Federal Policy for the Protection of Human Subjects

DEPARTMENT OF HOMELAND SECURITY

6 CFR Part 46

DEPARTMENT OF AGRICULTURE

7 CFR Part 1c

DEPARTMENT OF ENERGY

10 CFR Part 745

NATIONAL AERONAUTICS AND SPACE ADMINISTRATION

14 CFR Part 1230

DEPARTMENT OF COMMERCE

15 CFR Part 27

SOCIAL SECURITY ADMINISTRATION

20 CFR Part 431

AGENCY FOR INTERNATIONAL DEVELOPMENT

22 CFR Part 225

DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT

24 CFR Part 60

DEPARTMENT OF LABOR

29 CFR Part 21

DEPARTMENT OF DEFENSE

32 CFR Part 219

DEPARTMENT OF EDUCATION

34 CFR Part 97

DEPARTMENT OF VETERANS AFFAIRS

38 CFR Part 16

ENVIRONMENTAL PROTECTION AGENCY

40 CFR Part 26

DEPARTMENT OF HEALTH AND HUMAN SERVICES

45 CFR Part 46

RIN 0937-AA02

NATIONAL SCIENCE FOUNDATION

45 CFR Part 690

DEPARTMENT OF TRANSPORTATION

49 CFR Part 11

Federal Policy for the Protection of Human Subjects

AGENCY:

Department of Homeland Security; Department of Agriculture; Department of Energy; National Aeronautics and Space Administration; Department of Commerce; Social Security Administration; Agency for International Development; Department of Housing and Urban Development; Department of Labor; Department of Defense; Department of Education; Department of Veterans Affairs; Environmental Protection Agency; Department of Health and Human Services; National Science Foundation; and Department of Transportation.

ACTION:

Final rule.

SUMMARY:

The departments and agencies listed in this document announce revisions to modernize, strengthen, and make more effective the Federal Policy for the Protection of Human Subjects that was originally promulgated as a Common Rule in 1991. This final rule is intended to better protect human subjects involved in research, while facilitating valuable research and reducing burden, delay, and ambiguity for investigators. These revisions are an effort to modernize, simplify, and enhance the current system of oversight.

DATES:

This rule is effective on January 19, 2018. The compliance date for this rule, except for § __.114(b) (cooperative research), is January 19, 2018. The compliance date for § __.114(b) (cooperative research) is January 20, 2020.

ADDRESSES:

Jerry Menikoff, M.D., J.D., OHRP, 1101 Wootton Parkway, Suite 200, Rockville, MD 20852.

FOR FURTHER INFORMATION CONTACT:

Jerry Menikoff, M.D., J.D., Office for Human Research Protections (OHRP), Department of Health and Human Services, 1101 Wootton Parkway, Suite 200, Rockville, MD 20852; telephone: 240-453-6900 or 1-866-447-4777; facsimile: 301-402-2071; email:

jerry.menikoff@hhs.gov

.

SUPPLEMENTARY INFORMATION:

Preamble

Executive Summary

I. The Rationale for Modernizing the Common Rule

II. To What Does This Policy Apply? Scope and Applicability of the Regulations

III. Definitions for Purposes of this Policy (§ __.102)

IV. Ensuring Compliance with this Policy (§ __.103)

V. Exempt Research (§ __.104)

VI. Protection of Identifiable Private Information and Identifiable Biospecimens

VII. IRB Membership and Modification to References to Vulnerability (§§ __.107(a), __.111(a)(3), and __.111(b))

VIII. IRB Functions and Operations (§ __.108)

IX. IRB Review of Research (§ __.109)

X. Expedited Review Procedures (§ __.110)

XI. Criteria for IRB Approval of Research (§ __.111)

XII. Cooperative Research (§ __.114)

XIII. IRB Records (§ __.115)

XIV. General Requirements for Informed Consent (§ __.116)

XV. Documentation of Informed Consent (§ __.117)

XVI. Applications and Proposals Lacking Definite Plans for Involvement of Human Subjects (§ __.118)

XVII. Research Undertaken Without the Intention of Involving Human Subjects (§ __.119)

XVIII. Conditions (§ __.124)

XIX. Regulatory Impact Analyses

XX. Environmental Impact

XXI. Paperwork Reduction Analysis

XXII. Tribal Consultation Statement

Final Regulatory Text

Executive Summary

Purpose of the Regulatory Action

Individuals who are the subjects of research may be asked to contribute their time and assume risk to advance the research enterprise, which benefits society at large. U.S. federal regulations governing the protection of human subjects in research have been in existence for more than three decades. The Department of Health, Education, and Welfare first published regulations for the protection of human subjects in 1974, and the Department of Health and Human Services (HHS) revised them in the early 1980s. During the 1980s, HHS began a process that eventually led to the adoption of a revised version of the regulations by 15 U.S. federal departments and agencies in 1991. The purpose of this effort was to promote uniformity, understanding, and compliance with human subject protections as well as to create a uniform body of regulations across federal departments and agencies (subpart A of 45 Code of Federal Regulations [CFR] part 46), often referred to as the “Common Rule” or “Protection of Human Subjects Regulations.” Those regulations were last amended in 2005, and have remained unchanged until the issuance of this final rule.

Since the Common Rule was promulgated, the volume and landscape of research involving human subjects have changed considerably. Research with human subjects has grown in scale and become more diverse. Examples of developments include: an expansion in the number and types of clinical trials, as well as observational studies and cohort studies; a diversification of the types of social and behavioral research being used in human subjects research; increased use of sophisticated analytic techniques to study human biospecimens; and the growing use of electronic health data and other digital records to enable very large datasets to be rapidly analyzed and combined in novel ways. Yet these developments have not been accompanied by major change in the human subjects research oversight system, which has remained largely unaltered over the past two decades.

On July 26, 2011, the Office of the Secretary of HHS, in coordination with the Executive Office of the President's Office of Science and Technology Policy (OSTP), published an advance notice of proposed rulemaking (ANPRM) to request comment on how current regulations for protecting those who participate in research might be modernized and revised to be more effective.

1

1

HHS. Human Subjects Research Protections: Enhancing Protections for Research Subjects and Reducing Burden, Delay, and Ambiguity for Investigators. 76 FR 44512 (Jul. 26, 2011). Retrieved from

https://www.gpo.gov/fdsys/pkg/FR-2011-07-26/pdf/2011-18792.pdf

On September 8, 2015, HHS and 15 other federal departments and agencies published a Notice of Proposed Rulemaking (NPRM) proposing revisions to the regulations for protection of human subjects in research.

2

Like the ANPRM, the NPRM sought comment on how to better protect research subjects while facilitating valuable research and reducing burden, delay, and ambiguity for investigators. Public comments on both the ANPRM and the NPRM have informed the final rule that is now being promulgated.

2

HHS. Federal Policy for the Protection of Human Subjects. 80 FR 53931 (Sept. 8, 2015). Retrieved from

https://www.federalregister.gov/documents/2015/09/08/2015-21756/federal-policy-for-the-protection-of-human-subjects

The final rule is designed to more thoroughly address the broader types of research conducted or otherwise supported by all of the Common Rule departments and agencies such as behavioral and social science research. It also benefits from continuing efforts to harmonize human subjects policies across federal departments and agencies.

Summary of the Major Changes in the Final Rule

The final rule differs in important ways from the NPRM. Most significantly, several proposals are not being adopted:

• The final rule does not adopt the proposal to require that research involving nonidentified biospecimens be subject to the Common Rule, and that consent would need to be obtained in order to conduct such research.

• To the extent some of the NPRM proposals relied on standards that had not yet been proposed, the final rule either does not adopt those proposals or includes revisions to eliminate such reliance.

• The final rule does not expand the policy to cover clinical trials that are not federally funded.

• The final rule does not adopt the proposed new concept of “excluded” activities. Generally, activities proposed to be excluded are now either described as not satisfying the definition of what constitutes research under the regulations or are classified as exempt.

• The proposed revisions to the exemption categories have been modified to better align with the long-standing ordering in the final rule. The final rule does not include the proposed requirement that exemption determinations need to be made in specified ways.

• The final rule does not include the proposed standardized privacy safeguards for identifiable private information and identifiable biospecimens. Aspects of proposals that relied on those safeguards have been modified or are not being adopted.

• The final rule does not adopt the most restrictive proposed criteria for obtaining a waiver of the consent requirements relating to research with identifiable biospecimens.

The final rule makes the following significant changes to the Common Rule:

• Establishes new requirements regarding the information that must be given to prospective research subjects as part of the informed consent process.

• Allows the use of broad consent (

i.e.,

seeking prospective consent to unspecified future research) from a subject for storage, maintenance, and secondary research use of identifiable private information and identifiable biospecimens. Broad consent will be an optional alternative that an investigator may choose instead of, for example, conducting the research on nonidentified information and nonidentified biospecimens, having an institutional review board (IRB) waive the requirement for informed consent, or obtaining consent for a specific study.

• Establishes new exempt categories of research based on their risk profile. Under some of the new categories, exempt research would be required to undergo limited IRB review to ensure that there are adequate privacy safeguards for identifiable private information and identifiable biospecimens.

• Creates a requirement for U.S.-based institutions engaged in cooperative research to use a single IRB for that portion of the research that takes place within the United States, with certain exceptions. This requirement becomes effective 3 years after publication of the final rule.

• Removes the requirement to conduct continuing review of ongoing research for studies that undergo expedited review and for studies that have completed study interventions and are merely analyzing study data or involve only observational follow up in conjunction with standard clinical care.

Other minor changes have been to improve the rule and for purposes of clarity and accuracy.

Estimated Costs and Benefits

Table 1 summarizes the quantified and nonquantified benefits and costs of all changes to the Common Rule. Over the 2017-2026 period, present value benefits of $1,904 million and annualized benefits of $223 million are estimated using a 3 percent discount rate; present value benefits of $1,494 million and annualized benefits of $213 million are estimated using a 7 percent discount rate. Present value costs of $528 million and annualized costs of $62.0 million are estimated using a 3 percent discount rate; present value costs of $474 million and annualized costs of $67.0 million are estimated using a 7 percent discount rate. Nonquantified benefits include improved human subjects protections in research; enhanced oversight of research reviewed by IRBs not operated by a Federalwide Assurance (FWA)-holding institution; and increased uniformity in regulatory requirements among Common Rule departments and agencies. Nonquantified costs include the time needed for consultation among

Common Rule agencies before federal guidance is issued.

Table 1—Accounting Table of Benefits and Costs of All Changes

Present value of 10 years by discount rate

(millions of 2015 dollars)

3 percent

7 percent

Annualized value over 10 years by discount rate

(millions of 2015 dollars)

3 percent

7 percent

Benefits:

Quantified Benefits

1,904

1,493

223

213

Nonquantified Benefits:

Improved human subjects protections in research; enhanced oversight in research reviewed by IRBs not operated by an FWA-holding institution; and increased uniformity in regulatory requirements among Common Rule departments and agencies.

Costs:

Quantified Costs

528

474

62.0

67.0

Nonquantified Benefits:

Time for consultation among Common Rule agencies before federal guidance is issued.

I. The Rationale for Modernizing the Common Rule

A. The Changing Nature of Research

This final rule recognizes that in the past two decades a paradigm shift has occurred in how research is conducted. Evolving technologies—including imaging, mobile technologies, and the growth in computing power—have changed the scale and nature of information collected in many disciplines. Computer scientists, engineers, and social scientists are developing techniques to integrate different types of data so they can be combined, mined, analyzed, and shared. The advent of sophisticated computer software programs, the Internet, and mobile technology has created new areas of research activity, particularly within the social and behavioral sciences. In biomedical science, the Human Genome Project laid the foundation for precision medicine and promoted an environment of data sharing and innovation in analytics and technology, and drew attention to the need for policies that support a changing research landscape. New technologies, including genomic sequencing, have quickly led to exponential growth in the data to which investigators have access. The sheer volume of data that can be generated in research, the ease with which it can be shared, and the ways in which it can be used to identify individuals were simply not possible, or even imaginable, when the Common Rule was first adopted.

Research settings are also shifting. Although much biomedical research continues to be conducted in academic medical centers, more research is being conducted in clinical care settings, thus combining research and medical data. Biospecimen repositories and large databases have made it easier to do research on existing (stored) biospecimens and data. Clinical research networks connected through electronic health records have developed methods for extracting clinical data for research purposes and are working toward integration of research data into electronic health records in a meaningful way. The scientific community recognizes the value of data sharing and open-source resources and understands that pooling intellectual resources and capitalizing on efficient uses of data and technology represent the best ways to advance knowledge.

At the same time, the level of public engagement in the research enterprise has changed. More people want to play an active role in research, particularly related to health.

As technology evolves, so does the nature of the risks and benefits of participating in certain types of research. Many studies do not involve interaction with research subjects, but instead involve secondary analysis of data or biospecimens. Risks related to these types of research studies are largely informational, not physical; that is, harms could result primarily from the inappropriate disclosure of information and not from the research interventions themselves. Nonetheless, those harms can be significant.

Because of these shifts in science, technology, and public engagement and expectations, a wide range of stakeholders have raised concerns about the limitations of the existing regulatory framework, arguing for a re-evaluation of how the fundamental principles of the 1979

Belmont Report

3

that underlie the Common Rule—respect for persons, beneficence, and justice—are applied in practice to the myriad new contexts in which U.S. research is conducted in the 21st century. The changes that are being implemented in the final rule continue to be shaped by those principles (a detailed background discussion of which was provided in the NPRM).

3

National Commission for the Protection of Human Subjects of Biomedical and Behavioral Research. Belmont Report. Washington, DC: U.S. Department of Health and Human Services. 1979. Retrieved from

http://www.hhs.gov/ohrp/humansubjects/guidance/belmont.html.

Finally, it is important to note that, to the extent appropriate, the intent is to eventually amend the other subparts of the HHS human subjects protection regulations in 45 CFR part 46 (subparts B, C, D, and E), and consider the need for updates to FDA regulations and other relevant federal departmental or agency regulations with overlapping scope.

B. Public Comments, Expert Advice, Stakeholder Dialogue

The revisions to the Common Rule are based on a variety of sources of public, stakeholder, and expert comments and advice, including comments received on the 2011 ANPRM and the 2015 NPRM. They also benefit from guidance provided by a 2014 National Research Council consensus report,

Proposed Revisions to the Common Rule for the Protection of Human Subjects in the Behavioral and Social Sciences,

4

and

the National Academies of Science, Engineering, and Medicine 2016 report

Optimizing the Nation's Investment in Academic Research: A New Regulatory Framework for the 21st Century.

