December 10, 2018
Updated Common Rule: Key Changes for Research Using
Stored Biospecimens
On January 19, 2017, the Department of Health and Human
Federal Register 2885), and again to January 21, 2019 (83
Services (HHS) and 15 other federal departments and
Federal Register 28497), from the original compliance date
agencies jointly published a final rule to amend the uniform
of January 19, 2018.
set of regulations—known as the Common Rule—that
govern the ethical conduct of research supported by these
Definition of Human Subject Research
agencies involving humans (82 Federal Register 7149).
The Common Rule defines human subject research to
According to HHS, the purpose of the final rule is to
include not only studies that obtain data “through
modernize, simplify, and strengthen the Common Rule to
intervention or interaction with an individual,” but also
better protect human research subjects, while facilitating
studies that obtain “identifiable private information.” Thus,
new research and reducing burden and ambiguity for
it applies to noninterventional research using biospecimens
investigators. The Common Rule had remained virtually
and stored data provided the specimens and data are
unchanged since it was adopted in 1991, while the research
identifiable. The Common Rule states that information is
landscape has undergone significant transformation.
identifiable if the subject’s identity “may readily be
ascertained” by the researcher. A biospecimen or genome
Traditionally, the Common Rule has protected the rights
sequence stripped of any accompanying identifiers (e.g.,
and welfare of individuals participating in clinical trials and
name, address, social security number) is not considered to
other interventional research. However, much of today’s
be readily identifiable.
health research involves the analysis of health information
rather than direct interactions with research subjects due to
The final rule modifies the definition of human subject
the growth in health data analytics, that is, using large
research to clarify the current interpretation of the
databases of clinical, genomic, and other types of data in
regulations by explicitly stating that it includes obtaining
health research. Consequently, the primary risk for these
and analyzing “information and biospecimens through
research participants is no longer physical harm, but rather
intervention,” as well as research that “obtains, uses,
loss of privacy and loss of control over the use of their
analyzes, or generates identifiable private information or
information.
identifiable biospecimens.” Research using nonidentifiable
private information and nonidentifiable biospecimens
The rapid growth of research involving biospecimens,
remains outside the scope of the Common Rule.
which increasingly are collected and used for whole
genome sequencing and other genetic analysis, in particular
IRB Review and Informed Consent
has resulted in new challenges in the protection of human
Under the Common Rule, research protocols must be
research subjects. Repositories store biospecimens for
reviewed and approved by an Institutional Review Board
possible use in future (i.e., secondary) research that may be
(IRB) to ensure that the rights and welfare of the research
unrelated to the primary clinical or research use of the
subjects are protected. The regulation lists several criteria
material. For example, the All of Us research program—part
for IRB approval, including the requirement that
of the Precision Medicine Initiative (PMI) to accelerate
researchers obtain and appropriately document the informed
research on personalized treatments tailored to a patient’s
consent of their research subjects.
characteristics—seeks to establish a national cohort of at
least 1 million Americans who will contribute biospecimens
The informed consent process includes an explanation of
for genome sequencing and other unspecified analyses.
the purpose of the research, a description of the research
procedures, and a description of the risks and benefits of the
The final rule made a series of changes to the Common
research, among other things. An IRB may decide to waive
Rule, including, among others, making the informed
the informed consent requirement if it determines that the
consent process more transparent and imposing strict new
research poses no more than minimal risk to the subjects,
requirements on the information given to prospective
the waiver will not adversely affect their rights and welfare,
research subjects; changes to existing and creation of new
and the research is not practicable without a waiver.
exemptions to the requirements; and definitional changes,
among other things. Many of these changes together create
The final rule adds new informed consent requirements
a new approach to regulating research with identifiable
relating to any research involving the collection of
private information and biospecimens, and it is these
identifiable biospecimens or private information.
changes that have generally received the most attention.
Specifically, it requires that the informed consent include
The general compliance date of the revised common rule
either a statement that de-identified biospecimens may be
(referred to as the “2018 Rule” or the “2018
used in future research without additional consent or that
Requirements”) was delayed initially to July 19, 2018 (83
the subject’s biospecimens or private information will never
https://crsreports.congress.gov

