office for Human Research Protections, HHS, or any successor office.

(b)(1) An IRB may use the expedited review procedure to review the following:

(i) Some or all of the research appearing on the list described in paragraph (a) of this section, unless the reviewer determines that the study involves more than minimal risk;

(ii) Minor changes in previously approved research during the period for which approval is authorized; or

(iii) Research for which limited IRB review is a condition of exemption under § __.104(d)(2)(iii), (d)(3)(i)(C), and (d)(7) and (8).

(2) Under an expedited review procedure, the review may be carried out by the IRB chairperson or by one or more experienced reviewers designated by the chairperson from among members of the IRB. In reviewing the research, the reviewers may exercise all of the authorities of the IRB except that the reviewers may not disapprove the research. A research activity may be disapproved only after review in accordance with the nonexpedited procedure set forth in § __.108(b).

(c) Each IRB that uses an expedited review procedure shall adopt a method for keeping all members advised of research proposals that have been approved under the procedure.

(d) The department or agency head may restrict, suspend, terminate, or choose not to authorize an institution's or IRB's use of the expedited review procedure.

§ __.111 Criteria for IRB approval of research.

(a) In order to approve research covered by this policy the IRB shall determine that all of the following requirements are satisfied:

(1) Risks to subjects are minimized:

(i) By using procedures that are consistent with sound research design and that do not unnecessarily expose subjects to risk, and

(ii) Whenever appropriate, by using procedures already being performed on the subjects for diagnostic or treatment purposes.

(2) Risks to subjects are reasonable in relation to anticipated benefits, if any, to subjects, and the importance of the knowledge that may reasonably be expected to result. In evaluating risks and benefits, the IRB should consider only those risks and benefits that may result from the research (as distinguished from risks and benefits of therapies subjects would receive even if not participating in the research). The IRB should not consider possible long-range effects of applying knowledge gained in the research (e.g., the possible effects of the research on public policy) as among those research risks that fall within the purview of its responsibility.

(3) Selection of subjects is equitable. In making this assessment the IRB should take into account the purposes of the research and the setting in which the research will be conducted. The IRB should be particularly cognizant of the special problems of research that involves a category of subjects who are vulnerable to coercion or undue influence, such as children, prisoners, individuals with impaired decision-making capacity, or economically or educationally disadvantaged persons.

(4) Informed consent will be sought from each prospective subject or the subject's legally authorized representative, in accordance with, and to the extent required by, § __.116.

(5) Informed consent will be appropriately documented or appropriately waived in accordance with § __.117.

(6) When appropriate, the research plan makes adequate provision for monitoring the data collected to ensure the safety of subjects.

(7) When appropriate, there are adequate provisions to protect the privacy of subjects and to maintain the confidentiality of data.

(i) The Secretary of HHS will, after consultation with the Office of Management and Budget's privacy office and other Federal departments and agencies that have adopted this policy, issue guidance to assist IRBs in assessing what provisions are adequate to protect the privacy of subjects and to maintain the confidentiality of data.

(ii) [Reserved.]

(8) For purposes of conducting the limited IRB review required by § __.104(d)(7)), the IRB need not make the determinations at paragraphs (a)(1) through (7) of this section, and shall make the following determinations:

(i) Broad consent for storage, maintenance, and secondary research use of identifiable private information or identifiable biospecimens is obtained in accordance with the requirements of § __.116(a)(1)-(4), (a)(6), and (d);

(ii) Broad consent is appropriately documented or waiver of documentation is appropriate, in accordance with § __.117; and

(iii) If there is a change made for research purposes in the way the identifiable private information or identifiable biospecimens are stored or maintained, there are adequate provisions to protect the privacy of subjects and to maintain the confidentiality of data.

(b) When some or all of the subjects are likely to be vulnerable to coercion or undue influence, such as children, prisoners, individuals with impaired decision-making capacity, or economically or educationally disadvantaged persons, additional safeguards have been included in the study to protect the rights and welfare of these subjects.

§ __.112 Review by Institution

Research covered by this policy that has been approved by an IRB may be subject to further appropriate review and approval or disapproval by officials of the institution. However, those officials may not approve the research if it has not been approved by an IRB.