5

4

National Research Council of the National Academies. Proposed Revisions to the Common Rule for the Protection of Human Subjects in the Behavioral and Social Sciences. Washington, DC: The National Academies Press; 2014. 13-168. Retrieved from

http://www.nap.edu/catalog/18614/proposed-revisions-to-the-common-rule-for-the-

protection-of-human-subjects-in-the-behavioral-and-social-sciences.

5

National Academies of Sciences, Engineering, and Medicine. Optimizing the Nation's Investment in Academic Research: A New Regulatory Framework for the 21st Century. Washington, DC: The National Academies Press; 2016. Retrieved from

https://www.nap.edu/read/21824/chapter/1.

Since the publication of the 2011 ANPRM, HHS has continued to solicit public comment on a variety of policy issues related to human subjects protections, including consent, the use of a single IRB for multi-institutional studies, and sharing of genomic data. Although these policies were more specific than the issues raised in the ANPRM, the responses received from public comments provide insight for refining the proposals initially put forward in the ANPRM. Of particular relevance are the National Institutes of Health's (NIH's) recently issued policy on the use of a single IRB for multi-institutional research,

6

the Office for Human Research Protection's (OHRP's) draft guidance on the required content of consent language for research conducted within the standard of care,

7

and NIH's policy to promote sharing of large-scale human genomic data generated from studies funded or conducted by NIH.

8

6

National Institutes of Health. Final NIH Policy on the Use of a Single Institutional Review Board for Multi-Site Research. June 21, 2016. Notice Number: NOT-OD-16-094. Retrieved from

https://grants.nih.gov/grants/guide/notice-files/NOT-OD-16-094.html.

7

HHS. Draft Guidance on Disclosing Reasonably Foreseeable Risks in Research Evaluating Standards of Care. 79 FR 63630 (Oct. 24, 2014). Retrieved from

https://www.gpo.gov/fdsys/pkg/FR-2014-10-24/pdf/2014-25318.pdf.

8

Information about the NIH Genomic Data Sharing policy is available at

https://gds.nih.gov/03policy2.html.

Other developments include the enactment of the Newborn Screening Saves Lives Reauthorization Act of 2014 (Pub. L. 113-240) in December 2014. The law made a number of changes relevant to the HHS regulations for protecting research subjects, including asserting that research with newborn dried blood spots (DBS) that is federally funded pursuant to the Public Health Service Act is to be considered research with human subjects, and that the provisions allowing IRBs to waive consent would not apply. By statute, the changes made by this law applied only until changes to the Common Rule are promulgated. Thus, the changes made by this statute will no longer apply after the effective date of this rule, January 19, 2018. In addition, in April 2015, the Medicare Access and Children's Health Insurance Program Reauthorization Act of 2015 (Pub. L. 114-10) was passed. That law requires HHS to issue a clarification or modification of the Common Rule with regard to how the regulatory requirements should be applied to activities involving clinical data registries. In addition, in December 2016 the 21st Century Cures Act (Pub. L. 114-255) was enacted.

Finally, as a result of conducting a variety of public discussions associated with the President's Precision Medicine Initiative,

9

10

11

many perspectives were heard, with much alignment around the central tenet that participants should be active partners in such research and not merely passive subjects of research studies.

9

The White House, Office of the Press Secretary. Fact Sheets: President Obama's Precision Medicine Initiative. January 30, 2015. Retrieved from

https://www.whitehouse.gov/the-press-office/2015/01/30/fact-sheet-president-obama-s-precision-medicine-initiative.

10

Collins FS, Varmus H. A New Initiative on Precision Medicine.

The New England Journal of Medicine

2015 Feb; 372:793-795.

11

For more information on the Precision Medicine Initiative Cohort Program see

https://www.nih.gov/sites/default/files/research-training/initiatives/pmi/pmi-working-group-report-20150917-2.pdf.

1. Summary of Public Comments on Structural, Conceptual, and Policy Implications of the Proposed Rule

The NPRM received more than 2,100 public comments, the majority of which were from people writing in their individual capacity. The remaining comments were submitted by institutions, professional organizations and societies, and membership organizations. The proposals receiving the most comments were those related to biospecimens (expanded definition of human subject, broad consent, and tightened criteria for waiver of consent). Here we summarize comments on the overall structural, conceptual, and policy implications of the proposed rule. Comments regarding the specific provisions of the rule appear throughout this preamble.

The NPRM asked for public comment on whether the proposed changes will achieve the objectives of: (1) decreasing administrative burden, delay, and ambiguity for investigators, institutions, and institutional review boards (IRBs); and (2) strengthening, modernizing, and making the regulations more effective in protecting research subjects. In response, many public commenters expressed concern about the overall complexity and length of the NPRM, the unavailability of key deliverables, proposals being internally inconsistent, and proposals giving investigators too much leeway to determine if their research is exempt or falls outside the scope of the rule.

Several commenters expressed concerns that they were unable to adequately or meaningfully comment on particular provisions proposed in the NPRM because an underlying document, tool, or list had not been developed or shared with the public at the time the NPRM was published, specifically: (1) the proposed broad consent templates; (2) the proposed standards for privacy protection; (3) the proposed list of eligible expedited procedures; and (4) the proposed exemption decision tool. Several commenters suggested that these items should be removed from the final rule and developed independently, urging government personnel to work collaboratively with representatives from the research community and funding agencies in the development of such documents, tools, and lists.

Some commenters suggested issuing a new NPRM that would be more complete and would include details on the privacy protection standards, exemption decision tool, and broad consent templates. Another commenter recommended that only the fully developed, less controversial provisions of the NPRM should be adopted into a final rule. Another commenter urged the Common Rule departments and agencies to reissue the NPRM to solicit comment on several of these documents, tools, and lists, arguing that it would be unlawful for a final rule to be issued until such an action were taken. This commenter noted that for members of the public to reasonably participate in rulemaking, agencies must provide enough factual detail and rationale to allow interested parties to comment meaningfully on the rule. This commenter also argued that the NPRM did not satisfy the requirement set forth in the Administrative Procedure Act that the notice provided to the public in rulemaking include either the terms or substance of the proposed rule or a description of the subjects and issues involved. In sum, the commenter argued that the NPRM sought comments on numerous provisions without providing the “terms or substance” of the specific proposals.

Some commenters encouraged dropping the proposal to require consent for research use of nonidentified biospecimens and instead exploring a system of public notification and opportunity to opt out of such research through issuance of a new NPRM following widespread consultation. A few commenters

suggested that Common Rule departments and agencies fund pilot studies to better understand how such a system might work. Additional commenters focused on the importance of public education about the research enterprise regardless of the policy choices pursued in a final rule.

Commenters, including state health departments and other health entities involved in newborn screening activities, raised concerns that several of the NPRM proposals represented unfunded mandates, specifically the expansion of the definition of human subject to include all biospecimens regardless of identifiability, expansion of the policy to apply to all clinical trials that meet certain conditions, and mandatory single IRB review of cooperative research. Several institutions and disease advocacy groups noted that statewide newborn screening programs are often modestly funded, and the NPRM proposals would impose processes that could cost millions of dollars each year.

In addition, commenters raised concerns that HHS and other Common Rule departments and agencies are not authorized under 42 U.S.C. 289 to regulate humanities and social science research.

Public comments also discussed several ideas for consideration in a final rule that were not otherwise proposed in the NPRM, including:

• Develop or strengthen sanctions and penalties for investigators or institutions that re-identify subjects without proper authorization or review, rather than focusing solely on obtaining consent as the way to protect subjects. To this end, several commenters suggested that a separate section be added to the Common Rule focused on investigator responsibilities.

• Develop an IRB efficiency rating system.

• Deem research about IRB operations as an excluded, exempt, or expeditable activity to foster research into IRB operations.

• Include provisions about compensation for research-related injuries.

• More fully review and address how the rule should or should not apply to prisoners, children, and pregnant women and fetuses.

• Include provisions about U.S.-funded studies in developing countries with regard to defining standards of care and addressing post-trial access to proven therapies.

2. Response to Public Comments on Structural, Conceptual, and Policy Implications of the Proposed Rule

The final rule differs in numerous, major ways from what was proposed in the NPRM. Most significantly, the provisions relating to making nonidentified biospecimens subject to the Common Rule are not being implemented. That change alone addresses many of the public comments on the NPRM. Eliminating that proposal is intended to address concerns about the complexity of and lack of justification for the proposed changes in the rule, as well as concerns about embarking on significant changes without evidence that they would improve the system. Responses to public comments on specific provisions appear throughout this preamble. Below we summarize our responses to comments that addressed major structural or organizational issues or perceived insufficiencies in the NPRM proposals and their presentation.

Concerns about the overall complexity of the proposed changes have been addressed in several ways. For example, concerns about creating a new category of “excluded” activities have been addressed by not adopting that concept in the final rule. Instead, the goal of clarifying what is covered by the rule has been accomplished by modifying the definition of what constitutes research, and by adding or modifying exemptions that were already in the pre-2018 rule.

12

And, even where existing concepts are modified, we have attempted to make those modifications in ways that minimize the extent of the change (such as largely preserving much of the core structure of the previous exemption categories).

12

For purposes of this preamble, the terms “pre-2018 requirements” or “pre-2018 rule” refer to the Common Rule as published in the 2016 edition of the Code of Federal Regulations (

i.e.,

the Federal Policy for the Protection of Human Subjects, originally published on June 18, 1991 and subsequently amended on June 23, 2005). In addition, the term “this rule” or “final rule” refers to the 2018 requirements as presented in this issuance.

To reduce public concerns about the aspects of the proposal that were not yet developed, we chose not to implement most of those provisions. For example, given the changes made to the proposals regarding broad consent, the final rule does not reference or include the concept of broad consent templates. The requirement that the Secretary of HHS develop a list of proposed privacy safeguards has been eliminated, as has the proposed exemption decision tool. In addition, we have dropped the regulatory requirement for the Secretary of HHS to publish a list of activities that are minimal risk (as was proposed in the NPRM in the definition of minimal risk). The final rule retains the requirement at § __.110(a) that the Secretary of HHS will establish and publish for public comment a list of categories of research that may be reviewed by an IRB through the expedited review procedure, consistent with the pre-2018 rule.

Some of the “new ideas” for altering the system for protecting research subjects that were presented by commenters—for example, addressing compensation for research-related injuries or the meaning of equivalent protections when research is conducted in foreign countries—were either very innovative or not yet widely discussed. This made it difficult to adopt them at this point without further study and additional notice and opportunity for public comment. Therefore, the fact that one or another of these ideas was not incorporated into the final rule should not be viewed as a rejection of their possible merits, or an indication that they might not be explored in some future revision of the Common Rule or in guidance.

a. Process Issues

We carefully considered concerns voiced by commenters about the process that led to this final rule, and other legal concerns about the adequacy of that process. We concluded that the approach proposed in the NPRM and the approach adopted in this final rule are consistent with the Federal Government's obligations under the Administrative Procedure Act.

Regarding the concerns expressed that the Common Rule departments and agencies are not authorized to regulate humanities and social science research, this challenge had been asserted previously against the 1981 HHS protection of human subjects regulations,

13

as well as the 1991 Common Rule,

14

and in each case the regulatory agencies concluded that the regulation of humanities and social science research is justified. We continue to assert the authority to regulate humanities and social science research that falls within the scope of the final rule.

13

Federal Regulations Amending Basic HHS Policy for the Protection of Human Research Subjects; Final Rule, 46 FR8366 (January 26, 1981). Retrieved from

https://wayback.archive-it.org/all/20160202182914/http://archive.hhs.gov/ohrp/documents/19810126.pdf.

14

Federal Policy for the Protection of Human Subjects; Notices and Rules. 56 FR 28002. (June 18, 1981). Retrieved from

https://www.hhs.gov/ohrp/sites/default/files/ohrp/policy/frcomrul.pdf.

C. Signatories to the Common Rule

This section provides information about where each Common Rule department or agency's statutory authority for enacting and revising human subjects research protection regulation lies, and provides additional information about new signatories to the Common Rule.

The regulations are codified in each department or agency's title or chapter of the CFR. The Common Rule was based on HHS's regulations, 45 CFR part 46, subpart A, and includes identical language in the separate regulations of each department and agency.

Although they did not previously issue the Common Rule in regulations, four departments and agencies have historically complied with all subparts of the HHS protection of human subjects regulations at 45 CFR part 46. These are the Central Intelligence Agency (CIA), the Office of the Director of National Intelligence (ODNI), the Department of Homeland Security (DHS), and the Social Security Administration (SSA).

Pursuant to Executive Order 12333 of December 4, 1981, as amended, elements of the Intelligence Community must comply with the guidelines issued by HHS regarding research on human subjects found in 45 CFR part 46. This final rule does not supersede the Executive Order. The CIA will continue to adhere to the HHS regulations at 45 CFR part 46, pursuant to the Executive Order.

Through this rulemaking, DHS is codifying the final rule into its own agency regulations. DHS, which was created after issuance of the pre-2018 rule, has been required by statute (Pub. L. 108-458, title VIII, section 8306) to comply with 45 CFR part 46, or with equivalent regulations promulgated by the Secretary of Homeland Security or his designee. Through this rulemaking, DHS is issuing equivalent regulations, consistent with statute, and will comply with the DHS regulations as the requirements will be equivalent to compliance with HHS regulations at 45 CFR part 46, subpart A.

Through this rulemaking, SSA is codifying the final rule into its own agency regulations. SSA was separated from HHS in 1995 and, pursuant to the transition rules provided in Section 106 of title 1 of Pub. L. 103-296, has been required to apply regulations that applied to SSA before the separation, absent action by the Commissioner. With this rulemaking, SSA will follow the SSA regulations (adopting the provisions of this final rule) instead of HHS regulations at 45 CFR part 46, subpart A. (See Pub. L. 103-296 §106(b), 108 Stat. 1464, 1476.)

The Department of Labor (DOL), which was not a signatory to the pre-2018 rule, is now a signatory to this rulemaking and is codifying the final rule in DOL regulations for human subjects research that DOL conducts or supports.

The Consumer Product Safety Commission (CPSC), subject to Commission vote, intends to adopt this rule through a separate rulemaking.

