Updating the Common Rule in an Era of Big Health Data

March 24, 2016 Updating the Common Rule in an Era of Big Health Data Last fall the Department of Health and Human Services (HHS) and 15 other federal departments and agencies jointly released a proposed rule to amend the uniform set of regulations—informally known as the Common Rule—that govern the ethical conduct of research involving humans (80 Federal Register 53931, September 8, 2015). Federal regulations to protect human research subjects were first published by HHS in 1974 and revised in 1981 to implement the Belmont Report. That landmark report laid out an ethical framework for conducting human subject research based on the principles of (1) respect for persons (i.e., individuals are autonomous agents and should be given the opportunity to make informed choices based on their own judgment and opinions); (2) beneficence (i.e., the potential benefits of research should be maximized while minimizing the potential risks to research participants); and (3) justice (i.e., the benefits and the risks of research should be distributed fairly and not fall on one particular group). A modified version of the Common Rule was adopted by HHS and multiple other departments and agencies in 1991. While it has remained virtually unchanged since that time, the research landscape has undergone enormous change. One key area is the rapid growth of research involving the collection and use of biospecimens (i.e., human blood, tissue, and other biological samples). Biospecimens increasingly are used for genome sequencing and other genetic analysis. Repositories are being created to store biospecimens for use in secondary research, which may be unrelated to any primary research using the material at the time it was collected. The President’s Precision Medicine Initiative to accelerate research on personalized treatments tailored to a patient’s genetic characteristics seeks to establish a national research cohort of at least 1 million Americans who will contribute biospecimens for genomic sequencing (see CRS Insight IN10227, The Precision Medicine Initiative). The focus of the Common Rule traditionally has been to protect the safety of individuals who participate in clinical trials and other interventional research. But with the enormous growth in health data analytics—using large databases of clinical, genomic, and other types of data— much of today’s health research involves the analysis of information rather than direct interactions with research subjects. Consequently, the primary risk for many research participants is no longer physical harm but loss of privacy. The stated purpose of the proposal is to modernize, simplify, and strengthen the current system of Common Rule oversight of research involving human subjects. The proposed changes seek to enhance the protections for research subjects while facilitating important new research. Common Rule: IRB Review and Informed Consent Under the Common Rule, research protocols must be approved by an Institutional Review Board (IRB) to ensure that the rights and welfare of the research subjects are protected. The regulations list several criteria for IRB approval, including the requirement that researchers obtain the informed consent of their research subjects. The informed consent process includes an explanation of the purpose of the research, a description of the research procedures, and a description of the risks and benefits of the research, among other things. An IRB may decide to waive the informed consent requirement if it determines that the research poses no more than minimal risk to the subjects, the waiver will not adversely affect their rights and welfare, and the research is not practicable without a waiver. The Common Rule defines human subject research to include not only studies that obtain data through direct intervention or interaction with an individual, but also studies that acquire identifiable private information about an individual. Thus, the rule applies to non-interventional research on donated biospecimens and stored data provided the specimens and data are identifiable. The Common Rule states that information is identifiable if the researcher can readily ascertain the identity of the subject. A biospecimen or genome sequence that has been stripped of any accompanying identifiers—such as name, address, social security number, or any other identifying number, image, or code—is not considered readily identifiable and is not subject to the Common Rule. The Common Rule permits the informed consent process to include corollary and secondary research. For example, researchers may wish to store information and specimens obtained during the primary research study for use in future studies. In such instances, an IRB may approve an informed consent document that asks research participants to allow future research on their identifiable information or specimens. However, the document must contain sufficient detail about the future research to allow for truly informed consent. Broad Consent for Secondary Research HHS and other departments and agencies have proposed a series of important changes to the Common Rule. Those include making the informed consent process more transparent and imposing strict new requirements on the information that must be given to prospective research subjects. The proposal also would exclude certain categories of research from the Common Rule that are deemed not to be research, or that are inherently low-risk and already subject to independent controls. https://crsreports.congress.gov Updating the Common Rule in an Era of Big Health Data But it is the treatment of biospecimens that has attracted the most scrutiny. The proposal would expand the definition of human subject research to include any study that obtains, uses, or analyses biospecimens regardless of identifiability. This represents a significant expansion of the Common Rule. It potentially would make all secondary research on stored biospecimens subject to full IRB review, requiring investigators to obtain informed consent from the individuals who originally donated the specimens, unless the IRB waives consent. Having expanded the definition of human subject research to include all research using biospecimens, the proposed rule then creates two exemptions to facilitate the secondary