Federal Policy for the Protection of Human Subjects

Federal RegisterSep 8, 2015

Ask Donna

What actually matters in this document.

Text

DEPARTMENT OF HOMELAND SECURITY

6 CFR Part 46

DEPARTMENT OF AGRICULTURE

7 CFR Part 1c

DEPARTMENT OF ENERGY

10 CFR Part 745

NATIONAL AERONAUTICS AND SPACE ADMINISTRATION

14 CFR Part 1230

DEPARTMENT OF COMMERCE

15 CFR Part 27

SOCIAL SECURITY ADMINISTRATION

20 CFR Part 431

AGENCY FOR INTERNATIONAL DEVELOPMENT

22 CFR Part 225

DEPARTMENT OF JUSTICE

28 CFR Part 46

DEPARTMENT OF LABOR

29 CFR Part 21

DEPARTMENT OF DEFENSE

32 CFR Part 219

DEPARTMENT OF EDUCATION

34 CFR Part 97

DEPARTMENT OF VETERANS AFFAIRS

38 CFR Part 16

ENVIRONMENTAL PROTECTION AGENCY

40 CFR Part 26

DEPARTMENT OF HEALTH AND HUMAN SERVICES

45 CFR Part 46

RIN 0937-AA02

NATIONAL SCIENCE FOUNDATION

45 CFR Part 690

DEPARTMENT OF TRANSPORTATION

49 CFR Part 11

Federal Policy for the Protection of Human Subjects

AGENCY:

Department of Homeland Security; Department of Agriculture; Department of Energy; National Aeronautics and Space Administration; Department of Commerce; Social Security Administration; Agency for International Development; Department of Justice; Department of Labor; Department of Defense; Department of Education; Department of Veterans Affairs; Environmental Protection Agency; Department of Health and Human Services; National Science Foundation; and Department of Transportation.

ACTION:

Notice of proposed rulemaking.

SUMMARY:

The departments and agencies listed in this document propose revisions to modernize, strengthen, and make more effective the Federal Policy for the Protection of Human Subjects that was promulgated as a Common Rule in 1991. This NPRM seeks comment on proposals to better protect human subjects involved in research, while facilitating valuable research and reducing burden, delay, and ambiguity for investigators. This proposed rule is an effort to modernize, simplify, and enhance the current system of oversight. The participating departments and agencies propose these revisions to the human subjects regulations because they believe these changes would strengthen protections for research subjects while facilitating important research.

DATES:

To be assured consideration, comments must be received at one of the addresses provided below, no later than 5 p.m. on December 7, 2015.

ADDRESSES:

You may submit comments, identified by docket ID number HHS-OPHS-2015-0008, by one of the following methods:

•

Federal eRulemaking Portal:

http://www.regulations.gov

. Enter the above docket ID number in the “Enter Keyword or ID” field and click on “Search.” On the next Web page, click on “Submit a Comment” action and follow the instructions.

•

Mail/Hand delivery/Courier [For paper, disk, or CD-ROM submissions] to:

Jerry Menikoff, M.D., J.D., OHRP, 1101 Wootton Parkway, Suite 200, Rockville, MD 20852.

Comments received, including any personal information, will be posted without change to

http://www.regulations.gov

FOR FURTHER INFORMATION CONTACT:

Jerry Menikoff, M.D., J.D., Office for Human Research Protections (OHRP), Department of Health and Human Services, 1101 Wootton Parkway, Suite 200, Rockville, MD 20852; telephone: 240-453-6900 or 1-866-447-4777; facsimile: 301-402-2071; email:

jerry.menikoff@hhs.gov

SUPPLEMENTARY INFORMATION:

Executive Summary

Purpose of the Regulatory Action

Summary of the Major Provisions of the Proposed Regulatory Actions

Estimated Costs and Benefits

I. The Rationale for Modernizing the Common Rule

A. The Changing Nature of Research

B. Public Comments, Expert Advice, Stakeholder Dialogue

C. Guiding Principles for Proposed Changes

1. Question for Public Comment

D. Organization of the NPRM

II. Major Proposals To Modernize the Common Rule

A. Proposed Changes to the Scope and Applicability of the Regulations

1. Expanding the Definition of Human Subject to Cover Research With Non-identified Biospecimens (NPRM at §§ __.102(e) and __.101(b)(3)(i))

a. NPRM Goals

b. Current Rule

c. ANPRM Discussion

d. NPRM Proposal

i. Alternative Proposals

e. What would change in the definition of “human subject” under the primary proposal?

f. Questions for Public Comment

2. Explicit Exclusion of Activities From the Common Rule

a. Exclusion of Activities That Are Deemed Not Research (NPRM at § __.101(b)(1))

i. Program Improvement Activities (NPRM at § __.101(b)(1)(i))

(1) NPRM Proposal

(2) Questions for Public Comment

ii. Oral History, Journalism, Biography, and Historical Scholarship Activities (NPRM at § __.101(b)(1)(ii))

(1) ANPRM Discussion

(2) NPRM Proposal

iii. Criminal Justice Activities (NPRM at § __.101(b)(1)(iii))

(1) NPRM Proposal

iv. Quality Assurance and Quality Improvement Activities (NPRM at § __.101(b)(1)(iv))

(1) NPRM Proposal

v. Public Health Surveillance (NPRM at § __.101(b)(1)(v))

(1) NPRM Proposal

(2) Question for Public Comment

vi. Intelligence Surveillance Activities (NPRM at § __.101(b)(1)(vi))

(1) NPRM Proposal

b. Exclusion of Activities That Are Low-Risk and Already Subject to Independent Controls (NPRM at § __.101(b)(2))

i. NPRM Goals

ii. ANPRM Discussion

iii. Educational Tests, Survey Procedures, Interview Procedures, or Observation of Public Behaviors (NPRM at § __.101(b)(2)(i))

(1) NPRM Proposal

(2) Questions for Public Comment

iv. Research Involving the Collection or Study of Information That Has Been or

Will Be Collected (NPRM at § __.101(b)(2)(ii))

(1) Current Rule

(2) ANPRM Discussion

(3) NPRM Proposal

(4) Questions for Public Comment

v. Research Conducted by a Government Agency Using Government-Generated or Government-Collected Data (NPRM at § __.101(b)(2)(iii))

(1) NPRM Proposal

(2) Questions for Public Comment

vi. Certain Activities Covered by HIPAA (NPRM at § __.101(b)(2)(iv))

(1) ANPRM Discussion

(2) NPRM Proposal

(3) Questions for Public Comment

c. Applicability of Exclusions to the Subparts

i. Current Rule

ii. NPRM Proposals

iii. Questions for Public Comment

3. Proposed Exemptions (NPRM at § __.104)

a. Making Exempt Research Determinations (NPRM at § __.104(c))

i. NPRM Goal

ii. Current Rule

iii. ANPRM Discussion

iv. NPRM Proposal

v. Questions for Public Comment

b. Exemptions Subject to the Documentation Requirements of § __.104(c) and No Other Section of the Proposed Rule

i. Research Conducted in Established or Commonly Accepted Educational Settings (NPRM at § __.104(d)(1); current Rule at § __.101(b)(1))

(1) NPRM Goal

(2) Current Rule

(3) NPRM Proposal

(4) Questions for Public Comment

ii. Research and Demonstration Projects Conducted or Supported by a Federal Department or Agency (NPRM at § __.104(d)(2); Current Rule at § __.101(b)(5))

(1) NPRM Goal

(2) Current Rule

(3) ANPRM Discussion

(4) NPRM Proposal

(5) Questions for Public Comment

iii. Research Involving Benign Interventions in Conjunction With the Collection of Data fFrom an Adult Subject (NPRM at § __.104(d)(3))

(1) NPRM Goal

(2) Current Rule

(3) ANPRM Discussion

(4) NPRM Proposal

(5) Questions for Public Comment

iv. Taste and Food Quality Evaluation and Consumer Acceptance Studies (NPRM at § __.104(d)(4); Current Rule at § __.101(b)(6))

(1) Question for Public Comment

c. Exemptions Subject to the Documentation Requirements of § __.104(c) and the Privacy Safeguards Described in § __.105

i. Questions for Public Comment

ii. Research Involving Educational Tests, Surveys, Interviews, or Observation of Public Behavior if the Information Is Recorded With Identifiers and Even if the Information Is Sensitive (NPRM at § __.104(e)(1))

(1) NPRM Goals

(2) Current Rule

(3) ANPRM Discussion

(4) NPRM Proposal

(5). Questions for Public Comment

iii. Secondary Research Use of Identifiable Private Information (NPRM at § __.104(e)(2))

(1) NPRM Goal

(2) Current Rule

(3) ANPRM Discussion

(4) NPRM Proposal

(5) Questions for Public Comment

d. Exemptions Subject to the Documentation Requirements of § __.104(c), the Privacy Safeguards Described in § __.105, Limited IRB Review as Described in § __.111(a)(9), and Broad Consent in Accordance With § __.116(c)

i. NPRM Goals

ii. Current Rule

iii. ANPRM Discussion

iv. NPRM Proposals

(1) Exemption for the Storage or Maintenance of Biospecimens or Identifiable Private Information for Secondary Research Use (NPRM at § __.104(f)(1))

(2) Exemption for Secondary Research Use of Biospecimens or Identifiable Private Information Where Broad Consent Has Been Sought and Obtained (NPRM at § __.104(f)(2))

v. Questions for Public Comment

e. Applicability of Exemptions to the Subparts (NPRM at § __.104(b); Current Rule at Footnote 1)

i. Current Rule

ii. NPRM Proposals

ii. Questions for Public Comment

f. What would change in the exemptions?

B. Proposed Changes To Obtaining, Waiving, and Documenting Informed Consent (§§ __.116 and__.117)

1. Required Elements of Informed Consent (NPRM at § __.116(a), (b))

a. NPRM Goal

b. Current Rule

c. ANPRM Discussion

d. NPRM Proposals

e. What would change?

f. Question for Public Comment

2. Broad Consent to the Storage, Maintenance and Secondary Research Use of Biospecimens and Identifiable Private Information (NPRM at § __.116(c), (d))

a. NPRM Goal

b. Current Rule

c. ANPRM Discussion

d. NPRM Proposal

e. What would change?

f. Questions for Public Comment

3. Waiver of Informed Consent or Documentation of Informed Consent (NPRM at §§ __.116(e), (f) and __.117)

a. NPRM Goals

b. Current Rule

c. ANPRM Discussion

d. NPRM Proposals

e. What would change?

f. Questions for Public Comment

4. Posting of Consent Forms

a. NPRM Goals

b. NPRM Proposal

c. What would change?

C. Proposed Changes To Protect Information and Biospecimens (NPRM at § __.105)

1. NPRM Goal

2. Current Rule and Other Regulatory or Statutory Requirements

3. ANPRM Discussion

4. NPRM Proposals

5. What would change?

6. Questions for Public Comment

D. Harmonization of Agency Guidance (NPRM at § __.101(j))

1. NPRM Goal

2. Current Rule

3. ANPRM Discussion

4. NPRM Proposal

5. What would change?

6. Question for Public Comment

E. Cooperative Research (NPRM and Current Rule at § __.114) and Proposal To Cover Unaffiliated IRBs Not Operated by an Institution Holding a Federalwide Assurance (NPRM at § __.101(a))

1. NPRM Goal

2. Current Rule

3. Relevant Prior Proposals and Discussions

4. NPRM Proposals

5. What would change?

6. Questions for Public Comment

F. Changes To Promote Effectiveness and Efficiency in IRB Operations

1. Continuing Review of Research (NPRM at § __.109(f); Current Rule at § __.109(e))

a. NPRM Goal

b. Current Rule

c. ANPRM Discussion

d. NPRM Proposals

e. What would change?

2. Expedited Review Procedures and the Definition of “Minimal Risk” (NPRM at §§ __.110 and __.102(j))

a. NPRM Goal

b. Current Rule

c. ANPRM Discussion

d. NPRM Proposal

e. What would change?

f. Questions for Public Comment

G. Proposed Changes to IRB Operational Requirements

1. Proposed Criteria for IRB Approval of Research (NPRM at § __.111)

a. NPRM Goals

b. Current Rule

c. ANPRM Discussion

d. NPRM Proposals

e. What would change?

f. Questions for Public Comment

2. Proposed Revisions To IRB Operations, Functions, and Membership Requirements

a. NPRM Goal

b. Current Rule

c. NPRM Proposal

d. What would change?

e. Question for Public Comment

H. Other Proposed Changes

1. Proposal To Extend the Common Rule to All Clinical Trials (With Exceptions) (NPRM at § __.101(a)(1))

a. NPRM Goals

b. Current Rule

c. ANPRM Discussion

d. NPRM Proposal

e. What Would Change?

f. Questions for Public Comment

2. Changes to the Assurance Process (NPRM at §§ __.103 and __.108; Current Rule at § __.103)

a. NPRM Goal

b. Current Rule

c. NPRM Proposals

d. What would change?

e. Question for Public Comment

3. Department or Agency Discretion About Applicability of the Policy (NPRM at § __.101(c), (d), (i)) and Discretion Regarding Additional Requirements Imposed by the Conducting or Supporting Department or Agency (NPRM and Current Rule at § __.124)

a. NPRM Goals

b. Current Rule

c. NPRM Proposals

4. Research Covered by This Policy Conducted in Foreign Countries (NPRM at § __.101(h))

I. Effective and Compliance Dates of New Rule (NPRM at § __.101(k))

1. Effective Dates

2. Transition Provisions

a. Research Initiated Prior to the Effective Date of This Subpart (NPRM at § __.101(k)(1))

b. Use of Prior Collections of Biospecimens (NPRM at § __.101(k)(2))

III. Regulatory Impact Analyses

IV. Environmental Impact

V. Paperwork Reduction Act

VI. Summary of Comments Received on the 2011 Common Rule ANPRM

VII. Regulatory Text

Executive Summary

Purpose of the Regulatory Action

Individuals who are the subjects of research may be asked to contribute their time and assume risk to advance the research enterprise, which benefits society at large. U.S. federal regulations governing the protection of human subjects in research have been in existence for more than three decades. The Department of Health, Education, and Welfare (HEW) first published regulations for the protection of human subjects in 1974, and the Department of Health and Human Services (HHS) revised them in the early 1980s. During the 1980s, HHS began a process that eventually led to the adoption of a revised version of the regulations by 15 U.S. federal departments and agencies in 1991. The purpose of this effort was to promote uniformity, understanding, and compliance with human subject protections as well as to create a uniform body of regulations across Federal departments and agencies (subpart A of 45 CFR part 46), often referred to as the “Common Rule” for the Protection of Human Subjects.