§ __.113 Suspension or Termination of IRB Approval of Research

An IRB shall have authority to suspend or terminate approval of research that is not being conducted in accordance with the IRB's requirements or that has been associated with unexpected serious harm to subjects. Any suspension or termination of approval shall include a statement of the reasons for the IRB's action and shall be reported promptly to the investigator, appropriate institutional officials, and the department or agency head.

(Approved by the Office of Management and Budget under Control Number 0990-0260)

§ __.114 Cooperative Research

(a) Cooperative research projects are those projects covered by this policy that involve more than one institution. In the conduct of cooperative research projects, each institution is responsible for safeguarding the rights and welfare of human subjects and for complying with this policy.

(b)(1) Any institution located in the United States that is engaged in cooperative research must rely upon approval by a single IRB for that portion of the research that is conducted in the United States. The reviewing IRB will be identified by the Federal department or agency supporting or conducting the research or proposed by the lead institution subject to the acceptance of the Federal department or agency supporting the research.

(2) The following research is not subject to this provision:

(i) Cooperative research for which more than single IRB review is required by law (including tribal law passed by the official governing body of an American Indian or Alaska Native tribe); or

(ii) Research for which any Federal department or agency supporting or conducting the research determines and documents that the use of a single IRB is not appropriate for the particular context.

(c) For research not subject to paragraph (b) of this section, an institution participating in a cooperative project may enter into a joint review arrangement, rely on the review of another IRB, or make similar arrangements for avoiding duplication of effort.

§ __.115 IRB Records

(a) An institution, or when appropriate an IRB, shall prepare and maintain adequate documentation of IRB activities, including the following:

(1) Copies of all research proposals reviewed, scientific evaluations, if any, that accompany the proposals, approved sample consent forms, progress reports submitted by investigators, and reports of injuries to subjects.

(2) Minutes of IRB meetings, which shall be in sufficient detail to show attendance at the meetings; actions taken by the IRB; the vote on these actions including the number of members voting for, against, and abstaining; the basis for requiring changes in or disapproving research; and a written summary of the discussion of controverted issues and their resolution.

(3) Records of continuing review activities, including the rationale for conducting continuing review of research that otherwise would not require continuing review as described in § __.109(f)(1).

(4) Copies of all correspondence between the IRB and the investigators.

(5) A list of IRB members in the same detail as described in § __.108(a)(2).

(6) Written procedures for the IRB in the same detail as described in § __.108(a)(3) and (4).

(7) Statements of significant new findings provided to subjects, as required by § __.116(c)(5).

(8) The rationale for an expedited reviewer's determination under § __.110(b)(1)(i) that research appearing on the expedited review list described in § __.110(a) is more than minimal risk.

(9) Documentation specifying the responsibilities that an institution and an organization operating an IRB each will undertake to ensure compliance with the requirements of this policy, as described in § __.103(e).

(b) The records required by this policy shall be retained for at least 3 years, and records relating to research that is conducted shall be retained for at least 3 years after completion of the research. The institution or IRB may maintain the records in printed form, or electronically. All records shall be accessible for inspection and copying by authorized representatives of the Federal department or agency at reasonable times and in a reasonable manner.

(Approved by the Office of Management and Budget under Control Number 0990-0260)

§ __.116 General Requirements for Informed Consent

(a) General. General requirements for informed consent, whether written or oral, are set forth in this paragraph and apply to consent obtained in accordance with the requirements set forth in paragraphs (b) through (d) of this section. Broad consent may be obtained in lieu of informed consent obtained in accordance with paragraphs (b) and (c) of this section only with respect to the storage, maintenance, and secondary research uses of identifiable private information and identifiable biospecimens. Waiver or alteration of consent in research involving public benefit and service programs conducted by or subject to the approval of state or local officials is described in paragraph (e) of this section. General waiver or alteration of informed consent is described in paragraph (f) of this section. Except as provided elsewhere in this policy:

(1) Before involving a human subject in research covered by this policy, an investigator shall obtain the legally effective informed consent of the subject or the subject's legally authorized representative.