---

Updated Common Rule: Key Changes for Research Using Stored Biospecimens
be used in future research (45 C.F..R §46.116(b)(9)). In
personal health information (PHI) may not be used or
addition, it requires, where applicable, that the consent
disclosed for research purposes without the individual’s
include statements about the possibility of commercial
authorization, unless authorization is waived by an IRB (or
profit from such research where that exists and whether the
equivalent privacy board). These HIPAA requirements
research will include whole genome sequencing (45 C.F.R.
often apply concurrently with the Common Rule if, for
§46.116(c)(7) and (9)).
example, the human subject research is conducted by a
HIPAA-covered entity such as a hospital or any other
Currently, if an IRB reviewing a secondary research project
health care facility. To minimize duplicative regulation, the
concludes that the original informed consent document does
final rule exempts from the Common Rule any secondary
not adequately describe the secondary research—which can
research on identifiable information or biospecimens that is
be challenging given details of the research may be hard to
subject to the Privacy Rule. An example of this type of
predict—then the researchers must either find the research
research would be research that takes place at a HIPAA-
subjects and obtain their informed consent (unless waived
regulated institution and that involves the investigator’s use
by the IRB) to conduct the new research or strip the
of PHI.
identifiers from the research material. To help address this
issue, the final rule added a new category of broad consent,
Periodic Reexamination of Identifiability
which allows researchers to gain consent for secondary
Privacy advocates question whether the current definition
research studies at the time of the initial study and consent
of identifiability is sufficient to protect individual privacy.
process.
They point to new technologies that are making it easier to
re-identify information or biospecimens considered to be
Broad Consent for Storage, Maintenance, and
nonidentifiable. For example, it is possible to re-identify
Secondary Research
supposedly de-identified genomic data by matching it with
Broad consent for the storage, maintenance, and secondary
identifiable information from other public databases. In
research use of identifiable information or biospecimens
response to these concerns, the final rule requires
differs from study-specific informed consent. It includes
regulators—within one year and every four years
some but not all of the core elements of informed consent,
thereafter—to reexamine the definition of identifiable and
as well as several additional elements. For example, broad
assess which technologies and techniques can produce
consent must include a general description of the types of
identifiable information and biospecimens. Genomic
research that may be conducted with the identifiable
sequencing is expected to be one of the first technologies to
information or biospecimens; a description of the
be evaluated.
identifiable information or biospecimens that might be used
in the research; whether sharing of identifiable information
Harmonization with FDA’s Human Research
or biospecimens might occur; and the types of institutions
Subjects Regulations
and researchers that might conduct the research.
The Food and Drug Administration (FDA) has issued its
own set of Human Subject Regulations, which are similar,
Under the final rule, researchers now have the option of
but not identical, to the Common Rule (21 C.F.R. Parts 50
obtaining—subject to limited IRB review—“broad consent”
and 56). FDA generally applies these regulations to all the
for the storage, maintenance, and yet-to-be specified
research it regulates, including clinical trials of new drugs
secondary research use of identifiable private information
and medical devices, regardless of the source of funding for
or biospecimens, rather than having to undergo full IRB
the research. In certain cases, where a clinical study is both
review and obtain study-specific informed consent (unless
federally funded and is investigating an FDA-regulated
waived by the IRB).
medical product, researchers will be subject to both sets of
regulations. Section 3023 of the 21st Century Cures Act
The final rule creates a new pair of partial exemptions to
(P.L. 114-255) requires the HHS Secretary, to the extent
the Common Rule requirements for secondary research on
possible, to harmonize differences between the Common
identifiable biospecimens or information where broad
Rule and the FDA Human Subject Regulations. This
consent has been obtained. The first exemption allows
harmonization must be completed by no later than
researchers to store and maintain identifiable information
December 13, 2019. The FDA has indicated its intention to
or biospecimens for secondary research use, provided an
undertake rulemaking in 2019 in the fall 2018 Unified
IRB conducts a limited review to determine that broad
Regulatory Agenda to accomplish harmonization. In the
consent has been obtained and appropriately documented
interim, the agency acknowledges that given the revisions
(45 C.F.R. §46.104(d)(7)). The second exemption allows
to the Common Rule and a lack of harmonization with FDA
researchers to conduct secondary research on the stored
regulations, confusion may arise for researchers subject to
identifiable information or biospecimens, provided an IRB
both sets of regulations. Therefore, FDA has published
conducts a limited review to confirm that (1) broad consent
guidance entitled “Impact of Certain Provisions of the
was obtained and appropriately documented, and (2) the
Revised Common Rule on FDA-Regulated Clinical
secondary research falls within its scope (45 C.F.R.
Investigators” to help clarify how to meet requirements of
§46.104(d)(8)). The IRB also must determine that there are
both sets of regulations, where necessary.
adequate privacy protections in place.
Amanda K. Sarata, Specialist in Health Policy
HIPAA-Regulated Secondary Research
IF11043
Under the Health Information Portability and
Accountability Act (HIPAA) Privacy Rule, an individual’s
https://crsreports.congress.gov

---

Updated Common Rule: Key Changes for Research Using Stored Biospecimens


Disclaimer
This document was prepared by the Congressional Research Service (CRS). CRS serves as nonpartisan shared staff to
congressional committees and Members of Congress. It operates solely at the behest of and under the direction of Congress.
Information in a CRS Report should not be relied upon for purposes other than public understanding of information that has
been provided by CRS to Members of Congress in connection with CRS’s institutional role. CRS Reports, as a work of the
United States Government, are not subject to copyright protection in the United States. Any CRS Report may be
reproduced and distributed in its entirety without permission from CRS. However, as a CRS Report may include
copyrighted images or material from a third party, you may need to obtain the permission of the copyright holder if you
wish to copy or otherwise use copyrighted material.

https://crsreports.congress.gov | IF11043 · VERSION 2 · NEW

---