In September 2015, the U.S. Department of Health and Human Services (HHS) released a Notice of Proposed Rulemaking (NPRM) to significantly revise the human subject protection and informed consent regulations known as the “Common Rule.”1 If enacted, it will be the first substantial change to these regulations since 1981. Including HHS, the NPRM would affect 16 federal agencies; however, of note, the Food and Drug Administration (FDA) is not included in the current NPRM due to its unique role and statutory framework. FDA’s intent is to issue a separate NPRM after the final rule has been enacted, in order to harmonize its specific regulations with the overarching regulations of HHS (of which FDA is an agency) to the extent possible.
The goal of the NPRM is to recalibrate protection of human subjects and administrative burden by reducing institutional review board (IRB) oversight of minimal-risk research, while simultaneously implementing stronger consent and data protection measures. If enacted, it will lead to changes for IRBs, investigators, institutions, and sponsors.
The HHS did an admirable job of couching the proposed changes within the framework of the historic Belmont Report2 principles of respect for persons, beneficence, and justice in research involving human subjects. In this paper, we discuss seven of the most significant proposed changes, including those addressing biospecimens, new exclusions, revised exemptions, consent changes, IRB continuing review, extension of the Common Rule to nonfunded clinical trials, and the requirement for single IRBs for multicenter research.
The most far-reaching and significant proposal in the NPRM is that all human biospecimens will be considered to be identifiable, even if they are de-identified or anonymized, and thus research with biospecimens will always be considered to involve human subjects. It would no longer be possible to remove identifiers and then conduct research without IRB oversight or consent, as often occurs at present, except for “compelling research needs” that are expected to be “rare.”
This approach is based on the premises that individuals in the U.S. want to control use of their biospecimens in research; that biospecimens are inherently identifiable due to the genetic fingerprint; and that, in order to maintain public trust, it is necessary to obtain consent for nearly all research with biospecimens. One important exception is that these requirements would not apply to secondary research use of a nonidentified biospecimen that is designed only to generate information about an individual that already is known, such as the development of a new cancer assay using biospecimens from individuals known to have cancer.
HHS has proposed that consent for future unspecified research will be obtained through a “broad consent” process, and plans to develop a template that can be used for this purpose. When an individual provides broad consent, researchers will be able to use existing data and samples at the institution, as well as obtain additional data and samples about that person for a period of 10 years. However, the research using the data and samples will be able to continue for as long as described in the consent process, which can be indefinitely. (For children, the period covered is the shorter of 10 years or until they reach majority, at which time their new consent is required.)
If an individual refuses to provide broad consent, the refusal must be tracked and honored. The broad consent will include four elements of consent from the current regulations, including risks, benefits, confidentiality provisions, and contacts for questions. In addition, the broad consent must include:
- A statement that the subject’s biospecimens may be used for commercial profit and whether the subject will or will not share in this commercial profit
- A statement regarding whether clinically relevant research results, including individual research results, will be disclosed to subjects, and if so, under what conditions
- An option for the subject or the representative to consent, or refuse to consent, to investigators re-contacting the subject to seek additional information or biospecimens or to discuss participation in another research study
- A general description of the types of research that may be conducted with information and biospecimens • Information that is expected to be generated from the research
- Types of information or biospecimens that might be used in research
- Types of institutions that might conduct research with the biospecimens or information
- A clear description of the types of biospecimens or information that were or will be collected
Once broad consent has been obtained, biospecimens can be stored and used for research as long as two conditions are met: First, there is a limited scope, one-time IRB review, and second, new data security measures that HHS will devise are applied to the storage and use. However, if the investigator anticipates returning research results, then full IRB review and consent will be required.
Many will argue that the requirement for broad consent for all biospecimens weights the principle of autonomy too heavily at the expense of beneficence and the public good. It is foreseeable that in many healthcare settings there will not be the resources or incentives to obtain broad consent, particularly in institutions that do not receive federal funds to conduct human subjects research. If that is true, then large amounts of biospecimens that are currently available for use in research when stripped of identifiers would be no longer available for federally funded research, and perhaps for FDA-regulated research, depending on how FDA implements this requirement.
In addition to introducing broad consent for biospecimens collected for nonresearch purposes, the NPRM suggests several important revisions to the informed consent regulations. The rationale for the changes is a recommitment to the ethical principle of respect for persons, and a desire to promote greater transparency to the general public regarding the research enterprise.
The NPRM contends that consent forms have become information repositories that serve sponsors, institutions, and investigators at the expense of adequately informing the potential subject. To combat the trend toward long consent documents, the proposed rule requires that informed consent documents be limited to information required in the elements of consent and written in nontechnical language understandable to the average person.