research use of identifiable information and biospecimens. The first exemption would allow the collection, storage, and maintenance of identifiable information and biospecimens without the need for full IRB review, provided (1) the researchers obtain “broad consent” (i.e., consent for future, unspecified research studies); and (2) security standards for the repository are in place. The second exemption would then permit investigators to conduct secondary research on the stored information and biospecimens without a separate IRB review or consent process. Broad consent for secondary research would differ from the regular informed consent process for primary research studies. It would include some but not all of the core elements of informed consent, as well as several elements specific to the collection, storage, and future research use of identifiable information or biospecimens. For example, broad consent would have to include a description of the types of information or biospecimens that will be collected, details of how the information or biospecimens will be stored, a general description of the types of research that may be conducted using the information or biospecimens, and an indication of how long researchers may continue to study the stored information or biospecimens. Notably, the proposal would permit broad consent for future research on information or biospecimens for an indefinite period time. The proposed rule states that HHS will create a broad consent template to guide the process. If anyone uses that template, then IRB review of the broad consent document would not be required. In addition, for the exemptions to apply, any repository of information or biospecimens would have to implement and maintain reasonable and appropriate security safeguards to protect the stored information or biospecimens from unintentional or unauthorized use or disclosure. The proposed rule indicates that HHS will issue standards for biorepositories, which would also have the option of applying the HIPAA health information security standards. Compliance with the modified definition of human subject research would be delayed until three years after a final rule is published. The rule’s provisions would apply to biospecimens collected from that date forward. An Alternative Proposal for Genomic Data These proposed changes have met with considerable criticism from stakeholders. Privacy and patients’ rights advocates are critical of the front-loaded broad consent process, which they argue would relieve investigators from having to obtain informed consent for secondary research on stored information or biospecimens. And they dispute the notion that the proposed broad consent process would provide sufficient information about possible future research to allow individuals to make an informed decision, potentially years before the research is conducted. The research community strongly opposes the proposal to abandon indentifiability as the test for determining whether the Common Rule applies to research involving biospecimens. They also are critical of the broad consent mechanism, which they argue will create a significant administrative burden on researchers. In an effort to address some of these concerns, the proposed rule also discusses a pair of alternative options for expanding the definition of human subject research. Rather than considering human subject research to include all research involving biospecimens, one alternative would be to expand the definition to encompass only research involving whole genome sequencing (WGS) data. Under this alternative, researchers using WGS data could not avoid Common Rule oversight by removing identifiers from the data because WGS data would by itself meet the definition of a human subject. This alternative definition of human subject research would be narrower in scope than the primary proposal to extend Common Rule oversight to research involving all biospecimens. But it would capture research (including secondary research) in which WGS data was generated from biospecimens. Importantly, HHS also would create an exemption under this alternative proposal to allow secondary research on WGS data without IRB review, provided broad consent is obtained up-front, and security standards are in place to protect the stored information or biospecimens. The proposals to make research involving all biospecimens or WGS data subject to Common Rule oversight, regardless of identifiability, would be a significant shift from the current requirement that biospecimens or WGS data must be readily identifiable for the Common Rule to apply. While WGS data, by itself, is uniquely identifiable (except in the case of identical siblings), HHS currently does not consider genomic data stripped of accompanying identifiers to be readily identifiable under the Common Rule. The proposed changes in policy come at a time when bioethicists and data analysts question whether deidentification is a reliable mechanism for privacy protection. They point to recent studies in which analysts were able to re-identify supposedly de-identified genomic data by matching it with identifiable information from other publicly available databases (see CRS Report R44026, Genomic Data and Privacy: Background and Relevant Law). C. Stephen Redhead, Specialist in Health Policy https://crsreports.congress.gov IF10380 Updating the Common Rule in an Era of Big Health Data Disclaimer This document was prepared by the Congressional Research Service (CRS). CRS serves as nonpartisan shared staff to congressional committees and Members of Congress. It operates solely at the behest of and under the direction of Congress. Information in a CRS Report should not be relied upon for purposes other than public understanding of information that has been provided by CRS to Members of Congress in connection with CRS’s institutional role. CRS Reports, as a work of the United States Government, are not subject to copyright protection in the United States. Any CRS Report may be reproduced and distributed in its entirety without permission from CRS. However, as a CRS Report may include copyrighted images or material from a third party, you may need to obtain the permission of the copyright holder if you wish to copy or otherwise use copyrighted material. https://crsreports.congress.gov | IF10380 · VERSION 2 · NEW