(2) An investigator shall seek informed consent only under circumstances that provide the prospective subject or the legally authorized representative sufficient opportunity to discuss and consider whether or not to participate and that minimize the possibility of coercion or undue influence.

(3) The information that is given to the subject or the legally authorized representative shall be in language understandable to the subject or the legally authorized representative.

(4) The prospective subject or the legally authorized representative must be provided with the information that a reasonable person would want to have in order to make an informed decision about whether to participate, and an opportunity to discuss that information.

(5) Except for broad consent obtained in accordance with paragraph (d) of this section:

(i) Informed consent must begin with a concise and focused presentation of the key information that is most likely to assist a prospective subject or legally authorized representative in understanding the reasons why one might or might not want to participate in the research. This part of the informed consent must be organized and presented in a way that facilitates comprehension.

(ii) Informed consent as a whole must present information in sufficient detail relating to the research, and must be organized and presented in a way that does not merely provide lists of isolated facts, but rather facilitates the prospective subject's or legally authorized representative's understanding of the reasons why one might or might not want to participate.

(6) No informed consent may include any exculpatory language through which the subject or the legally authorized representative is made to waive or appear to waive any of the subject's legal rights, or releases or appears to release the investigator, the sponsor, the institution, or its agents from liability for negligence.

(b) Basic elements of informed consent. Except as provided in paragraph (d), (e), or (f) of this section, in seeking informed consent the following information shall be provided to each subject or the legally authorized representative:

(1) A statement that the study involves research, an explanation of the purposes of the research and the expected duration of the subject's participation, a description of the procedures to be followed, and identification of any procedures that are experimental;

(2) A description of any reasonably foreseeable risks or discomforts to the subject;

(3) A description of any benefits to the subject or to others that may reasonably be expected from the research;

(4) A disclosure of appropriate alternative procedures or courses of treatment, if any, that might be advantageous to the subject;

(5) A statement describing the extent, if any, to which confidentiality of records identifying the subject will be maintained;

(6) For research involving more than minimal risk, an explanation as to whether any compensation and an explanation as to whether any medical treatments are available if injury occurs and, if so, what they consist of, or where further information may be obtained;

(7) An explanation of whom to contact for answers to pertinent questions about the research and research subjects' rights, and whom to contact in the event of a research-related injury to the subject;

(8) A statement that participation is voluntary, refusal to participate will involve no penalty or loss of benefits to which the subject is otherwise entitled, and the subject may discontinue participation at any time without penalty or loss of benefits to which the subject is otherwise entitled; and

(9) One of the following statements about any research that involves the collection of identifiable private information or identifiable biospecimens:

(i) A statement that identifiers might be removed from the identifiable private information or identifiable biospecimens and that, after such removal, the information or biospecimens could be used for future research studies or distributed to another investigator for future research studies without additional informed consent from the subject or the legally authorized representative, if this might be a possibility; or

(ii) A statement that the subject's information or biospecimens collected as part of the research, even if identifiers are removed, will not be used or distributed for future research studies.

(c) Additional elements of informed consent. Except as provided in paragraph (d), (e), or (f) of this section, one or more of the following elements of information, when appropriate, shall also be provided to each subject or the legally authorized representative:

(1) A statement that the particular treatment or procedure may involve risks to the subject (or to the embryo or fetus, if the subject is or may become pregnant) that are currently unforeseeable;

(2) Anticipated circumstances under which the subject's participation may be terminated by the investigator without regard to the subject's or the legally authorized representative's consent;

(3) Any additional costs to the subject that may result from participation in the research;

(4) The consequences of a subject's decision to withdraw from the research and procedures for orderly termination of participation by the subject;

(5) A statement that significant new findings developed during the course of the research that may relate to the subject's willingness to continue participation will be provided to the subject;

(6) The approximate number of subjects involved in the study;

(7) A statement that the subject's biospecimens (even if identifiers are removed) may be used for commercial profit and whether the subject will or will not share in this commercial profit;

(8) A statement regarding whether clinically relevant research results, including individual research results, will be disclosed to subjects, and if so, under what conditions; and

(9) For research involving biospecimens, whether the research will (if known) or might include whole genome sequencing (i.e., sequencing of a human germline or somatic specimen with the intent to generate the genome or exome sequence of that specimen).