The legal authority for the departments and agencies that are signatories to this action is as follows:

Department of Homeland Security, 5 U.S.C. 301; Pub. L. 107-296, sec. 102, 306(c); Pub. L. 108-458, sec. 8306. Department of Agriculture, 5 U.S.C. 301; 42 U.S.C. 300v-1(b). Department of Energy, 5 U.S.C. 301; 42 U.S.C. 7254; 42 U.S.C. 300v-1(b). National Aeronautics and Space Administration, 5 U.S.C. 301; 42 U.S.C. 300v-1(b). Department of Commerce, 5 U.S.C. 301; 42 U.S.C. 300v-1(b). Social Security Administration, 5 U.S.C. 301; 42 U.S.C. 289(a). Agency for International Development, 5 U.S.C. 301; 42 U.S.C. 300v-1(b), unless otherwise noted. Department of Housing and Urban Development, 5 U.S.C. 301; 42 U.S.C. 300v-1(b) and 3535(d). Department of Labor, 5 U.S.C. 301; 29 U.S.C. 551. Department of Defense, 5 U.S.C. 301. Department of Education, 5 U.S.C. 301; 20 U.S.C. 1221e-3, 3474; 42 U.S.C. 300v-1(b). Department of Veterans Affairs, 5 U.S.C. 301; 38 U.S.C. 501, 7331, 7334; 42 U.S.C. 300v-1(b). Environmental Protection Agency, 5 U.S.C. 301; 7 U.S.C. 136a(a) and 136w(a)(1); 21 U.S.C. 346a(e)(1)(C); sec. 201, Pub. L. 109-54, 119 Stat. 531; and 42 U.S.C. 300v-1(b). Department of Health and Human Services, 5 U.S.C. 301; 42 U.S.C. 289(a); 42 U.S.C. 300v-1(b). National Science Foundation, 5 U.S.C. 301; 42 U.S.C. 300v-1(b). Department of Transportation, 5 U.S.C. 301; 42 U.S.C. 300v-1(b).

II. To what does this policy apply?

Scope and Applicability of the Regulations

This section of the preamble describes changes made in the final rule with regard to its scope and applicability. Specifically, it addresses which entities are subject to the rule; coverage of clinical trials; department and agency discretion in applying the rule; the relevance of state and local laws; coverage of research conducted in foreign countries; the goal of harmonizing guidance across the federal entities; effective and compliance dates; and severability.

A. IRBs Not Operated by an Institution Holding a Federalwide Assurance (§ __.101(a)(1))

1. Background and Pre-2018 Requirements

Before this final rule, IRBs not operated by an institution holding an FWA were not directly subject to oversight for compliance with the Common Rule. In situations in which an institution relied on an IRB not operated by the institution, OHRP's practice was to hold the institution engaged in human subjects research accountable for compliance violations, even in circumstances in which the regulatory violation was directly related to the responsibilities of the IRB.

An institution might rely on an IRB not operated by that institution to review cooperative research, that is, research conducted at more than one institution. However, for some, such reliance has been considered problematic due to lack of direct regulatory accountability for these IRBs. Previously, the choice to have cooperative research reviewed by a single IRB was voluntary and, for federally funded research, most institutions have been reluctant to replace review by their own IRB with review by a single IRB not operated by that institution.

2. NPRM Proposal To Cover IRBs not Operated by an Institution Holding an FWA

For the reasons outlined above, and based on comments to OHRP's 2011 ANPRM, the NPRM proposed adding a new provision at § __.101(a) that would explicitly give Common Rule departments and agencies the authority to enforce compliance directly against IRBs that are not operated by an FWA-holding institution (sometimes referred to as “independent IRBs”). Under the pre-2018 rule, even if an institution engaged in research relied on an IRB operated by another FWA-holding institution, OHRP's practice has been to enforce compliance through the engaged institution and not the reviewing IRB.

Relatedly, another NPRM proposal would require single IRB review of multi-institution studies (see Section XII of this preamble). This proposal would place responsibility for meeting the relevant regulatory requirements on the IRB of record in a multi-institutional study, rather than on the institution engaged in the research.

3. Public Comments

Approximately 50 comments addressed this proposal, largely in support, because it would encourage institutions to rely on IRBs not operated by an FWA-holding institution when necessary and would place responsibility on the IRB and its decisions rather than on the institution relying on the IRB's determination. Commenters stated that this change could increase IRB accountability and protect institutions relying on IRBs that they do not operate. However, a few commenters supported the proposal only if the mandate for a single IRB of record in multi-institutional research was not implemented. That is, they supported the concept of holding IRBs not operated by the institution engaged in research accountable for compliance, but did not support it if it was intended solely to facilitate mandatory single IRB review for cooperative research, because they opposed that mandate. One organization that advocates for human subjects protections opposed the proposal because it did not believe that any research should be reviewed by an independent IRB, and feared this practice would become more frequent with this change. Several academic institutions opposed the proposal, as did a large trade organization, stating that this extension of the rule was not necessary.

4. Response to Comments and Explanation of the Final Rule: Authority To Enforce Compliance Directly Against IRBs Not Operated by an FWA-Holding Institution

New language at § __.101(a) is adopted that gives Common Rule departments and agencies the authority to enforce compliance directly against IRBs that are not operated by an assured institution. This authority will allow Common Rule departments and agencies to avoid involving other engaged institutions in enforcement activities related to the responsibilities of the designated IRB. It is anticipated that this change will reassure institutions using an IRB that they do not operate because compliance actions could be taken directly against the IRB responsible for the regulatory noncompliance, rather than against the institutions that relied on that review.

B. Coverage of Clinical Trials

1. Background and Pre-2018 Requirements

The Common Rule has historically applied to human subjects research that is conducted or supported by a Common Rule department or agency. Research that is not federally conducted or supported has not been subject to the Common Rule's requirements unless the U.S. institution receiving federal funding for research voluntarily extended the Common Rule to all research conducted at that institution, regardless of funding source.

The Institute of Medicine,

15

the National Bioethics Advisory Commission,

16

and others have stated that human subjects would be best protected by applying consistent ethical standards and a uniform system of regulatory oversight to all human subjects research conducted in the United States. Common Rule departments and agencies do not have statutory authority to directly apply the Common Rule to all human subjects research conducted in the United States. However, departments and agencies can require U.S. institutions that receive some federal funding from a Common Rule department or agency for research with human subjects to extend regulatory protections to all research studies conducted at the institution as a condition of funding. The 2011 ANPRM sought comment on this approach.

15

Federman DD, Hanna KE, Rodriguez LL, eds.

Responsible Research: A Systems Approach to Protecting Research Participants.

Washington, DC: National Academies Press; 2002.

16

National Bioethics Advisory Commission.

Ethical and Policy Issues in Research Involving Human Participants.

Bethesda, MD; 2001.

2. NPRM Proposal

The NPRM proposed changes in the regulatory language to extend the rule to all clinical trials, irrespective of funding source, that met three conditions: (1) The clinical trials are conducted at an institution that receives support from a federal department or agency for human subjects research that was not proposed to be excluded under the NPRM and was not exempt; (2) the clinical trials are not subject to FDA regulation; and (3) the clinical trials are conducted at an institution located within the United States.

The purpose of the proposed clinical trials extension was to ensure that clinical trials involving significant risks that would otherwise not be covered be subject to federal oversight. It was for that reason that the proposed extension excluded clinical trials subject to FDA oversight. The proposed extension also was based on whether an institution received funding specifically for other human subjects research that had to comply with the substantive requirements of the Common Rule. The Common Rule departments and agencies have a more substantial relationship with institutions that receive federal support to conduct research subject to the regulatory requirements than they do with institutions that receive such support for only exempt human subjects research.

The NPRM proposed that a clinical trial be defined as a research study in which one or more human subjects are prospectively assigned to one or more interventions (which may include placebo or other control) to evaluate the effects of the interventions on biomedical or behavioral health-related outcomes. By the term “behavioral health-related outcomes,” the NPRM recognized that clinical trials may occur outside of the biomedical context, and further stated that the studies addressed in the proposed definition of clinical trial are more likely to present more than minimal risk to subjects, and, therefore, require the highest level of oversight.

3. Public Comments

Approximately 70 comments discussed the proposal to extend the Common Rule to cover certain clinical trials. Opinion was mixed, with a slim majority opposing the proposed change. Universities and medical centers providing comments largely opposed the proposed measure, while professional associations and advocacy groups largely supported the proposal. We note that some of those who opposed the clinical trial extension did so because they felt that the proposal did not go far enough to include additional types of research.

Those supporting the proposed change indicated that it had the potential to ensure greater consistency of rules and protections for research subjects, thereby aiding efficiency and speeding the review process of study protocols. However, even those commenters who supported the proposal indicated that such an extension must fulfill the intent of a risk-based, streamlined approach to human subject protection, considering the effects of this extension on certain minimal risk research activities, such as student research, and social, behavioral, and educational research.

Those expressing opposition to this expansion of coverage noted concerns that: (1) Because the research institutions likely to engage in clinical trials already require IRB review of such research, the expansion would only increase administrative burdens (such as federal reporting requirements) for this type of research without a meaningful increase in protections to human subjects; (2) the regulatory extension to nonfederally funded

clinical trials would encompass many minimal-risk social and behavioral research activities and currently unregulated institutional activities that involve randomization (such as nonfederally funded quality improvement or quality assurance activities); and (3) because an institution's funding status may change, implementation of this proposal would be complicated. Several commenters expressed concern about the lack of detail in the NPRM regarding the planned implementation of the proposed requirement.

Several commenters also expressed concern that the unfunded clinical trials encompassed by this proposal would be subject to the single IRB mandate without a corresponding provision of federal funds to implement that requirement.

Some commenters suggested that the proposed change in the NPRM will not address the real gap in human subjects protections—facilities that receive no federal funding—and that if broad concern exists that some subjects are not being adequately protected in research that is not federally funded, then Congress would be the appropriate body to address any such deficiency through legislation. Further, some commenters expressed concern that extending the Common Rule to nonfederally funded clinical trials might have an overall effect of decreasing human subject protections by discouraging some smaller organizations from accepting any federal funding, thus removing federal oversight of their work.

One research institution noted that, if finalized, the proposed clinical trials extension would be implemented at the same time the ability of institutions to formally extend the application of the rule to all research conducted at the institution is being eliminated. Some states, such as Virginia, have state human subjects regulations that must be applied to research when federal regulations are not required. The commenter noted that removing the option to voluntarily extend the FWA would have the effect of reducing uniform application of the federal standards, as nonfederally funded research that does not meet the proposed definition of a clinical trial would by default be subject to state law.

A few commenters challenged whether the legal authority provided by the Public Health Service Act was sufficient to extend the Common Rule to nonfederally funded clinical trials. Commenters also suggested that this proposal is an unfunded mandate from the Federal Government with no benefit accruing to subjects or the research enterprise.

4. Response to Comments and Explanation of the Final Rule: Coverage of Certain Clinical Trials

The final rule does not adopt the NPRM proposal. Although we continue to maintain the position that increased harmonization of appropriate standards for ethical oversight of human subjects research is an important and desirable endpoint, we agree with the concerns expressed by commenters suggesting that our proposal for extending the Common Rule to currently unregulated clinical trials would benefit from further deliberation. Some commenters asserted that, in our attempt to close the perceived “gap” in oversight, the NPRM created a structure that would be both confusing and complicated for institutions to implement. We received multiple comments objecting to the administrative complexity involved in applying a regulatory extension triggered by the receipt of Common Rule department or agency funding for other nonexempt research, and asserting that the administrative burden is not offset by a corresponding increase in the meaningful protection of human subjects. Additionally, it is apparent from the public comments received that our intention to apply the Common Rule to cover the most risky types of research—clinical trials—was not accomplished through the NPRM proposal, given the definition of “clinical trial” included in the NPRM, as that definition encompassed research that would pose no more than minimal risk to subjects. Commenters were further concerned that an unintended consequence might be that the proposed extension would apply to low-risk student research and social, behavioral, or educational research, and would cause currently unregulated institutional activities, such as certain quality improvement or quality assurance activities, to fall within regulatory oversight. Upon reflection on the perspectives expressed by these commenters, we are persuaded that the proposed extension of the Common Rule is not appropriate to include in a final rule at this time. We will continue to carefully consider the related issues.

As an alternative, we contemplated explicitly limiting the extension of this policy to clinical trials that present greater than minimal risk to subjects in order to better align with the intent of this extension, as described in the preamble to the NPRM. However, such an alteration of the rule would itself introduce a variety of complexities, including the question of how a determination would be made that a particular activity involves more than minimal risk. Thus, there would be a very real possibility that such a rule would lead to an administrative burden on substantially more activities than the rule itself would be targeting (such as many minimal risk quality improvement activities).

We also considered the alternative of maintaining the pre-2018 standard of allowing institutions to voluntarily extend their FWAs to nonfederally funded research. We concluded that this alternative would not further the expressed goal of increasing the application of consistent protections to clinical trials, regardless of the source of support, because the extension of the FWA would be optional. We therefore plan to implement the proposed nonregulatory change to the assurance mechanism to eliminate the voluntary extension of the FWA to nonfederally funded research.

We note the concern expressed by commenters that a gap in federal oversight will remain for nonfederally funded research, and the comment that Congress would be the appropriate body to address any such deficiency through legislation. We recognize that institutions may choose to establish an institutional policy that would require IRB review of research that is not funded by a Common Rule department or agency (and indeed, as commenters noted, almost all institutions already do this), and nothing in this final rule precludes institutions from providing protections to human subjects in this way. As a result, the final rule continues to allow institutions the same wide degree of flexibility that they currently have with regard to making other similar determinations regarding ethical oversight of research not regulated by the Common Rule.

Although we are not implementing the proposed extension of the Common Rule to “clinical trials” (as defined by this policy), the proposed definition of “clinical trial” is still relevant to the final rule provision requiring posting of one IRB-approved consent form used to enroll subjects for a clinical trial conducted or supported by a federal department or agency, at § __.116(h). The definition of clinical trial is unaltered from the NPRM proposal and appears at § __.102(b).

C. Activities Deemed Not To Be Research Appear at § __.102(l) and Research Exempt From This Policy Appears at § __.104

In response to the public comments, the NPRM's general approach of designating various categories of

activities as excluded is not included in the final rule. The final rule reverts to the general structure of the pre-2018 rule and integrates some of the categories proposed for exclusion in the NPRM into that structure. Some changes to the categories are also included in the final rule.

In the final rule, some of the proposed exclusions from the requirements of the Common Rule are addressed in the definition of research, which includes a provision identifying “activities that are deemed not to be research” (see Section III). In addition, some of the proposed exclusions are included as exemptions in the final rule. Under § __.101(b) of the pre-2018 rule, six categories of research were considered exempt from this policy unless otherwise required by department or agency heads. In the final rule, exempt research is now described at § __.104 and eight categories are included (see Section V).