Since the Common Rule was promulgated, the volume and landscape of research involving human subjects have changed considerably. Research with human subjects has grown in scale and become more diverse. Examples of developments include: An expansion in the number and type of clinical trials, as well as observational studies and cohort studies; a diversification of the types of social and behavioral research being used in human subjects research; increased use of sophisticated analytic techniques for use with human biospecimens; and the growing use of electronic health data and other digital records to enable very large data sets to be analyzed and combined in novel ways. Yet these developments have not been accompanied by major change in the human subjects research oversight system, which has remained largely unchanged over the last two decades.

The regulations are codified in each department or agency's title or chapter of the Code of Federal Regulations (CFR). The Common Rule was based on HHS' regulations, 45 CFR part 46, subpart A, and includes identical language in the separate regulations of each department and agency.

Although they have not issued the Common Rule in regulations, three departments and agencies currently comply with all subparts of the HHS protection of human subjects regulations at 45 CFR part 46. These are the Central Intelligence Agency (CIA), the Department of Homeland Security (DHS), and the Social Security Administration (SSA). DHS, and SSA are joining this proposed rulemaking with the intent of codifying the final rule in their own agency regulations.

Pursuant to Executive Order 12333 of December 4, 1981, as amended, elements of the Intelligence Community must comply with the guidelines issued by the Department of Health and Human Services regarding research on human subjects found in 45 CFR part 46. This proposed rulemaking does not supersede the Executive Order. The Office of the Director of National Intelligence and the CIA will continue to adhere to the HHS guidelines, pursuant to the Executive Order, when the final rule is implemented.

DHS, created after issuance of the Common Rule, is required by statute (Pub. L. 108-458, title VIII, section 8306) to comply with 45 CFR part 46, or with equivalent regulations promulgated by the Secretary of Homeland Security or his designee. This proposed rulemaking initiates the process of promulgating equivalent regulations, consistent with statute. Once DHS executes a final rule, DHS will comply with the DHS regulations as the requirements will be equivalent to compliance with HHS regulations at 45 CFR part 46, subpart A.

SSA was separated from HHS in 1995 and, pursuant to the transition rules provided in Section 106 of title 1 of Public Law 103-296, must apply all regulations that applied to SSA before the separation, absent action by the Commissioner. Once the final rule is codified in SSA regulations, SSA will follow the SSA regulations instead of HHS regulations at 45 CFR part 46, subpart A. See Public Law 103-296 § 106(b), 108 Stat. 1464, 1476.

Another department is joining this proposed rulemaking. The Department of Labor (DOL) is not a signatory to the current Common Rule, and is joining this proposed rulemaking in order to promulgate the Common Rule in DOL regulations and to apply the regulations to human subjects research that DOL may conduct or support, pending the scope of the final rule.

Finally, note that there are two current Common Rule agencies that are not listed as part of this proposed rulemaking. The Department of Housing and Urban Development (HUD) supports this proposal, but due to certain statutory prepublication requirements governing HUD rules, HUD will adopt this proposal through a separate rulemaking. The Consumer Product Safety Commission (CPSC), subject to Commission vote, also intends to adopt this proposed rule through a separate rulemaking.

On July 26, 2011, the Office of the Secretary of HHS, in coordination with the Executive Office of the President's Office of Science and Technology Policy (OSTP), published an advanced notice of public rulemaking (ANPRM) to request comment on how current regulations for protecting human subjects who participate in research might be modernized and revised to be more effective.

The ANPRM sought comment on how to better protect human subjects who are involved in research while facilitating valuable research and reducing burden, delay, and ambiguity for investigators.

76 FR 44512 (Jul. 26, 2011).

Since the publication of the ANPRM, science has continued to advance, as has the dialogue regarding the changing nature of research and the preferred balance of protections for research participants among the principles of respect for persons, beneficence, and justice. Important elements of that debate have centered on the appropriate level of transparency in government and medicine and how patient and research participant expectations should be incorporated into government policies.

These factors have helped shape the development of the regulatory actions proposed in this NPRM.

The proposal also benefits from public comments submitted in response to more recent policy proposals regarding specific topics such as informed consent through the Office for Human Research Protection (OHRP)'s Draft Guidance on Disclosing Reasonably Foreseeable Risks in Research Evaluating Standards of Care

and the use of a single institutional review board (IRB) for multi-site research studies through the National Institutes of Health (NIH)'s Draft Policy on the Use of a Single Institutional Review Board for Multi-Site Research.

79 FR 63630 (Oct. 24, 2014).

National Institutes of Health. (2014, December 14). Request for Comments on the Draft NIH Policy on the Use of a Single Institutional Review Board for Multi-Site Research. See more at:

http://grants.nih.gov/grants/guide/notice-files/NOT-OD-15-026.html#sthash.fmjlNRi6.dpuf

. Retrieved from National Institutes of Health, Office of Extramural Research:

http://grants.nih.gov/grants/guide/notice-files/NOT-OD-15-026.html

Finally, the NPRM more thoroughly addresses behavioral and social science research perspectives and the broader types of research conducted or otherwise supported by the other Common Rule agencies. Similarly, the proposal benefits from continuing efforts at HHS to harmonize human subjects policies, particularly between OHRP and the U.S. Food and Drug Administration (FDA).

Summary of the Major Provisions of the Proposed Regulatory Action

The goals of the NPRM are to increase human subjects' ability and opportunity to make informed decisions; reduce potential for harm and increase justice by increasing the uniformity of human subject protections in areas such as information disclosure risk, coverage of clinical trials, and coverage of IRBs; and facilitate current and evolving types of research that offer promising approaches to treating and preventing medical and societal problems through reduced ambiguity in interpretation of the regulations, increased efficiencies in the performance of the review system, and reduced burdens on researchers that do not appear to provide commensurate protections to human subjects. It is hoped that these changes will also build public trust in the research system.

An example of some major changes being proposed that will better protect research subjects and help build public trust are the rules relating to informed consent. With regard to informed consent in general (such as consent to participating in clinical trials), the rules would be significantly tightened to make sure that the process becomes more meaningful. Consent forms would no longer be able to be unduly long documents, with the most important information often buried and hard to find. They would need to give appropriate details about the research that is most relevant to a person's decision to participate in the study, such as information a reasonable person would want to know, and present that information in a way that highlights the key information. In addition, to assure that these rules do indeed change current practices, there will be a one-time posting requirement for the consent forms for clinical trials, so that anyone drafting a consent form will do so knowing that it will eventually be subject to public scrutiny.

In addition, informed consent would generally be required for secondary research with a biospecimen (for example, part of a blood sample that is left over after being drawn for clinical purposes), even if the investigator is not being given information that would enable him or her to identify whose biospecimen it is. Such consent would not need to be obtained for each specific research use of the biospecimen, but rather could be obtained using a “broad” consent form in which a person would give consent to future unspecified research uses.

The NPRM also attempts to strengthen the effectiveness and efficiency of the oversight system by making the level of review more proportional to the seriousness of the harm or danger to be avoided. Research that poses greater risk to subjects should receive more oversight and deliberation than less risky research. The NPRM seeks to avoid requirements that do not enhance protection and impose burden, which can decrease efficiency, waste resources, erode trust, and obscure the true ethical challenges that require careful deliberation and stakeholder input. Cumbersome and outdated regulatory standards overwhelm and distract institutions, IRBs, and investigators in ways that stymie efforts to appropriately address the real risks and benefits of research.

The result of these types of changes, as the NPRM proposes to implement them, is that some studies that currently require IRB review would now become exempt. Some that are currently exempt would specifically be declared as outside the scope of the regulations (“excluded”), and thus would not require any administrative or IRB review. Further, in terms of determining when a study is exempt, a web-based “decision tool” will be created. That decision tool will provide a determination of whether or not a study is exempt. That result, so long as the tool was provided with accurate information, will be presumed by the Common Rule agencies to be an appropriate determination of exempt status. Thus, it is expected that in many instances the tool would be used by the investigators themselves, thus obviating both the need for further review and the concern that the institution might be subjecting itself to future liability by allowing investigators to use the tool. For all of the excluded and exempt research activities, this NPRM also affirms the importance of applying the ethical principle of respect for persons, in addition to the importance of abiding by this principle in fully regulated non-exempt research involving human subjects.

The following list encompasses the most significant changes to the Common Rule proposed in the NPRM:

(1) Improve informed consent by increasing transparency and by imposing stricter new requirements regarding the information that must be given to prospective subjects, and the manner in which it is given to them, to better assure that subjects are appropriately informed before they decide to enroll in a research study.

(2) Generally require informed consent for the use of stored biospecimens in secondary research (for example, part of a blood sample that is left over after being drawn for clinical purposes), even if the investigator is not being given information that would enable him or her to identify whose biospecimen it is. That consent would generally be obtained by means of broad consent (

i.e.,

consent for future, unspecified research studies) to the storage and eventual research use of biospecimens.

(3) Exclude from coverage under the Common Rule certain categories of activities that should be deemed not to be research, are inherently low risk, or where protections similar to those usually provided by IRB review are separately mandated.

(4) Add additional categories of exempt research to accommodate changes in the scientific landscape and to better calibrate the level of review to the level of risk involved in the research. A new process would allow studies to be determined to be exempt without requiring any administrative or IRB review. Certain exempt and all non-exempt research would be required to provide privacy safeguards for biospecimens and identifiable private information. New categories include:

a. certain research involving benign interventions with adult subjects;

b. research involving educational tests, surveys, interviews or observations of public behavior when sensitive information may be collected, provided that data security and information privacy protections policies are followed;

c. secondary research use of identifiable private information originally collected as part of a non-research activity, where notice of such possible use was given;

d. storing or maintaining biospecimens and identifiable private information for future, unspecified secondary research studies, or conducting such studies, when a broad consent template to be promulgated by the Secretary of HHS is used, information and biospecimen privacy safeguards are followed, and limited IRB approval of the consent process used is obtained.

(5) Change the conditions and requirements for waiver or alteration of consent such that waiver of consent for research involving biospecimens (regardless of identifiability) will occur only in very rare circumstances.

(6) Mandate that U.S. institutions engaged in cooperative research rely on a single IRB for that portion of the research that takes place within the United States, with certain exceptions. To encourage the use of IRBs that are otherwise not affiliated with or operated by an assurance-holding institution (“unaffiliated IRBs”), this NPRM also includes a proposal that would hold such IRBs directly responsible for compliance with the Common Rule.

(7) Eliminate the continuing review requirement for studies that undergo expedited review and for studies that have completed study interventions and are merely analyzing data or involve only observational follow-up in conjunction with standard clinical care.

(8) Extend the scope of the policy to cover all clinical trials, regardless of funding source, conducted at a U.S. institution that receives federal funding for non-exempt human subjects research.

In sum, the proposed modifications described above are designed to continue to uphold the ethical principles upon which the Common Rule is based, as applied to the current social, cultural, and technological environment.

The legal authority for the departments and agencies that are signatories to this action is as follows:

Department of Homeland Security, 5 U.S.C. 301; Public Law 107-296, sec. 102, 306(c); Public Law 108-458, sec. 8306. Department of Agriculture, 5 U.S.C. 301. Department of Energy, 5 U.S.C. 301; 42 U.S.C. 7254. National Aeronautics and Space Administration, 5 U.S.C. 301. Department of Commerce, 5 U.S.C. 301. Social Security Administration, 5 U.S.C. 301; 42 U.S.C. 289(a). Agency for International Development, 5 U.S.C. 301. Department of Justice, 5 U.S.C. 301; 28 U.S.C. 509-510. Department of Labor, 5 U.S.C. 301; 29 U.S.C. 551. Department of Defense, 5 U.S.C. 301. Department of Education, 5 U.S.C. 301; 20 U.S.C. 1221e-3, 3474. Department of Veterans Affairs, 5 U.S.C. 301; 38 U.S.C. 501, 7331, 7334. Environmental Protection Agency, 5 U.S.C. 301. Department of Health and Human Services, 5 U.S.C. 301; 42 U.S.C. 289. National Science Foundation, 5 U.S.C. 301. Department of Transportation, 5 U.S.C. 301.

Estimated Costs and Benefits

Table 1 summarizes the quantified and non-quantified benefits and costs of all proposed changes to the Common Rule. Over the 2016-2025 period, present value benefits of $2,629 million and annualized benefits of $308 million are estimated using a 3 percent discount rate; present value benefits of $2,047 million and annualized benefits of $291 million are estimated using a 7 percent discount rate. Present value costs of $13,342 million and annualized costs of $1,564 million are estimated using a 3 percent discount rate; present value costs of $9,605 million and annualized costs of $1,367 million are estimated using a 7 percent discount rate. Non-quantified benefits include improved human subjects protections in clinical trials and biospecimen research not currently subject to oversight; enhanced oversight of research reviewed by unaffiliated IRBs; increased uniformity in regulatory requirements among Common Rule agencies; standardization of human subjects protections when variation among review IRBs is not warranted; revised informed consent forms and processes; improved protection of biospecimens and individually identifiable private information; and increased transparency of Common Rule agency-supported clinical trials to inform the development of new consent forms. Non-quantified costs include the time needed for consultation among Common Rule agencies before federal guidance is issued; and the time needed by investigators to obtain, document, and track the permissible uses of biospecimens and identifiable private information for secondary research use.

Table 1—Accounting Table of Benefits and Costs of All Proposed Changes

Benefits

Present value of 10 years

by discount rate

(millions of 2013 dollars)

3 Percent

7 Percent

Annualized value over 10 years

by discount rate

(millions of 2013 dollars)

3 Percent

7 Percent

Quantified Benefits

2,629

2,047

308

291

Non-quantified Benefits

Improved human subjects protections in clinical trials and biospecimen research not currently subject to oversight; enhanced oversight in research reviewed by unaffiliated IRBs; increased uniformity in regulatory requirements among Common Rule agencies; ethical benefit of respecting an individual's wishes in how his or her biospecimens are used in future research; standardization of human subjects protections when variation among review IRBs is not warranted; improved informed consent forms and processes; improved protection of biospecimens and individually identifiable private information; better ensuring availability of biospecimens for future research activities; and increased transparency of Common Rule-supported clinical trials to inform the development of new consent forms.

Costs

3 Percent

7 Percent

3 Percent

7 Percent

Quantified Costs

13,342

9,605

1,564

1,367

Non-quantified Costs

Time for consultation among Common Rule agencies before federal guidance is issued; time for investigators to obtain consent for secondary use of biospecimens or identifiable private information.

I. The Rationale for Modernizing the Common Rule

A. The Changing Nature of Research

In the last two decades there has been a paradigm shift in how research is conducted. Evolving technologies, including imaging, mobile technologies, and the growth in computing power have changed the scale of information collected in many disciplines. Computer scientists, engineers, and social scientists are developing techniques to integrate different types of data so they can be combined, mined, analyzed, and shared. Research has also increased, evolved, and diversified in other areas, such as national security, crime and crime prevention, economics, education, and the environment, using a wide array of methodologies in the social sciences and multidisciplinary fields. The advent of sophisticated computer software programs, the internet, and mobile technology has created new areas of research activity, particularly within the social and behavioral sciences. In biomedical science, the Human Genome Project laid the foundation for precision medicine and promoted an environment of data sharing and innovation in analytics and technology, and drew attention to the need for policies that support a changing research landscape. New technologies, including genomic sequencing, have quickly led to exponential growth in the data to which investigators have access. The sheer volume of data that can be generated in research, the ease with which it can be shared, and the ways in which it can be used to identify individuals were simply not possible, or even imaginable, when the Common Rule was first adopted.