(d) Elements of broad consent for the storage, maintenance, and secondary research use of identifiable private information or identifiable biospecimens. Broad consent for the storage, maintenance, and secondary research use of identifiable private information or identifiable biospecimens (collected for either research studies other than the proposed research or nonresearch purposes) is permitted as an alternative to the informed consent requirements in paragraphs (b) and (c) of this section. If the subject or the legally authorized representative is asked to provide broad consent, the following shall be provided to each subject or the subject's legally authorized representative:

(1) The information required in paragraphs (b)(2), (b)(3), (b)(5), and (b)(8) and, when appropriate, (c)(7) and (9) of this section;

(2) A general description of the types of research that may be conducted with the identifiable private information or identifiable biospecimens. This description must include sufficient information such that a reasonable person would expect that the broad consent would permit the types of research conducted;

(3) A description of the identifiable private information or identifiable biospecimens that might be used in research, whether sharing of identifiable private information or identifiable biospecimens might occur, and the types of institutions or researchers that might conduct research with the identifiable private information or identifiable biospecimens;

(4) A description of the period of time that the identifiable private information or identifiable biospecimens may be stored and maintained (which period of time could be indefinite), and a description of the period of time that the identifiable private information or identifiable biospecimens may be used for research purposes (which period of time could be indefinite);

(5) Unless the subject or legally authorized representative will be provided details about specific research studies, a statement that they will not be informed of the details of any specific research studies that might be conducted using the subject's identifiable private information or identifiable biospecimens, including the purposes of the research, and that they might have chosen not to consent to some of those specific research studies;

(6) Unless it is known that clinically relevant research results, including individual research results, will be disclosed to the subject in all circumstances, a statement that such results may not be disclosed to the subject; and

(7) An explanation of whom to contact for answers to questions about the subject's rights and about storage and use of the subject's identifiable private information or identifiable biospecimens, and whom to contact in the event of a research-related harm.

(e) Waiver or alteration of consent in research involving public benefit and service programs conducted by or subject to the approval of state or local officials—(1) Waiver. An IRB may waive the requirement to obtain informed consent for research under paragraphs (a) through (c) of this section, provided the IRB satisfies the requirements of paragraph (e)(3) of this section. If an individual was asked to provide broad consent for the storage, maintenance, and secondary research use of identifiable private information or identifiable biospecimens in accordance with the requirements at paragraph (d) of this section, and refused to consent, an IRB cannot waive consent for the storage, maintenance, or secondary research use of the identifiable private information or identifiable biospecimens.

(2) Alteration. An IRB may approve a consent procedure that omits some, or alters some or all, of the elements of informed consent set forth in paragraphs (b) and (c) of this section provided the IRB satisfies the requirements of paragraph (e)(3) of this section. An IRB may not omit or alter any of the requirements described in paragraph (a) of this section. If a broad consent procedure is used, an IRB may not omit or alter any of the elements required under paragraph (d) of this section.

(3) Requirements for waiver and alteration. In order for an IRB to waive or alter consent as described in this subsection, the IRB must find and document that:

(i) The research or demonstration project is to be conducted by or subject to the approval of state or local government officials and is designed to study, evaluate, or otherwise examine:

(A) Public benefit or service programs;

(B) Procedures for obtaining benefits or services under those programs;

(C) Possible changes in or alternatives to those programs or procedures; or

(D) Possible changes in methods or levels of payment for benefits or services under those programs; and

(ii) The research could not practicably be carried out without the waiver or alteration.

(f) General waiver or alteration of consent—(1) Waiver. An IRB may waive the requirement to obtain informed consent for research under paragraphs (a) through (c) of this section, provided the IRB satisfies the requirements of paragraph (f)(3) of this section. If an individual was asked to provide broad consent for the storage, maintenance, and secondary research use of identifiable private information or identifiable biospecimens in accordance with the requirements at paragraph (d) of this section, and refused to consent, an IRB cannot waive consent for the storage, maintenance, or secondary research use of the identifiable private information or identifiable biospecimens.

