The Common Rule (45 C.F.R. Part 46, Subpart A, "Basic HHS Policy for Protection of Human Research Subjects") was first published in 1991 and governs the ethical conduct of human subjects research supported by federal agencies. Key ethical principles in human subjects research, including, for example, autonomy, as described in the Belmont Report, served as a foundation for the Common Rule. The Common Rule provides broad protections for the rights and welfare of individuals participating in clinical trials and other research across federal agencies, primarily through oversight of research by Institutional Review Boards (IRBs), informed consent requirements, and the equitable selection of subjects. The 1991 rule reflected the adoption and codification of Subpart A by 15 other federal departments and agencies. The Department of Health and Human Services (HHS) regulations include, in addition to Subpart A, subparts addressing research with pregnant women, human fetuses, and neonates (Subpart B); prisoners (Subpart C); and children (Subpart D).
The Common Rule remained virtually unchanged since it was adopted in 1991 through 2017, when it was significantly revised through rulemaking. During that time, the biomedical research landscape was undergoing significant transformation, with more health research relying on analysis of health data, rather than direct interactions with research subjects. Growth in health data analytics, which used large databases of clinical, genomic, and other types of data in health research, contributed to this change. In addition, there was rapid growth of research involving banked biospecimens, which were increasingly being collected, stored, and used for genomic and other analysis. Repositories store biospecimens for possible use in future (i.e., secondary) research that may be unrelated to the primary clinical or research use of the material. For example, the All of Us research program, a national cohort initiative with the aim of recruiting at least 1 million Americans, has already enrolled hundreds of thousands of participants who contribute biospecimens and clinical and other data for unspecified analyses.
Taken together, these changes to the biomedical research landscape created new challenges to the protection of human research subjects. In January 2017, HHS and 15 other federal departments and agencies jointly published a final rule to amend the Common Rule (82 Federal Register 7149). According to HHS, the purpose of the final rule was to modernize, simplify, and strengthen the Common Rule to better protect human research subjects, while facilitating new research and reducing burden and ambiguity for investigators. The 2017 final rule made a series of changes to the Common Rule, which together created a new approach to regulating research with identifiable private information and identifiable biospecimens. The revised Common Rule (referred to as the "2018 Common Rule" or the "2018 Requirements") had a compliance date of January 21, 2019 (modified from the original date of January 19, 2018; see 83 Federal Register 28497).
The 2018 Common Rule defines human subjects research by defining "human subject" and "research" separately. A human subject includes a research subject about whom an investigator conducting research (1) "obtains information or biospecimens through intervention or interaction with the individual" or (2) "obtains, uses, studies, analyzes, or generates identifiable private information or identifiable biospecimens." Thus, the 2018 Common Rule applies to noninterventional research using biospecimens and stored data, provided the specimens and data are identifiable. According to the 2018 Common Rule, information is identifiable if the subject's identity "may readily be ascertained" by the researcher. A biospecimen or genome sequence stripped of any accompanying identifiers (e.g., name, address) is not considered to be readily identifiable. Research using nonidentifiable private information and nonidentifiable biospecimens remains outside the scope of the 2018 Common Rule.
Over the past decade, further rapid changes in health research, facilitated in large part by advances in artificial intelligence (AI), vast amounts of patient-generated health data, and big data analytic capabilities, have once again raised questions about the 2018 Common Rule's protections for human research subjects.
To comply with the 2018 Common Rule, research protocols must be reviewed and approved by an IRB to ensure that the rights and welfare of the research subjects are protected. The regulation lists several criteria for IRB approval, including the requirement that researchers obtain and appropriately document the informed consent of their research subjects. The informed consent process includes an explanation of the purpose of the research, a description of the research procedures, and a description of the risks and benefits of the research, among other things. An IRB may decide to waive the informed consent requirement if it determines that the research poses no more than minimal risk to the subjects, the waiver will not adversely affect subjects' rights and welfare, and the research is not practicable without a waiver.
The 2018 Common Rule includes informed consent requirements relating to research involving the collection of identifiable biospecimens or private information. Specifically, it requires that an informed consent must include either a statement that de-identified biospecimens may be used in future research without additional consent or that the subject's biospecimens or private information will never be used in future research (45 C.F.R §46.116(b)(9)). In addition, it requires, where applicable, the consent to include statements about the possibility of commercial profit from such research and whether the research includes whole genome sequencing (45 C.F.R. §46.116(c)(7) and (9)).
The 2018 Common Rule also includes a category of broad consent, added by the 2017 final rule, which allows researchers to gain consent for secondary research studies at the time of the initial study and consent process. Prior to this, if an IRB reviewing a secondary research project concluded the original informed consent document did not adequately describe the secondary research—a possibility, given that details of future research are hard to predict—then the researchers had to find the research subjects and obtain their informed consent (unless waived by the IRB) or strip identifiers from the research material in order to proceed.
Broad consent for the storage, maintenance, and secondary research use of identifiable information or biospecimens differs from study-specific informed consent. It includes some but not all of the core elements of informed consent, as well as several additional elements. For example, broad consent must include a general description of the types of research that may be conducted with the identifiable information or biospecimens; a description of the identifiable information or biospecimens that might be used in the research; whether sharing of identifiable information or biospecimens might occur; and the types of institutions and researchers that might conduct the research. Researchers have the option of obtaining broad consent for the storage, maintenance, and secondary research use of identifiable private information or biospecimens, subject to limited IRB review, rather than having to undergo full IRB review and obtain study-specific informed consent (unless waived by the IRB).
The 2018 Common Rule includes several provisions to clarify requirements for secondary research with broad consent.
The 2017 final rule created a pair of partial exemptions for secondary research on identifiable biospecimens or private information where broad consent has been obtained. One exemption allows researchers to store and maintain identifiable information or biospecimens for potential secondary research use, provided an IRB conducts a limited review to determine that broad consent has been obtained and appropriately documented (45 C.F.R. §46.104(d)(7)). The second exemption allows researchers to conduct secondary research on stored identifiable private information or biospecimens with broad consent, provided an IRB conducts a limited review to confirm that the secondary research falls within the scope of the broad consent obtained (45 C.F.R. §46.104(d)(8)). The IRB also must determine that there are adequate provisions to protect the privacy of subjects and confidentiality of data. The HHS Secretary is required to "issue guidance to assist IRBs in assessing what provisions are adequate to protect the privacy of subjects and to maintain the confidentiality of data." Additionally, the research plan may not include return of individual research results, and the broad consent must be appropriately obtained and documented.
Under the Health Information Portability and Accountability Act of 1996 (HIPAA) Privacy Rule (45 C.F.R. Part 164, Subpart E), an individual's protected health information (PHI) may not be used or disclosed for research purposes generally without the individual's authorization, unless authorization is waived by an IRB (or equivalent privacy board). These requirements may apply concurrently with the 2018 Common Rule if, for example, research is conducted by a HIPAA-covered entity (e.g., a hospital or other health care facility) using PHI. To minimize duplicative regulation, secondary research with identifiable private information that is subject to the Privacy Rule is exempt from the 2018 Common Rule.