Research settings are also shifting. While much biomedical research continues to be conducted in academic medical centers, more research is being conducted in clinical care settings, thus combining research and medical data. Biospecimen repositories and large databases have made it easier to do research on existing biospecimens and data. Clinical research networks connected through electronic health records (EHRs) have developed methods for extracting clinical data for research purposes and are working toward integration of research data into EHRs in a meaningful way. The overall volume of research has increased across the board, with growing reliance on research networks and multi-site studies. Large cohort studies number well into the hundreds in the United States alone and many collect biospecimens and data on the same people over many years. Recent trends clearly show that the scientific community recognizes the value of data sharing and open-source resources and understands that pooling intellectual resources and capitalizing on efficient uses of data and technology represent the best ways to advance knowledge.

At the same time, the level of public engagement in the research enterprise has changed; more people want to play an active role in research, particularly related to health, and they have different expectations than when the Common Rule was first established. A more participatory research model is emerging in social, behavioral, and biomedical research, one in which potential research subjects and communities express their views about the value and acceptability of research studies. This participatory model has emerged alongside a broader trend in American society, facilitated by the widespread use of social media, in which Americans are increasingly sharing identifiable personal information and expect to be involved in decisions about how to further share the personal information, including health-related information that they have voluntarily chosen to provide. In many ways, these changes are extensions of the fact that over the past half-century, rather than being passive recipients of health advice and treatment, patients have gradually become more active in decisions about their health and health care. The shift from a paternalistic research environment to one where participants are active partners in biomedical and behavioral research is a critical development in human subjects research.

As technology evolves, so does the nature of the risks and benefits of participating in certain types of research. Many studies do not involve interaction with research subjects, but instead involve, for example, analyzing information obtained from medical records, administrative claims data, education records, criminal justice records, research data shared through data repositories, and existing biospecimens stored in repositories. Risks related to these types of research studies are largely informational, not physical; that is, harms could result primarily from the inappropriate release of information and not from the research interventions themselves. Nonetheless, those harms can be significant.

New methods, more powerful computers, and easy access to large administrative datasets produced by local, state, and federal governments have meant that some types of data that formerly were treated as non-identified can now be re-identified through combining large amounts of information from multiple sources. In 2013, scientists demonstrated that the identity of individual research subjects could be ascertained by collating and analyzing certain types of genomic data, including genomic data from publicly available information sources.

Thus, the possibility of fully identifying biospecimens and some types of data from which direct identifiers had been stripped or did not originally include direct identifiers has grown, requiring vigilance to ensure that such research be subject to appropriate oversight. Most importantly, people want to be asked for their permission. A growing body of survey data show that many prospective participants want to be asked for their consent before their biospecimens are used in research.

5 6 7 8

Gymrek M

et al.

“Identifying personal genomes by surname inference”.

Science

339.6117(2013) 0: 321-324.

Kaufman DJ

et al.

Public opinion about the importance of privacy in biobank research.

American Journal of Human Genetics

2009 Nov;85(5):643-654.

Vermeulen E

et al.

A trial of consent procedures for future research with clinically derived biological samples.

British Journal of Cancer

2009 Nov 3;101(9):1505-1512.

Trinidad SB

et al.

Research practice and participant preferences: The growing gulf.

Science

2011 Jan 21; 331(6015):287-288.

Simon CM et al. Active choice but not too active: Public perspectives on biobank consent models.

Genetics in Medicine.

2011 Sep;13(9):821-831.

Because of these shifts in science, technology, and public engagement expectations, a wide range of stakeholders have raised concerns about the limitations of the existing framework, arguing for a re-evaluation of how the fundamental principles that underlie the Common Rule —respect for persons, beneficence, and justice—are applied in practice to the myriad new contexts in which U.S. research is conducted in the 21st century.

9 10

Dialogue focuses around whether the current system:

Emanuel EJ, Wood A, Fleischman A, et al. Oversight of human participants research: Identifying problems to evaluate reform proposals.

Annals of Internal Medicine

2004;141(4):282-291.

Maschke K. Human research protections: Time for regulatory reform?

Hastings Center Report.

2008 Mar-Apr; 38(2):19-22.

• Is sufficiently supportive of a participant-centered research model that adequately respects participants as partners;

• is not sufficiently risk-based, resulting in both over- and under-regulation of research activities;

11 12 13

Kim S, Ubel P, De Vries R. Pruning the regulatory tree.

Nature

2009 Jan 29;457(7229):534-535.

Wendler D, Varma S. Minimal risk in pediatric research.

Journal of Pediatrics.

2006 Dec;149(6):855-861.

Infectious Disease Society of America. Grinding to a halt: The effects of the increasing regulatory burden on research and quality improvement efforts.

Clinical Infectious Diseases

2009 Aug 1;49(3):328-335.

• is sufficiently tailored to new and emerging areas of research, including social and behavioral research and research involving the collection and use of genetic information;

14 15 16 17 18 19

National Research Council.

Protecting Participants and Facilitating Social and Behavioral Sciences Research.

Washington, DC: National Academies Press, 2003.

Anderlik M. Commercial biobanks and genetic research: Ethical and legal issues.

American Journal of Pharmacogenomics

2003;3(3):203-215.

Schrag ZM. How talking became human subjects research: The Federal regulation of the social sciences, 1965-1991.

Journal of Policy History

2009 January; 21(01):3-37.

Hansson MG

et al.

Should donors be allowed to give broad consent to future biobank research?

Lancet Oncology

2006 Mar; 7(3):266-269.

Murphy J

et al.

Public perspectives on informed consent for biobanking.

American Journal of Public Health

2009 December; 99(12):2128-2134.

Kaufman DJ

et al.

Public opinion about the importance of privacy in biobank research.

American Journal of Human Genetics

2009 Nov; 85(5):643-654.

• effectively informs subjects of psychological, informational, or privacy risks;

20 21 22

Paasche-Orlow MK, Taylor HA, Brancati F. Readability standards for informed-consent forms as compared with actual readability.

New England Journal of Medicine

2003 Feb 20; 348(8):721-726.

Schneider CE. The Hydra.

Hastings Center Report

2010 Jul-Aug; 40(4):9-11.

Albala I, Doyle M, Appelbaum PS. The evolution of consent forms for research: A quarter century of changes.

IRB Ethics & Human Research

2010 May-June; 32(3):7-11.

• adequately accounts for the needs of a “learning” healthcare system for continual quality improvement;

23 24 25

Faden RR, Beauchamp TL, Kass NE. Informed consent, comparative effectiveness, and learning health care.

New England Journal of Medicine

2014 Feb 20;370(8):766-768.

Dziak K

et al.

Variations among institutional review board reviews in a multisite health services research study.

Health Services Research

2005 Feb; 40(1):279-290.

Lynn J

et al.

The ethics of using quality improvement methods in health care.

Annals of Internal Medicine

2007 May 1;146(9):666-673.

• provides sufficient mechanisms to ensure the consistency, quality, and accountability of IRB decision-making.

26 27 28 29

Heimer CA

et al.

Regulating creativity: Research and survival in the IRB iron cage.

Northwestern University Law Review

2007; 101:593-641.

Green LA

et al.

Impact of institutional review board practice variation on observational health services research.

Health Services Research

2006 Feb; 41(1):214-230.

Jansen LA. Local IRBs, multicenter trials, and the ethics of internal amendments.

IRB

2005 Jul-Aug;27(4):7-11.

Schrag Z.

Ethical Imperialism.

Baltimore, MD: Johns Hopkins University Press, 2010.

B. Public Comments, Expert Advice, Stakeholder Dialogue

The revisions to the Common Rule proposed here are based upon a variety of sources of public, stakeholder, and expert comments and advice. First, the NPRM more thoroughly addresses social science and behavioral research perspectives, benefiting from guidance provided by a National Research Council's consensus report entitled “Proposed Revisions to the Common Rule for the Protection of Human Subjects in the Behavioral and Social Sciences.”

The Report was commissioned to ensure that the issues related to research involving human subjects in social and behavioral research would be addressed appropriately, in view of what had been said in the ANPRM. The Panel made numerous recommendations, including recommendations about what research studies should not undergo review, about calibrating the level of IRB review to the level of risk, about the desirability of privacy and confidentiality protections in social and behavioral research other than those of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and about improving informed consent by placing greater emphasis on the process of consent. The NPRM revises some of the ANPRM proposals in light of those recommendations.

National Research Council of the National Academies. (2014). Proposes Revisions to the Common Rule for the Protections of Human Subjects in the Behavioral and Social Science. The National Academies Press, 13-168. Retrieved from

http://www.nap.edu/catalog/18614/proposed-revisions-to-the-common-rule-for-the-protection-of-human-subjects-in-the-behavioral-and-social-sciences.

Second, since the publication of the ANPRM, HHS has continued to solicit public comment on a variety of human subjects related issues, including consent, the use of a single IRB for multi-site studies, and sharing of genomic data. Although these policies were more specific than the issues raised in the ANPRM, the responses received from public comments provide insight for refining the proposals initially put forward in the ANPRM. Of particular interest:

• NIH's proposal that it expects the use of a single IRB for all multi-site research studies funded or conducted by the NIH.

Under that proposal, all domestic sites of a multi-site study would be expected, as a condition of NIH funding, to use a single IRB of record. In response to this proposal, NIH received 165 comments from a range of stakeholders, including investigators, IRB members, and members of the public. The majority of respondents were supportive; however concerns were raised that it would be expensive and time-consuming to identify a single IRB for each new multi-site study.

National Institutes of Health. (2014, December 14). Request for Comments on the Draft NIH Policy on the Use of a Single Institutional Review Board for Multi-Site Research. See more at:

http://grants.nih.gov/grants/guide/notice-files/NOT-OD-15-026.html#sthash.fmjlNRi6.dpuf

. Retrieved from National Institutes of Health, Office of Extramural Research:

http://grants.nih.gov/grants/guide/notice-files/NOT-OD-15-026.html.

• OHRP's draft guidance discussing the required content of consent language for research done within the standard of care.

In August of 2013, prior to the publication of the draft guidance document, HHS held a public meeting to hear from the community on issues raised during the debate surrounding the SUPPORT study.

The public meeting and the draft guidance document spurred a significant public discussion about the nature of the information included in informed consent forms, specifically how investigators should communicate the risks of research studies done within the standard of care. A total of 93 comments were received from bioethicists, investigators and research institutions, hospitals and physicians, IRB members, patient advocates, and industry.

79 FR 63630 (Oct. 24, 2014).

78 FR 48163 (Aug 7, 2013).

• To enhance human subject protections and reduce regulatory burden, OHRP and FDA have been actively working to harmonize the agencies' regulatory requirements and guidance for human subject research, and the FDA's draft guidance, “Use of Electronic Informed Consent in Clinical Investigations” was developed as part of these efforts. The draft guidance was issued in conjunction with an OHRP

Federal Register

notice soliciting comment on the whether joint final guidance would be useful for the regulated community, and whether FDA's draft guidance would be appropriate for all research regulated under 45 CFR part 46, such as social and behavioral research studies. Comments were received largely favoring joint guidance, but with separate sections addressing research regulated solely by 45 CFR part 46.

• NIH's proposal to promote sharing of large-scale human genomic data generated from studies funded or conducted by NIH.

The policy lays out an expectation that investigators generating genomic data get consent for future research use of those data. The NIH received 107 comments on the policy, including many that addressed

the concept of broad consent for unspecified future research use.

79 FR 51345 (Aug. 28, 2014).

There have also been developments on the legislative front that have informed the discussions leading up to this NPRM. In December of 2014, the Newborn Screening Saves Lives Reauthorization Act of 2014 (Pub. L. 113-240), was signed into law. The new law makes a number of changes relevant to the HHS regulations for protecting research subjects, including declaring that research with newborn dried blood spots that is federally funded pursuant to the Public Health Service Act is to be considered research with human subjects, and the provisions allowing IRBs to waive consent will not apply. These changes will be effective until updates to the Common Rule are promulgated. In addition, in April of 2015, the Medicare Access and CHIP Reauthorization Act of 2015 (Pub. L. 114-10) was passed. That law requires HHS to issue a clarification or modification of the Common Rule with regard to how they apply to activities involving clinical data registries.

Most recently, with the launch of the President's Precision Medicine Initiative (PMI),

35 36

the Federal Government is proposing a new research cohort based on a model that puts participants at the center.

To understand participant preferences the White House and PMI agencies have been hosting a series of roundtables and public workshops about public expectations for how participants want to engage in research today. These discussions have included individuals from many sectors, including prospective research participants, patients and patient advocates, privacy experts, bioethicists, academic and industry investigators, data scientists, technology innovators, healthcare institutions and providers. The government has heard many perspectives, with much alignment around the central tenet that participants should be active partners in research, and not merely passive subjects of research studies. Many are seeking a research environment where they can contribute to the greater good and have transparency into the research being conducted using their specimens and data. The conversations have focused on promoting the ethical principles of respect for persons, beneficence, and justice, as well as promoting other protections, such as data security and privacy.

The White House, Office of the Press Secretary. (2015, January 30). Fact Sheets: President Obama's Precision Medicine Initiative. Retrieved from The White House:

https://www.whitehouse.gov/the-press-office/2015/01/30/fact-sheet-president-obama-s-precision-medicine-initiative.

Collins FS, Varmus H. A New Initiative on Precision Medicine.

N Engl J Med

2015 Feb; 372:793-795.

See also

http://www.scientificamerican.com/article/big-precision-medicine-plan-raises-patient-privacy-concerns/, http://www.nih.gov/precisionmedicine/

, and

http://www.nih.gov/precisionmedicine/.

C. Guiding Principles for Proposed Changes

In 1979, the Belmont Report

was predicated on three principles that were felt to be central to shaping an ethical framework for the conduct of research with human subjects. The three ethical principles are respect for persons, beneficence, and justice. Interpretation of, and balancing among, these three principles played a major role in shaping what became the development the federal regulations that have become known as the Common Rule. The preamble to the proposal considers whether and how the interpretation of these fundamental principles might be updated within the context of the current technological, social, cultural, and ethical environment. That consideration involves explicitly identifying the interplay among the principles. The Common Rule provides a framework for how researchers and IRBs weigh the often conflicting implications of these three principles.

