Highlights of Revisions to the Common Rule

Compliance with the new rules will begin one year after publication of the Final Rule, on January 19, 2018. Compliance with section .114(b), which mandates the use of a single IRB for cooperative (or multisite) research will begin after 3 years, on January 20, 2020. Ongoing research studies that were approved, waived, or determined exempt by an IRB before January 19, 2018 do not need to comply with the Final Rule. Institutions may, however, choose to comply with the new requirements for such ongoing research studies after the effective date.

The changes to the Common Rule aim to improve informed consent practices with more meaningful consent forms. They will also facilitate research with protections that are proportional to risks as well as research review processes that reduce burden, delay, and ambiguity for investigators. It is notable that the Final Rule is significantly less complex than the NPRM, in large part in response to public comments decrying its complexity as well as due to removal of the proposed biospecimens provisions in the NPRM.

A number of provisions in the Final Rule have as-yet unknown implications for the field of genomics. This includes an upcoming assessment of what technologies may render data identifiable, with 'whole genome sequencing' (WGS) first on the list of technologies to be evaluated.

Biospecimens (.102(e)(i,ii))

The NPRM proposed to expand the definition of "human subject" to cover research with non-identified biospecimens. Under this expansion, informed consent would have been required for any use of biospecimens, regardless of identifiability. Almost 50 percent of those who commented on the NPRM made comments on this proposal, and about 80 percent of them were opposed to this requirement. This proposal was not adopted, and consistent with current regulations, biospecimens can be deidentified and used for secondary research without additional consent.

Although the provisions to require consent (and more specifically, broad consent) for the secondary use of biospecimens were not adopted, other provisions relevant to the use of biospecimens were adopted. The Final Rule requires the Common Rule departments and agencies to re-examine the definition of the terms "identifiable private information" and "identifiable biospecimen." It also requires them to assess whether there are "analytic technologies and techniques that should be considered by investigators to generate identifiable private information or identifiable biospecimens." The departments and agencies will then create a list of these technologies along with recommendations on consent, privacy, and data protections that will go through a public comment process. The agencies and departments must do this at least every four years, beginning in one year.

The preamble to the rule specifically notes that whole genome sequencing is expected to be one of the first technologies to be evaluated to determine if it should be on this list. The rule defines WGS as "the sequencing of a human germline or somatic specimen with the intent to generate the genome or exome sequence of that specimen." 

Informed Consent (.116)

The revisions aim to increase transparency in research through more meaningful informed consent practices. Forms must begin with a concise and focused presentation of the key information that is most likely to assist a prospective subject in understanding the reasons why one might or might not want to participate in the research. The Final Rule also requires new elements of informed consent, including one new basic element and three new additional elements (to be used as applicable).

The new basic element requires a statement describing whether or not identifiers will be removed from information/biospecimens and used in future research without additional consent

The new additional elements include:

• A statement of whether biospecimens may be used for commercial profit and whether subjects will share in the profit.
• A statement about whether results will be disclosed to participants.
• A statement to inform participants if their biospecimens will undergo WGS.

Lastly, consent forms for clinical trials will be subject to a one-time posting requirement to make them available on a federal website.

Broad Consent (.116(d))

The Final Rule maintains a provision that allows the use of broad consent for the secondary research use of identifiable private information and identifiable biospecimens. Unlike in the NPRM, which would have required broad consent for any secondary research with biospecimens or identifiable private information, investigators have other ways of conducting this secondary research. As under the current regulations, they may conduct their research on deidentified biospecimens and information, obtain a waiver of consent from an IRB, or obtain specific consent.

The Final Rule also maintains exemptions for the use of broad consent for 1) the storage or maintenance of identifiable biospecimens or identifiable private information for secondary research use and 2) the secondary research use of identifiable biospecimens or identifiable private information. These exemptions allow for limited IRB review of these activities. This limited IRB review includes determinations that broad consent will be/was obtained properly, that adequate protections are in place for safeguarding the privacy and confidentiality of participants, and (for secondary studies) that individual research results will not be returned to participants.

The Final Rule provides a list of twelve elements that, when applicable, should be included in a broad consent form, in addition to some general consent requirements. Among other requirements, a broad consent should include a description with enough information for a 'reasonable person' to expect the types of research that may be conducted with their samples or information. It must also disclose that participants may not have chosen to consent to some of the research studies that might be carried out (if participants will not be informed of the specific studies). If a person refuses broad consent to store and maintain biospecimens or identifiable private information, a waiver of consent cannot be obtained to use this individual's samples or information.

