The Final Common Rule: Much Either Retained or Removed, But Not Much New Added

On January 18, 2017, the U.S. Department of Health and Human Services along with 15 other federal agencies issued the Final Rule to revise the Federal Policy for the Protection of Human Subjects, known as the “Common Rule.”  This 1991 set of regulations created a uniform set of human subject protections which are codified in each department or agency’s title or chapter of the Code of Federal Regulations (CFR) based on HHS’ regulations at 45 CFR part 45, subpart A.

This announcement comes just a little over a year since the public comment period ended for the proposed rule, which posed a number of questions to stakeholders and generated over 2,100 comments (see our coverage of the NPRM here).  As a result of these comments, HHS and the other federal agencies made a number of significant changes from the proposed rule.  This blog post will explore some of the most significant changes from the NRPM.

While FDA-regulated research is not subject to the Final Rule, the NPRM received a large number of comments about harmonization and had input from FDA, in addition to longstanding efforts between HHS and FDA to achieve harmonization. The preamble to the Final Rule discusses the link between the Common Rule and FDA regulations, noting that the 21st Century Cures Act (“Cures Act”), enacted December 2016, “requires that the Secretary of HHS, to the extent practicable and consistent with other statutory provisions, harmonize the differences between 45 CFR part 46, subpart A, and FDA’s human subject regulations.”  For example, it directs FDA to allow multisite and cooperative research projects to use single IRB review, which is consistent with HHS’s policy under the Final Rule.  In addition, another provision of the Cures Act amends the Federal Food, Drug, and Cosmetic Act to alter the informed consent requirements for both drugs and medical devices such that a waiver of informed consent may now be granted for “proposed clinical testing [that] poses no more than minimal risk to…human beings and includes appropriate safeguards…” so that it is more aligned with how minimal risk is handled under the Common Rule.  The consideration of public comments to the Common Rule NPRM, and changes made in the last year between the NPRM and the Final Rule, may reflect the direction of harmonization as we move toward a potential “reopening” of FDA’s regulations under the Cures Act.

Regulating Research Use of Biospecimens

The NPRM proposed to revise the definition of “human subject” to include research in which an investigator obtains, uses, studies or analyzes biospecimens, regardless of identifiability. This would have required informed consent for research involving biospecimens in most circumstances (e.g., unless an IRB determined strict waiver requirements were met).  Such consent would have been able to be obtained through “broad consent” for future unspecified research.  This proposal received intensive public comment about the need for obtaining consent before using such biospecimens for research, and the potential negative impacts of implementing that proposal on the ability to conduct research.  Therefore, the Final Rule does not include this proposal, maintaining the current practice with respect to oversight of these biospecimens.  Instead, the Final Rule includes added requirements to the informed consent process to increase transparency so that potential subjects will have more information about how their biospecimens or private information may be used (e.g., that identifiers might be removed and used for future research, that the biospecimens might be used for commercial profit).

For studies on stored identifiable data or identifiable biospecimens, researchers will have the option of relying on broad consent obtained for future research as an alternative to seeking IRB approval to waive the consent requirement. Researchers will still not have to obtain consent for studies on non-identified stored data or biospecimens.

Recalibrating the Review Process: Exemptions But Not Exclusions

The NPRM proposed creating an “exclusions” section and adding new “exemptions” that would specify activities that would be outside the scope of the Common Rule that would make the level of review more proportional to the seriousness of the harm or danger to be avoided, with some activities being not subject to any level or review.

Due to public comments expressing concerns with an added layer of unnecessary complexity (e.g., the overlapping categories of exclusions and exemptions) and the lack of requirements on who would decide whether an activity met the criteria for an exclusion, the Final Rule did not adopt the NPRM’s general approach that would have added an “exclusions” section. Instead, the Final Rule reverts to the general structure of the pre-2018 rule and integrates some categories proposed for exclusion in the NPRM into that structure.  Certain categories of activities (that were proposed as exclusions in the NPRM) were removed from the definition of research in the Final Rule: (a) scholarly and journalistic activities, (b) public health surveillance activities, (c) criminal justice activities, and (d) authorized operational activities in support of national security missions.  In addition, four categories of activities that were determined to be low-risk and already subject to independent controls were incorporated into the Final Rule.