National Commission for the Protection of Human Subjects of Biomedical and Behavioral Research. (1979). Belmont Report. Washington, DC: U.S. Department of Health & Human Services. Available at:

http://www.hhs.gov/ohrp/humansubjects/guidance/belmont.html

Beneficence

: Individuals who participate in research contribute their time and may assume significant risks to advance the research enterprise. Their valuable contributions produce knowledge that benefits society at large. The Belmont Report describes the principle of beneficence as the goal of maximizing possible benefits of research and minimizing possible harms. This principle has been interpreted to, in part, emphasize the benefit associated with the knowledge that might be generated by a research study. Evaluating beneficence requires examining the likelihood that knowledge would be generated, and how important or useful that knowledge might be to the population. When more weight is given to research that has the potential to generate a great deal of knowledge, particularly knowledge that could be very useful to society (such as how to treat serious diseases that are currently untreatable), policies would lean in favor of encouraging and facilitating more of that type of research.

A distinct aspect of the principle of beneficence concerns the benefits and risks to the specific persons who would be participating in a particular research study. In the example of a randomized clinical trial comparing two treatments for a disease, the benefits and risks to the subjects in the trial are distinct from the possible benefits to society as a whole from learning which of the two treatments is better. This aspect of beneficence assumes that there are limits on the risks to which people should be subject, even if they are willing to undergo those risks.

Society is in an information age. In all facets of one's life information about that person is generated, stored, shared, analyzed, and often provides tremendous societal value. People share information about themselves with large numbers of people with the click of a button, and this trend of rapid and widespread sharing is only likely to grow. The increase in concern about unauthorized and inadvertent information disclosure, in combination with newer research techniques that increase the volume and nature of identifiable data suggest the need for the Common Rule to more explicitly address data security and privacy protection.

Of particular interest for this proposal is addressing risks from inappropriate disclosure of information generated from biospecimens. One way to protect subjects from such risks is to bring under oversight research for which risks are greater of subjects being identified and information being inappropriately disclosed. Although it may be difficult to identify individuals from their non-identified biospecimens at present, and most investigators would have no need to do so unless they were seeking additional associated phenotypic information, certain technologies and methods can be used to generate data that are unique to the individual who provides the biospecimen, and those data can sometimes be combined with other data sources to identify the individual. In the future, technologies will facilitate the use and analysis of greater variety and volumes of information, and there is a possibility that it will be increasingly difficult, if not impossible, to make biospecimens fully non-identified. In fact, a number of reports have already demonstrated the ability to re-identify individuals from biospecimens or data that lack direct identifiers.

39 40

As analytic techniques become more sophisticated and large

datasets become more accessible, it will not be possible to guarantee that an individual could never be identified from a biospecimen or combination or data sources, particularly if whole genome sequencing is conducted.

Rothstein MA. Is deidentification sufficient to protect health privacy in research?

American Journal of Bioethics

Sep 2010; 10(9): 3-11.

El Emam K et al. A systematic review of re-identification attacks on health data.

PLoS One

2011; 6(12):e28071.

Respect for Persons

: The Belmont Report describes this concept as the notion of treating people as autonomous agents, and allowing them to make choices based on their own judgments and opinions. Inherent in the principle of autonomy is the concept of transparency—clearly providing the information necessary for the research participant to make such judgments. Transparency requires a clear articulation of risks, potential benefits, and alternatives to participating in a research study, as well as the purpose of the research. The principle of autonomy encompasses the value ascribed to an individual's right to know how one's data is being used and who will have access to it. As such autonomy also covers the paired concept of protecting those persons who lack the capability to make such decisions. There are a variety of different ways of demonstrating respect for persons.

Obtaining informed consent from human subjects for the collection and analysis of information about them is one means of implementation of respect for persons in the research context. Informed consent is designed to ensure that each individual approached to participate in a research study fully understands the risks and potential benefits of the study so that they have sufficient information to make an individualized calculation as to whether or not the tradeoffs inherent in participation are worth it for them to agree to participate. Both the potential harms and benefits tend to be greater in the context of a clinical trial where subjects are randomized to one or another of two possible treatments with significantly different suspected risks than in situations where subjects are simply asked to provide, for instance, a urine sample.

Notice, in which individuals are informed about how data will be used, but explicit consent is not obtained, is another means of facilitating transparency. Notice is sometimes used in the context of informing people about how data collected for non-research purposes (

e.g.,

when providing information in the context of applying for public benefits) might be used for either general or specific research purposes. Another method for showing respect for persons with regard to using data about them for research could be providing them with a right to opt out of such research, by, for example, filing a form stating such a wish with the holder of the data.

Related, implicit consent might be obtained when a research subject completes a questionnaire. If they did not wish to provide the information, presumably they would not be answering the questions. The NPRM contains a number of provisions that are designed to further promote respect for participants through increases in both transparency and opportunities for consent.

Justice:

The Belmont Report describes this principle as being about fairness in terms of who receives the benefits from research and who bears its burdens. One of the most direct applications of the principle of justice to the Common Rule relates to determining who is studied and how subjects are selected. This principle also is relevant to protection of vulnerable populations. In addition, the idea of justice is relevant to one of core goals of this NPRM: Clarifying important aspects of the Common Rule where there has been ambiguity in interpretation. To the extent that IRBs and others interpret the regulations in significantly different ways, the result is that participants in research can end up being treated in very different ways, even when they are participating in the same study. Thus this idea is embedded in all of the NPRM's attempts to make sure that these rules are applied in a more uniform and consistent manner.

The three ethical principles of the Belmont Report often cannot all be fulfilled at the same time. In many cases, it will be necessary to choose which of those principles will deserve the greatest adherence. This NPRM, at its heart, represents an attempt to evaluate the weights to be applied to each of these three core principles in a variety of specific contexts. Giving greater weight to one of the principles will frequently mean a decreased ability to fulfill one of the other principles. By necessity, value judgments, influenced by the social norms of the time, drive the implementation of the broad principles underlying the Belmont Report. The efficacy of the oversight system also requires proportionality in weighing the application of these three principles. This is reflected in the analysis that follows, in terms of evaluating the specific aspects of beneficence, respect for persons, and justice that relate to a particular issue, and weighing those aspects against one another. Research that poses greater risk should receive more attention and deliberation than less risky research, and the degree and type of oversight should be commensurate with the level of risk. In addition, requirements that do not enhance protection but that impose burden can increase inefficiency, waste resources, erode trust, and obscure the ethical challenges that require careful deliberation and stakeholder input. Cumbersome and outdated regulatory standards overwhelm and distract oversight bodies and other stakeholders from appropriately addressing the real risks and benefits of research.

There is tremendous support for research in this country. American society values advances in knowledge and has reaped the reward of many key insights that have led to increases in quality of life and a doubling of our life expectancy in the last century. There would not have been such strides in medical and behavioral research without the willingness of individuals to join research studies. Participants are told that they are not likely to benefit directly from any given study, yet they choose to participate for the greater good. Beneficence is a powerful driver. On the other hand, members of the public deserve, and indeed now expect, to know how publicly-funded research is being conducted and overseen, and need to have confidence that the interests of research participants are adequately protected. Transparency is key for developing trust, especially between investigators, funders, regulators, and the public.

Our reassessment of these ethical principles in the context of current technology and social norms suggests the need for changes to the Common Rule that: (1) Increase subject autonomy by increasing human subjects' ability and opportunity to make informed decisions; (2) reduce potential for harm and increase justice by increasing the uniformity of human subject protections in areas such as information disclosure risk, coverage of clinical trials, and coverage of IRBs; and (3) increase beneficence by facilitating current and evolving types of research that offer promising approaches to treating and preventing medical and societal problems though reduced ambiguity in interpretation of the regulations, increased efficiencies in the performance of the review system, and reduced burdens on researchers that do not appear to provide commensurate protections to human subjects. If a reasonable balance is struck between protecting human research subjects, minimizing the administrative burden of the system, and engendering public trust, this should maximize beneficence and raise all ships.

Public comment is sought not only on the provisions outlined below, but on whether the proposals strike a reasonable balance among the core

ethical principles. A better balance among the core principles should increase the strength of the partnership between the research enterprise and the public, and even greater scientific understanding and innovation will be fostered.

Finally, it is important to note that, to the extent appropriate, the intent is to eventually amend the other subparts of the HHS human subjects protection regulations in 45 CFR part 46 (subparts B, C, D, and E), and consider the need for updates to FDA regulations and other relevant Federal departmental or agency regulations with overlapping scope.

1. Question for Public Comment

1. Public comment is sought on whether the proposed changes will achieve the objectives of (i) decreasing administrative burden, delay and ambiguity for investigators, institutions, and IRBs, and (ii) strengthening, modernizing, and making the regulations more effective in protecting research subjects.

D. Organization of the NPRM

Section II of the NPRM, which immediately follows, describes in detail the major proposals for revisions to the Common Rule. In general, the changes that are likely to be of greatest significance are discussed in the earlier parts of section II of this preamble. Section II.A is devoted to changes that affect which activities are subject to the Common Rule. Following that section are discussions devoted to changes relating to informed consent (section II.B), changes relating to privacy safeguards for the research use of information and biospecimens (section II.C), and a proposal to encourage greater harmonization of guidance across the agencies that adhere to the Common Rule (section II.D). Discussions of changes relating to how IRBs operate, including a proposal to reduce the number of reviews by different IRBs that take place for multi-site studies, are in the several sections that follow (sections II.E, F and G). The final section (section II.H) collects a variety of other changes, including expanding the scope of the rule to cover clinical trials that are not federally funded but are conducted at institutions that received some federal funding for research with human subjects.

The three sections that follow then discuss various administrative review requirements: Regulatory Impact Analyses (section III), Environmental Impact (section IV), and Paperwork Reduction Act (section V). The final section of the document (section VII) provides the full regulatory text of the proposed changes to the Common Rule. Section VI provides a comprehensive summary of responses received to the 2011 Common Rule ANPRM.

II. Major Proposals To Modernize the Common Rule

A. Proposed Changes to the Scope and Applicability of the Regulations

1. Expanding the Definition of Human Subject to Cover Research with Non-identified Biospecimens (NPRM at §§ __.102(e) and __.101(b)(3)(i))

This section focuses on the ethical principles associated with the secondary research use of biospecimens. These biospecimens may have been originally collected from either research or non-research settings (

e.g.,

leftover portion of tissue from a clinical biopsy).

a. NPRM Goals

One of the goals of this NPRM is facilitating cutting edge research in genomics and other `omics' such as the transcriptome and the microbiome, which generate a wealth of data from biospecimens designed to inform the development of treatments and preventative measures for chronic diseases such as cancer. Facilitating such research, however, requires navigating complex ethical issues. The key question is, under what circumstances should the Common Rule govern what research investigators are able to do with biospecimens that have been collected for some other (

e.g.,

clinical) purpose? (Note that if a researcher interacted with an individual to actually collect a biospecimen for research purposes—for example, obtaining a saliva sample—that “primary” research activity is already covered under the current regulations, and is not the focus of the change discussed in this section.) In this case, maximizing the societal value of research would mean reducing barriers to the secondary use of biospecimens to the extent possible.

However, there is a growing recognition that many people want to have some degree of control over the circumstances in which an investigator can derive information about them, above and apart from their interest in whether or not that information might be inappropriately disclosed. More specifically, a growing body of literature shows that in general people prefer to have the opportunity to consent (or refuse to consent) to research involving their own biological materials.

Furthermore, in 2012, the Presidential Commission for the Study of Bioethical Issues highlighted the ethical importance of obtaining consent for genomics research and recommended that “unauthorized whole genome sequencing without the consent of the individual from whom the sample came” be prohibited.

Their rationale for reaching this conclusion was based on concerns relating to privacy as well as autonomy.

See supra

notes 5-8.

Presidential Commission for the Study of Bioethical Issues. (2012). Privacy and Progress in Whole Genome Sequencing. Washington, DC: Presidential Commission for the Study of Bioethical Issues. Retrieved from

http://bioethics.gov/sites/default/files/PrivacyProgress508_1.pdf.

In assigning weights to the principles of beneficence and respect for persons in the context of research with biospecimens, strong consideration was given to the fact that failure to acknowledge and give appropriate weight to this distinct autonomy interest in research using biospecimens could, in the end, diminish public support for such research, and ultimately jeopardize our ability to be able to conduct the appropriate amount of future research with biospecimens. To that end, the proposals given below are designed to meet the goals of increasing transparency in when and how biospecimens collected in a variety of circumstances will be used for research purposes and increasing opportunities for consent. Various ways in which these goals might be achieved are the subject of alternative proposals discussed below.

b. Current Rule

The application of the current regulations to secondary research use of a biospecimen is tied to the identifiability of the biospecimen in the hands of the researcher. In particular, the definition of human subject in the current Common Rule at § __.102(f) states that a human subject is a living individual about whom an investigator (whether professional or student) conducting research obtains data through intervention or interaction with the individual, or identifiable private information. Private information is described as information that is individually identifiable (

i.e.,

the identity of the subject is or may readily be ascertained by the investigator or associated with the information) in order for obtaining the information to constitute research involving human subjects.

Consistent with historical interpretation of identifiable private information under the Common Rule, the terms “non-identified” or “non-identifiable” are used throughout this

NPRM to signify biospecimens or data that have been stripped of identifiers such that an investigator cannot readily ascertain a human subject's identity. Re-identification of non-identified or non-identifiable biospecimens or information may be possible, depending on the circumstances. The term “de-identified” is distinct; it is only used in this proposal to refer specifically to the HIPAA standard of non-identifiability.

Thus, where there is no intervention or interaction with an individual, central to determining whether human subjects are involved in a research activity covered by the current Common Rule is determining the meaning of “identifiable.” Under the current Rule, provided the biospecimens and data were collected for purposes other than the currently proposed research, it is permissible for investigators to conduct research on biospecimens and data that have been stripped of all identifiers without obtaining consent because the non-identified biospecimens and data do not meet the regulatory definition of human subject.

It is, however, worth noting that although informed consent is not strictly required by the current regulations when research takes place using non-identified biospecimens, some IRBs have indicated that they are requiring that investigators explicitly obtain consent for future analysis of biospecimens collected in the research setting, and some are refusing to waive consent for use of biospecimens collected in non-research contexts.

c. ANPRM Discussion

The ANPRM asked whether consent should be required before an investigator could conduct research on a non-identified biospecimen. It further asked, if consent were to be required, could such consent be obtained by having a person provide consent for unspecified future research with the biospecimen, instead of requiring that specific consent be obtained each time that the biospecimen would actually be used in a research study.

Although HHS does not consider whole genome analysis to produce identifiable private information unless additional information is available to the investigator that would enable the investigator to “readily ascertain” the identity of the individual, it is acknowledged that a time when investigators will be able readily ascertain the identity of individuals from their genetic information may not be far away. The ANPRM suggested that, regardless of what information is removed, it is theoretically possible to extract DNA from a biospecimen itself and potentially link it to otherwise available data to identify individuals. In addition, irrespective of whether biospecimens are considered individually identifiable, the ANPRM sought comment on whether the regulations should be changed to allow human subjects to decide whether their biospecimens would be available for research.