D. Department or Agency Discretion in Applying the Policy (§ __.101(c), (d), (i))

1. Background and Pre-2018 Requirements

The pre-2018 requirements included provisions at § __.101 that allowed federal department or agency heads to determine which specific activities or classes of activities are covered by the rule and whether certain requirements could be waived. This flexibility was allowed in recognition of the varying missions of the federal departments and agencies, the possibility that there may be superseding or alternative statutes or regulations governing their activities, and the possibility that a given situation requires either more stringent oversight (

e.g.,

“sensitive research”) or reduced requirements (

e.g.,

a public health emergency).

2. NPRM Proposals

The NPRM proposed to retain the Common Rule's pre-2018 requirement that federal department or agency heads retain final judgment about the coverage of particular research activities under the Common Rule (§ __.101(c)) and proposed an additional requirement that federal department or agency heads exercise their authority consistent with the principles of the

Belmont Report.

The NPRM also proposed at § __.101(d) that a department or agency may require additional protections for specific types of research it supports or conducts, or that is otherwise subject to regulation by the federal department or agency but not otherwise covered by the Common Rule. However, advance public notice would be required when those additional requirements apply to entities outside of the federal department or agency itself. This latter requirement was intended to promote harmonization among federal agencies or departments, to the extent possible, and to ensure transparency between funding entities and the regulated community.

Finally, at § __.101(i) the NPRM proposed to amend the criteria for a department or agency waiving the applicability of some or all of the provisions of the policy, by stating that the alternative procedures to be followed must be consistent with the principles of the

Belmont Report.

The addition of this provision was to make explicit the ethical basis underpinning how waiver decisions have and must be considered. The NPRM also proposed that such waivers be posted on a publicly accessible federal Web site.

3. Public Comments

Approximately 25 comments related to the NPRM proposals at § __.101(c) and (i) and none on § __.101(d). Comments received on these proposals generally expressed opposition to ever granting the authority to department or agency heads to retain final judgment as to whether a particular activity is covered by this policy, or to waive certain requirements, even though these provisions existed in the pre-2018 rule. These commenters were concerned about the potential for Common Rule departments and agencies to exclude certain activities for political purposes or for expediency, such as certain activities that might involve surveillance or criminal investigative aims. With regard to § __.101(i), some commenters stated that reference to the ethical principles of the

Belmont Report

was too narrow. That is, one might rely on additional ethical considerations to evaluate the applicability of the regulations.

4. Response to Public Comments and Explanation of the Final Rule: Department or Agency Discretion About Applicability of the Policy

The final rule adopts the NPRM proposals in § __.101(c). Thus, under § __.101(c), department or agency heads retain final judgment as to whether a particular activity is covered by the Common Rule, and this judgment should be exercised consistent with the ethical principles of the

Belmont Report.

We note that under the pre-2018 requirements Common Rule departments and agencies retained final authority as to whether a particular human subjects research study conducted or supported by that department or agency is covered by the Common Rule (§ __.101(c)) and that authority continues under the final regulations, but with the new limitation that this judgment must be consistent with the ethical principles of the

Belmont Report.

This discretion provides important flexibility given the varying missions and policies of the many departments and agencies.

Although some commenters were opposed to ever granting departments or agencies the authority permitted by § __.101(c), we believe requiring that these decisions be consistent with the principles of the

Belmont Report

is an approach that promotes accountability while still giving federal departments and agencies the necessary flexibility to achieve their respective missions.

The final rule in § __.101(d) does not adopt the NPRM proposals, and instead retains the pre-2018 language. The NPRM proposed to modify § __.101(d) to say that department or agency heads could require additional protections to research activities conducted or supported by federal departments or agencies, but that were not otherwise covered by the Common Rule. This language was intended as a clarification to the pre-2018 language. However, we determined that the term “additional protections” could potentially be confusing in that the activities at issue in this provision are those for which no Common Rule protections are required; thus the protections imposed by department or agency heads might be the only protections to which these activities are subject. We also note that departments or agencies conducting or supporting an activity subject to the Common Rule may require additional protections for human subjects.

The final rule also does not incorporate the NPRM proposal in § __.101(d) that advance public notice must be provided when a department or agency head requires that the Common Rule, or part of it, be applied to research activities not otherwise subject to the rule. Upon further assessment, we decided that such a requirement could hinder the ability of a department or agency to move quickly in cases where the department or agency determined that additional protections are warranted.

Section __.101(i) of the final rule adopts a majority of the NPRM proposals. As proposed in the NPRM, § __.101(i) is modified to require that any alternative procedures adopted by departments or agency heads are consistent with the principles of the

Belmont Report.

Also as proposed in the NPRM, § __.101(i) is modified to state

that, unless otherwise required by statute or executive order, notice of these alternative procedures must be forwarded to OHRP (or any successor office), or to the equivalent office within the appropriate federal department or agency. The pre-2018 rule only listed OHRP (or any successor office) as the office to which notices must be sent. This final rule modification is intended to ensure that if a non-HHS department or agency allows for alternative procedures, the appropriate office within that same department or agency receives notification. The final rule retains the pre-2018 requirement for the notice to also be published in the

Federal Register

or in such other manner provided for in department or agency procedures.

The final rule also adopts in § __.101(i) the NPRM proposal to require that the waiver notice include a statement that identifies the conditions under which the waiver will be applied and a justification as to why the waiver is appropriate for the research, including how the decision is consistent with the principles in the

Belmont Report.

Section __.101(i) of the final rule does not include the NPRM proposal that would have required each federal department or agency conducting or supporting the research to establish on a publicly accessible federal Web site a list of the research for which a waiver has been issued. We decided that the rule's requirement to publish the waiver notice in the

Federal Register

, or in such other manner as provided in department or agency procedures, adequately ensures that the waiver notice will be available to the public without also requiring that such notices be listed on a federal Web site. We note that some departments, such as HHS, currently post such notices on their Web sites.

The final rule thus formally codifies in § __.101(c) and (i) the general practice that the ethical standards articulated in the Belmont Report are the ethical standards that Common Rule departments or agencies will use in determining whether an activity is covered under this policy or whether to grant a waiver of the applicability of some or all of the provisions (unless otherwise required by law). The addition of the reference to the Belmont Report makes explicit the ethical basis underpinning how waiver decisions have and must be considered.

E. State and Local Laws That Provide Additional Protections for Human Subjects (§ __.101(f))

1. Background and Pre-2018 Requirements

The pre-2018 rule specified that the policy does not affect any state or local laws or regulations that may otherwise be applicable and that provide additional protections for human subjects. The NPRM did not propose any changes to this statement. However, questions raised by public comments, as described below, led to some clarifications to the final rule.

1. Public Comments

Several public comments raised questions and concerns about the ability of tribal nations to require additional protections that might be needed for research involving American Indian/Alaska Native (AI/AN) populations.

One tribal government noted the documented mistrust of research by AI/AN people and communities, and advocated for specific provisions acknowledging the authority and role of tribal nations in overseeing research that happens on their lands and with their citizens. Additionally, this entity noted that tribal nations do not always have their own regulatory bodies for human subject research protections, expressing concern about external groups deciding what constitute risks and benefits for the community.

Other AI/AN Population concerns of commenters included:

•

Tribal (i.e., group) and individual consent for secondary research with biospecimens:

Commenters noted that group consent can occur and should inform the proposed changes in the rule. They also noted that broad consent for future, unspecified research use of biospecimens presents a challenge to the ongoing ability of both tribes and individuals to choose to remove their data from research, or to understand how their information is being used to benefit, or put at risk, themselves or others.

•

Tribal and individual consent for research with biospecimens or other data from people who are no longer alive:

AI/AN groups noted the need to address protections for biospecimens initially collected from living humans after those humans pass away.

•

Research oversight by tribal IRBs and other tribal regulatory bodies:

AI/AN groups raised concerns about the use of a single IRB in cooperative and multi-institutional research, which does not foster community-based governance and oversight of research that has the potential to improve outcomes for tribal and minority populations.

•

Research oversight for categories of research and activities important in tribal contexts:

Commenters noted concerns about the proposed changes related to the exclusion of certain categories of activities (

e.g.,

oral history, biography), addition of exempt categories of research (

e.g.,

educational tests, surveys, interviews), and elimination of continuing review requirements for some studies because tribal research review often extends the scope of examination beyond individual-level protections to enact community-level protections important for maintaining the integrity of culturally significant information and practices. Changes to excluded and exempt categories of research and eliminating some continuing review requirements, especially where no clear mechanism for additional tribal oversight and input has been established, are a cause for concern for the AI/AN community.

2. Response to Public Comments and Explanation of the Final Rule: State and Local Laws That Provide Additional Protections

Consistent with the pre-2018 rule, this final rule retains the language in § __.101(f)) providing that the Common Rule does not affect any state or local laws or regulations that may otherwise be applicable and that provide additional protections for human subjects. However, the final rule adds clarifying language providing that the referenced state or local laws or regulations include tribal laws passed by the official governing body of an AI/AN tribe. Thus, if the official governing body of a tribe passes a tribal law that provides additional protections for human subjects, the Common Rule does not affect or alter the applicability of such tribal law. (Note that a similar change was also made to § __.116(i) and (j) to provide the same clarification.) In addition, for purposes of the exception to the single IRB review requirement for cooperative research, relating to circumstances where review by more than a single IRB is required by law, § __.114(b)(2)(i) specifies that tribal law is to be considered in assessing whether more than single IRB review is required by law.

F. Research Covered by This Policy Conducted in Foreign Countries (§ __.101(h))

1. Background and Pre-2018 Requirements

The pre-2018 requirements at § __.101(h) stated that when research covered by this policy takes place in foreign countries, procedures normally followed in those countries to protect human subjects may differ from those set forth in this policy. The previous rule cited the Declaration of Helsinki, as amended in 1989, as an example of internationally recognized ethical standards that a foreign country might use as its ethical standard. The rule provided that if a department or agency head determined that procedures prescribed by the institution in the foreign country afforded protections that are at least equivalent to those provided in this policy, the department or agency head may approve the substitution of the foreign procedures in lieu of the procedural requirements provided in this policy.

2. NPRM Proposal

The NPRM proposed to remove the specific reference to the Declaration of Helsinki in this provision. A concern with providing a specific example of an internationally recognized ethical document is that such a document is subject to change independent of Common Rule departments and agencies, and therefore could be modified to contain provisions that are inconsistent with future U.S. laws and regulations.

3. Public Comments

A few comments addressed the removal of the reference to the Declaration of Helsinki. These comments were equally divided between those opposed and those supportive or generally supportive. Those opposed feared that the removal of the reference would suggest that the Declaration of Helsinki does not apply and that it was cited in the pre-2018 requirements as an example, not as an equivalent replacement for the Common Rule. These commenters also noted that the United States had refused to sign on to some recent revisions to the Declaration. One organization commented that it would have been useful for the NPRM to address the issue of equivalent protections for U.S.-funded research conducted in foreign countries, as that might have addressed ongoing concerns about the use of alternative systems of protections when research is conducted outside the United States. Those supportive of removing the reference to the Declaration of Helsinki agreed with the arguments laid out in the NPRM and felt that it was judicious to not align U.S. regulations with other standards because those standards are likely to change, perhaps in ways inconsistent with U.S. policy.

4. Response to Public Comments and Explanation of Final Rule: Removing the Reference to the Declaration of Helsinki

The final rule adopts the NPRM proposal. Although the pre-2018 requirements cited the Declaration of Helsinki as an example of internationally recognized ethical standards that a foreign country might use as its ethical base, we note that providing a specific example of an internationally recognized ethical document is concerning because such a document is subject to change independent of Common Rule department or agency policies, and therefore might be modified in ways that create standards that are inconsistent with U.S. laws and regulations.

G. Harmonization of Department and Agency Guidance (§ __.101(j))

1. Background and Pre-2018 Requirements

Each Common Rule department and agency and the Food and Drug Administration (FDA) are authorized to issue its own guidance with regard to interpreting and implementing the regulations protecting human subjects. That guidance may differ substantially across entities. Currently, multiple efforts are underway to address variation in guidance across the Federal Government, but no regulatory requirement exists for departments and agencies to consult with other departments before issuing a policy, to the extent appropriate. As a result, interdepartmental communication has been at times uneven, leading to potentially avoidable inconsistencies. The Common Rule departments and agencies have procedures for sharing proposed guidance before it is adopted, and these procedures have generally been successful. Additionally, FDA and OHRP have worked closely to ensure harmonization of guidance to the extent possible, given the differing statutory authorities and regulatory missions. Also, as mentioned earlier in section I.B., the 21st Century Cures Act was enacted in December 2016. Among other things, it requires that the Secretary of HHS, to the extent practicable and consistent with other statutory provisions, harmonize the differences between 45 CFR part 46, subpart A, and FDA's human subject regulations.

2. NPRM Proposal

Responses to questions in the 2011 ANPRM about the need for harmonization of guidance across Common Rule departments and agencies reflected widespread support for such efforts. Several commenters acknowledged the difficulty of getting all Common Rule departments and agencies to agree on all issues, as each has a different mission and research portfolio. However, they encouraged seeking harmonized guidance whenever possible. Thus the NPRM proposed that the regulations contain language requiring consultation among the Common Rule departments and agencies for the purpose of harmonization of guidance, to the extent appropriate, before guidance on the Common Rule is issued, unless such consultation is not feasible. The NPRM requested public comment on whether the proposed language would be effective in achieving greater harmonization of department and agency guidance, and if not, how it should be modified.

3. Public Comments

Approximately 60 comments were received regarding this proposal, and they were almost equally divided for and against it, although some of those opposed thought it did not go far enough to achieve the intended goal. Those who supported the proposal, either fully or partially, cited concerns they have as institutions, investigators, or IRBs in navigating different sets of regulations and different department or agency guidance documents. As noted above, among those who opposed the proposal, some expressed concern that the proposed language about harmonization did not go far enough. That is, they thought the language should mandate harmonization in guidance across Common Rule departments and agencies. These commenters felt that without a requirement to harmonize, federal departments and agencies will continue with business as usual and policy and guidance will continue to differ, creating complexity in the research environment. For example, one large research university emphasized the importance of harmonization across federal departments and agencies regarding guidance on the protections of human subjects for investigators, IRB administrators, and human subjects, and felt that the proposed language in the Common Rule NPRM might be ineffective in harmonizing agency

guidance. Several commenters emphasized the need, in particular, for greater harmonization between the Common Rule and FDA requirements, and between the Common Rule and the requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA; Pub. L. 104-191).

Others were concerned that this provision would, in effect, mean that Common Rule departments and agencies issue fewer guidance documents because of lengthy internal government review and approval processes.

