Bringing the Common Rule into the 21st Century

On September 8, 2015, the Department of Health and Human Services (HHS) and 15 other federal departments and agencies issued a proposal to revise the regulations governing the ethical conduct of research involving humans.¹ The current regulations were adopted by HHS in 1981 to implement the landmark 1979 Belmont Report. Adopted by other agencies throughout government in 1991, the regulations, informally known as the Common Rule, have changed little since their inception, while the research landscape has changed radically.

In addition to revolutionary advances in scientific knowledge and technologies, society has undergone tremendous shifts in recent decades that are highly relevant to the conduct of research. Today’s studies are more likely to include multiple research sites and large numbers of participants. Research is moving toward a more participatory model, as volunteers increasingly expect to be partners in research — as exemplified by such studies as the President’s Precision Medicine Initiative (www.nih.gov/precisionmedicine). Sharing data and biospecimens can accelerate discoveries, and increasingly sophisticated information can be obtained from biospecimens. The controversy that followed the 2013 publication of the genome sequence of the HeLa cell line (derived from tumor cells from Henrietta Lacks) underscores the need for greater involvement of and respect for research participants.²

The two central goals of the proposed revisions to the Common Rule are to enhance respect and safeguards for research participants and to increase research efficiency by reducing unnecessary burdens and calibrating oversight to the level of risk. If they are ultimately adopted, the key changes will require consent for research involving biospecimens, allow participants to grant broad consent for future use of data and biospecimens, strengthen privacy and security safeguards to prevent unauthorized disclosure and use of data and biospecimens, streamline institutional review board (IRB) operations by requiring reliance on a single IRB for multisite studies conducted in the United States, and exclude some nonresearch activities and low-risk research from the rule, while exempting other low-risk research from certain requirements (see Table 1). The proposals reflect careful consideration of the public comments on proposals published in 2011³ and a deeper understanding of participants’ preferences and risks⁴ that has been developed over the past 4 years.

Table 1.

Major Proposed Changes in the Common Rule Notice of Proposed Rulemaking (NPRM).^*

Objective	Current Common Rule	NPRM
Enhancing respect, strengthening informed consent	Does not apply to research with deidentified specimens	Requires consent for all biospecimens, with a few exceptions
	Generally does not allow broad consent	Allows broad consent for future research use of biospecimens and data
	Provides basic elements of informed consent	Adds new elements of informed consent; streamlines consent forms to required elements
Enhancing safe-guards	Requires IRBs to ensure confidentiality but provides no specific measures	Specifies privacy and security safeguards for research involving biospecimens and identifiable information
Streamlining review	Allows use of single or local IRBs for multisite studies	Requires use of single IRB for multisite studies in the United States, unless otherwise required by law
	Allows expedited review of minimal-risk research	Requires justification for continuing review of studies eligible for expedited review
	Defines minimal risk	Guidance will be published on determining minimal-risk research
	Requires IRB review of grant or contract proposals	Does not require IRB review of grant or contract proposals
Calibrating oversight	Does not apply to research not funded by Common Rule agencies	Extends rule to unregulated, privately funded clinical trials conducted at institutions funded for human subjects research
	Exempts certain types of low-risk research but does not list examples of exemptions for nonresearch activities	Sets out excluded activities; clarifies entirely exempt activities and creates new category of partially exempt categories

^*This table provides an overview of the major changes; it is not comprehensive. IRB denotes institutional review board. The following agencies have signed on to the NPRM for the Common Rule: Department of Homeland Security, Department of Agriculture, Department of Energy, National Aeronautics and Space Administration, Department of Commerce, Social Security Administration, Agency for International Development, Department of Justice, Department of Labor, Department of Defense, Department of Education, Department of Veterans Affairs, Environmental Protection Agency, Department of Health and Human Services, National Science Foundation, Department of Transportation, and Department of Housing and Urban Development.

One of the most significant changes will be requiring consent for the use of all biospecimens in research, whether or not they are deidentified (see Table 2). A growing body of literature indicates that prospective research participants want to decide whether their biospecimens are used in research; they want researchers to ask their permission — it is the respectful thing to do. Moreover, given the available tools and technologies, we know that biospecimens can be used to generate information unique to individuals and therefore cannot be truly de-identified⁴; there is thus an ethical obligation to seek permission and inform participants of risks to their privacy. The proposed change allows consent to be broad, enabling participants to grant permission for researchers to use their biospecimens and data for all kinds of downstream research questions.

Table 2.