The ANPRM asked whether some types of genomic data should be considered identifiable and, if so, which types (

e.g.,

genome-wide single nucleotide polymorphism [SNP] analyses or whole genome sequences). It also asked whether a human biospecimen should be considered inherently identifiable.

The ANPRM also suggested that the definition of identifiability in the Common Rule be modified to better harmonize it with other regulatory definitions of identifiability within HHS. The ANPRM considered adopting the HIPAA Privacy Rule's standards of what constitutes individually identifiable information, a limited data set, and de-identified information (as defined under HIPAA), in order to address inconsistencies regarding these definitions and concepts between the HIPAA Privacy Rule and the Common Rule.

More specifically, as described above, private information is not considered to be identifiable under the current Rule if the identity of the subject is not or may not be “readily ascertained” by the investigator from the information or associated with the information. In contrast, under the HIPAA Privacy Rule, health information is de-identified and thus exempt from that rule only if it neither identifies nor provides a reasonable basis to believe that the information can be used to identify an individual. The HIPAA Privacy Rule provides two ways to de-identify information: (1) A formal determination by a qualified expert that the risk is very small that an individual could be identified; or (2) the removal of all 18 specified identifiers of the individual and of the individual's relatives, household members, and employers, as long as the covered entity has no actual knowledge that the remaining information could be used to identify the individual (45 CFR 164.514(b)).

The HIPAA Privacy Rule addresses some informational risks by imposing restrictions on how individually identifiable health information collected by health plans, health care clearinghouses, and most health care providers (“covered entities”) may be used and disclosed, including for research. In addition, the HIPAA Security Rule (45 CFR parts 160 and, subparts A and C of part 164) requires that these entities implement certain administrative, physical, and technical safeguards to protect this information, when in electronic form, from unauthorized use or disclosure. However, the HIPAA Rules apply only to covered entities (and in certain situations to their business associates), and thus not all investigators are part of a covered entity and required to comply with those rules. Moreover, the HIPAA Rules do not apply specifically to biospecimens in and of themselves.

Public comments in response to the 2011 ANPRM regarding covering all biospecimens raised a series of important concerns. A majority of the commenters opposed the ANPRM's suggested requirement of consent for research use of all biospecimens, regardless of identifiability, particularly if applied to samples collected before the effective date of the regulation. Some commenters cited lack of convincing evidence of harm caused by research use of non-identified clinical biospecimens without consent; they noted that they were not convinced that the principle of autonomy outweighs or trumps the principle of beneficence. They expressed concern that doing so would significantly slow advances in research and human health.

Others acknowledged the erosion of public trust that can result from high-profile disputes involving the use of non-identified biospecimens collected during research.

Commenters cited the costs to collect, log, and track consent status of data and biospecimens collected in a clinical setting to ensure that any restrictions on the research use of such resources were honored. However, it is important to note that it appears that many commenters were reacting to concerns that any change in the Common Rule with respect to consent for use of biospecimens would be applied retroactively—that is, to samples already collected.

National Congress of American Indians. Havasupai Tribe and the lawsuit settlement aftermath. Retrieved on November 17, 2014, from

http://genetics.ncai.org/case-study/havasupai-Tribe.cfm

Some patient advocacy organizations also expressed concerns about the consequences of requiring consent for the use of non-identified biospecimens. Other commenters noted that the recommendation to require consent might inappropriately give greater weight to the Belmont Report's principle of autonomy over the principle of justice, because requiring consent could result in lower participation rates in research by

minority groups and marginalized members of society. Yet, most of the comments from individual members of the public strongly supported consent requirements for use of their biospecimens, regardless of identifiability.

Many commenters expressed the opinion that the existing regulatory framework is adequate and that current practices should be maintained, stressing that the research use of non-identified data or biospecimens does not involve risk to the research participant. Furthermore, several commenters noted that, although it is theoretically plausible to identify a person based on their biospecimen, the likelihood remains remote enough to argue against the presumption that the sources of all biospecimens are identifiable and cited a study showing that the risk of re-identification from a system intrusion of databases was only 0.22%.

In contrast, some commenters supported the idea of requiring consent for research use of all biospecimens, with one commenter noting simply that “research use of data initially collected for non-research purposes should always require informed consent.”

Kwok P et al. Harder Than You Think: A Case Study of Re-Identification Risk of HIPAA-Compliant Records. NORC at The University of Chicago and Office of the National Coordinator for Health Information Technology. 2011.

http://www.amstat.org/meetings/jsm/2011/onlineprogram/AbstractDetails.cfm?abstractid=302255.

Several commenters stated that if the Common Rule were modified such that all biospecimens were covered under the rule regardless of identifiability there still might be some activities involving biospecimens that should be considered exempt or excluded from coverage. Suggestions included:

• Identifying markers for cancer prognosis or prediction of response to cancer therapy, or identifying cancer molecular targets (molecular research)

• Basic science research (including analysis of biological processes)

• Research on rare conditions and diseases

• Pediatric research

• Research with samples that lack potentially identifying information, such as serum or plasma not containing DNA

• Biospecimens lacking nucleic acids (such as certain red blood cells, expiratory gases)

• Blood culture bacteria

• Bacterial and viral specimens (this was listed in a comment as a public health issue)

• Protein analysis

• Statistical method development (to the extent that this development is related to biospecimens)

• New molecular methods to detect infectious agents

• Use of specimens to develop and validate new assays for infectious agents

• Archival paraffin blocks

With respect to the 2011 proposal to adopt the HIPAA Privacy Rule's definition of identifiability, a majority of the public commenters strongly opposed the idea. They indicated that the HIPAA Privacy Rule's standard of identifiability would expand what is considered identifiable for purposes of the Common Rule and thus greatly impede relatively low-risk research without adding meaningful protections for human subjects. In particular, they asserted that the HIPAA standards were created to protect against disclosure of health information contained in medical records. As such, commenters argued, they are not appropriate for many types of research that would be covered by the Common Rule (

e.g.,

behavioral and social science research). Others said this would be an extreme change in response to an as yet unidentified or clear problem. Commenters said that the information most at risk for inappropriate disclosure is the type of private health information that is already protected under the HIPAA Rules. Commenters feared that such a change in policy, while “harmonizing” the Common Rule to certain HIPAA standards, would create inordinate burdens in terms of new documentation requirements and result in a requirement to apply the HIPAA standards to all types of research, regardless of the level of risk.

d. NPRM Proposal

Regardless of the scale on which harms may have occurred in the past, continuing to allow secondary research with biospecimens collected without consent for research places the publicly-funded research enterprise in an increasingly untenable position because it is not consistent with the majority of the public's wishes, which reflect legitimate autonomy interests. As such, one of the most fundamental changes proposed in this NPRM is to the definition of human subject (proposed § __.102(e)). The proposal is for the obtaining, use, study, or analysis of biospecimens to be covered under the Common Rule, regardless of identifiability. Covering biospecimens regardless of identifiability avoids codifying any given interpretation of the quickly evolving debates regarding whether certain analytic results (

e.g.,

decoding the whole genome) should be considered to yield identifiable data. (Accompanying this proposal are some minor wording changes to other portions of that definition that are merely intended to clarify how the word “obtains” is currently interpreted by OHRP.)

Thus, the focus of this proposal is to require informed consent for research involving biospecimens in all but a limited number of circumstances. The consent would not need to be obtained for

each

specific study using the biospecimen, but could instead be obtained through

broad

consent for future unspecified research (described in more detail in sections II.A.3.d and II.B of this preamble).

An increase in trust and partnership is likely to increase participation rates in research; using individuals' samples and data without permission will hinder true partnership. Better communication and community engagement with patients, particularly in geographic areas and for population subgroups where consent rates are lower than average, should be a priority for the research community.

In response to comments received about the 2011 ANPRM, the NPRM proposes to have the new definition of human subject apply prospectively, that is, it will only apply to research involving biospecimens that will be collected in the future. Additionally, in recognizing that this proposal will have major implications for the operational functioning of the research enterprise, compliance with this provision would be delayed until three years after publication of a final rule.

Also consistent with comments received on the ANPRM, it is proposed that a subset of secondary research on stored biospecimens would be allowed without consent. Specifically, research designed to only generate information about the person that is already known would be considered outside of the scope of the Common Rule. This exclusion would include but not be limited to the development and validation of certain tests and assays (such as research to develop a diagnostic test for a condition using specimens from individuals known to have the condition and those known not to have the condition), quality assurance and control activities, and proficiency testing. This provision would be implemented through a new exclusion from the regulations at § __.101(b)(3)(i), which has specifically been designed to reflect the underlying ethical principles.

If the research is designed not to generate any new information about the

person, but only confirm something about them that is already known, then the interest in respecting the person's autonomy would appear to be relatively weak. As an example, imagine that a person is known to have a particular genetic disease, and the research involves evaluating a new product that might in a few minutes, at low cost, produce a result showing whether a person has that disease. The person's autonomy interest in whether or not such a study could take place would seem little different from that of anyone in a study that involved secondary use of identifiable information about them.

In addition, the proposal permits IRBs to waive the requirement for informed consent, but the requirements for approval of such waivers would be very strict, and such waivers will only occur in rare circumstances. Note also that the exclusions proposed in § ;____.101(b)(1)(i), (iii)-(vi) would also allow for the use of biospecimens without consent in certain limited circumstances; these additional exclusions are discussed in section II.A.2 of this preamble, below.

This proposal would not modify the Common Rule standard of identifiability (in contrast to what was discussed in the 2011 ANPRM). That is, the standard for determining when an investigator has sufficient information to readily ascertain the identity of an individual is not being changed under this proposal. Thus, coverage of information derived from biospecimens (whether or not the biospecimen was initially collected in the research or non-research context), or indeed any other type of information, would be the same under this proposal as is the case under the current Common Rule.

i. Alternative Proposals

In this section, we discuss two alternative proposals, both of which maintain “identifiability” as the lynchpin for determining applicability of the Common Rule to biospecimens. These models increase transparency and opportunities for consent over and above what is provided for in the current Common Rule, but in a smaller set of circumstances than provided for under the primary proposal discussed above.

Alternative Proposal A: Expand the Definition of “Human Subject” To Include Whole Genome Sequencing (WGS)

Rather than consider all research using biospecimens as constituting human subjects research, this alternative proposal would expand the definition of human subjects to include only specifically whole genome sequencing data, or any part of the data generated as a consequence of whole genome sequencing, regardless of the individual identifiability of biospecimens used to generate such data. Under this alternative, whole genome sequencing would be considered the sequencing of a human germline or somatic biospecimen with the intent to generate the genome or exome sequence of that biospecimen.

Thus, under this alternative, the regulations would then apply both to research that would generate whole genome sequencing data, the use of any part of the generated data, and to research involving secondary use of any part of whole genome sequencing data that was originally generated for other purposes than the proposed research. Investigators conducting whole genome sequencing research could not avoid the need to comply with the Common Rule by removing identifiers from biospecimens or data, because whole genome sequence data in and of itself would meet the definition of human subject. Under this alternative, a new exemption would also be created that would allow such research to be considered exempt if consent to secondary future research use were obtained in accordance with proposed new requirements at § __.116(c) and standards were met for protecting information and biospecimens as proposed at § __.105. A waiver of consent would be permitted, but would be modeled on the more stringent waiver criteria proposed for research involving biospecimens at § __.116(f)(2).

Explicit consent to conduct research using whole genome sequencing data can be considered ethically important because such data can provide important insights into the health of individuals as well as their relatives. Moreover, whole genome sequence data gathered for one purpose may reveal important information, perhaps unanticipated and unplanned for, years later. Finally, whole genome sequence data are unique for each individual, or at the very least, highly unlikely to be the same as any other individual. Thus, the current allowable practice of removing identifiers from biospecimens and data to conduct whole genome sequencing research without consent might not sufficiently protect both the privacy and autonomy interests of the subject.

As is currently the case, under this alternative, investigators' use of individually identifiable biospecimens, collected for purposes other than the currently proposed research study, would continue to be considered human subjects research. However, the secondary research use of non-identified information or non-identified biospecimens would continue to fall outside of the scope of the Common Rule, with the exception of whole genome sequence data as described above.

One of the less obvious differences in scope between the primary proposal and this Alternative A relates to what research could be done with the data generated from whole genome sequencing that had taken place for clinical purposes. Under the primary proposal, the data produced by such sequencing could continue to be used for research, without additional consent, so long as it did not meet the definition of being identifiable private information. (HHS does not currently consider whole genome sequencing data to meet that definition for purposes of the Common Rule.) Under this Alternative A, consent would be required before using that data for research purposes.

In contrast with the primary proposal in this NPRM, this Alternative Proposal A could be viewed as giving greater weight to the principle of beneficence, while giving less weight to the principle of respecting the autonomy of persons. It would require consent only for the type of studies that many people seem most concerned about (genomic research, including secondary use of genomic information that was produced for clinical purposes). And given that at the moment there is relatively little whole genome sequencing research taking place (in comparison to other types of biospecimen research; see section III.F of this preamble for more information), it would appear to currently impose a somewhat lesser burden in terms of obtaining and tracking consent than the main NPRM proposal.

The major concern with this alternative proposal is that it would codify only a single technology as producing information that would be subject to the Common Rule, necessitating a re-evaluation of the scope of the Rule when technologies now in development to study, for instance, other “omics,” become more widespread.

Alternative Proposal B: Classifying Certain Biospecimens Used in Particular Technologies as Meeting the Criteria for “Human Subject”

This Alternative Proposal B would expand the definition of human subjects to include the research use of information that was produced using a

technology applied to a biospecimen that generates information unique to an individual such that it is foreseeable that, when used in combination with publicly available information, the individual could be identified. Information that met this standard would be referred to as bio-unique information. This proposal is conceptually very similar to Alternative Proposal A. The main difference is that the scope is somewhat broader: Whereas Alternative A requires consent for whole genome sequencing, Alternative B would require consent for genomic sequencing of even small portions of a person's genome, and also require consent for the use of other technologies that might be developed that similarly can generate information unique to a person.

There are three separate conditions that would all need to be met before information would constitute bio-unique information: (1) It would have to have been produced by applying to a biospecimen a technology that is capable of producing information that is unique to an individual; (2) The technology would have to be used to produce enough information such that the information produced is likely to be unique to an individual; and (3) There would need to be publicly available information that, when combined with the information produced by the use of the technology, would create the possibility that some of the individuals whose biospecimens were analyzed using the technologies could be identified.

The major concern with this alternative proposal is that, in order to make such a requirement responsive to scientific and technological developments, HHS would have to continually evaluate new technologies and the nature and amount of information produced using such technologies. Not only would this involve resources and expertise that may not be available to Federal departments and agencies, it would introduce ongoing uncertainty that may actually increase delays in important research.

e. What would change in the definition of “human subject” under the primary proposal?

• It is anticipated that the compliance date for the proposed expansion of the definition would be three years after the publication date. The main consequence of this change would be that informed consent (which could be broad, as described in sections II.A.3.d and II.B of this preamble) would generally be required before research use of biospecimens not covered by an exclusion.