Proportional Oversight and IRB Review (.102(l), .104)

Many changes to the Common Rule are designed to better tailor review and research protections to the level of risk posed by a study to enhance protection when necessary and reduce burdens to researchers and IRBs when risk is minimal. In the Final Rule, this is accomplished through new exemptions and the exclusion of some activities from the definition of research.

Four proposed exclusions from the NPRM were adopted into the Final Rule by removing the activities from the definition of research, including:

• Scholarly and journalistic activities that focus directly on the specific individuals from whom the information is collected.
• Public health surveillance activities that are necessary to allow a public health authority to "identify, monitor, assess, or investigate potential public health signals, onset of disease outbreaks, or conditions of public health importance."
• Collection and analysis of information or biospecimens required by or for a criminal justice agency for criminal justice purposes.
• Activities in support of intelligence, homeland security, defense, or other national security missions.

The Final Rule also includes eight exemptions, with three related to the secondary use of identifiable biospecimens and information, four on "research involving normal educational practices, research involving benign behavioral interventions, research involving public benefit or service programs, and research involving taste and food quality," and one related to secondary research that does not require consent. Unlike under the Common Rule, some exempt research is still subject to some review and requirements, such as limited IRB review and the use of broad consent.

Additional Provisions to Streamline IRB Review

Streamlining IRB review is accomplished in part through the removal of certain activities from the definition of research and the addition of new exemptions to the Common Rule. Other important revisions that streamline IRB review include:

• A mandate for the use of a single IRB for cooperative research conducted in the US. Multiple IRBs are still considered appropriate for research outside the U.S. given that local IRBs will have more insight into ethical issues that require consideration (.114).
• Enforced compliance of the Common Rule against unaffiliated IRBs, e.g. independent IRBs, such as Western IRB (.101(a)).
• Elimination of continuing review requirements for studies that have undergone expedited review. This provision also eliminates continuing review requirements for studies that have completed the intervention phases of their study and are now analyzing data or conducting observational follow-up (.109(f)).

Tribal Sovereignty (.101(f))

The policy, as before, does not affect state or local laws and regulations that provide additional protections for participants in research. Unlike before, the policy specifically notes that this includes "tribal law passed by the official governing body of an American Indian or Alaska Native tribe." In general, many parts of the Final Rule have been clarified to emphasize the sovereignty of tribal laws and regulations to add additional protections. For example, if a tribal government requires review by more than one IRB for multi-site research, the single IRB requirements do not apply.

Research with Biospecimens

As noted above, the NPRM proposed to expand the definition of "human subject" to cover research with non-identified biospecimens and require consent for the use of any biospecimen, regardless of identifiability.

The NPRM also laid out two alternative proposals for expanding the definition of "human subject." Alternative A proposed to expand the definition of human subject to include whole genome sequencing "or any part of the data generated as a consequence of whole genome sequencing." Alternative B would have expanded the definition to include any potentially identifiable "bio-unique" information, as determined by a list compiled by the HHS Secretary. 

These proposals were not adopted, but new requirements (outlined above) for departments and agencies to assess questions on the identifiability of data generated from certain technologies (including WGS) were adopted and look similar in some ways to these alternative proposals.

Research Excluded from the Common Rule

The NPRM proposed a new category of 'excluded' research. The proposed categories of excluded research have either been removed from the definition of research, included as exemption categories, or taken out of the rule entirely.

Coverage of All Clinical Trials

Only federally-funded clinical trials are subject to the requirements of the current Common Rule. The NPRM proposed to extend the Common Rule to cover all clinical trials, regardless of funding source, if the research was conducted at a US institution that receives federal funding for non-exempt human subjects research. This proposal was not adopted, and as under the current regulations, only federally-funded clinical trials are subject to the Common Rule.

Standards and Tools

The NPRM proposed a number of additional not-yet-created standards and tools that would have later been posted for public comment. Commenters to the NPRM noted that it was difficult to say whether the proposals should be included in the Final Rule without first being able to see them. Therefore, these proposals were not adopted, but the preamble to the Final Rule indicates that they may be included in future guidance that will go out for public comment. This includes standards for data security, an exemption tool that would allow investigators to make exemption determinations about their own research, and a broad consent template.

[1] The term "non-identified" was used to distinguish it from the HIPAA term "de-identified." Non-identified biospecimens or data "have been stripped of identifiers such that an investigator cannot readily ascertain a human subject's identity" while HIPAA has specific requirements for what qualifies as de-identified.

[2] According to the Final Rule, a clinical trial "means a research study in which one or more human subjects are prospectively assigned to one or more interventions (which may include placebo or other control) to evaluate the effects of the interventions on biomedical or behavioral health-related outcomes." This aligns with NIH's definition for a Clinical Trial.