(2) Alteration. An IRB may approve a consent procedure that omits some, or alters some or all, of the elements of informed consent set forth in paragraphs (b) and (c) of this section provided the IRB satisfies the requirements of paragraph (f)(3) of this section. An IRB may not omit or alter any of the requirements described in paragraph (a) of this section. If a broad consent procedure is used, an IRB may not omit or alter any of the elements required under paragraph (d) of this section.

(3) Requirements for waiver and alteration. In order for an IRB to waive or alter consent as described in this subsection, the IRB must find and document that:

(i) The research involves no more than minimal risk to the subjects;

(ii) The research could not practicably be carried out without the requested waiver or alteration;

(iii) If the research involves using identifiable private information or identifiable biospecimens, the research could not practicably be carried out without using such information or biospecimens in an identifiable format;

(iv) The waiver or alteration will not adversely affect the rights and welfare of the subjects; and

(v) Whenever appropriate, the subjects or legally authorized representatives will be provided with additional pertinent information after participation.

(g) Screening, recruiting, or determining eligibility. An IRB may approve a research proposal in which an investigator will obtain information or biospecimens for the purpose of screening, recruiting, or determining the eligibility of prospective subjects without the informed consent of the prospective subject or the subject's legally authorized representative, if either of the following conditions are met:

(1) The investigator will obtain information through oral or written communication with the prospective subject or legally authorized representative, or

(2) The investigator will obtain identifiable private information or identifiable biospecimens by accessing records or stored identifiable biospecimens.

(h) Posting of clinical trial consent form. (1) For each clinical trial conducted or supported by a Federal department or agency, one IRB-approved informed consent form used to enroll subjects must be posted by the awardee or the Federal department or agency component conducting the trial on a publicly available Federal Web site that will be established as a repository for such informed consent forms.

(2) If the Federal department or agency supporting or conducting the clinical trial determines that certain information should not be made publicly available on a Federal Web site (e.g. confidential commercial information), such Federal department or agency may permit or require redactions to the information posted.

(3) The informed consent form must be posted on the Federal Web site after the clinical trial is closed to recruitment, and no later than 60 days after the last study visit by any subject, as required by the protocol.

(i) Preemption. The informed consent requirements in this policy are not intended to preempt any applicable Federal, state, or local laws (including tribal laws passed by the official governing body of an American Indian or Alaska Native tribe) that require additional information to be disclosed in order for informed consent to be legally effective.

(j) Emergency medical care. Nothing in this policy is intended to limit the authority of a physician to provide emergency medical care, to the extent the physician is permitted to do so under applicable Federal, state, or local law (including tribal law passed by the official governing body of an American Indian or Alaska Native tribe).

(Approved by the Office of Management and Budget under Control Number 0990-0260)

§ __.117 Documentation of informed consent.

(a) Except as provided in paragraph (c) of this section, informed consent shall be documented by the use of a written informed consent form approved by the IRB and signed (including in an electronic format) by the subject or the subject's legally authorized representative. A written copy shall be given to the person signing the informed consent form.

(b) Except as provided in paragraph (c) of this section, the informed consent form may be either of the following:

(1) A written informed consent form that meets the requirements of § __.116. The investigator shall give either the subject or the subject's legally authorized representative adequate opportunity to read the informed consent form before it is signed; alternatively, this form may be read to the subject or the subject's legally authorized representative.

(2) A short form written informed consent form stating that the elements of informed consent required by § __.116 have been presented orally to the subject or the subject's legally authorized representative, and that the key information required by § __.116(a)(5)(i) was presented first to the subject, before other information, if any, was provided. The IRB shall approve a written summary of what is to be said to the subject or the legally authorized representative. When this method is used, there shall be a witness to the oral presentation. Only the short form itself is to be signed by the subject or the subject's legally authorized representative. However, the witness shall sign both the short form and a copy of the summary, and the person actually obtaining consent shall sign a copy of the summary. A copy of the summary shall be given to the subject or the subject's legally authorized representative, in addition to a copy of the short form.

