NIH

The Notice of Proposed Rulemaking (NPRM) for Revisions to the Common Rule

Summary of Proposed Changes Relevant to Genomics Research

Questions & Answers About NPRM

Additional Resources & Events


Background

The Notice of Proposed Rulemaking (NPRM) for revisions to the Common Rule was published in the Federal Register on September 8, 2015. The proposed revisions aim to "modernize, simplify, and enhance" oversight for human subjects research in the United States to address changes in the nature of research since the original publication of the Common Rule in 1991. The NPRM follows the July 2011 Advance Notice of Proposed Rulemaking (ANPRM) and is the next step toward publication of the Final Rule. The following page aims to outline the proposed changes that will be most relevant for genomics research. . The information presented is not an official interpretation by the National Institutes of Health (NIH) or the Office of Human Research Protections (OHRP); instead, it is intended to highlight information in the NPRM that is relevant to the field and point members of the genomics community to resources that might inform their own considerations and comments to OHRP. Please see OHRP's NPRM page for more information: NPRM for Revisions to the Common Rule

The NPRM aims to achieve two primary goals: to enhance protections for research participants and to facilitate valuable research by reducing delay, burden, and ambiguity for researchers. The proposed changes to the Common Rule would:

  1. Require consent for any use of biospecimens, regardless of whether personal identifiers are attached to the biospecimens
  2. Improve informed consent practices with shorter and clearer consent forms
  3. Facilitate research through protections that are proportional to risks and review of research that reduces burden, delay, and ambiguity for investigators
  4. Increase uniformity in guidance and consistency in how protections are applied
  5. Promote privacy with new data security standards

The NPRM is open for comments through January 6, 2016. The comments will be used to revise the regulations before publication of the Final Rule. Compliance with the Final Rule will begin one year after its publication with the exception of provisions .102(e) (revised definition for 'human subject') and .114(b) (requirement for a single reviewing IRB for cooperative research), which will be given three years. Provisions that give additional flexibility and reduce burdens to researchers can be voluntarily implemented 90 days after publication of the Final Rule.

Please provide all feedback and comments about the NPRM to OHRP by the January 6th deadline. Submit comments at: Federal Policy for the Protection of Human Subjects

Top of page

Research with biospecimens and private information

The NPRM proposes to expand the definition of "human subject" to cover research with non-identified1 biospecimens. Under this expansion, informed consent would be required for any use of biospecimens, regardless of identifiability. The provision is prospective and will only apply to future research activities.

  • Broad consent for future unspecified research can be used to fulfill the requirement for informed consent. The HHS Secretary will issue a template for broad consent for the storage and maintenance of biospecimens and identifiable private information and use of these for future studies (.116(d)). This template will be issued at a later date and will be open for comments.
  • There are two proposed exemptions to facilitate secondary research with biospecimens and identifiable private information. The exemption at .104(f)(1) allows the storage and maintenance of biospecimens and identifiable private information if broad consent is obtained. The exemption at .104(f)(2) then allows the use of these stored samples for secondary research use. The exemptions apply when a broad consent template from the Secretary of HHS is used, privacy safeguards are followed, and limited IRB approval of the consent process has been obtained. Studies that intend to return results to participants would require additional review and would not fall under this exemption.
  • If a person refuses broad consent to store and maintain biospecimens or identifiable private information, a waiver of consent cannot be obtained to use this individual's samples or information (.117(c)(3)).
  • It is important to note that the treatment of de-identified (or non-identified) data under the NPRM is no different than under the current Common Rule. Research with non-identified data does not constitute human subjects research and is not covered under the regulations. This is true irrespective of the source (e.g. biospecimen or medical record). For this reason, genomic sequencing data from clinical encounters could be stripped of identifiers and used without consent (if not originally anticipated for research use). Moreover, secondary users of previously-generated genomic data could conduct research on non-identified data without the data security safeguards proposed in .105 (discussed in New privacy safeguards).
  • NIH's informed consent requirements under the GDS Policy are more stringent with regard to genomic data than those under the proposed revisions to the Common Rule. The GDS Policy expects investigators to obtain consent for genomic and phenotypic data to be used in future research and to be shared broadly, irrespective of the source of the data. The data are also expected to be de-identified. In contrast, there are no expectations outlined in the NPRM for de- (or non-) identification or broad data sharing.
  • The NPRM also lays out two alternative proposals for expanding the definition of human subject:
    •  Alternative A would expand the definition of human subject to include whole genome sequence data "or any part of the data generated as a consequence of whole genome sequencing." Under Alternative A, consent would only be required for research use of whole genome sequence data and not for all biospecimens. Unlike under the primary proposal, both de-identified and identified sequencing data would be treated as human subjects and would require consent for any uses.
    • Alternative B is narrower than the primary proposal but broader than Proposal A. This proposal would expand the definition of "human subjects" to biospecimens if the technology used to analyze the information obtained from the biospecimens renders it potentially identifiable. This information would be called "bio-unique information" and would include sequence data from "even small portions of a person's genome." Bio-unique information would also include future technologies and information that meet this definition (as identified in a Secretary's list that would be created).