The addition of new “exemptions” of research based on the level of risk they pose to participants was retained in the Final Rule, largely for categories of social and behavioral research. For example, to reduce unnecessary regulatory burden and allow IRBs to focus their attention on higher risk studies, there is a new exemption for secondary research involving identifiable private information if the research is regulated by and participants protected under the HIPAA rules.

Changes to IRB Operational Requirements

The NPRM proposed a number of changes to the criteria for IRB approval of research, as well as IRB operations, functions, and membership, that were retained in the Final Rule, including:

• To have IRBs consider the equitable selection of subjects focus on issues related to coercion or undue influence in research with vulnerable populations;
• Inclusion of special considerations related to the involvement of vulnerable populations;
• Removal of the requirement to conduct continuing review of ongoing research studies in certain instances where such review does little to protect subjects.

Mandating Single IRBs

The Final Rule adopts the NPRM proposal of mandating that all institutions located in the United States engaged in cooperative research rely on a single IRB for that study, with some exceptions (e.g., where more than single IRB review is required by law, such as FDA-regulated medical devices). However, public comments recommended a greater role should be provided for grantee input on choosing the IRB of record, so the Final Rule includes modified language that allows lead institutions to propose the reviewing IRB.

Reforming the Informed Consent Process

Although the regulatory language is structured differently in the Final Rule, it largely contains the major revisions to the requirements for informed consent proposed in the NPRM, including:

• All the proposals to improve and clarify the general requirements of informed consent;
• That prospective subjects and legally authorized representatives must be provided with key information that is most likely to assist a prospective subject or legally authorized representative in making a decision about participating in research, and to provide an opportunity to discuss that information;
• The proposal to inform potential subjects about the possible use of their identifiable private information and the potential for commercial profit (as described above);
• Additional elements of consent: (a) a statement regarding whether clinically relevant research results, including individual research results, will be disclosed to subjects and, if so, under what conditions; and (b) which was not in the NPRM: when appropriate for research involving biospecimens, subjects be informed of whether the research will (if known) or might include whole genome sequencing;
• An option to obtain broad consent for storage, maintenance, and secondary research use of identifiable private information or identifiable biospecimens (although such consent is not required for non-identifiable secondary research use as it was under the NPRM as discussed above), however the Final Rule does not include broad consent templates to be established by HHS;
• The language proposed providing that if an individual was asked to consent to the storage or maintenance for secondary research use of identifiable private information or identifiable biospecimens in accordance with the broad consent provisions and such individual refused to consent, the IRB would be prohibited from waiving consent of such biospecimens or information;
• Waiver criterion mandating that for research involving access to or use of identifiable private information or identifiable biospecimens, the requirements of of informed can be waived or altered only if the research could not be practicably carried out without using such information or biospecimens in an identifiable format;
• The provision that would authorize an IRB to approve a research proposal in which investigators obtain identifiable private information without individuals’ informed consent for the purpose of screening, recruiting, or determining the eligibility of prospective human subjects of research (but without a requirement that investigators adhere to the NPRM’s proposed privacy safeguards, since they were not included in the Final Rule); and
• The provision that would require that a copy of the final version of the consent form (absent any signatures) for each clinical trial conducted or supported by a Common Rule department or agency be posted on a publicly available Federal website that will be established a repository for such consent forms.

Diverging from the NRPM, the Final Rule includes an approach that emphasizes efforts to foster understanding overall rather than imposing specific length limitations on the entire consent forms. In addition, the Final Rule does not adopt a requirement that certain information be included only in appendices; will the same goal of facilitating comprehension, the Final Rule instead establishes a “beginning section” to the informed consent document.

The Scope of the Regulations Not Extended

The Final Rule does not extend the Common Rule to cover clinical trials that are not federally funded, as was proposed in the NPRM.

Effective Date and General Compliance Date

The Final Rule adopts an effective date and general compliance date of 1 year from the publication of the Final Rule, which would be on January 19, 2018. As such, ongoing research studies that were initially approved by an IRB, waived, or determined to be exempt before this date will not be required to comply with the changes in the Final Rule.  However, the Final Rule allows institutions to voluntarily comply with the Final Rule on a study-by-study basis.  The single IRB requirement for cooperative research (discussed above) adopts a separate 3-year compliance date for this requirement to allow institutions sufficient time to develop institutional policies and procedures to implement this requirement.