All other information would be moved into an appendix to the consent document. Although the goals of improving the consent process and enhancing subject understanding are laudable, there is likely to be concern that the new appendix will become an unwieldy home to even more information than is currently contained in consent forms.
The proposal also includes minor changes to both the required and optional elements of informed consent. A new required element of informed consent would inform subjects of potential future research use of study data, and new optional elements address commercialization of biospecimens, the return of clinically relevant research results, and consent to future contact by the researchers.
Each of these changes addresses a current gap in the existing regulations, but also raises questions. For example, it is not clear what constitutes a “clinically relevant research result.” Minor changes are also proposed to the criteria for a waiver of informed consent.
One theme of the NPRM is a desire to calibrate the level of IRB oversight to the level of risk expected in the research. One way this is addressed in the proposal is through changes to continuing review requirements.
The draft policy proposes eliminating the need for continuing review for all research approved by expedited review, as well as any research that is in the data analysis phase or where the research interventions have concluded and data collection is limited to follow-up clinical data. Given that expedited research must be classified as being of a minimal-risk nature in order to be approved, this change is welcome.
It is not clear if this was considered for all minimal-risk research. Nevertheless, this will eliminate a large number of continuing reviews by IRBs. While traditional continuing review for these studies is eliminated, there is a requirement that the IRB receive annual confirmation that no changes have occurred that would require the IRB to conduct continuing review.
The elimination of traditional continuing review may reduce regulatory burden, but some of these gains may be offset by the annual confirmation process. This change will require IRBs to implement new administrative processes in order to accommodate the new annual confirmations.
Extensions of Clinical Trials
Critics of the current regulations have long pointed to the gap whereby a clinical trial that is neither federally funded nor regulated by the FDA is not subject to regulatory oversight. The NPRM attempts to reduce this gap by extending coverage to any clinical trial being conducted at an institution that receives federal research funding.
Research that is subject to regulation by the FDA is not impacted by this proposal. The proposed rule also provides a definition for the term “clinical trial” that is comparable to the definition used by the National Institutes of Health (NIH) and the International Committee of Medical Journal Editors.
Another change that applies to clinical trials is a new requirement related to consent. As part of the overarching theme of transparency to the general public, sponsors of all clinical trials covered by this policy will be required to post a copy of the informed consent form to a yet-to-be determined public website within 60 days of the close of enrollment. It is not clear that the informed consent appendices will have to be posted.
Some are likely to question the value of posting consent documents for studies that are no longer recruiting, and whether a consent form that is posted out of context truly benefits the general public. At the same time, it is possible that sponsors, knowing that the consent forms used to inform people about their research will be posted in a public space, will take greater care to ensure that consent materials are written in a clear, concise manner in a language that would be considered understandable to the lay public.
The NPRM proposes the use of a central IRB for all domestic multisite studies subject to Common Rule oversight, a concept that has also been proposed by a draft NIH policy3 and the draft 21st Century Cures4 legislation. The single IRB would be selected by the sponsor, and when research is not funded the lead site would select the IRB. Federal sponsors would have the authority to determine that a single IRB is not appropriate for certain studies, but such a determination would need to be justified.
However, numerous questions remain; for example, while it is clear that the sponsor will select the single IRB, it is not clear if there will be criteria for selecting the IRB. The HHS Secretary’s Advisory Committee on Human Research Protections5 has previously identified multiple necessary attributes of single IRBs, including adequate electronic management systems, knowledge of state laws, and independent accreditation.
Further, with the sponsoring agency selecting the IRB, there are questions about what that process will look like. Concerns may be raised that some of the efficiencies gained through use of a single IRB would be lost if the selection process is mired in bureaucratic government contracting. Also, there will be concern about a “one-size fits all” process that treats a collaborative project between three institutions implementing a behavioral research project the same as a multisite clinical trial network.
The NPRM also proposes a new regulatory classification of “excluded research.” Excluded activities do not have to satisfy any regulatory requirements, nor undergo any type of review process to determine this status, and there are no recordkeeping requirements for the IRB or institution. Eleven specific types of activities will be outside the scope of the regulations, falling into three general categories.
The first category includes activities that are not research (or might be research), but are part of inherently governmental functions. There are six exclusions in the first category, the most notable being oral history, journalism, biography, and historical scholarship activities; as well as quality assurance and quality improvement activities.
