Changes to the Federal Common Rule — what you need to know

The year 2018 is finally upon us, and many expectant privacy professionals have their eyes trained towards May — when the General Data Protection Regulation goes into effect. However, 2018 also brings some other regulatory changes, and here in the U.S. many researchers and institutions are chiefly concerned with the updates to the Federal Common Rule, which will become effective Jan. 19.

The Common Rule was initially proffered in 1981 and established for the purpose of protecting human subjects involved in research. It applies any time human subjects research is conducted using federal funding; therefore, federal agencies, academic institutions, and health care research institutes are among the top qualifying institutions. Included in the updates to the Common Rule, frequently referred to as the "Final Rule," are new requirements for informed consent, the delineation of several new and expanded exempt categories of research, the creation of a new classification of “broad consent,” the introduction of limited Institutional Review Board review, the discontinuation of “continuing review,” and an update to the description of vulnerable populations, in addition to other changes.

New requirements for informed consent

One of the more notable changes in the regulation is the introduction of a requirement that informed consent forms must now begin with a concise summary of the information detailed within the consent form. The regulation requires this statement be a focused presentation with a level of detail that provides what a reasonable person would want to know. 

New exempt categories

The Final Rule makes significant changes to the categories of research that are exempt from the reach of the Common Rule. One category has been deleted (“Educational tests, survey and interview procedures, or observation of public behavior in public officials”); two existing categories have been expanded to allow collection of sensitive identifiable information with limited IRB review (“Normal educational practices in commonly accepted settings” and “Educational tests, surveys, interviews, observation of public behavior”); and three new categories have been added (“Benign behavioral interventions with adults,” “Storage or maintenance of identifiable private information or identifiable biospecimens for secondary research” and “Research involving use of identifiable private information or identifiable biospecimens stored pursuant to a broad consent”).

Each exemption is nuanced and many set limitations depending on whether or not data is identifiable, whether children can be enrolled, and whether or not the research involves an intervention.

The new exempt Category 3 includes benign behavioral interventions with adults.  This provides researchers who are studying interventions that are brief, harmless, painless, not invasive, and not offensive or embarrassing to subjects an easier review pathway.  Such interventions may include having adults complete computer tasks, seeing how environmental factors such as noise may impact memory, or randomizing subjects to complete different types of puzzles or coloring activities to see which reduces stress more.

Additionally, exempt Category 4 now includes secondary research for which consent is not required using identifiable data/biospecimens collected as part of clinical care or an IRB-approved study, if at least one of the following criteria is met: (1) the identifiable private information or identifiable biospecimens are publicly available; (2) the information is recorded by the investigator in such a manner that the identity of the human subjects cannot readily be ascertained directly or through identifiers linked to the subjects, the investigator does not contact the subjects, and the investigator will not re-identify subjects; (3) identifiable information is collected but the research is regulated under HIPAA, or (4) the research is conducted by a federal department or agency for nonresearch activities and is subject to the E-Government Act of 2002. Relevant for many health carecare research institutions, this third qualification for exemption under Category 4 creates a carve out for covered entities; where data is subject to HIPAA, it is now exempted from the Common Rule. This modification is aimed at ending the “unduly burdensome and confusing” duplicative compliance efforts by institutions with data subject to both health care regulations. Further, this exemption allows the reuse of identifiable information that is collected for purposes other than the primary purpose; for example, during clinical care. It also expands the previous exempt Category 4 to allow for prospective data collection instead of limiting it to existing data. For many institutions this means that chart review studies which were previously subject to the reach of the Common Rule can be exempt under the new regulations which allows more flexibility and shorter submissions for this common category of research.

For deeper understanding of any individual exemption categories, qualifying institutions and departments should seek clarification from their IRB or relevant administrator.

Limited IRB review

The Final Rule allows more research to qualify for exempt review where the primary risk is breach of privacy and confidentiality. To maintain protections for subjects, certain exempt categories now require limited IRB review which includes an IRB determination that, when appropriate, adequate provisions are in place to protect the privacy of subjects and the confidentiality of data.  This is the same IRB approval criteria related to privacy and confidentiality that is required for nonexempt human subjects research.  This review has to be done by the IRB Chair or an experienced IRB Committee member.  Exempt submissions which require limited IRB review can no longer be done as an administrative action by IRB staff who are not Committee members. 

“Broad consent”

The Final Rule introduces the new concept of Broad Consent to allows institutions to seek prospective consent for unspecified future research from a subject for the storage, maintenance, and secondary research use of identifiable private information and identifiable biospecimens.

This concept codifies a pathway for researchers to store and continue to re-use identifiable data and specimens. Although the premise of an HHS-authored Broad Consent template was discussed in the comments to the Advance Notice of Proposed Rulemaking, no template is offered at this time; instead, institutions are allowed the flexibility to create and customize their own consent forms, assuming they satisfy the requirements.

In many ways, Broad Consent could be perceived as a step forward for patients’ rights because of the increased focus and guidance that the concept brings, as well as the new and more powerful ability of a patient to limit the use of their information and specimens. At the same time, Broad Consent presents additional tracking and controls requirements for institutions, as well as newfound limitations on IRB permissions.  If a subject declines Broad Consent, the IRB is not permitted to allow use of their data or specimens under a waiver of consent.  Additionally, Broad Consent for use of pediatric data and samples only applies until a subject turns 18 at which point the subject, rather than a parent or legally authorized representative, would need to provide Broad Consent for continued use of their data or specimens. Implementing Broad Consent would take an institution-wide commitment to put into place infrastructure for the labeling of data and specimens as well as a complex tracking system.

Discontinuation of “continuing review”

One of the most appealing changes for researchers is that the Final Rule discontinues the requirement for continuing review for minimal risk studies, an establishment which required IRB oversight on an annual basis. Under the new Rule, continuing review is no longer required for non-FDA regulated research if the research is (1) minimal risk or (2) greater than minimal risk but the remaining procedures are minimal risk and limited to long-term follow-up or data analysis. The IRB may still require continuing review on a case-by-case basis, but if doing so must provide documentation of why continuing review was required for a specific study. This change will decrease the administrative burden on researchers conducting minimal risk research. However with less IRB oversight, more responsibility lies with the researchers to ensure the research is conducted in accordance with the regulations. 

Vulnerable populations

Additionally, the Final Rule makes adjustments to the definition of “vulnerable populations” in an attempt to better align the definition with populations vulnerable to coercion or undue influence, specifically in regards to the ability to make an informed decisions about participating in research. For that reason, pregnant women and those individuals who are physically handicapped or disabled are no longer included in the definition of vulnerable populations. The Final Rule also adopts the term “individuals with impaired decision making ability” to replace “mentally disabled persons.”

These changes, and the many others not touched on here, seek to bring the Common Rule into the 21st century. Reduced burdens on IRBs, and a reduction in overlap with other competing regulations, are welcome changes. Many suggestions appearing in the comments to the Final Rule indicate that additional changes are desirable; potentially imminent. For now, institutions prepare to adjust to these manyfold updates with a view to seeing how the new regulations will play out.