4. Response to Public Comments and Explanation of the Final Rule: Harmonization of Guidance

We believe there is a compelling case for as much consistency as is possible regarding guidance on the protections of human subjects. As such, the final rule implements the NPRM proposal at § __.101(j). The final rule creates a requirement that guidance should be issued only after consultation among the Common Rule departments and agencies, while also permitting guidance to be issued without such consultation when it is not feasible. The proposal recognizes that harmonization will not always be possible or desirable given the varied missions of the departments and agencies that oversee the protection of human subjects and differences in their statutory authorities.

We note that some public comments expressed concern about the acceptable degree of variability among departments and agencies and encouraged attention to these concerns when diverging on guidance. The departments and agencies that oversee the protection of human subjects have a variety of missions and functions, including regulatory agencies and agencies that conduct and support research. In addition, in some cases, statutory differences among the departments and agencies have resulted in different regulatory requirements and guidance. They also oversee very different types and phases of research and thus may have reasonable justifications for differences in guidance. However, we agree that efforts should be made to issue collective guidance when possible and feasible and in a timely manner. We do not believe that this provision will result in the issuance of less guidance, because it largely codifies what has been the working practice among Common Rule departments and agencies up to this point.

H. Compliance Dates and Transition Provisions of the Final Rule (§ __.101(l))

1. NPRM Proposal

In the NPRM, we shared the expectation that both the effective date of the final rule (meaning the date that the regulatory text is published in the Code of Federal Regulations) and the general compliance date of the final rule (meaning the date after which, as a general matter, regulated entities must comply with this rule) would be 1 year after publication of the final rule in the

Federal Register

. The NPRM also proposed two exceptions that would provide different compliance dates for two provisions. The first proposed exception pertained to the NPRM's proposal that the Common Rule be extended to cover all biospecimens regardless of identifiability. The second proposed exception pertained to the NPRM's proposal that a single IRB would be responsible for certain multi-institutional clinical trials, also described as cooperative research. The NPRM proposed that both of these provisions would have compliance dates of 3 years after publication of the final rule in the

Federal Register

. The intent behind this proposed delay was to enable institutions to develop institutional policies and procedures necessary to implement these new requirements. The NPRM sought public comments about the advisability of this proposed approach as well as possible alternatives.

The preamble to the NPRM also discussed the option for institutions or investigators to implement provisions of the final rule anticipated to provide additional regulatory flexibilities voluntarily 90 days after publication of the final rule in the

Federal Register

. This proposed approach was intended to enable institutions or investigators to gain the benefit of revisions to the Common Rule as soon as possible. The NPRM proposed a 90-day timeframe for this flexibility to enable the Common Rule departments and agencies time to develop the documents and tools needed to assist institutions in implementing the rule's regulatory flexibilities (

e.g.,

the Secretary's broad consent templates) and the Secretary's list of privacy safeguards.

The NPRM also explained that the proposed extension of the Common Rule to clinical trials that are not directly funded by a Common Rule department or agency, but that are conducted at an institution that receives funding from a Common Rule department or agency for other human subjects research, would not apply to an institution until the institution had received federal funding for nonexempt research in an award made after the effective date of the final rule.

The NPRM also proposed that ongoing human subjects research initiated before the effective date of the final rule would not need to comply with particular regulatory requirements.

In addition, the NPRM proposed a grandfather clause for research involving the use of biospecimens collected before the compliance date. This clause applied to the provision that would extend the Common Rule to cover all biospecimens, regardless of identifiability. Specifically, the NPRM proposed that such research would not need to comply with the final rule if any research uses of the biospecimens occurred only after removal of any individually identifiable information.

2. Public Comments

A majority of comments received on the effective dates opposed the NPRM's proposal that only nonidentified biospecimens would be grandfathered. Others commented on the proposed 3-year compliance date for the proposed expansion of the definition of human subjects to all biospecimens, regardless of their identifiability. In Section III, we discuss the determination not to finalize the biospecimen provisions, which addresses these comments. Some commenters expressed support for the general compliance date, as well as the delayed compliance date for the cooperative research provision.

Many commenters expressed the viewpoint that regulated entities would need to invest significant time and resources before they would be able to comply with the changes to the Common Rule proposed in the NPRM. Some commenters (including an academic institution and a hospital association) noted that such investments would have implications not only for research operations, but also for clinical care. Some commenters also noted their concern that 1 year was not enough time for institutions to comply with the large number of new and different regulatory requirements proposed in the NPRM and that such changes would necessitate significant modifications to their research and clinical enterprises and might impose hardships on IRBs, IRB staff, institutional leadership, and the regulated research community. Several commenters explained that the proposed 1-year general compliance period would not provide enough time to update written IRB procedures (which are required under the Common Rule), disseminate such procedures, update related documents (

e.g.,

forms),

and develop appropriate training materials. One of these commenters explained that accredited institutions will need time for accrediting bodies to align their accreditation standards with the revised regulatory standards or risk conflicts between meeting proposed regulatory standards and losing accreditations.

Other commenters recommended 2-year or 3-year general compliance dates (including some that recommended permitting institutions to comply earlier), noting that compliance would be particularly challenging for institutions with smaller research programs. At least one commenter argued that the 3-year compliance date for the proposed cooperative research provision was inadequate given the significant costs and time that would be associated with establishing reliance agreements between collaborating research sites, maintaining required documents at the reviewing IRB, and ensuring that applicable laws were followed. At least one commenter argued that the proposed effective and compliance provisions left institutions with the discretion to remove studies from the oversight of the Common Rule without establishing any protective standards for doing so.

One group representing multiple professional societies stated that the efficiencies achieved by eliminating protracted negotiations concerning consent forms and institutional responsibilities will far outweigh any upfront costs incurred through implementation of this policy, and advocated for a faster timeframe for compliance than the proposed 3 years from the time of final publication: 1 year for clinical trials and 2 years for research studies. Another commenter echoed these views.

We did not receive many comments concerning the proposal to allow institutions to implement provisions offering regulatory flexibilities before the compliance date.

3. Response to Comments and Explanation of the Final Rule: Compliance Dates and Transition Provisions

The effective date and compliance dates included in this final rule are intended to meet the same general objectives as those described in the NPRM. Nonetheless, the approach adopted in the final rule is different in certain respects from the approach proposed in the NPRM.

As a general matter, none of the proposed dates in the NPRM related to research with biospecimens will be implemented because the proposal included to extend the Common Rule to research with all biospecimens, regardless of identifiability, is not being implemented.

The final rule adopts an effective date and a general compliance date of 1 year from publication of this final rule in the

Federal Register

. During this 1-year timeframe, institutions will be able to revise forms, documents, and practices for consistency with the revisions reflected in this regulation. Although we recognize the work associated with compliance, we concluded that 1 year is a reasonable and adequate timeframe. We note that ongoing research studies that were initially approved by an IRB, waived pursuant to § __.101(i), or determined to be exempt before January 19, 2018 will not be required to comply with the changes reflected in this final rule.

Section 101(l) describes the regulatory requirements that will apply to specific categories of research once the final rule goes into effect. For clarity, § __.101(l) begins by defining two sets of requirements. First, as set forth in § __.101(l)(1), the pre-2018 rule is described as the “pre-2018 Requirements”, which refers to the Common Rule as published in the 2016 edition of the Code of Federal Regulations. As described below, certain ongoing research may be subject to these requirements.

Section 101(l)(3)-(4) describes the different regulatory requirements that apply to different categories of research. For clarity and in order to have an easy-to-implement standard, these categories are generally based upon the date the research was initially approved by an IRB, waived pursuant to § __.101(i), or determined to be exempt.

The first category of research, described in § __.101(l)(3), applies to research initially approved by an IRB, waived pursuant to § __.101(i), or determined to be exempt before January 19, 2018. We believe that such research (

e.g.,

research for which an initial determination was made before the effective date of this final rule) should, as a general rule, be able to follow the same set of standards throughout the entire course of the research. The intent is to minimize burdens associated with research conducted over a period of time and to avoid a requirement that such research be subject to two sets of rules during the lifetime of the research. For that reason, this regulation adopts as a default rule, set forth in § __.101(l)(3), that research initially approved by an IRB, waived pursuant to § __.101(i), or determined to be exempted before January 19, 2018 (the effective date of this final rule) will not be subject to this final rule but will continue to be subject to the requirements of the Common Rule in place before January 19, 2018.

However, we also recognize that institutions may prefer, for a particular study initiated before to January 19, 2018, to comply with this final rule given the benefits that it offers and for administrative simplicity such as common regulatory requirements across an institution. Thus, § __.101(l)(3) permits institutions engaged in ongoing research that was initially approved by an IRB, waived pursuant to § __.101(i), or determined to be exempted before January 19, 2018, to choose, on a study-by-study basis, whether such research will be subject to the pre-2018 requirements (the rule in place before January 19, 2018, or the final rule. This is an exception and is offered as an additional flexibility to regulated entities. If an institution engaged in such research determines that it prefers to comply with the final rule for a particular research study, such research will be subject to the final rule if the institution formally makes a determination that the final rule will apply to such research and an IRB documents the decision made by the institution. If these requirements are not met or if the institution makes no decision, the pre-2018 requirements will apply to such research.

The second category of research, described in § __.101(l)(4), applies

to research initially approved by an IRB, waived pursuant to § __.101(i), or determined to be exempted on or after

January 19, 2018. Because such research does not begin and is not conducted until after the general compliance date of this final rule, this category of research is subject to the final rule throughout its lifetime.

A single IRB requirement for cooperative research has been adopted in § __.114(b) of this final rule. As set forth in § __.101(l)(2), this final rule adopts the proposed 3-year compliance date for this requirement to afford affected institutions sufficient time to prepare for and implement this requirement (

e.g.,

developing institutional policies and procedures).

Although we understand the concerns expressed concerning the complexities that will be involved in establishing reliance agreements to satisfy the cooperative research provision adopted in this final rule, this final rule reflects the conclusion that a 3-year compliance date is adequate for this provision, based on our belief that this provision will offer significant benefits to institutions, particularly as the regulated community becomes

accustomed to this requirement. In addition, we believe it is likely that the institutional policies, procedures, and standard documents needed to implement this regulatory provision will, over time, become increasingly standardized, which will significantly minimize the burden on institutions associated with this requirement. So long as all other regulatory requirements are satisfied, institutions may use a single IRB to oversee cooperative research even before this compliance date occurs with respect to any research that institutions believe may benefit from this approach.

This final rule does not adopt the proposal mentioned in the preamble to the NPRM to permit institutions and investigators to voluntarily implement provisions in the final rule that allow additional flexibilities 90 days after publication of the final rule. We determined that the approach adopted at § __.101(l)(3), and described above, offers institutions and investigators similar advantages with respect to the conduct of ongoing research, while providing greater clarity and more simplicity concerning which set of regulatory requirements apply to particular studies.

We disagree with the comment that the proposed timelines enable institutions to remove their studies from the oversight of the Common Rule without establishing appropriate standards for doing so. The final rule does not enable institutions to opt out of compliance with the Common Rule. The effective dates do afford institutions the discretion to choose, on a study-specific basis whether existing research should comply with the Common Rule in place when the research was initiated (the pre-2018 requirements) or this final rule (the 2018 requirements). This flexibility is offered only for certain ongoing research studies that were initially approved, determined to be exempt, or subject to a § __.101(i) waiver before the effective date of this final rule.

To explain the approach adopted in this final rule, the following chart describes the standards that apply to different categories of research:

Research Study Initiation Date

Standards

Research initially approved by an IRB, waived pursuant to § __.101(i), or determined to be exempt before January 19, 2018

These studies are by default subject to the pre-2018 rule (the Common Rule as published in the 2016 edition of the Code of Federal Regulations).

However, an institution engaged in such research may choose to comply with the final rule (2018 requirements) for such a study if the institution makes a determination to apply the final rule to the study and an IRB documents this determination.

Research initially approved by an IRB, waived pursuant to § __.101(i), or determined to be exempt on or after January 19, 2018

These studies are subject to the final rule (2018 requirements).

I. Severability (§ __.101(m))

A severability clause has been added as § __.101(m), providing that if any provision of this final rule is held to be unenforceable in one set of circumstances, it should be construed to give maximum effect to the provision as applied to other persons or circumstances. Similarly, if a provision is held to be invalid or unenforceable, that provision should be severable from, and have no impact on the application of, the remainder of the rule. This provision reflects our intention regarding the way that this final rule, and the pre-2018 rule, should be construed and interpreted and is meant as a clarification.

III. Definitions for Purposes of this Policy (§ __.102)

The final rule revises and adds new definitions of key terms for the purposes of this policy, as summarized below. Some of the changes are made to clarify new provisions that appear elsewhere in the final rule. In addition, the definitions have been placed in alphabetical order to facilitate searching by the reader. The definitions of institution, IRB, and IRB approval are unchanged but appear in a different place in the regulatory language.

A. Certification (§ __.102(a))

Although “certification” was defined in the pre-2018 requirements, as was proposed in the NPRM, the final rule clarifies that notification by the institution that a proposed research study has been reviewed and approved is made to the supporting “federal” department or agency and that it might be a component of the agency or department that is notified rather than the entity as a whole. This clarification relates to the change included in the final rule at § __.102(d) regarding the definition of “federal department or agency” that clarifies that this phrase refers to the department or agency itself, not its bureaus, offices, or divisions. There were no public comments on this clarification.

B. Clinical Trial (§ __.102(b))

1. Background and Pre-2018 Requirements

The pre-2018 rule did not include a definition of “clinical trial.”

2. NPRM Proposal

The NPRM proposed defining “clinical trial,” for purposes of this policy, as a research study in which one or more human subjects are prospectively assigned to one or more interventions (which may include placebo or other control) to evaluate the effects of the interventions on biomedical or behavioral health-related outcomes. In addition, the NPRM requested public comment on whether the proposed definition should include additional explanation of what is encompassed by the term behavioral health-related outcomes.

3. Public Comments

Approximately 20 comments explicitly addressed the definition of “clinical trial” included in the NPRM. All expressed concern that the proposed definition encompassed more activities than intended, given the NPRM discussion that the definition was intended to cover the riskiest research. Commenters who responded asked for some type of clarification, either in guidance or in the regulatory language itself about the term “behavioral health-related outcomes.” One commenter noted that clinical trials involving activities such as behavioral interventions, psychotherapy, or skills training, for example, should be included in the proposed regulations of clinical trials in a risk-based manner, as for nonbehavioral studies. That is, greater oversight would be required for trials with a higher potential degree of risk, regardless of what type of trial. The commenter noted that certain populations for whom behavioral health research is conducted are high risk by

nature, such as chronically suicidal individuals. Another commenter asked that the regulatory language include additional explanation of what is encompassed by the term “behavioral health-related outcomes” because practitioners and researchers conceptualize the term differently.