(c)(1) An IRB may waive the requirement for the investigator to obtain a signed informed consent form for some or all subjects if it finds any of the following:

(i) That the only record linking the subject and the research would be the informed consent form and the principal risk would be potential harm resulting from a breach of confidentiality. Each subject (or legally authorized representative) will be asked whether the subject wants documentation linking the subject with the research, and the subject's wishes will govern;

(ii) That the research presents no more than minimal risk of harm to subjects and involves no procedures for which written consent is normally required outside of the research context; or

(iii) If the subjects or legally authorized representatives are members of a distinct cultural group or community in which signing forms is not the norm, that the research presents no more than minimal risk of harm to subjects and provided there is an appropriate alternative mechanism for documenting that informed consent was obtained.

(2) In cases in which the documentation requirement is waived, the IRB may require the investigator to provide subjects or legally authorized representatives with a written statement regarding the research.

(Approved by the Office of Management and Budget under Control Number 0990-0260)

§ __.118 Applications and proposals lacking definite plans for involvement of human subjects.

Certain types of applications for grants, cooperative agreements, or contracts are submitted to Federal departments or agencies with the knowledge that subjects may be involved within the period of support, but definite plans would not normally be set forth in the application or proposal. These include activities such as institutional type grants when selection of specific projects is the institution's responsibility; research training grants in which the activities involving subjects remain to be selected; and projects in which human subjects' involvement will depend upon completion of instruments, prior animal studies, or purification of compounds. Except for research waived under § __.101(i) or exempted under § __.104, no human subjects may be involved in any project supported by these awards until the project has been reviewed and approved by the IRB, as provided in this policy, and certification submitted, by the institution, to the Federal department or agency component supporting the research.

§ __.119 Research undertaken without the intention of involving human subjects.

Except for research waived under § __.101(i) or exempted under § __.104, in the event research is undertaken without the intention of involving human subjects, but it is later proposed to involve human subjects in the research, the research shall first be reviewed and approved by an IRB, as provided in this policy, a certification submitted by the institution to the Federal department or agency component supporting the research, and final approval given to the proposed change by the Federal department or agency component.

§ __.120 Evaluation and disposition of applications and proposals for research to be conducted or supported by a Federal department or agency.

(a) The department or agency head will evaluate all applications and proposals involving human subjects submitted to the Federal department or agency through such officers and employees of the Federal department or agency and such experts and consultants as the department or agency head determines to be appropriate. This evaluation will take into consideration the risks to the subjects, the adequacy of protection against these risks, the potential benefits of the research to the subjects and others, and the importance of the knowledge gained or to be gained.

(b) On the basis of this evaluation, the department or agency head may approve or disapprove the application or proposal, or enter into negotiations to develop an approvable one.

§ __.121 [Reserved]

§ __.122 Use of Federal funds.

Federal funds administered by a Federal department or agency may not be expended for research involving human subjects unless the requirements of this policy have been satisfied.

§ __.123 Early termination of research support: Evaluation of applications and proposals.

(a) The department or agency head may require that Federal department or agency support for any project be terminated or suspended in the manner prescribed in applicable program requirements, when the department or agency head finds an institution has materially failed to comply with the terms of this policy.

(b) In making decisions about supporting or approving applications or proposals covered by this policy the department or agency head may take into account, in addition to all other eligibility requirements and program criteria, factors such as whether the applicant has been subject to a termination or suspension under paragraph (a) of this section and whether the applicant or the person or persons who would direct or has/have directed the scientific and technical aspects of an activity has/have, in the judgment of the department or agency head, materially failed to discharge responsibility for the protection of the rights and welfare of human subjects (whether or not the research was subject to federal regulation).

§ __.124 Conditions.

With respect to any research project or any class of research projects the department or agency head of either the conducting or the supporting Federal department or agency may impose additional conditions prior to or at the time of approval when in the judgment of the department or agency head additional conditions are necessary for the protection of human subjects.

Adoption of the Common Rules

The adoption of the common rules by the participating agencies, as modified by agency-specific text, is set forth below.

DEPARTMENT OF HOMELAND SECURITY

List of Subjects in 6 CFR Part 46

• Human research subjects
• Reporting and record-keeping requirements
• Research

For the reasons stated in the preamble, the Department of Homeland Security adds 6 CFR part 46 as set forth at the end of the common preamble of this document.