• All biospecimens used for research purposes that do not fall under an exclusion (see proposed § __.101(b)(3)(i), and also § __.101(b)(1)(i), (iii)-(vi)) and are collected after the compliance date would be subject to the requirements of this rule, regardless of identifiability.

f. Questions for Public Comment

2. Would providing a definition of biospecimen be helpful in implementing this provision? If so, how might the definition draw a line between when a biospecimen is covered by the Common Rule, and when processing of biological materials (

e.g.,

to create a commercial product used for treatment purposes) has sufficiently altered the materials so that they should not be subject to the regulations? Would only covering biospecimens that include nucleic acids draw an appropriate line?

3. To what extent do the issues raised in this discussion suggest the need to be clearer and more direct about the definition of identifiable private information? How useful and appropriate is the current modifier “may be readily ascertained” in the context of modern genomic technology, widespread data sharing, and high speed computing? One alternative is to replace the term “identifiable private information” with the term used across the Federal Government: Personally identifiable information (PII). The Office of Management and Budget's

concept of PII refers to information that can be used to distinguish or trace an individual's identity (such as their name, social security number, biometric records, etc.) alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother's maiden name, etc. It is acknowledged that replacing “identifiable private information” with “PII” would increase the scope of what is subject to the Common Rule. However, the practical implications of such an expansion, other than the need to ensure that the data are security stored and otherwise protected against disclosure, may be minimal. Public comment is requested on the advantages and disadvantages of such a change.

Executive Office of the President, Office of Management and Budget. (2007). Memorandum for the Heads of Executive Departments and Agencies. Retrieved from The White House:

https://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2007/m07-16.pdf.

4. Which of the three proposals regarding the definition of human subject achieves the most reasonable tradeoff between the principles of autonomy (including transparency and level of trust) versus beneficence (as measured by facilitating valuable research)?

5. Public comment is sought regarding any concerns that you have about each of the three proposals, including concerns about implementation or burden to investigators and institutions.

2. Explicit Exclusion of Activities From the Common Rule

The NPRM creates a new section in the regulations referred to as “exclusions.” This section outlines eleven specific types of activities that will be outside the scope of the regulations. These activities will therefore not have to satisfy any regulatory requirements, nor is it expected (unlike exempt research) that they will undergo any type of review process to determine this status. The exclusions will eliminate uncertainty regarding some activities that are not research, and identify some activities that arguably might be judged to be research, but whose contribution to public welfare is so imperative that they should proceed without having to satisfy the regulatory requirements. The exclusions also identify certain research activities that are sufficiently low-risk and nonintrusive that the protections provided by the regulations are an unnecessary use of time and resources, whereas the potential benefits of the research are substantial.

The Common Rule has been criticized for not being clear about how to interpret what activities are covered by the policy and for inappropriately being applied to and inhibiting certain activities. The first six exclusion categories are for activities that are deemed not to be research for the purposes of this policy, without needing to consider whether the regulatory definition applies. The definition of research does not provide such a clear and precise way of distinguishing among similar activities that it is immediately obvious which activities fall under the definition and which do not. By creating exclusion categories that are deemed not research, these activities are more clearly distinguished as not having to satisfy the regulatory requirements.

Three of the exclusions seek to eliminate any uncertainty about whether certain internal program improvement activities, historical or journalistic inquiries, or quality assurance or improvement activities satisfy the definition of research. The other three exclusions include some

activities that fall into to a gray area that encompasses some activities that arguably might be judged to be research, but that are part of inherently governmental functions that have purposes other than research, such as responsibilities to protect public health and welfare (see exclusions for criminal investigations, public healthy surveillance, and intelligence surveillance). These activities promote recognized specific goods that are crucial to the public welfare, and should be carried out without any hindrances that satisfying regulatory requirements might impose. For these activities, the principles of beneficence and justice outweigh any intrusions on individual autonomy that the regulations might have prevented.

The next four categories of proposed exclusions are for activities that are considered low-risk either in themselves or because there are appropriate safeguards already in place independent of the Common Rule. Here the level of risk, the potential benefits, and the nature of human participation in this research are such that the principle of beneficence determines that the research activities may go forward without the need to impose the protections of the Common Rule.

The last exclusion applies to research involving the secondary use of non-identified biospecimens when the research is limited to generating information about the subject that is already known. As such, this research does not need any additional protections provided by these regulations and the potential benefits of this research justify it under the principle of beneficence. Because this exclusion directly relates to the proposed changes in the definition of “human subject” to include all biospecimens, it is discussed above in section II.A.1 of this preamble.

It should be noted that the fact that the NPRM now specifically includes a list of certain excluded activities should not be seen as altering the fact that many other activities that do not meet the criteria for being subject to the Common Rule remain outside the scope of the rule. For example, an activity that does not meet the regulatory definition of research, or does not involve human subjects, would still not be subject to these regulations.

Currently, the Common Rule excludes from coverage (1) activities that do not meet the definition of research (§ __.102(d) of the current Rule); (2) activities that are not described as research subject to regulation (§ __.102(e) of the current Rule); and (3) activities that do not involve a human subject (§ __.102(f) of the current Rule).

The ANPRM asked questions about the definition of research and whether various activities should be excluded from the Common Rule, either by changing the definition of research or by adding exemptions, or both. The ANPRM sought comment on whether and, if so, how, the Common Rule should be changed to clarify whether quality improvement activities, program evaluation studies, or public health activities are covered. It also asked whether there are specific types of studies for which the existing rules are inappropriate. If so, comments were sought on whether this problem should be addressed through modifications to the exemption categories, or by changing the definition of “research” used in the Common Rule to exclude some of these studies, or a combination of both.

If the definition of research were to be changed, public comment was sought on how excluded activities should be defined (

e.g.,

“quality improvement” or “program evaluation”). With regard to quality improvement activities, the public was asked to comment on whether it might be useful to adopt the distinction made by the HIPAA Privacy Rule, which distinguishes between “health care operations” and “research” activities, defining “health care operations” to include, among other activities, “conducting quality assessment and improvement activities, including outcomes evaluation and development of clinical guidelines, provided that the obtaining of generalizable knowledge is not the primary purpose of any studies resulting from such activities.”

a. Exclusion of Activities that are Deemed Not Research (NPRM at § __.101(b)(1))

The first set of six exclusions involve activities that will be excluded from the regulations because they will be deemed to not involve research. Three of the first six exclusions (discussed in sections II.A.1.a.i, ii, and iv, below) provide clarity regarding the applicability of the Common Rule to activities about which institutions have raised questions in the past as to whether these activities meet the regulatory definition of research. These exclusions aim to reduce the time and effort involved trying to determine whether the regulations apply, and in unnecessary reviews of these activities.

The other three of these exclusions (discussed in sections II.A.1.iii, v, and vi below) apply to activities that are largely inherently government functions that have purposes other than research, and, when conducted by a government employee or contractor, are subject to a variety of other statutes, regulations, and polices that are designed to protect individual privacy and data security, as well as provide notice to those providing the information as to the uses to which the information will be put (see, for example, the Privacy Act of 1974). These activities promote recognized specific goods that are crucial to the public welfare, and because of this they should be carried out without any hindrances that satisfying the Common Rule regulatory requirements might impose. For these activities, the principle of beneficence outweighs any intrusions on individual autonomy that the regulations might have prevented, and this allows these important activities to proceed without delay.

The ANPRM asked whether various activities such as quality improvement, public health activities, or program evaluations studies should be excluded from the rule.

i. Program Improvement Activities (NPRM at § __.101(b)(1)(i))

(1) NPRM Proposal

The first exclusion, proposed in the NPRM at § __.101(b)(1)(i), is for data collection and analysis, including the use of biospecimens, for an institution's own internal operational monitoring and program improvement purposes, if the data collection and analysis is limited to the use of data or biospecimens originally collected for any purpose other than the currently proposed activity, or is obtained through oral or written communications with individuals (

e.g.,

surveys or interviews). This category is excluded because these activities are designed for various administrative purposes related to using information to improve the quality of services provided by a specific institution, and are not designed to produce generalizable knowledge. A majority of commenters to the 2011 ANPRM supported excluding program evaluation activities from the scope of the Common Rule. Many of these commenters argued that the public benefits resulting from this type of activity justified its practice, particularly given the generally low-risk involved.

An example of an activity that would satisfy this exclusion is a survey of hospital patients to evaluate and improve the quality of meals delivered to hospital patients. An example of an activity that would not satisfy this exclusion is a prospective observational

study of patient treatments to analyze the comparative effectiveness of two different standard of care treatments frequently used to treat the same medical condition.

(2) Questions for Public Comment

6. Public comment is sought for whether this excluded activity should simply be discussed in the text of the final rule's preamble, and guidance produced to assist investigators in making such a determination, or whether any other similar exclusions should be addressed.

7. Public comment is sought for whether biospecimens should not be included in any of these exclusion categories, and if so, which ones.

ii. Oral History, Journalism, Biography, and Historical Scholarship Activities (NPRM at § __.101(b)(1)(ii))

(1) ANPRM Discussion

The ANPRM asked whether there were any fields of study (such as classics, history, languages, literature, and journalism) whose usual methods of inquiry were not intended to or should not be covered by the Common Rule.

(2) NPRM Proposal

The second proposed exclusion, in the NPRM at § __.101(b)(1)(ii) is for oral history, journalism, biography and historical scholarship activities that focus directly on the specific individuals about whom the information is collected.

The overwhelming majority of public comments to the 2011 ANPRM responding to the question about excluding specific fields of study from the regulatory requirements of the Common Rule supported explicitly excluding certain activities from the definition of research versus modifying the exemption categories. The overwhelming majority of these comments focused on oral history. Some of the comments were virtually identical and appear to have been coordinated. Many of the comments reflected the view that the Common Rule was not designed or intended to include oral history activities, and that the ethical codes pertaining to oral history procedures are not consistent with the application of the ethical principles reflected in the Common Rule.

A smaller number of similar comments were submitted with respect to various humanities disciplines and journalism. A significant minority of commenters opposed the exclusion of any fields of study, arguing that the activity itself rather than the academic discipline or training of the investigator should be the basis for the assessment of whether the activity should be excluded. Some of the commenters recommended that the definition of research be focused more explicitly by being limited to “biomedical and behavioral research,” in accordance with the statutory provision underlying the Common Rule. A significant number of commenters recommended that guidance should be issued to clarify how the definition of research should be applied, with cases and explanations.

While the NPRM does not propose to modify the definition of “research”, it does propose to explicitly exclude oral history, journalism, biography, and historical scholarship activities that focus directly on the specific individuals about whom the information or biospecimens is collected. In the kinds of activities referred to here, the ethical requirement is to provide an accurate and evidence-based portrayal of the individuals involved, and not to protect them from public scrutiny. Therefore, the protections afforded to individuals by the Common Rule seem unhelpful in furthering the aforementioned ethical goal in this context. Additionally, these fields of research have their own codes of ethics, according to which, for example, consent is obtained for oral histories. It is believed that because of these reasons, explicit exclusion of these activities from the scope of the Common Rule is appropriate.

iii. Criminal Justice Activities (NPRM at § __.101(b)(1)(iii))

(1) NPRM Proposal

The third category of activities that the NPRM excludes from the proposed rule encompasses data collection and analysis that enables the uniform delivery of criminal justice. The scope of this exclusion is collection and analysis of data, biospecimens, or records by or for a criminal justice agency for activities authorized by law or court order solely for criminal justice or criminal investigative purposes. The activities excluded are necessary for the operation and implementation of the criminal justice system.

The provision would essentially codify current Federal interpretation that such activities are not deemed to be research under the Common Rule. The addition of this provision is designed to avoid the imposition of disparate requirements by IRBs with overlapping jurisdiction when a data collection or analysis activity encompasses the development of methods required by law or court order for criminal justice or criminal investigative purposes. For example, the Federal Bureau of Investigation (FBI) is charged by law with setting standards governing the collection and processing of DNA biospecimens and information taken (forcibly if necessary) from certain federal and state criminal offenders incident to their arrest or conviction for prescribed offenses under the National DNA Identification Act of 1994 and other acts. Similarly, the FBI is charged by law with setting standards governing the collection and processing of fingerprints and related biographical information taken from federal and state criminal offenders and certain sensitive civil employment applicants. At the same time, through its Laboratory Division and other components the FBI routinely collects human biospecimens at crime scenes from or relating to victims and offenders both known and unknown. Incident to these activities, the FBI is also charged with maintaining, and authenticating through identification processes, the criminal record history information of criminal offenders for the Federal Government and for the overwhelming majority of state governments who elect to participate and share information through those FBI systems.

iv. Quality Assurance and Quality Improvement Activities (NPRM at § __.101(b)(1)(iv))

(1) NPRM Proposal

The fourth category of excluded activities covers quality assurance or improvement activities involving the implementation of an accepted practice to improve the delivery or quality of care or services (including, but not limited to, education, training, and changing procedures related to care or services) if the purposes are limited to altering the utilization of the accepted practice and collecting data or biospecimens to evaluate the effects on the utilization of the practice. This exclusion does not cover the evaluation of an accepted practice itself.

As an example of an activity that would satisfy this exclusion, assume that there is an accepted practice that is known to reduce the likelihood of an infection after the insertion of a central line. A randomized study in which half the participating institutions would be assigned to have the staff undergo an educational intervention about the need to use that accepted practice, and the other half would not undergo that intervention, would satisfy this exclusion, since it would only be intended to see if the intervention resulted in greater use of the accepted practice. In contrast, imagine a different study that was designed to determine

how well that accepted practice, when it is used, reduces infections. That study would not satisfy this exclusion, since it would be studying the effectiveness of the practice itself, in contrast to studying an effort to increase use of the practice.

Over the past several years, including in response to the 2011 ANPRM, OHRP has received comments from many individuals and organizations expressing concern that some readings of the definition of “research” would imply that the regulations apply to quality improvement activities, thereby potentially interfering with the ability of health care and other professionals to enhance the delivery or quality of care or services involving the use of accepted practices. Indeed, a majority of commenters to the 2011 ANPRM supported excluding quality improvement activities from the scope of the Common Rule. These quality improvement activities are in many instances conducted by health care and other organizations under clear legal authority to change internal operating procedures to increase safety or otherwise improve performance, often without the consent of staff or clients, followed by monitoring or evaluation of the effects. These activities are generally conducted in circumstances where independent privacy, confidentiality, and security safeguards are in place, minimizing the chances of harm. These efforts, some of which could be judged to be research, should be carried out because of the recognized public good they achieve. This exclusion is intended to avoid impeding such efforts where the Common Rule's requirements might have a chilling effect on the ability to learn from, and conduct, important types of innovation.