Major Changes to Requirements by Research Type.^*

Research Type	Current Common Rule	NPRM
Quality-assurance or quality-improvement activities involving accepted practices	Unclear	Excluded if for the implementation of accepted practices
Public health surveillance	Unclear	Excluded
Research with electronic health records and Medicare claims data	Covered	Excluded if regulated by the HIPAA privacy rule
Research with nonidentifiable biospecimens	Not covered	Generally exempt if collected with broad consent, limited IRB review, privacy safeguards
Research with identifiable biospecimens	Covered	Exempt if collected with broad consent, limited IRB review, privacy safeguards
Research with deidentified or publicly available information collected for nonresearch purposes	Exempt	Excluded
Research involving collection of identifiable information through surveys, interviews, or observations of public behavior	Covered	Exempt with privacy safeguards
Research collection of nonidentifiable, nonsensitive information through surveys, interviews, or observations of public behavior	Exempt	Excluded
Research involving benign interventions and collection of nonidentifiable data	Covered	Exempt
Research involving benign interventions and collection of nonsensitive identifiable data	Covered	Exempt
Secondary research with identifiable, sensitive information collected for nonresearch purposes	Covered	Exempt if prior notice was given and with privacy safeguards
Unregulated privately funded clinical trials conducted at institutions receiving covered funding for human subjects research	Not covered	Covered if not regulated by the Food and Drug Administration
Multisite research	Reliance on single IRB allowed	Reliance on single IRB required when carried out at U.S. sites, unless local IRB review is otherwise required by law

^*This table provides an overview of the major changes; it is not comprehensive.

HIPAA denotes Health Insurance Portability and Accountability Act, and IRB institutional review board.

No doubt, requiring consent for the use of deidentified bio-specimens and allowing broad consent will pose challenges for the research community. But the proposed rule allows continued use of deidentified biospecimens collected in the past, and the new policy will be phased in over 3 years. In the beginning, there will be additional costs and effort needed to make the consent process work and to track the consent status of stored biospecimens. Enormous benefits, however, will be realized as biospecimens become more available for secondary research.

The Common Rule proposal also tackles some long-standing complaints about informed-consent documents — namely, that they are too long, too complicated, and filled with legal text designed more to protect institutions than participants. Under the proposal, the content of these forms will be limited to specific elements outlined in the rule, with nonessential information moved into a separate appendix. Furthermore, the proposed regulations strengthen privacy and security safeguards for all research involving biospecimens or identifiable information, as well as for certain research that may be exempt from other provisions of the rule. The proposal brings under the Common Rule umbrella currently unregulated clinical trials (e.g., trials of surgical procedures that do not involve devices regulated by the Food and Drug Administration [FDA] and are not funded by one of the Common Rule agencies), if they are conducted in the United States at institutions that receive human-subjects research funding from a Common Rule agency. This extension of the rule will not apply to clinical trials that are subject to regulation by the FDA or that are conducted at institutions that receive funding only for exempt research.

Multisite research now accounts for nearly half the studies funded by the National Institutes of Health (NIH). The proposal addresses inefficiencies created by the current process of redundant IRB review of multisite studies, by requiring participating U.S. institutions to rely on a single IRB of record, unless local IRB review is required by law or the federal department or agency supporting or conducting the research determines that use of a single IRB is not appropriate for the particular study. This change will help speed the initiation of research and save considerable resources.⁵ One concern that institutions have expressed regarding relying on single IRBs is uncertainty over whether an outside IRB or the institution would be held responsible for regulatory violations by the IRB, and the proposal addresses this concern by establishing that the IRB of record, rather than the institution relying on the IRB, will be held responsible for any IRB regulatory violations.

Several other changes will, collectively, reduce the burden on IRBs, allowing them to focus on higher-risk research. Continuing IRB review will be eliminated for studies that qualify for expedited IRB review and for most studies that have completed the interventional stages and involve only data analysis, unless on initial review it was determined that continuing review was appropriate. In addition, publication of a list of activities considered to pose minimal risk will reduce the burden on IRBs in making minimal-risk determinations. Finally, IRBs will no longer be required to review grant applications or contract proposals.

Another set of proposed changes aims to match the level of oversight to the level of risk the research poses to participants, by defining categories of research that are excluded from the Common Rule or are exempt from one or more of its requirements (e.g., IRB review). The excluded categories are activities that are deemed not to meet the rule’s definition of research (such as public health surveillance and some quality-assurance activities), to be very low-risk social science research (such as surveys, focus groups, and interviews), or to be subject to other rules with appropriate requirements (such as research involving medical records and Medicare claims data that is subject to the privacy rule of the Health Insurance Portability and Accountability Act).

Determinations of whether specific research proposals are exempt from the rule can be made with a Web-based decision tool. For example, one category of research that will be exempt from nearly all requirements includes certain types of studies involving standard educational practices, public program evaluations, or benign interventions (such as interactions that are temporary and painless with no lasting negative effects). Another category includes certain uses of sensitive information from which individuals are identifiable, if proper privacy and security safeguards are in place. Establishment of biospecimen and data repositories will be exempted from full IRB review if initial broad consent has been obtained, safeguards are in place, and to ensure that both these requirements are met, a limited IRB review is conducted. Secondary research using these repositories will be required only to have safeguards in place, and no IRB review will be necessary.

These long-overdue reforms will bring the Common Rule into the 21st century. They should help the scientific community take a giant leap forward in showing respect for research participants, without whom the biomedical research enterprise would cease to exist. Just as the Lacks family’s experience helped clarify how research needed to change, the perspectives of researchers, the public, and patients should be heard as these reforms are finalized. The NIH urges all stakeholders to closely review the proposed changes and participate in the comment process by the deadline of December 7, 2015.

Editor’s note: HHS has extended the comment period by 30 days, to January 6, 2016.