4. Response to Comments and Explanation of the Final Rule Definition of Clinical Trial

The final rule at § __.102(b) adopts the NPRM definition of “clinical trial,” which is a research study in which one or more human subjects are prospectively assigned to one or more interventions (which may include placebo or other control) to evaluate the effects of the interventions on biomedical or behavioral health-related outcomes. We generally expect that this definition will be applied harmoniously with the definition of clinical trial recently promulgated in the ClinicalTrials.gov final rule.

17

17

HHS. Clinical Trials Registration and Results Information Submission. 81 FR 64981. (Sept. 21, 2016). Retrieved from

https://www.federalregister.gov/documents/2016/09/21/2016-22129/clinical-trials-registration-and-results-information-submission

In response to public concerns about an overly expansive definition of “clinical trial” given the importance of that definition to the proposed extension of the rule to clinical trials previously not covered by the rule, we have eliminated that proposed expansion of coverage in this final rule. As such, the definition that appears in the final rule will only be relevant to the requirement for posting of consent forms for clinical trials conducted or supported by Federal departments or agencies (§ __.116(h)). It should be appropriate for that relatively narrow regulatory purpose.

C. Department or Agency Head and Federal Department or Agency/Institutions (§ __.102(c) (d) and (f))

1. Background and Pre-2018 Requirements

The pre-2018 rule provided a definition of “department or agency head.” The phrase appeared repeatedly throughout the regulations.

2. NPRM Proposals

New definitions of “department or agency head” and “federal department or agency” were proposed in the NPRM to clarify requirements related to federal department and agency discretion in applying the policy to their funded or conducted research.

3. Public Comments

There were no comments directly related to these proposed revisions.

4. Explanation of the Final Rule: Definition of Department or Agency Head, Federal Department or Agency, and Institution

The final rule adopts the NPRM proposals to provide new definitions of “department or agency head” and “federal department or agency,” which appear at § __.102(c) and (d). “Department or agency head” at § __.102(c) refers to the head of any federal department or agency, for example, the Secretary of HHS, and any other officer or employee of any federal department or agency to whom authority has been delegated. To add clarity to the definition found in the pre-2018 regulations, the example of the Secretary of HHS was inserted.

The final rule provides at § __.102(d) a definition of “federal department or agency” in order to avoid confusion as to whether this phrase encompasses federal departments and agencies that do not follow the Common Rule. The definition also clarifies that this phrase refers to the department or agency itself, not its bureaus, offices, or divisions. This is consistent with the historical interpretation of the Common Rule. Related to this, the definition of “institution” was changed at § __.102(f) in the final rule to clarify that departments can be considered institutions for the purposes of this policy. The final rule provides examples of what is intended by this definition: HHS, the Department of Defense, and the Central Intelligence Agency.

D. Human Subject (§ __.102(e))

1. Background and Pre-2018 Requirements

The pre-2018 rule defined “human subject” as a living individual about whom an investigator (whether professional or student) conducting research obtains (1) data through intervention or interaction with the individual, or (2) identifiable private information. Further, the pre-2018 rule asserted that “private information” was considered individually identifiable if the identity of the subject is or may readily be ascertained by the investigator or is associated with the information.

Thus, in cases where no intervention or interaction with an individual occurred, determining the meaning of “identifiable” and “readily ascertainable” was central to determining whether human subjects were involved in a research activity covered by the pre-2018 rule. Under the pre-2018 rule, provided the data were collected for purposes other than the currently proposed research, it was permissible for investigators to conduct research on biospecimens and data that had been stripped of all identifiers or coded without obtaining consent because the nonidentified biospecimens and data did not meet the regulatory definition of a human subject.

Moreover, “private information” was not considered to be identifiable under the pre-2018 rule if the identity of the subject is not or may not be “readily ascertained” by the investigator from the information or associated with the information.

If the definition of “human subject” was met, together with the other significant requirements, the pre-2018 rule required IRB review and approval unless the study was exempt. IRB waiver of informed consent was allowable under the Common Rule, if the research study satisfied the criteria for waiver of informed consent.

2. NPRM Proposal

The NPRM proposed to revise the definition of “human subject” to include research in which an investigator obtains, uses, studies, or analyzes biospecimens, regardless of identifiability. Thus, the focus of this proposal was to require informed consent for research involving biospecimens in all but a limited number of circumstances. In addition, the NPRM proposal would have still permitted IRBs to waive the requirement for informed consent for research use of biospecimens, but the requirements for approval of such waivers would have been very strict, and such waivers would have occurred only in rare circumstances (see Section XIV on waiver of informed consent). This expansion of the definition of “human subject” would also have triggered other provisions of the NPRM relating to the use of biospecimens, including security measures. Thus, it was a complex and far-reaching proposal.

The NPRM also offered two alternative proposals to altering the definition of “human subject,” both of which maintained “identifiability” as a major aspect of determining applicability of the Common Rule to biospecimens. The public was asked to comment on which of the three proposals achieved the most reasonable tradeoff between the principles of autonomy and beneficence.

Alternative Proposal A would have expanded the definition of “human subject” to include whole genome sequencing (WGS). Under this

alternative, WGS would have been considered to be the sequencing of a human germline or somatic biospecimen with the intent to generate the genome or exome sequence of that biospecimen.

Alternative Proposal B would have expanded the definition of “human subject” to include the research use of information that was produced using a technology applied to a biospecimen that generated information unique to an individual. In such a case, it was foreseeable that, when used in combination with publicly available information, the individual could have been identified. Information that met this standard would have been referred to as “bio-unique information.”

The NPRM also asked the public to comment on whether the rule should include a definition of “biospecimen” and whether the rule should be clearer and more direct about the definition of “identifiable private information.”

The NPRM also proposed some minor changes to the wording of the definition of “human subject” merely to clarify how the word “obtains” has been interpreted.

The NPRM did not propose any major substantive modifications to the descriptions of “private information” and “identifiable private information” found in the pre-2018 rule. However, the NPRM proposed clarifying language with regard to “private information” and “identifiable private information.” The pre-2018 rule used the example of a medical record as constituting private information. The NPRM added the example of a biospecimen in keeping with the proposal to expand the definition of “human subject” to include all biospecimens. In addition, the NPRM proposed adding the words “shared or” to the description of what constitutes “private information,” for the purpose of expanding the scope of the information that would be described by that term.

In addition, the NPRM asked for public comment about whether a different identifiability standard would be appropriate. One alternative discussed was to adopt the term “identifiable private information” with the term used across the Federal Government: “personally identifiable information” (PII). PII refers to information that can be used to distinguish or trace an individual's identity (such as name, social security number, biometric records) alone, or when combined with other personal or identifying information that is linked or linkable to a specific individual, such as date and place of birth, or mother's maiden name. It acknowledged that replacing “identifiable private information” with “PII” would increase the scope of what is subject to the Common Rule. Subsequent to the release of the NPRM, the Office of Management and Budget (OMB) updated government-wide guidance for managing personally identifiable information.

18

18

CIRCULAR NO. A-130 Memorandum to: The Heads of Executive Departments and Agencies Subject: “Managing Information as a Strategic Resource”. July 7, 2016. See especially,

Appendix II: Responsibilities for Managing Personally Identifiable Information.

Retrieved from

https://www.federalregister.gov/documents/2016/07/28/2016-17872/revision-of-omb-circular-no-a-130-managing-information-as-a-strategic-resource

Related to this issue, the NPRM noted new legislative developments, specifically the Newborn Screening Saves Lives Reauthorization Act of 2014 (Pub. L. 113-240), signed into law in December 2014. The law required consent for federally funded research with newborn dried blood spots and prohibits IRBs from waiving consent. These changes were to be effective until updates to the Common Rule were promulgated, and applied whether or not the newborn dried blood spots would be considered “identifiable private information” under the regulatory definition.

3. Public Comments

a. Public Comments on the Primary NPRM Proposal

The proposal regarding revising the definition of “human subject” to include biospecimens regardless of identifiability was commented on by almost 50 percent of the commenters. Others commented on the effects such an expansion would have on consent requirements, the ability to waive consent, and the applicability of exemptions and exclusions. The vast majority of commenters who addressed this expansion (80 percent) were opposed to it for a variety of reasons, particularly because of the implications of this change for requiring consent for most research uses of biospecimens that were collected as part of clinical care.

A majority of these commenters responded as members of the general public (that is, not explicitly affiliated with a specific organization or institution) or as patients (including family members of patients). Patients tended to oppose these proposals, focusing on the additional and more stringent criteria for waiver of informed consent because they believed the effects of the proposals would be that many people would not provide consent, thus restricting access by investigators to biospecimens, which would in turn slow research. Investigators also expressed concerns about the negative impact on research. Organizations and institutions with some affiliation with the research enterprise expressed opposition to this suite of proposals as well, but for different reasons, as discussed further below.

Most support for the expansion of the definition of “human subject” to encompass all biospecimens and its implications for consent, waiver of consent, and exempt research came from members of the public who argued that they wanted to always be consulted before their biospecimens were used in research, without exception. Within this group, a strong majority opposed the comprehensive biospecimen-related proposals because they were uncomfortable with the concept of broad consent (as discussed in Section IIV of this preamble) to any future research use of those biospecimens and the existence of any type of over-ride by an IRB of the requirement to obtain informed consent.

Many of the commenters supporting the expansion stated that it would respect autonomy by requiring that nearly all research with biospecimens be subject to IRB review and informed consent requirements. Others expressed distrust of the medical and scientific enterprises. One member of the public felt that consent should be required for government research seeking to use an individual's biospecimens, and that researchers should be required to inform the individual of the “who, what, how, and why” of the desired research.

Many of those who expressed support for this proposal also indicated that they felt it important for their biospecimens to be anonymized in research activities. For example, a member of the public with experience in biobanking expressed a willingness to consent to the use of his biospecimens to advance science, but called for a mechanism to inform the public about such research use even if some individuals might decline to participate. The commenter stressed the importance of respecting the individual's right to know and refuse, citing privacy concerns and stressing the importance of anonymity of biospecimens to protect individuals from potential negative consequences.

Still others supported the expansion of the definition of “human subject” to include all biospecimens because of a desire to receive research results or to financially profit from discoveries, implying that retaining identifying information with biospecimens would enable both of these possibilities. Some who felt there is an entitlement to

financially profit from discoveries described biospecimens as personal property. For example, one commenter compared the use of an individual's biospecimens without consent to one party illegally taking another's property such as land, a house, or an arm.

Several commenters noted that medical services should not be allowed to be contingent upon a person's consent to use of their leftover biospecimens for research despite the fact that this was not proposed in the NPRM. In fact, the pre-2018 rule states that informed consent must include a statement that “refusal to participate will involve no penalty or loss of benefits to which the subject is otherwise entitled” and that element appears in the final rule as well.

For example, one commenter indicated that patients should be informed and be given the opportunity to consent to the use of their body tissues, and if one declines consent, the individual should not be denied treatment or receive diminished care. In other words, they felt that consent should never be a condition of treatment.

The reasons for opposing the expansion of the definition of “human subject” to include all biospecimens were numerous, including: the feasibility of obtaining broad consent in a clinical setting; the costs of obtaining, tagging, and tracking consents given the low risk nature of the research in question; allowing autonomy to trump beneficence and justice; insufficient evidence of risk or public concern about the issue; the fact that it would result in fewer specimens collected from fewer sources, with adverse implications for rare diseases and for justice; the idea that requiring all biospecimens to remain identified poses greater privacy and confidentiality risks than the current system; and overall negative impacts on research.

Many expressed concern about the number of biospecimens that might no longer be available for research, not out of concern that individuals would decline to have their leftover tissue used in research, but rather because many hospitals and medical providers might decline to enact the expensive consent and tracking system that the NPRM envisioned. Some commenters were concerned that this would then limit the heterogeneity of biospecimens obtained and stored, as community hospitals and clinics might opt out of participating in such collections.

Several comments suggested that for academic medical centers where a large amount of research is conducted, research activities often do not result in profits, and that the proposed policies would come at great costs to institutions already struggling to financially sustain a healthy research enterprise. For example, one commenter noted that the NPRM proposal would require additional resources to obtain consent, which would hinder smaller institutions with fewer staff or resources available in their ability to contribute to scientific and medical research, and limit the opportunities for patients at these facilities to participate in research. The commenter also pointed out that academic institutions rarely receive significant financial gain from their research, and institutions sometimes share biospecimens, which can be valuable in research, especially in the case of uncommon and poorly understood diseases. Thus, this commenter expressed concern that biospecimens might not be available for research given the requirements of the proposed policy.

Many members of the public with rare diseases commented on how research into their specific diseases might be affected should the NPRM proposal be finalized. For example, several commenters expressed interest in the proposed rule because they or a family member had been diagnosed with a desmoid tumor, which are often limb threatening and sometimes life threatening. Research using tissue blocks is critical to determine how to treat these tumors, which are rare and can vary among patients. The commenter felt that the proposed rule would make desmoid tumor research virtually impossible by reducing access to the already low number of tissue blocks available for research.

More than one academic medical center asserted that there was a lack of evidence that patients value their autonomy over the potential for innovative diagnostics, treatments, cures, or preventative interventions that could result from research with leftover biospecimens, and called for empirical research on whether patients, patient advocacy groups, and the general public value autonomy (in the form of written consent for research use of nonidentified biospecimens) above other values when explained in light of potential impact on medical advances.

Some public commenters pointed out the illogic of treating biospecimens differently from information for the purposes of defining what constitutes a human subject. For instance, one professional organization composed of investigative pathologists and dozens of individual pathologists around the country noted that there are several areas in which the NPRM proposes treating biospecimens differently from identifiable information unjustifiably since both create the potential for identification of the donor and a potential negative impact on the individual and their family, such as employment or insurance discrimination, embarrassment, or stigmatization. That organization noted that no empirical evidence has been provided to indicate either that biospecimens pose a risk greater than that posed for identifiable information or that the public is more concerned about the use of biospecimens compared to the use of identifiable private information.

One member of the public asserted that the research use of leftover biospecimens in medical research poses less of a privacy risk to individuals than market research that analyzes one's attitudes, words, and behaviors and is used to generate commercial profit.

Several commenters noted that the proposed expansion of the definition of “human subject” creates a cascade of consequences throughout the rule that are overly complex and unnecessary given the minimal risk of such research.