The second category includes low-risk research or research that is protected under other federal privacy protections, and thus does not need protection under the Common Rule. There are four exclusions in the second category:
- educational tests, survey procedures, interview procedures, or observation of public behaviors if subjects cannot be identified, or if disclosure would not reasonably place the subjects at risk, or the activity is conducted under other federal acts that provide protection of confidentiality;
- research involving the collection or study of information that has been or will be collected and is recorded such that the individuals cannot be identified;
- research conducted by a government agency using government-generated or government-collected data under a federal law providing confidentiality protections; and
- research that involves the use of protected health information by an entity covered by the Health Insurance Portability and Accountability Act.
The third and final category involves secondary use of nonidentified biospecimens when the research is limited to generating information about the subject that is already known.
By and large, the new excluded category appears to be a reduction in administrative burden balanced with appropriate protection of human subjects, and several currently uncertain activities are clearly placed outside the research framework.
Significant changes are proposed to the current Common Rule “exemption” categories (or “exempt research”), including increased oversight requirements. A few of the current exemptions are maintained, with minor changes, while other categories are new.
In contrast to the exclusions, records of an exemption decision must be maintained by the relevant IRB or institution. HHS will develop an electronic exemption decision tool allowing for an exemption decision to be made by entering information about the research. Use of the exemption tool will be considered a safe harbor, but an institution may alternatively choose to have a knowledgeable person can make the exemption determination, as currently occurs. (The NPRM asks for public input on whether investigators should be allowed to use the tool without any other review.)
There are two levels of exemptions—those described in the new .104(d) section that do not need additional controls, and those at the new .104(e) and .104(f) sections that contain exemptions that must meet the new privacy safeguards described in section .105. HHS will publish a list of specific measures that will provide reasonable and appropriate safeguards to satisfy .105 after the NPRM is finalized.
Three of the new .104(d) exemptions are largely similar to current exemptions, while the fourth .104(d) exemption is new, and applies to research involving benign interventions in conjunction with the collection of data from an adult subject through verbal or written responses or video recording, if the subject prospectively agrees to the intervention and data collection, and either subjects cannot be identified or any disclosure will not harm subjects. This represents a significant improvement over the current exemptions, as these types of studies currently must be reviewed and approved under IRB expedited review, even though they represent no risk to subjects.
The next set of the new .104(e) exemptions require the application of the new .105 privacy protections in order to qualify for exempt status. The first is research involving the use of educational tests, survey procedures, interview procedures, or observation of public behavior where subjects can be identified in the records. This research can involve a risk of information harm to subjects due to the sensitive nature of the research, such as interviews about illegal behavior, because the .105 privacy protections provide protection in place of IRB review.
The second of the new .104(e) exemptions is secondary research use of identifiable private information (not including biospecimens) that has been or will be acquired for nonresearch purposes, if prior notice has been given to the individuals that such information may be used in research; and the identifiable private information is used only for purposes of the specific research project.
Finally, as previously mentioned in the section on biospecimens, the third set of the new exemptions at .104(f) involve the storage, maintenance, and subsequent use for secondary research of biospecimens or identifiable private information that have been or will be acquired for research studies other than for the proposed research study, or for nonresearch purposes.
Beyond the application of the .105 protections, as an extra protection the IRB must provide review using a new criteria for approval at .111(a)(9), which includes the requirement for broad consent.
It is difficult to judge the value of the proposed revised exempt categories of research for several reasons. First, HHS has not yet developed the exemption tool, the new .105 privacy safeguards, or the broad consent template, and thus their effectiveness and administrative ease cannot be assessed. In addition, there is concern that if investigators are allowed to make their own exemption determinations, accidental or intentional misapplications may expose subjects to research risks without IRB oversight. The NPRM is also silent as to whom the responsible parties are if such misapplications occur.
The proposals in the NPRM are intended to revise the regulations to better apply to this century’s research environment, and enhance research subject protections while simultaneously reducing unnecessary administrative burden. The proposals are appropriately supported by use of the Belmont principles, and many of them will be welcomed by the research community as striking the appropriate balance.
However, because many tools have not yet been developed, it is difficult to assess whether the appropriate balance has been struck regarding biospecimens and the new exemption categories. They could end up transferring administrative burden from the IRB to other departments in institutions, and at the same time inhibiting valuable, low-risk research.
David Forster, JD, MA, CIP, (firstname.lastname@example.org) is chief compliance officer for WIRB-Copernicus Group in Princeton, N.J.
David Borasky, MPH, CIP, (email@example.com) is vice president of quality management at Copernicus Group IRB (part of the WIRB-Copernicus Group), in Research Triangle Park, N.C.