PART 46—PROTECTION OF HUMAN SUBJECTS

Authority: 5 U.S.C. 301; Pub. L. 107-296, sec. 102, 306(c); Pub. L. 108-458, sec. 8306.

DEPARTMENT OF AGRICULTURE

List of Subjects in 7 CFR Part 1c

• Human research subjects
• Reporting and record-keeping requirements
• Research

For the reasons stated in the preamble, the Department of Agriculture revises 7 CFR part 1c as set forth at the end of the common preamble of this document.

PART 1c—PROTECTION OF HUMAN SUBJECTS

Authority: 5 U.S.C. 301; 42 U.S.C. 300v-1(b).

DEPARTMENT OF ENERGY

List of Subjects in 10 CFR Part 745

10 CFR Part 745

• Human research subjects
• Reporting and record-keeping requirements
• Research

For the reasons stated in the preamble, the Department of Energy revises 10 CFR part 745 as set forth at the end of the common preamble of this document.

PART 745—PROTECTION OF HUMAN SUBJECTS

Authority: 5 U.S.C. 301; 42 U.S.C. 7254; 42 U.S.C. 300v-1(b).

NATIONAL AERONAUTICS AND SPACE ADMINISTRATION

List of Subjects in 14 CFR Part 1230

14 CFR Part 1230

• Human research subjects
• Reporting and record-keeping requirements
• Research

For the reasons stated in the preamble, the National Aeronautics and Space Administration revises 14 CFR part 1230 as set forth at the end of the common preamble of this document.

PART 1230—PROTECTION OF HUMAN SUBJECTS

Authority: 5 U.S.C. 301;42 U.S.C. 300v-1(b).

DEPARTMENT OF COMMERCE

List of Subjects in 15 CFR Part 27

15 CFR Part 27

• Human research subjects
• Reporting and record-keeping requirements
• Research

For the reasons stated in the preamble, the Department of Commerce revises 15 CFR part 27 as set forth at the end of the common preamble of this document.

PART 27—PROTECTION OF HUMAN SUBJECTS

Authority: 5 U.S.C. 301; 42 U.S.C. 300v-1(b).

SOCIAL SECURITY ADMINISTRATION

List of Subjects in 20 CFR Part 431

20 CFR Part 431

• Human research subjects
• Reporting and record-keeping requirements
• Research

For the reasons stated in the preamble, the Social Security Administration adds 20 CFR part 431 as set forth at the end of the common preamble of this document.

PART 431—PROTECTION OF HUMAN SUBJECTS

Authority: 5 U.S.C. 301; 42 U.S.C. 289(a).

AGENCY FOR INTERNATIONAL DEVELOPMENT

List of Subjects in 22 CFR Part 225

22 CFR Part 225

• Human research subjects
• Reporting and record-keeping requirements
• Research

For the reasons stated in the preamble, the Agency for International Development revises 22 CFR part 225 as set forth at the end of the common preamble of this document.

PART 225—PROTECTION OF HUMAN SUBJECTS

Authority: 5 U.S.C. 301; 42 U.S.C. 300v-1(b), unless otherwise noted.

DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT

List of Subjects in 24 CFR Part 60

24 CFR Part 60

• Human research subjects
• Reporting and record-keeping requirements
• Research

For the reasons stated in the preamble, the Department of Housing and Urban Development revises 24 CFR part 60 as set forth at the end of the common preamble of this document.

PART 60—PROTECTION OF HUMAN SUBJECTS

Authority: 5 U.S.C. 301; 42 U.S.C. 300v-1(b) and 3535(d).

DEPARTMENT OF LABOR

List of Subjects in 29 CFR Part 21

29 CFR Part 21

• Human research subjects
• Reporting and record-keeping requirements
• Research

For the reasons stated in the preamble, the Department of Labor adds 29 CFR part 21 as set forth at the end of the common preamble of this document.

PART 21—PROTECTION OF HUMAN SUBJECTS

Authority: 5 U.S.C. 301; 29 U.S.C. 551.

