HHS Issues Final Revisions to the Common Rule – New Protections for Human Research Subjects

On January 19, 2017, the U.S. Department of Health and Human Services (HHS) and fifteen other Federal Departments and Agencies issued a final rule to update “Federal Policy for the Protection of Human Subjects,” also known as “the Common Rule,” under 45 CFR 46, Subpart A.

These long awaited regulatory changes offer more flexibility for the dynamic research environment that exists today, as compared to the biomedical and behavioral research that took place in 1974 when the rule originally was contemplated. The Common Rule was codified in 1991 in separate regulations by 15 federal departments and agencies. The Rule has not been updated since then. Research has evolved significantly in the last few decades—in scale, in lab environment, in the diversity of subject matter, and in the way data is collected, digitized and analyzed.

In September 2015, 2,100 comments were filed in response to the Notice of Proposed Rulemaking (NPRM). Several of the proposed changes published in the 2015 NPRM were revised or entirely eliminated from the final rules.

The revisions to the Common Rule are intended to enhance protections for research participants and modernize the oversight conducted of volunteer research programs by reducing the administrative and regulatory burden, specifically for low-risk research.

In its announcement of the final revisions, HHS highlighted several key elements in the new Common Rule.

For instance, the updated Common Rule will:

• Require consent forms to provide adequate information about a project’s scope, risks, and benefits, so potential research subjects can make an informed decision about whether to participate.
• Require, in many cases, that a single institutional review board (IRB) be used for multi-institutional research studies. However, there is increased flexibility (as compared to the NPRM version of the rule) in removing broad groups of studies from this requirement.
• Offer researchers, for studies involving stored identifiable data or identifiable biospecimens, “the option of relying on broad consent obtained for future research as an alternative to seeking IRB approval to waive the consent requirement. As under the current rule, researchers will still not have to obtain consent for studies on non-identified stored data or biospecimens.”
• Establish new exempt categories of research, based on the level of risk they pose to participants. For example, there is a new exemption for secondary research involving identifiable private information, so long as HIPAA rules apply.
• No longer require continued review of ongoing research studies in some instances where the review does little to protect subjects.
• Require consent forms for certain federally funded clinical trials be posted on a public website.

As noted earlier, a number of significant changes were made to the proposed rule in response to the concerns that came to light during the NPRM review process. In its announcement, HHS highlighted the following examples of proposals that were not adopted in the final rule:

• The final rule does not require that research involving non-identified biospecimens be subject to the Common Rule, nor does it demand that consent be obtained to conduct such research. HHS states that in general, “researchers can continue to use such biospecimens in the way they are currently using them.”
• The final rule does not adopt proposals (or includes revisions to proposals) that relied on tools or standards that had not yet been proposed at the time the NPRM was published. HHS offers examples of items that were not included in the final rule, including “a template to be used for broad consent forms, and a decision tool to be used for making exemption determinations.”
• The expanded policy to cover clinical trials that are not federally funded was not adopted.
• The NPRM’s proposed concept of “excluded” activities was not adopted. What were previously considered “excluded” activities are “now described as not satisfying the definition of what constitutes research under the regulations or are classified as exempt.”
• In most respects, the final rule carries on the current approach to privacy standards—it does not adopt the proposed standardized privacy safeguards for identifiable private information and identifiable biospecimens.
• The more stringent criteria for obtaining a waiver of the consent requirements for identifiable biospecimens was not adopted.

HHS touts this modernized Common Rule as a reaffirmation of the federal government’s commitment to protect research participants. However, some argue that the final rule reduces the protections consumers would have had under the proposed rule set out in 2015. Others are still skeptical that the new regulations, which passed just days before the Administration change, will be implemented. It is still too early to tell. Regardless, entities that are affected by the changes to the Common Rule should review their practices for compliance with the new requirements, and identify how the rule interacts with other areas of regulation, including HIPAA requirements.