Other commenters suggested that the NPRM proposals would have negative impacts on the advancement of precision medicine. For example, a research university felt that mandating consent for de-identified biospecimens would impair the ability to achieve precision medicine for all. The commenter asserted that to offer care tailored to the needs of each individual based on understanding how each person is affected by disease requires understanding differences in the origins and manifestations of disease in individual patients who differ in genetics and environmental exposures. The commenter felt that restricting access to nonidentified biospecimens would violate the principles of justice and beneficence because many health care facilities serving under-represented minorities and economically-disadvantaged individuals, particularly those in rural settings, might not have the financial resources to obtain and track consent. As a result, medical research therefore might represent a skewed population of individuals receiving care at large, research intensive referral centers. In addition, the commenter felt that compliance would impose an onerous and expensive bureaucratic burden that would result in many institutions no longer collecting and using these critically important specimens with the net effect of thwarting efforts to provide precision medicine for all citizens.

Many commenters expressed the opinion that the existing regulatory framework is adequate and that current practices should be maintained, stressing that the research use of nonidentified data or biospecimens involves minimal or low risk to the research subject. Furthermore, several commenters noted that, although it is theoretically plausible to identify a person based on their biospecimen, the likelihood remains remote enough to argue against the presumption that the sources of all biospecimens are identifiable and cited a study showing that the risk of re-identification from a system intrusion of databases was only 0.22 percent.

19

Other commenters noted that the existing definition of human subject is sufficient because once a biospecimen becomes identifiable in research, such research is considered to involve human subjects and therefore IRB review and consent or waiver of consent would be required. They argued that the current policy works and there has been no evidence provided that it needs to be fixed.

19

Kwok P, et al. Harder Than You Think: A Case Study of Re-Identification Risk of HIPAA-Compliant Records. NORC at The University of Chicago and Office of the National Coordinator for Health Information Technology. 2011. Retrieved from

http://www.amstat.org/meetings/jsm/2011/onlineprogram/AbstractDetails.cfm?abstractid=302255.

The NPRM specifically asked whether the final rule should include a definition of “biospecimen” to assist the regulated community in understanding what types of activities might fall under the rule. Approximately 100 comments answered this question. A majority of these comments did not provide a suggestion for how biospecimen should be defined, but suggested that the Federal Government convene panels and solicit input from governmental and nongovernmental experts.

One university emergency medical department suggested including in this definition biological samples from human subjects which contain DNA and are being obtained for the purpose of medical analysis and provided examples of biospecimens which would fall under this definition, including excised tissue (fresh, fixed, or paraffin embedded), whole blood, urine (when hematuria is known to exist), and saliva among others. The commenter also provided examples of biospecimens which would not fit in this definition, including serum or plasma, urine (when no hematuria is known to exist), and processed tissues where the DNA has been removed as a part of the processing.

Others indicated that the definition of biospecimen used by the National Cancer Institute

20

seemed appropriate and workable for this rule.

20

NCI defines “biospecimen” as, “A quantity of tissue, blood, urine, or other human-derived material. A single biopsy may generate several biospecimens, including multiple paraffin blocks or frozen biospecimens. A biospecimen can comprise subcellular structures, cells, tissue (

e.g.,

bone, muscle, connective tissue, and skin), organs (

e.g.,

liver, bladder, heart, and kidney), blood, gametes (sperm and ova), embryos, fetal tissue, and waste (urine, feces, sweat, hair and nail clippings, shed epithelial cells, and placenta). Portions or aliquots of a biospecimen are referred to as samples (

NCI Best Practices

working definition).” Retrieved from

http://biospecimens.cancer.gov/bestpractices/got/#B

. Last modified March 16, 2016.

A majority of comments on the definition of “biospecimen” asked for explicit clarification on how certain biospecimens would be treated under the rule. Several comments asked whether microbiology biospecimens would be considered covered under the NPRM proposal. One research university requested specification that biologic material of organisms that use human biospecimens merely as a host (

e.g.,

bacteria, viruses, fungi) not be considered to involve human subjects.

The NPRM also asked whether covering only biospecimens that include nucleic acids would be a reasonable definition. A majority of those who responded to this said it would not be a good line to draw. One commenter specifically noted that the presence of nucleic acids does not guarantee re-identification.

b. Public Comments on Alternative NPRM Proposals A and B

Some of the alternative NPRM proposals were partly based on the premise that biospecimens could at some point become readily identifiable as a result of increasingly sophisticated technology. Many public commenters stated that a better approach to protecting privacy than requiring consent is to impose sanctions against investigators who aim to or do re-identify biospecimens without authorization by an IRB or other body. Such an approach, they said, would be less onerous for the entire enterprise, and if accompanied by clear guidance from funding agencies, would do more to protect privacy and guard against potential harms to subject rights and welfare.

Few commenters, approximately 20, explicitly supported Alternative A or B over the NPRM proposal or the pre-2018 rule.

The Presidential Commission for the Study of Bioethical Issues explicitly supported Alternative B, noting that it is the most forward-looking of all three proposals, using “bio-unique” data as human subjects research with a focus on the technology and its ability to identify donors using small amounts of data, as opposed to tying the definition of human subjects research to a particular kind of data.

21

Another commenter identified alternative B as the best proposal to keep pace with advances in technology (including technologies driving personalized medicine), protect research participants, respect autonomy, increase trust, and close the gap in protection in the current regulations.

21

The Commission had previously addressed related issues in its October 2012 report,

Privacy and Progress in Whole Genome Sequencing.

Washington, DC: Presidential Advisory Commission for the Study of Bioethical Issues. Retrieved from

http://bioethics.gov/sites/default/files/PrivacyProgress508_1.pdf.

Those who supported the primary NPRM proposal—to expand the definition of “human subject” to include all biospecimens—indicated that Alternatives A and B would not give individuals who wanted to control the use of their biospecimens the opportunity to do so.

Approximately 250 commenters (about 12 percent of the total comments received) said that they endorsed the pre-2018 policy, but that if the Federal Government must do something other than maintain the current definition of human subject, Alternative A would be preferable to the NPRM proposal or to Alternative B. These comments argued that Alternative A would be the least disruptive to the research enterprise, but that the pre-2018 policy would be better.

However, the majority of those commenters addressing the alternative proposals indicated that neither struck an appropriate balance among the

Belmont Report

principles. A research university concluded that both alternatives lack balance, emphasizing respect for persons with little regard for the principles of beneficence and justice.

Additional concerns about Alternative A included the fact that while limiting the expansion of the scope of activities covered by the rule to whole genome sequencing may be a reasonable line for inclusion today, that line might not be inclusive enough in the future.

Additional concerns about Alternative B included that by requiring continual re-review of technologies and databases by the federal government, there would be an “inevitable lag” between when a technology might be identified and when it would be added to the list. Thus, these commenters argued that the list might end up being useless.

c. Alternative Proposals Offered by Public Commenters

Many commenters proposed or endorsed alternatives to the NPRM proposals. Generally, these alternatives involved maintaining the existing schema, developing a system of notice and opt out, engaging in a public education campaign about how the research enterprise works, and developing penalties and sanctions for re-identification of biospecimens and information. A policy that requires notice, opt out, and public education were generally endorsed or discussed together.

The Secretary's Advisory Committee on Human Research Protections (SACHRP) offered one of the most detailed alternative proposals. SACHRP indicated that existing practices of research with biospecimens and data that have been collected for nonresearch uses (most often in the course of clinical care) should be revised to better protect subjects through greater transparency, public education about research with biospecimens, more exacting standards for protecting against dignity harms, allowing individuals to opt out, requiring IRB or institutional review and approval of specific research uses of identified biospecimens and identified data, and through strict legal consequences for re-identification of de-identified biospecimens and data that have been shared for research purposes.

SACHRP also proposed that data security protections be developed to safeguard biospecimen-associated data and identified data against unauthorized release or access, and focused review of the storage, maintenance, or secondary research use of identified biospecimens and identified data to determine whether the proposed activity is likely to be objectionable.

A professional organization of investigative pathologists urged consideration of opt-out broad consent models for nonidentified biospecimens collected in research and nonresearch settings, and suggested that this model would bring consent for the broad use of nonidentified biospecimens in line with HIPAA privacy practices, preserving the ability for an individual to decide not to participate in research efforts. This organization asserted that this option would be less burdensome and an inclusive, respectful, and functional way to promote ethically conducted biomedical research on biospecimens.

d. Public Comments on Identifiability

Approximately 40 comments were received in response to the request to comment on the definition of identifiable private information. Comments were mixed. The largest proportion of those comments (approximately 13) supported the definition in the pre-2018 rule. Others felt that the pre-2018 definition of identifiable private information was sufficient, but that additional guidance would be needed to implement it. Another group of commenters supported adopting a different identifiability standard in the final rule (such as the federal government's personally identifiable information standard, or the HIPAA identifiability standard).

Several public comments claimed that the meaning of “identifiable” with regard to information and biospecimens will change as technology advances. They indicated that the technique of whole genome sequencing altered the conversations about the identifiability of biospecimens and future technological advances using advanced computing and large databases could provide methods for easily aggregating disparate data for the purposes of identifying an individual.

Public comments received from a large professional association related to the definition of identifiable private information noted that the modifier “may be readily ascertained” that was included in the definition of identifiable private information within the definition of human subject allows for changes in scientific technology and data sharing over time since what was readily ascertainable 10 years ago has changed and will be different 10 years from now. The commenter noted that this allows IRBs and investigators to assess identifiability based on current technology, data sharing and computing capabilities, rather than comparing it to an enumerated list of identifiers or scientific technologies.

Some commenters expressed a desire for guidance to be issued on these definitions or for the definitions to be better clarified and explained in the regulatory text. Several comments specifically suggested a need for a definition of or guidance on the term “readily ascertainable.”

Approximately 10 comments endorsed replacing the Common Rule's identifiability standard with either the Federal Government's concept of personally identifiable information (PII) or HIPAA's concept of protected health information (PHI).

One academic medical center felt that the concept of PII would unnecessarily broaden the scope of the Common Rule and create a larger administrative burden due to the vagueness of the PII definition without providing substantial added protection to human subjects, and suggested replacing the term “identifiable private information” with the definition of “protected health information,” which can be found at 45 CFR 160.103.

Those who supported the use of the PII concept noted that it would harmonize other definitions of identifiability used in other Federal Government regulations. One state department of health and human services noted that adopting PII would be consistent with other confidentiality laws, policies, and industry standards that require organizations to protect the privacy and security of PII, achieving consistency across standards and helping organizations comply with the various privacy and security requirements. The commenter felt that replacing the identifiable private information standard with the concept of PII should not be overly burdensome on the research community since exemptions and waivers of informed consent would likely apply in many contexts.

A few commenters also noted that regardless of how identifiability might be defined, some concerns about group harms still were not addressed in the NPRM.

Several other commenters noted that a change to the definition of PII would not increase public trust or understanding of the system, nor would it likely clarify for investigators whether biospecimens or private information are identifiable.

A majority of the commenters noted that whatever direction the final rule takes; additional guidance will be necessary to reduce ambiguity within the regulated community.

e. Public Comments on Newborn Dried Blood Spots

Approximately 50 comments discussed how issues related to research use of residual newborn dried blood spots (DBS) were addressed by the proposal to expand the definition of human subject. Of those comments, 35 supported the idea of parental consent for research with DBS. Thirty-two comments stated that specific consent should be required for all research uses, in other words, that the exemptions and exclusion categories should not apply to research involving DBS. Those who felt that parental consent should always be required for the research use of DBS expressed the need to respect autonomy and parents' rights, and frequently conveyed a distrust of medicine and scientists. These individuals generally supported the spirit of the main NPRM

proposal, but objected to any exemptions, exclusions, and waivers of informed consent.

Fifteen comments expressed concerns that the biospecimen proposals in the NPRM would impede research involving DBS, which could negatively affect the expansion and improvement of newborn screening programs due to, among other things, a possible lack of resources for obtaining consent. In this regard, an employee of a California state health department described the health department's experience of seeking and obtaining consent for the research use of DBS. This individual noted that 52 percent of new parents were offered the opportunity to consent. Of those offered the opportunity, 90 percent said yes. This employee was thus concerned that due to staffing constraints, the majority of new parents simply would not be asked to provide consent to future research uses of DBS.

Others indicated that some kind of notice and opt-out process would be acceptable, but that as a general matter the research community would benefit from guidance on the extent to which the exemptions and exclusions apply to this type of work.

4. Response to Comments and Explanation of the Final Rule: Definition of Human Subject

The final rule does not implement the proposed expansion of the definition of “human subject” to include all biospecimens regardless of identifiability. It is clear from the comments received that the public has significant and appropriate concern about both the need for obtaining consent before using such biospecimens for research, and the potential negative impacts of implementing that proposal on the ability to conduct research. And, while it does not substantially change the definition of “identifiable private information,” the final rule includes a new process by which Common Rule departments and agencies can regularly assess the scientific and technological landscape to determine whether new developments merit reconsideration of how identifiability of either information or biospecimens is interpreted in the context of research. Because the final rule does not implement the NPRM's proposed expansion to the definition of “human subject,” it also does not implement the NPRM proposal to exclude certain research activities involving nonidentified biospecimens.

With regard to changing the definition of “human subject” to include all biospecimens, the majority of commenters who addressed this expansion opposed it for a variety of reasons, as described above. As explained in the NPRM, one of the core reasons for proposing that the rule be broadened to cover all biospecimens, regardless of identifiability, was based on the premise that continuing to allow secondary research with biospecimens collected without consent for research places the publicly funded research enterprise in an increasingly untenable position because it is not consistent with the majority of the public's wishes, which reflect legitimate autonomy interests. However, the public comments on this proposal raise sufficient questions about this premise such that we have determined that the proposal should not be adopted in this final rule.

Further, the current regulatory policy appears to sufficiently protect against the unauthorized research use of identifiable biospecimens. Under the pre-2018 rule, if an investigator funded by a Common Rule department or agency uses nonidentified biospecimens and manages to re-identify them, that investigator would then be conducting human subjects research without IRB approval, in violation of the rules. It should also be noted that the position adopted in the final rule does not eliminate any authority, separate and apart from the Common Rule, that Common Rule departments and agencies have to establish policies with additional requirements related to consent for research involving nonidentifiable biospecimens or nonidentifiable private information, or preclude them from exercising such authority.

Nonetheless, we acknowledge the need to also appropriately respect and promote autonomy interests. Any future proposals aimed at promoting autonomy should jointly evaluate the importance of the autonomy interests at issue, as well as explicitly quantify the potential negative impacts the proposal might have on the ability to conduct research, including such consequences on the representativeness of biospecimens available for research.