Recognizing that some quality improvement efforts should not be considered to involve research as it is defined in the Common Rule can allay many of these concerns. Thus, this exclusion is being proposed to deal with quality improvement activities that are aimed at implementing practices that are already accepted, with the goal of improving the

delivery

quality

of treatments or services. This exclusion would permit measuring and reporting provider performance data for practice management, clinical, or administrative uses. As proposed, this exclusion does not include evaluations of different accepted practices themselves, however, such as activities designed to determine whether a particular accepted medical treatment is or is not more effective than another.

This provision also covers quality improvement activities that are not related to delivery of patient care, but rather involve the delivery or quality of other public benefit or social services. For example, institutions and other entities may provide social services, educational offerings, or other beneficial activities where there is empirical evidence of the value of those efforts, and they may wish to evaluate different ways of enhancing the delivery or quality of those existing services. This exclusion has been written broadly to include such activities.

The rationale for this excluded category is that these activities are designed only to improve the implementation of a practice that is already accepted, not to evaluate the effectiveness and value of the accepted practice itself, and thus would generally be expected to pose little if any risks to the recipients of those practices, and are directly aimed at improving the practical use of those practices. This does not include quality improvement activities designed with a research purpose relating to the safety and efficacy of the accepted practice. It is accordingly important to note that activities that

involve such research—for example, assigning patients to different versions of treatments that are within the standard of care in order to evaluate the differences between those treatments in terms of effectiveness or risks—would not come within this exclusion. In the educational context, for example, activities where students are assigned to experimental and control groups to determine the effectiveness of experimental teaching methodologies would also not come within this exclusion. Furthermore, that type of activity would also not meet a separate requirement of this exclusion—that the activity be related to the delivery of (

i.e.,

implementing) an accepted form of care, and not an attempt to evaluate the efficacy or risks of that form of care.

v. Public Health Surveillance (NPRM at § __.101(b)(1)(v))

(1) NPRM Proposal

The fifth category of excluded activities involves public health surveillance activities, including the collection and testing of biospecimens, conducted, supported, requested, ordered, required, or authorized by a public health authority and limited to those necessary to allow the public health authority to identify, monitor, assess, or investigate potential public health signals or the onset of a disease outbreak, including trends, or signals, and patterns in diseases, or sudden increase in injuries from using a consumer product, or conditions of public health importance, from data, and including those associated with providing timely situational awareness and priority setting during the course of an event or crisis that threatens public health, including natural or man-made disasters. A majority of commenters to the 2011 ANPRM supported excluding public health activities from the scope of the Common Rule.

The rationale for excluding some public health surveillance activities is that when a public health authority conducts public health surveillance activities to fulfill its legal mandate to protect and maintain the health and welfare of the populations it oversees, the regulatory protections of the Common Rule should not impede its ability to accomplish its mandated mission of promoting this recognized public good, in keeping with the principle of beneficence. Other protections independent of the Common Rule exist that serve to protect the rights and welfare of individuals participating in such activities, including privacy, confidentiality and security safeguards for the information collected.

Public health surveillance refers to the collection, analysis, and use of data to target public health prevention. It is the foundation of public health practice. Surveillance uses data from a variety of sources, including mandatory reporting of certain conditions, routine monitoring, vital records, medical billing records, and public health investigations in response to reports of potential outbreaks. The line between public health surveillance and epidemiological research can be difficult to draw, as the same techniques may be used in both. Generally, the difference between the activities is the purpose or context in which the investigation is being conducted and the role of the public health authority.

The following are examples of activities that meet the public health surveillance exclusion:

• Safety and injury surveillance activities designed to enable a public health authority to identify, monitor, assess, and investigate potential safety signals for a specific product or class of products (for example, the surveillance activities of the FDA's Adverse Event Reporting System (AERS), the Vaccine Adverse Event Reporting System (VAERS), Manufacturer and User Facility Device Experience (MAUDE) database, the Medical Product Safety Network (MedSun), and the Sentinel Initiative);

• Surveillance activities designed to enable a public health authority to identify unexpected changes in the

incidence or prevalence of a certain disease in a defined geographic region where specific public health concerns have been raised (

e.g.,

the U.S. influenza surveillance system, which allows CDC to find out when and where influenza activity is occurring, track influenza-related illness, determine what influenza viruses are circulating, detect changes in influenza viruses, and measure the impact influenza is having on hospitalizations and deaths in the United States);

• Surveillance activities designed to enable a public health authority to identify the prevalence of known risk factors associated with a health problem in the context of a domestic or international public health emergency;

• Surveillance activities designed to enable a public health authority to locate the range and source of a disease outbreak or to identify cases of a disease outbreak;

• Surveillance activities designed to enable a public health authority to detect the onset of disease outbreaks or provide timely situational awareness during the course of an event or crisis that threatens the public health, such as a natural or man-made disaster.

On the other hand, subsequent research using information collected during a public health surveillance activity, for instance genetic analysis of biospecimens, would not fall under this exclusion, but would likely be covered under one or more of the other exclusions for low-risk research or exemptions.

Additional examples of activities that would not fall under the exclusion include: Exploratory studies designed to better understand risk factors, including genetic predisposition, for chronic diseases; exploratory studies designed elucidate the relationships between biomarkers of exposure and biomarkers of disease; exploratory studies of potential relationships between behavioral factors (

e.g.,

diet) and indicators of environmental exposures. These types of activities would be considered research, and thus subject to the Common Rule, even if conducted by a Federal agency with a public health mandate. To clarify this proposed exclusion the NPRM also proposes a new regulatory definition of public health authority proposed in § __.102(k).

(2) Question for Public Comment

8. Public comment is requested on whether the parameters of the exclusions are sufficiently clear to provide the necessary operational guidance, or whether any additional criteria or parameters should be applied to clarify or narrow any of these exclusions.

vi. Intelligence Surveillance Activities (NPRM at § __.101(b)(1)(vi))

(1) NPRM Proposal

The sixth category of excluded activities that will not be considered research involves surveys, interviews, surveillance activities and related analyses, or the collection and use of biospecimens where these activities are conducted by a defense, national security, or homeland security authority solely for authorized intelligence, homeland security, defense, or other national security purposes.

The rationale for excluding the defense or national security-related activities is similar to that described above regarding public health surveillance activities. The lawful conduct of the departments' and agencies' mandated missions for actively protecting national security, homeland security, and homeland defense are fundamentally not research. These activities may incorporate the collection and analysis of identifiable information, but they are not designed to develop or contribute to generalizable knowledge; rather, they are solely conducted to fulfill a department or agency's legal mandate to ensure the safety and protection of the United States, its people, and its national security interests. This exclusion codifies the current interpretation of the Common Rule. Research conducted or sponsored by Federal departments and agencies using this exclusion will continue to be subject to this regulation.

b. Exclusion of Activities That Are Low-Risk and Already Subject to Independent Controls (NPRM at § __.101(b)(2))

i. NPRM Goals

The NPRM proposes to exclude four categories of research activities that do not entail physical risk and are non-intrusive, either in themselves or because they are subject to policies that provide oversight independent of the Common Rule. Although the activities are research, they will not be required to receive any form of determination or IRB approval—including expedited review. Additionally, statements of purpose, benefit, and voluntariness as well as consent are not required unless the entity conducting the research, collecting data, or providing data is also subject to separate statutes and regulations requiring such statements. Some of the activities proposed for exclusion are categories that appear as exemptions in the current Rule. It is proposed that the marginal protections provided by the Common Rule are not consistent with the amount of researcher time and institutional resources that they currently draw.

By reclassifying certain research activities from being exempt to being excluded, the proposed rule would eliminate the need for any administrative or IRB review. All investigators performing excluded studies are expected to act in a way that is consistent with the principles outlined in the Belmont Report, even if the Common Rule does not impose requirements on excluded work. For instance, consistent with the spirit of respect for persons, investigators should tell prospective subjects the purpose of the information collection and, where appropriate, that they can choose to participate or not in these activities, although investigators are not explicitly required to do so.

Designating certain research fully outside of the bounds of the Common Rule means that investigators are self-determining whether their own research is covered by the law. As such, the proposal to add these categories is based on the assumption that all investigators will be accurately determining whether their proposed activity is outside the scope of the Common Rule. There is no current proposal outlining how decisions will be made for determining whether a research activity is eligible for exclusion and by whom or how differences among collaborators would be handled. As readers review each of the exclusion categories below, please consider whether the benefits associated with reducing the delay for researchers are countervailed by potential increases in risk of harm.

Throughout this NPRM, the term “low-risk” is used to denote research activities that do not entail physical risk, and where both the probability and magnitude of other risks, once required protections are applied, are hypothesized to be low. Public comment is sought on whether there are instances in the regulatory text where the term “low-risk” is used, but these conditions do not apply, and whether there is a better way to characterize this category of risk.

ii. ANPRM Discussion

The ANPRM discussed criticisms of the current rule that it does not adequately calibrate the review process to the level of risk of the research, particularly in social and behavioral research. It also discussed whether answering questions should be sufficient indication of willingness to participate in survey or interview

research. It distinguished between informational or psychological risks and physical risks, and raised questions about how effectively IRB review provides protections from informational or psychological risks.

iii. Educational Tests, Survey Procedures, Interview Procedures, or Observation of Public Behaviors (NPRM at § __.101(b)(2)(i))

(1) NPRM Proposal

The exclusion at § __.101(b)(2)(i) is for research, not including interventions, that involves the use of educational tests (cognitive, diagnostic, aptitude, achievement), survey procedures, interview procedures, or observation of public behavior (including visual or auditory recording) uninfluenced by the investigators, if at least one of the following is met:

• The information is recorded by the investigator in such a manner that human subjects cannot be identified, directly or through identifiers linked to the subjects; or

• Any disclosure of the human subjects' responses outside the research would not reasonably place the subjects at risk of criminal or civil liability or be damaging to the subjects' financial standing, employability, educational advancement, or reputation; or

• The research will involve a collection of information subject to the Paperwork Reduction Act of 1995, 44 U.S.C. 3501

et seq.,

research information will be maintained on information technology that is subject to and in compliance with section 208(b) of the E-Government Act of 2002, 44 U.S.C. 3501 note, and all of the information collected, used, or generated as part of the research will be maintained in a system or systems of records subject to the Privacy Act of 1974, 5 U.S.C. 552a.

The exclusion does not include research activities in which any sort of intervention is used, in addition to the specified methods of information collection. Also, the term “survey” as used here refers to information collected about individuals via questionnaire or similar procedures (

e.g.,

the Current Population Survey conducted by the Census). “Human subjects” do not include organizations or businesses. “Survey,” as used here, does not include the collection of biospecimens or other types of information collection that might involve invasive procedures. Thus, a survey that included information collections in addition to verbal or written responses, including the collection of a biospecimen or the use of some other physically invasive procedures (

e.g.,

a diagnostic test and blood spot or buccal swab) could not use this exclusion.

This exclusion includes the research activities in current exemption category 2 in the (current Common Rule at § __.101(b)(2)), and some additional government information collection research activities using the same methods. As in the current exemption category 2, this proposed exclusion includes research studies whose methods consist of the use of educational tests, survey procedures or interview procedures, or observation of public behavior uninfluenced by the investigators, if the data are recorded anonymously, or the information is recorded with identifiers, but is not sensitive such that its disclosure could result in harm to the subjects. The exclusion provides a list of the specific harms that must be considered, which is the same as in the current exemption category, with the addition of the specific harm of being damaging to the subjects' educational advancement. This potential harm has been added because of the obvious relevance to the effects of the disclosure of responses in research involving educational tests.

This proposed exclusion does not include the first element in the current exemption category at § __.101(b)(3)(i), which is the element pertaining to research involving the use of educational tests, survey procedures, interview procedures, or observation of public behavior if the human subjects are elected or appointed public officials or candidates for public office. The rationale for this change in the proposed NPRM is that it does not seem appropriate to single out this category of subjects for different treatment in this way.

The third element of this proposed exclusion covers research activities using the same methods identified above even when the data are recorded with identifiers and the information recorded may be personally sensitive or private but not explicitly damaging to an individual, if the research is subject to specified federal statutes and regulations that require data security and subject privacy protections. Under this proposal, the preponderance of research conducted by Federal employees and contractors that collects information exclusively through educational tests, questionnaires, or observations of behavior would no longer be subject to the Common Rule because most such collections would be subject to the Paperwork Reduction Act of 1995, would be maintained on information technology that is subject to and in compliance with section 208(b) of the E-Government Act of 2002, and all of the information collected, used, or generated as part of the research would be maintained in a system or systems of records subject to the Privacy Act of 1974. Furthermore, consistent with these laws, OMB's Standard 2.2 in its “Standards and Guidelines for Statistical Surveys”

identifies the required notifications to potential survey respondents.

Executive Office of the President, OMB. (Sept. 2006). Standards and Guidelines for Statistical Surveys. Retrieved from The White House:

https://www.whitehouse.gov/sites/default/files/omb/inforeg/statpolicy/standards_stat_surveys.pdf

Specifically, Standard 2.2 states that Federal agencies must ensure that each information collection instrument clearly states the reasons the information is planned to be collected; the way such information is planned to be used to further the proper performance of the functions of the agency; whether responses to the collection of information are voluntary or mandatory (citing authority); the nature and extent of confidentiality to be provided, if any (citing authority); an estimate of the average respondent burden together with a request that the public direct to the agency any comments concerning the accuracy of this burden estimate and any suggestions for reducing this burden; the OMB control number; and a statement that an agency may not conduct and a person is not required to respond to an information collection request unless it displays a currently valid OMB control number. These policies are rooted in the Fair Information Practice Principles that cover the following concepts: Individual participation, transparency, authority, purpose specification and use limitation, minimization, access and amendment, redress, quality and integrity, security, training, integration, and accountability. It is proposed that the information risk protections afforded by these laws and their implementing regulations are generally stronger than the privacy protections that result from IRB review, and would result in affording more uniform protections to participants.

The rationale for excluding these research activities from the Common Rule, even when the research is not otherwise subject to additional federal controls, is that consent is inherent to participation and that the risks most likely to be experienced by subjects are related to disclosure of anonymous, non-sensitive information and are thus categorized as “low.” Said another way, all individuals, including vulnerable populations, would understand that actively providing response to

educational tests, surveys, or interview procedures constitutes consent to participate and that the risk associated with such participation would be related to disclosure of the information they provided. The exclusion of this type of activity rests in large part on the idea that all individuals, regardless of the setting or context in which the activity will take place, are generally familiar with common forms of educational tests, survey and interview procedures which they experience in their daily lives, and do not need additional measures to protect themselves and their privacy from investigators who seek their involvement in research activities involving these procedures.