For more information, see the below charts on: 1) comparison between proposals for treatment of biospecimens, 2) when an investigator must obtain informed consent for the use of biospecimens, and 3) when an investigator must obtain informed consent for the use of private information. Also see sections .102(3), .101(b)(3)(i), and .104(f) of the proposed regulation.

View in PDF
 

View in PDF

View in PDF

Top of page

Informed Consent

The proposed revisions aim to increase transparency in research through more meaningful informed consent practices. In order to accomplish this:

  • Consent forms should no longer be "unduly long documents," must provide information that a reasonable person would want to know, and should highlight the key information required by the rule (with additional information relegated to appendices).
  • Consent forms for clinical trials will be subject to a one-time posting requirement to make them available for public scrutiny at a Federal website.
  • If a person refuses broad consent to store and maintain biospecimens or identifiable private information, a waiver of consent cannot be obtained to use this individual's samples or information (.117(c)(3)).
  • The NPRM proposes required elements for broad consent for secondary research use, including some but not all of the basic elements of informed consent, plus some additional required elements (shown in chart below).

For more information, see the chart below on required consent elements for specific research and for broad consent. Also see sections .116 and .117. of the proposed regulation.

View in PDF

Top of page

New privacy safeguards

The NPRM notes the increased risk and concern about the possible disclosure of private information and the greater use of identifiable data for research studies. The NPRM proposes a requirement for institutions and investigators to implement "reasonable safeguards for protecting against risks to the security or integrity of biospecimens or identifiable private information." As stated, the safeguards apply to storage and maintenance of biospecimens and identifiable private information. The NPRM proposes three different sets of standards that researchers can choose from:

  1. A list of specific measures to be published by the HHS Secretary (when published, they will be open for public comment before finalization).
  2. The Health Insurance Portability and Accountability Act (HIPAA) privacy rules. If investigators comply with HIPAA rules, either because they are required or voluntarily adopted, they do not have to meet any additional safety standards.
  3. Compliance with the E-Government Act of 2002, the Privacy Act of 1974, and the Paperwork Reduction Act of 1995 for federal departments and agencies that conduct research.

For more information, see section .105 of the proposed regulation.

Top of page

Proportional oversight and IRB review

The proposed changes aim to better tailor review and research protections to the level of risk posed by a study to enhance protection when necessary and reduce burdens to researchers and IRBs when risk is minimal.

  • The NPRM adds a category of "excluded research" that would be excluded from the scope of regulations and would require no review because it is deemed not to be research, is inherently low risk, or has adequate protections otherwise mandated. There are 11 activities included in the exclusions. Many relate to the behavioral and social sciences (such as research that uses surveys and interviews).

View in PDF

  • The NPRM proposes new categories of exempt research that will either require no IRB review or limited IRB review. The 8 proposed exemptions can be grouped into 3 categories: 1) low-risk interventions that would not require information and biospecimen security protection, 2) research that may involve sensitive information and would require security protections, and 3) secondary research with biospecimens and identifiable private information that would require privacy safeguards and limited IRB review.
 

View in PDF

  • The NPRM proposes that exemption determinations must be documented. Institutions could use a web-based tool (to be developed) to determine whether or not a research study is exempt. Alternatively, a qualified individual from an institution (such as an IRB member) may determine whether a study is exempt.

For more information about the proposed exclusions and exemptions, see sections .101(b)(1-3) and .104 of the proposed regulation.

Top of page

Streamlining IRB review

Streamlining IRB review is accomplished in part through the new category of exclusions and the addition of new exemptions to the Common Rule. Other important proposed revisions that streamline and enhance IRB review include:

  • A mandate for the use of a single IRB for cooperative research conducted in the US (.114(b)(1)). Multiple IRBs would still be considered appropriate for research outside the U.S. given that local IRBs will have more insight into ethical issues that require consideration.
  • Granting direct authority to Common Rule departments and agencies to enforce external IRB compliance with the Common Rule (.101(a)). Currently, compliance is enforced through the institutions engaged in research rather than through external IRBs.
  • Elimination of continuing review requirements for studies that have undergone expedited review. This provision would also eliminate continuing review requirements for studies that have completed the intervention phases of their study and are now analyzing data or conducting observational follow-up (.109(f)).

For more information, see sections .114, .109(f), and .101(a) of the proposed regulation.

Top of page

Coverage of all clinical trials

Only federally-funded clinical trials are subject to the requirements of the current Common Rule. The proposed revisions would extend the Common Rule to cover all clinical trials, regardless of their funding source, if the research is conducted at a US institution that receives federal funding for non-exempt and non-excluded human subjects research.

For more information, see .101(a)(1-2) of the proposed regulation.


Footnotes

1. The term "non-identified" is used to distinguish it from the Health Insurance Portability and Accountability Act (HIPAA) term "de-identified." Non-identified biospecimens or data "have been stripped of identifiers such that an investigator cannot readily ascertain a human subject's identity" while HIPAA has specific requirements for what qualifies as de-identified.

Top of page

Last Updated: December 22, 2015