DEPARTMENT OF DEFENSE

List of Subjects in 32 CFR Part 219

32 CFR Part 219

• Human research subjects
• Reporting and record-keeping requirements
• Research

For the reasons stated in the preamble, the Department of Defense revises 32 CFR part 219 as set forth at the end of the common preamble of this document.

PART 219—PROTECTION OF HUMAN SUBJECTS

Authority: 5 U.S.C. 301; 42 U.S.C. 300v-1(b).

DEPARTMENT OF EDUCATION

List of Subjects in 34 CFR Part 97

• Human research subjects
• Reporting and record-keeping requirements
• Research

For the reasons stated in the preamble, the Department of Education amends 34 CFR part 97 as follows:

PART 97—PROTECTION OF HUMAN SUBJECTS

1. The authority citation for part 97 continues to read as follows:

Authority: 5 U.S.C. 301; 20 U.S.C. 1221e-3, 3474; 42 U.S.C. 300v-1(b).

2. Subpart A is revised as set forth at the end of the common preamble of this document.

Subpart A—Federal Policy for the Protection of Human Subjects (Basic ED Policy for Protection of Human Research Subjects)

DEPARTMENT OF VETERANS AFFAIRS

List of Subjects in 38 CFR Part 16

38 CFR Part 16

• Human research subjects
• Reporting and record-keeping requirements
• Research

For the reasons stated in the preamble, the Department of Veterans Affairs revises 38 CFR part 16 as set forth at the end of the common preamble of this document.

PART 16—PROTECTION OF HUMAN SUBJECTS

Authority: 5 U.S.C. 301; 38 U.S.C. 501, 7331, 7334; 42 U.S.C. 300v-1(b).

ENVIRONMENTAL PROTECTION AGENCY

List of Subjects in 40 CFR Part 26

40 CFR Part 26

• Human research subjects
• Reporting and record-keeping requirements
• Research

For the reasons stated in the preamble, the Environmental Protection Agency amends 40 CFR part 26 as follows:

PART 26—PROTECTION OF HUMAN SUBJECTS

1. The authority citation for part 26 continues to read as follows:

Authority: 5 U.S.C. 301; 7 U.S.C. 136a(a) and 136w(a)(1); 21 U.S.C. 346a(e)(1)(C); sec. 201, Pub. L. 109-54, 119 Stat. 531; and 42 U.S.C. 300v-1(b).

2. Subpart A is revised as set forth at the end of the common preamble of this document.

Subpart A—Basic EPA Policy for Protection of Subjects in Human Research Conducted or Supported by EPA

DEPARTMENT OF HEALTH AND HUMAN SERVICES

List of Subjects in 45 CFR Part 46

45 CFR Part 46

• Human research subjects
• Reporting and record-keeping requirements
• Research

For the reasons stated in the preamble, the Department of Health and Human Services amends 45 CFR part 46 as follows:

PART 46—PROTECTION OF HUMAN SUBJECTS

1. The authority citation for part 46 is revised to read as follows:

Authority: 5 U.S.C. 301; 42 U.S.C. 289(a); 42 U.S.C. 300v-1(b).

2. Subpart A is revised as set forth at the end of the common preamble of this document.

Subpart A—Basic HHS Policy for Protection of Human Research Subjects

NATIONAL SCIENCE FOUNDATION

List of Subjects in 45 CFR Part 690

45 CFR Part 690

• Human research subjects
• Reporting and record-keeping requirements
• Research

For the reasons stated in the preamble, the National Science Foundation revises 45 CFR part 690 as set forth at the end of the common preamble of this document.

PART 690—PROTECTION OF HUMAN SUBJECTS

Authority: 5 U.S.C. 301; 42 U.S.C. 300v-1(b).

DEPARTMENT OF TRANSPORTATION

List of Subjects in 49 CFR Part 11

49 CFR Part 11

• Human research subjects
• Reporting and record-keeping requirements
• Research

For the reasons stated in the preamble, the Department of Transportation revises 49 CFR part 11 as set forth at the end of the common preamble of this document.

PART 11—PROTECTION OF HUMAN SUBJECTS

Authority: 5 U.S.C. 301; 42 U.S.C. 300v-1(b).