This exclusion is based on the assumption that the activities covered by this category are largely informational, and thus the most important role that an IRB might play with respect to reducing potential harms is to ensure data security and privacy protections. Under this assumption, the proposed exclusion is consistent with the principle of respect for persons and the preservation of autonomy. In the case of observation of public behavior, even if the subject does not know that an investigator is watching his or her actions, the subject's behavior is public and could be observed by others and thus the research observation is not inappropriately intrusive. However, there are situations in which this assumption would not always hold. For instance, administration of a questionnaire or participation in a focus group on a sensitive topic may induce significant stress in some individuals, or individuals approached about taking a survey may feel compelled to participate. Whether and how the exclusion should be bounded so that the final rule achieves a balance among the principles of beneficence, autonomy, and justice is the subject of the request for comment on this proposed exclusion.

In addition, this exclusion is in keeping with one of the goals of this NPRM, namely to reduce burden on research that includes sufficient protections to research subjects. By proposing that this exclusion could be satisfied if the information to be collected is subject to the Paperwork Reduction Act of 1995, would be maintained on information technology that is subject to and in compliance with section 208(b) of the E-Government Act of 2002, and all of the information collected, used, or generated as part of the research would be maintained in a system or systems of records subject to the Privacy Act of 1974, the NPRM notes that the privacy protections afforded by these laws are generally comparable, if not stronger, than the privacy protections that result from IRB review.

(2) Questions for Public Comment

9. Public comment is requested on the extent to which covering any of these activities under the Common Rule would substantially add to the protections provided to human research subjects.

10. Public comment is sought on whether this exclusion should only apply to research activities in which notice is given to prospective subjects or their legally authorized representatives as a regulatory requirement. If so, please comment on what kind of information should be included in the notice such as the research purpose, privacy safeguards, contact information, ability to opt-out, etc. Would requiring notice as a condition of this exempt research strike a good balance between autonomy and beneficence?

11. Public comment is sought regarding whether it is reasonable to rely on investigators to make self-determinations for the types of research activities covered in this particular exclusion category. If so, should documentation of any kind be generated and retained?

12. Public comment is sought regarding whether some or all of these activities should be exemptions rather than exclusions.

13. Public comment is sought regarding whether these exclusions should be narrowed such that studies with the potential for psychological risk are not included. Are there certain topic areas of sensitive information that should not be covered by this exclusion? If so, please provide exemplary language to characterize such topic areas in a manner that would provide clarity for implementing the Rule.

14. For activities captured under the third element of this exclusion, do the statutory, regulatory, and other policy requirements cited provide enough oversight and protection that being subject to expedited review under the Common Rule would produce minimal additional subject protections? If so, should the exclusion be broadened to also cover secondary analysis of information collected pursuant to such activities?

15. Public comment is requested on the extent to which excluding any of these research activities from the Common Rule could result an actual or perceived reduction or alteration of existing rights or protections provided to human research subjects. Are there any risks to scientific integrity or public trust that may result from excluding these research activities from the Common Rule?

iv. Research Involving the Collection or Study of Information that has been or will be Collected (NPRM at § __.101(b)(2)(ii))

(1) Current Rule

This exclusion appears in the current Common Rule as exemption category 4 (current Rule at § __.101(b)(4)). This exemption currently applies to research involving the use of existing data, documents, records, and pathological or diagnostic specimens, but only if the sources are publicly available or if the information is recorded by investigators in such a manner that subjects cannot be identified, directly or through identifiers linked to them.

(2) ANPRM Discussion

The ANPRM proposed retaining this exemption as an exemption (not an exclusion). The ANPRM asked questions about whether the current limitations specified in exempt category 4 (research involving the use of existing information or biospecimens, § __.101(b)(4) in the current Rule) should be eliminated. Specifically, the ANPRM suggested that the category would be revised to eliminate the word “existing.” With this elimination, the exemption would be broadened to cover the use of information or biospecimens that were or will be collected for purposes other than the suggested research, rather than requiring that all of the information or biospecimens already exist at the time the study is suggested for exemption.

(3) NPRM Proposal

The second category of low-risk research activities excluded from the proposed rule is a revised version of the current Rule's exemption category 4 (current Rule at § __.101(b)(4)). The NPRM proposal is that the excluded category at § __.101(b)(2)(ii) includes research involving the collection or study of information that has been or will be acquired solely for non-research activities or was acquired for research studies other than the proposed research study when the sources are publicly available, or the information is recorded by the investigator in such a manner that human subjects cannot be identified, directly or through identifiers linked to the subjects, the investigator does not contact the subjects, and the investigator will not re-identify subjects or otherwise conduct an analysis that could lead to

creating individually identifiable private information.

In light of the proposed expansion of the rule to cover certain biospecimens regardless of identifiability, this category has been modified such that it does not include secondary research use of biospecimens. Many of the comments supported the discussion in the ANPRM of eliminating the requirement that the information be “existing” at the time the study was suggested for exemption. Thus, in addition to changing this category of activities from being exempted to being excluded, the proposed exclusion does not require that the data exist as of the time that the study commences, but rather is expanded to include the secondary research use of data collected in the future for research or non-research purposes. The underlying logic behind the exclusion in proposed § __.101(b)(2)(ii) is that such research involves no direct interaction or intervention with human subjects, and any research use of the information does not impose any additional personal or informational risk to the subjects, because (1) the information is already available to the public, and so any risk it may include exists already, or (2) the information recorded by the investigator cannot be identified, and no connection to or involvement of the subjects is contemplated. Any requirements of the Common Rule would not provide additional protections to subjects, and could add substantial administrative burden on IRBs, institutions, and investigators. Creating this excluded category avoids that problem.

(4) Questions for Public Comment

16. Public comment is sought regarding whether it is reasonable to rely on investigators to make self-determinations for the types of research activities covered in this particular exclusion category. If so, should documentation of any kind be generated and retained?

17. Public comment is requested on the extent to which covering any of these activities under the Common Rule would substantially add to the protections provided to human research subjects. Is there a way in which this exclusion should be narrowed? Public comment is also sought regarding whether activities described here should appear as an exclusion or as an exemption.

v. Research Conducted by a Government Agency using Government-Generated or Government-Collected Data (NPRM at § __.101(b)(2)(iii))

(1) NPRM Proposal

The third category of low-risk research activities excluded from the proposed rule at § __.101(b)(2)(iii) is research conducted by a federal department or agency using government-generated or government-collected information obtained for non-research purposes (including criminal history data), if the information originally involved a collection of information subject to the Paperwork Reduction Act of 1995, 44 U.S.C. 3501

et seq.,

the information is maintained on information technology that is subject to and in compliance with section 208(b) of the E-Government Act of 2002, 44 U.S.C. 3501 note, and all of the information collected, used, or generated as part of the research is maintained in a system or systems of records subject to the Privacy Act of 1974, 5 U.S.C. 552a. This proposed exclusion is consistent with the Federal Government's emphasis on minimizing the burden on the public and maximizing the value of the information collected by the Federal Government, while protecting participant privacy and data security.

This exclusion is proposed for situations in which both the original data collection and the subsequent (secondary) analysis are subject to data security, participant privacy, and notice requirements associated with the named federal statutes and regulations. As such, it does not seem that the delay imposed by obtaining a determination as “exempt” or “expedited” is likely to increase the protections provided to those who have already provided the government with information for other purposes. Public comment is requested on the extent to which covering any these activities under the Common Rule would substantially add to the protections provided to human research subjects.

United States Office of Management and Budget, February 14, 2014, Memorandum to Heads of Executive Departments and Agencies;

Guidance for Providing and Using Administrative Data for Statistical Purposes

https://www.whitehouse.gov/sites/default/files/omb/memoranda/2014/m-14-06.pdf

. This guidance builds on three previously issued OMB memoranda designed to increase the value of existing data:

Sharing Data While Protecting Privacy

(M-11-02 of November 3, 2010),

Open Data Policy-Managing Information as an Asset

(M-13-13 of May 9, 2013), and

Next Steps in the Evidence and Innovation Agenda

(M-13-17 of July 26, 2013).

(2) Questions for Public Comment

18. Public comment is sought on whether this or a separate exclusion should also include research involving information collected for non-research purposes by non-federal entities where there are comparable privacy safeguards established by state laws and regulations, or whether such non-federally conducted research would be covered by the proposed exemption at § __.104(e)(2).

19. Public comment is requested on the extent to which covering any of these activities under the Common Rule would substantially add to the protections provided to human research subjects.

20. Public comment is sought regarding whether it is reasonable to rely on investigators to make self-determinations for the types of research activities covered in this particular exclusion category. If so, should documentation of any kind be generated and retained?

21. Public comment is sought regarding whether some or all of these activities should be exemptions rather than exclusions.

vi. Certain Activities Covered by HIPAA (NPRM at § __.101(b)(2)(iv))

(1) ANPRM Discussion

The public was asked to comment on whether it might be useful to adopt the distinction made by the HIPAA Privacy Rule, which distinguishes between “health care operations” and “research” activities, defining “health care operations” to include, among other activities, “conducting quality assessment and improvement activities, including outcomes evaluation and development of clinical guidelines, provided that the obtaining of generalizable knowledge is not the primary purpose of any studies resulting from such activities.” The public was asked to comment about this specifically in the context of quality improvement activities.

(2) NPRM Proposal

The fourth category of low-risk research activities excluded from the proposed rule, found at § __.101(b)(2)(iv), covers activities that are regulated under the HIPAA Privacy Rule (

i.e.

, covered entities). These are activities whose risks relate only to privacy and confidentiality, and are already subject to independent controls provided by HIPAA. Specifically, it is proposed that research, as it is defined in this proposed rule, that involves the use of protected health information by a HIPAA covered entity for “health care operations,” “public health activities,” or “research,” as those three terms are defined under the HIPAA Rules, would

be excluded from the Common Rule. This proposed exclusion would not apply if the investigator that receives and uses individually identifiable health information for a research study was not covered by the HIPAA Rules, even if the entity disclosing the individually identifiable health information to the investigator was covered by the HIPAA Rules. The exclusion is limited in this way to ensure that it only applies to research studies and information that are already subject to independent privacy, confidentiality, and security protections.

A majority of comments on the 2011 ANPRM favored distinguishing between research and health care operations, as such terms are defined in the HIPAA Privacy Rule and the Health Information Technology for Economic and Clinical Health (HITECH) Act, and excluding the latter from the policy. Some commenters noted that people involved in these various activities are protected in other ways, and alluded to the sorts of measures that provide protection. Others suggested that any exclusions should be limited to data collection and analysis activities, or to activities below a certain threshold of risk (

i.e.,

minimal risk). A minority of comments objected to these exclusions, arguing that these activities represent encroachments on their individual rights and privacy, and that oversight in accordance with the Common Rule requirements would be more protective. The proposed exclusion excludes only certain activities that involve data collection and analysis, where privacy safeguards are in place.

(3) Questions for Public Comment

22. Public comment is requested on whether the protections provided by the HIPAA Rules for identifiable health information used for health care operations, public health activities, and research activities are sufficient to protect human subjects involved in such activities, and whether the current process of seeking IRB approval meaningfully adds to the protection of human subjects involved in such research studies.

23. Public comment is sought regarding to what extent the HIPAA Rules and HITECH adequately address the beneficence, autonomy, and justice aspects for the collection of new information (versus information collected or generated in the course of clinical practice,

e.g.

, examination, treatment, and prevention). Should this exclusion be limited to data collected or generated in the course of clinical practice? If additional data collection is allowable, should it be limited to what is on the proposed Secretary's list of minimal risk activities (discussed in more detail below in II.F.2 of this preamble)?

24. Public comment is requested on whether additional or fewer activities regulated under the HIPAA Privacy Rule should be included in this exclusion.

c. Applicability of Exclusions to the Subparts

i. Current Rule

The current Common Rule does not contain exclusion categories, though as discussed above, some of the proposed exclusions are similar to activities that are exempt under the current regulations, which therefore might provide a basis for comparison.

All of the current exemption categories can be applied to research that is subject to subpart B. None of the current exemption categories can be applied to research that is subject to subpart C.

The exemptions in the current Rule generally apply to subpart D. However, the exemption at § __.101(b)(2), for research involving educational tests, survey or interview procedures, or observation of public behavior does not apply to subpart D except for research involving educational tests or observations of public behavior when the investigators do not participate in the activities being observed.

ii. NPRM Proposals

Language specifying the application of the exclusions to the subparts can be found in the NPRM at § __.101(b)(2) and (3).

It is proposed that all of the exclusion categories in § __.101(b)(2) and (3) apply to research that is subject to subpart B, and therefore the requirements imposed by subpart B would not need to be met.

It is similarly proposed that all of the exclusion categories in § __.101(b)(2) and (3) apply to research involving prisoners, therefore the requirements of subpart C would not need to be met. This would narrow the scope of research currently requiring subpart C review and certification to OHRP. Considerations in favor of this conclusion include the preponderance of low-risk socio-behavioral research designed to improve prisoner welfare, including studies that focus on substance abuse treatment, community reintegration, and services utilization; the occurrence of prisoner-subjects in research not targeting prisoner populations; the occurrence of prisoner-subjects in databases or registries; and the broad regulatory interpretation of the subpart C “prisoner” definition. Public comment is requested on whether the application of these exclusions to research involving prisoners is appropriate and acceptable.

It is proposed that all of the exclusion categories in § __.101(b)(2) apply to research subject to subpart D, with the exception that the exclusion proposed under § __.101(b)(2)(i) would only apply to research involving educational tests or observations of public behavior when the investigator does not participate in the activities being observed. This limitation would maintain the protection currently provided by the similar application of the current exemption § __.101(b)(2) to research involving children, and would continue to require IRB review under the Common Rule and additional IRB review under subpart D of 45 CFR part 46 when the research involves surveys or interview procedures with children or observation of public behavior when the investigator participates in the activities being observed.

iii. Questions for Public Comment

25. Should research involving prisoners be allowed to use any or all of the exclusions found at § __.101(b)(2) and (3), as currently proposed?

26. Are there certain provisions within the broader categories proposed at § __.101(b)(2) and (3) to which the subparts should or should not apply?

3. Proposed Exemptions (NPRM at § __.104)

The Common Rule has been criticized for inadequately calibrating the review process to the risk of research. Some have argued that, particularly given the paucity of information suggesting significant risks to subjects in certain types of survey and interview-based research, the current system overregulates such research. Further, many critics see little evidence that most IRB review of social and behavioral research effectively protects subjects from psychological or informational risks. Overregulating social and behavioral research in general may serve to distract attention from identification of social and behavioral research studies that do pose ethical challenges and thus merit significant oversight.

The proposed exemption categories and attendant policies and procedures related to exemptions appear in the NPRM at § __.104, and are guided by the following policy goals:

• To create procedural efficiencies for IRBs, administrators and investigators in making and receiving exemption determinations, thereby reducing the overall IRB workload and the wait time for investigators to begin their work.

• To ensure that reasonable safeguards are in place for certain lower risk research activities not fully excluded under the current Common Rule by requiring that research in certain exemption categories follow elements of the pr

This text is long and has been trimmed here. Open the source document for the complete record.

This is a copy of a public record, reproduced as it was published. It is not legal advice, and it may not be the version a court would rely on. Check the official source before you cite it.