In the final rule, we have added requirements to the informed consent process to increase transparency so that potential subjects will have more information about how their biospecimens or private information might be used. Specifically, prospective subjects will be told that identifiers might be removed from their biospecimens or private information and used for future research, if this might be a possibility. Finally, as some public comments addressed the desire to share in any profits that might accrue as a result of research use of their biospecimens, an additional element of consent will require, as appropriate, a statement that the subject's biospecimens may be used for commercial profit and whether the subject will or will not share in this commercial profit. We believe that this increased attention to transparency in the consent process will allow individuals to make informed choices about whether they want to consent to current or future research uses of their biospecimens. A few clarifying changes are made in the final rule pertaining to the definition of “human subject” and the components within that definition, particularly referring to both information and biospecimens as key determinants of whether a human subject is involved in research.

With respect to the definition of “identifiable private information,” although the pre-2018 definition of “identifiable” did not incorporate a specific process for considering the growing volume of information being generated and shared in research (including from biospecimens), or consider how evolving technology can ease and speed the ability to re-identify information or biospecimens previously considered nonidentifiable, we appreciate that a change in that definition could have collateral implications with respect to imposing unwarranted consent requirements on activities that were not subject to the regulations. We appreciate the commenter requests for more guidance on how they should interpret the definition of identifiable private information. Thus, although the final rule only makes minor changes to the existing definition of “identifiable private information,” it sets in place a process (§ __.102(e)(7), discussed below) that will help facilitate any necessary future updates to the understanding of that term.

In the final rule the language at § __.102(e)(1)(i) relating to information obtained through intervention or interaction with an individual was adopted and modified by replacing the reference to data, as proposed in the NPRM, with a reference to information or biospecimens, and by adding the NPRM-proposed language relating to using, studying, or analyzing the information or biospecimens. The explicit reference to biospecimens in this context is intended as a mere clarification of the previous understanding of how the pre-2018 rule operated.

Likewise, the final rule adopts the NPRM-proposed language at § __.102(e)(1)(ii) relating to obtaining identifiable private information, but

modifies it by adding an explicit reference to “identifiable biospecimens.” This is also intended as a mere clarification of the previous understanding of how the pre-2018 rule operated as applied to biospecimens. Similarly, the definition of intervention has been modified to clarify that information or biospecimens might be gathered, replacing the former reference only to data. This, too, is merely a clarification of the existing understanding of that concept.

A definition of “identifiable biospecimen” has been added at § __.102(e)(6). This new definition was not added as a result of any substantive change, but rather to enable greater clarity in other provisions of these regulations in explaining when a particular provision relates to either identifiable private information alone (not including biospecimens), or identifiable biospecimens alone, or both. The pre-2018 rule's concept of “identifiable private information” had encompassed the concept of an identifiable biospecimen, whereas under the final rule that concept has been “cleaved off” from that definition and given its own definition. Note that a biospecimen is deemed to include private information (consistent with the understanding of this concept under the pre-2018 rule), so there is no need to add the adjective “private” in the definition of an “identifiable biospecimen.” In effect, once a biospecimen becomes identifiable (for example, by being tagged with the name or other information that indicates the person from whom the biospecimen was obtained), then an investigator using that biospecimen is already using something to which § __.102(e)(1)(ii) would apply. There is no need to make any additional determination about the “private” aspects of what is taking place.

In addition, the minor clarifying change in the language for the concept of “private information” that was proposed in the NPRM, namely adding the phrase “shared or,” was not adopted. It was decided that because any information that should not be shared would always meet the standard of being information that should not be made public, this change would not actually expand the amount of information that is considered private information.

Although the description of when private information is identifiable was not significantly changed, a new provision has been added at § __.102(e)(7) requiring federal departments and agencies that implement the Common Rule to regularly, upon consultation with appropriate experts, reexamine the meaning of the terms “identifiable private information,” as defined in § __.102(e)(5), and “identifiable biospecimen,” as defined in § __.102(e)(6). Such reexamination shall take place at least every 4 years. This new provision specifically requires that the federal departments and agencies implementing this policy collaborate on this process to avoid a duplication of efforts and in order to have a consistent interpretation of these terms.

This new process responds to the growing volume of information being generated and shared in research (including from biospecimens), and evolving technology that can ease and speed the ability to re-identify information or biospecimens previously considered nonidentifiable. With an increase in the number of exemptions included in this final rule, it will be important to reconsider the potential identifiability of information and biospecimens and facilitate uniform interpretation to ensure adequate privacy and security measures are in place.

Section 102(e)(7) also provides that, after conducting this process, if it is determined to be appropriate and permitted by law, Common Rule departments and agencies could alter the interpretation of identifiable private information or identifiable biospecimens, including through the use of guidance.

In addition, there will occur, also at least every 4 years and as a collaborative process among those federal departments and agencies, upon consultation with appropriate experts, an assessment as to whether there are analytic technologies and techniques that should be considered by investigators to generate identifiable private information or identifiable biospecimens. The ultimate goal is to implement the Common Rule in a way that is aligned with the evolving understanding of the concept of identifiability while protecting subjects and encouraging and facilitating valuable research.

To the extent that this process leads to a determination that particular analytic technologies or techniques, when applied to information or biospecimens that are not identified, do lead to the generation of identifiable private information or identifiable biospecimens, those technologies or techniques will be placed on a list of technologies and techniques satisfying that determination, and recommendations might accordingly be made with regard to relevant issues relating to consent and privacy and data security protections. The result may be that such technologies and techniques could therefore only be used in instances where the person has provided their consent (broad or study-specific) which meets the requirements of the Common Rule, or where an IRB has waived the requirement for consent.

Notice and the opportunity for public comment would take place before a technology or technique could be placed on this list. The expectation is that whole genome sequencing will be one of the first technologies to be evaluated to determine whether it should be placed on this list.

It is important to note that an investigator who possesses information or biospecimens to which such a technology or technique might be applied is not to be considered in possession of identifiable private information or identifiable biospecimens merely as a result of such a circumstance: that would only be true were the investigator to actually apply the technology or technique to generate identifiable private information or identifiable biospecimens.

This new provision is not being added as a result of any pre-conceived determination that there is indeed a need to change, whether by guidance or otherwise, the interpretation of “individually identifiable” as that concept is currently interpreted. Consistent with a core theme underpinning the process that led to this final rule, it would be inappropriate to expand the scope of coverage of the Common Rule with regard to activities that usually involve very little risk absent good reason to think that there is a problem that the added administrative burden will be correcting. The public comments on both the ANPRM and the NPRM do not identify a specific problem, but clarification from the regulatory agencies might be useful. Thus, apart from the consequences of placing technologies and techniques on the new list, the most significant effect of § __.102(e)(7) may be the issuance of guidance from time to time that facilitates understanding of and compliance with existing interpretations.

Finally, with regard to the use of newborn DBS, retaining the pre-2018 approach toward nonidentified biospecimens resolves many of the concerns expressed by commenters who felt that important research involving newborn screening would be halted or inhibited under the NPRM. The Newborn Screening Saves Lives Reauthorization Act of 2014 (Pub. L.

113-240) will no longer be effective following the effective date of this final rule, given that its changes applied only until changes to the Common Rule were promulgated. As a result, under the final rule, secondary research with nonidentified newborn DBS would be treated in the same way as secondary research with any other type of nonidentified biospecimen. Such research would not be considered research with human subjects under the final rule, and thus would not be subject to the rule.

E. Legally Authorized Representative (§ __.102(i))

1. Background and Pre-2018 Requirements

The Common Rule contains a definition of legally authorized representative to clarify who can consent on behalf of a prospective subject who is unable to consent to research participation on his or her own behalf. Under the pre-2018 rule, a legally authorized representative was defined as an individual or judicial or other body authorized under applicable law to consent on behalf of a prospective subject to the subject's participation in the procedure(s) involved in the research.

As there is no federal legal standard as to who, or what entity, is authorized to serve as a legally authorized representative to provide consent to a subject's research participation, the issue of who can serve as a legally authorized representative has been determined by the laws of the jurisdiction in which the research will be conducted. Within the United States, this generally means state or local law. “Applicable law” could be a state statute or regulation, case law on point, an opinion of a State Attorney General, or a combination of these.

Some states and jurisdictions have statutes, regulations, or common law that specifically address consent by someone other than the subject for participation in research. Most states and jurisdictions have no law specifically addressing the issue of consent in the research context. In these states and jurisdictions, law that addresses who is authorized to give consent on behalf of another person to specific medical procedures or generally to clinical care may be relevant if those types of procedures are the procedures involved in the research. The long-standing interpretation by OHRP has been that such laws relating to surrogate consent in the clinical context can be used for purposes of the Common Rule.

In every state, a legally authorized representative can be authorized through an advance directive or by a court through guardianship proceedings. However some states have no law specifically addressing the issue of consent by a surrogate in the research setting, and some states have no applicable statutes, regulations, or common law specifying when an individual can provide consent for another to medical treatment. In the absence of such law, it is usually the case that community or other standards (such as institutional policies) define hierarchies or identify individuals who are allowed to provide consent, for medical treatment purposes, on behalf of others who cannot consent for themselves.

SACHRP and the Presidential Commission for the Study of Bioethical Issues have raised concerns that the definition of legally authorized representative may be inappropriately hindering the conduct of research with subjects who lack capacity to consent. In the second part of its report on neuroscience and ethics,

Gray Matters: Topics at the Intersection of Neuroscience, Ethics, and Society (Volume 2),

the Commission recommended that federal regulatory agencies establish clear requirements to identify who can serve as legally authorized representatives for individuals with impaired decision-making capacity to support their responsible inclusion in research.

22

22

Presidential Commission for the Study of Bioethical Issues. Gray Matters: Topics at the Intersection of Neuroscience, Ethics, and Society (Volume 2). Washington, DC: Presidential Commission for the Study of Bioethical Issues, 2015. Retrieved from

http://bioethics.gov/sites/default/files/GrayMatter_V2_508.pdf

2. NPRM Proposal

Although the NPRM did not propose regulatory text that would change the definition of “legally authorized representative,” it requested public comment on whether we should modify the definition in light of the definition's reference to persons or entities “authorized under applicable law.”

The NPRM sought comment on whether expansion of the current definition to permit a legally authorized representative to be defined by an accepted common practice standard within a state or jurisdiction that lacks applicable state law for determining who can legally consent to clinical care would be consistent with the ethical principles underlying the Common Rule. The NPRM proposed to allow use of this alternative standard only in jurisdictions in which there is also no applicable law affirmatively authorizing a legally authorized representative to provide consent to the subject's research participation.

3. Public Comments

Approximately 60 commenters discussed the Common Rule's definition of “legally authorized representative.” A clear majority supported the goal of addressing the barrier that the regulatory definition of “legally authorized representative” poses in jurisdictions that have no applicable law affirmatively authorizing an individual to provide consent for another. Commenters also favored the suggested approach and responded that including the allowance of an accepted common practice standard would still appropriately protect subjects. About one-third of the commenters responding to this question, including disability rights organizations, advocacy organizations, and academic institutions, did not agree with the direction of the contemplated modification or whether this issue should be addressed through regulatory change.

Those supporting a modified definition generally agreed that broadening the definition to cover anyone considered acceptable to provide consent for another individual in the clinical setting would be appropriate, would represent an alignment with accepted common practice, and would bring consistency to the consent process for the jurisdictions that are silent on both who may provide consent for clinical care and who may provide consent for research. A number of commenters who supported the proposal for modification noted that state law authorizing individuals to provide consent would continue to apply.

Among the commenters who opposed the modification, several said state law provides sufficient guidance regarding the hierarchy of those who can consent for an adult incapable of consenting on his or her own behalf, and reduces the institution's liability in the event that an inappropriate person consents for the subject. A research institution recommended that we reassess this proposal and include more specific requirements and details as to the role and authority of the legally authorized representative. A disability rights organization, while recognizing that the pre-2018 standard is not acceptable, commented that the problem is not solved by incorporating broad discretion among different jurisdictions. The organization also opined that a common practice standard does not provide

sufficient guidance to assess and balance reasonable risk, considering that a legally authorized representative's consent is not equivalent to an autonomous decision by the subject. A research subject advocacy organization expressed concern that such a change would not provide sufficient oversight of investigators, who might use this standard in a way that would violate local law. Another commenter stated that certain individuals may be considered able to give consent for participation in clinical procedures for individuals unable to do so for themselves, but may not have the best interests of the individual in mind.

Commenters responded specifically to the solicitation of comment on the proposed standard of “accepted common practice” and indicated that practices for surrogate consent should be those used in clinical settings. Several commenters provided ideas for a more specific approach to interpreting the terms “accepted” and “common.” A researchers' association commented that interpretation of these terms should include standards that define hierarchies or identify individuals who may provide legally acceptable consent, for clinical purposes, on behalf of others who cannot consent for themselves. One commenter supporting the modification suggested that the terms could be defined to refer to the historically used form of governing and familial decision making within the group of subjects. A research institution commented that an IRB's careful review and documentation of who may serve as a legally authorized representative would be preferable to an accepted common practice standard, as that standard is vague. A research institution commenting in support of broadening the definition to those who are allowed to consent to clinical procedures advised that this would reduce confusion between physicians and researchers as to who can consent for whom in research situations, and suggested that the terms “accepted” and “common” should refer to the conducting institution's own policies on who can provide consent to clinical procedures.

4. Responses to Comments and Explanation of the Final Rule: Definition of Legally Authorized Representative

The definition of legally authorized representative in the final rule at § __.102(i) has been modified to address jurisdictions in which no applicable law authorizes a legally authorized representative to provide consent on behalf of a prospective research subject. In these jurisdictions, an individual recognized by institutional policy as acceptable for providing consent in the nonresearch context to the subject's participation in the procedures involved in the research, will now be considered a legally authorized representative for purposes of this rule.

The change made from the NPRM discussion that “accepted common practice” could be used to identify a legally authorized representative is in response to objections to the vagueness of these terms and the potential for confusion in implementation, which was expressed by the majority of commenters opposed to the proposal. We agree with the commenters' suggestion that an institution's own policies as to surrogate consent may be a better touchstone than “accepted common practice,” as a standard referencing institutional policy will provide additional clarity as to who may serve as a legally authorized representative at that particular institution.

The final rule also differs from the NPRM discussion in that it allows institutional policies applicable to surrogate consent in either the clinical context, or other nonresearch contexts, to authorize a legally authorized representative. We expect that implementation of this aspect of the final rule definition will in large part rely on institutional policies for determining surrogates for clinical decision making. In those instances, there is relatively little risk that this rule will have inappropriate consequences, as far more significant considerations, not related to the Common Rule, play a role in shaping and constraining an institution's policies relating to surrogate decision making in the clinical context.

However, we recognize that some studies cou

This text is long and has been trimmed here. Open the source document for the complete record.