Updating the Common Rule in an Era of Big Health Data
March 24, 2016
Updating the Common Rule in an Era of Big Health Data
Last fall the Department of Health and Human Services
Common Rule: IRB Review and Informed Consent
(HHS) and 15 other federal departments and agencies
Under the Common Rule, research protocols must be
jointly released a proposed rule to amend the uniform set of
approved by an Institutional Review Board (IRB) to ensure
regulations—informally known as the Common Rule—that
that the rights and welfare of the research subjects are
govern the ethical conduct of research involving humans
protected. The regulations list several criteria for IRB
(80 Federal Register 53931, September 8, 2015).
approval, including the requirement that researchers obtain
the informed consent of their research subjects. The
Federal regulations to protect human research subjects were
informed consent process includes an explanation of the
first published by HHS in 1974 and revised in 1981 to
purpose of the research, a description of the research
implement the Belmont Report. That landmark report laid
procedures, and a description of the risks and benefits of the
out an ethical framework for conducting human subject
research, among other things. An IRB may decide to waive
research based on the principles of (1) respect for persons
the informed consent requirement if it determines that the
(i.e., individuals are autonomous agents and should be
research poses no more than minimal risk to the subjects,
given the opportunity to make informed choices based on
the waiver will not adversely affect their rights and welfare,
their own judgment and opinions); (2) beneficence (i.e., the
and the research is not practicable without a waiver.
potential benefits of research should be maximized while
minimizing the potential risks to research participants); and
The Common Rule defines human subject research to
(3) justice (i.e., the benefits and the risks of research should
include not only studies that obtain data through direct
be distributed fairly and not fall on one particular group).
intervention or interaction with an individual, but also
studies that acquire identifiable private information about
A modified version of the Common Rule was adopted by
an individual. Thus, the rule applies to non-interventional
HHS and multiple other departments and agencies in 1991.
research on donated biospecimens and stored data provided
While it has remained virtually unchanged since that time,
the specimens and data are identifiable.
the research landscape has undergone enormous change.
The Common Rule states that information is identifiable if
One key area is the rapid growth of research involving the
the researcher can readily ascertain the identity of the
collection and use of biospecimens (i.e., human blood,
subject. A biospecimen or genome sequence that has been
tissue, and other biological samples). Biospecimens
stripped of any accompanying identifiers—such as name,
increasingly are used for genome sequencing and other
address, social security number, or any other identifying
genetic analysis. Repositories are being created to store
number, image, or code—is not considered readily
biospecimens for use in secondary research, which may be
identifiable and is not subject to the Common Rule.
unrelated to any primary research using the material at the
time it was collected. The President’s Precision Medicine
The Common Rule permits the informed consent process to
Initiative to accelerate research on personalized treatments
include corollary and secondary research. For example,
tailored to a patient’s genetic characteristics seeks to
researchers may wish to store information and specimens
establish a national research cohort of at least 1 million
obtained during the primary research study for use in future
Americans who will contribute biospecimens for genomic
studies. In such instances, an IRB may approve an informed
sequencing (see CRS Insight IN10227, The Precision
consent document that asks research participants to allow
Medicine Initiative).
future research on their identifiable information or
specimens. However, the document must contain sufficient
The focus of the Common Rule traditionally has been to
detail about the future research to allow for truly informed
protect the safety of individuals who participate in clinical
consent.
trials and other interventional research. But with the
enormous growth in health data analytics—using large
Broad Consent for Secondary Research
databases of clinical, genomic, and other types of data—
HHS and other departments and agencies have proposed a
much of today’s health research involves the analysis of
series of important changes to the Common Rule. Those
information rather than direct interactions with research
include making the informed consent process more
subjects. Consequently, the primary risk for many research
transparent and imposing strict new requirements on the
participants is no longer physical harm but loss of privacy.
information that must be given to prospective research
subjects. The proposal also would exclude certain
The stated purpose of the proposal is to modernize,
categories of research from the Common Rule that are
simplify, and strengthen the current system of Common
deemed not to be research, or that are inherently low-risk
Rule oversight of research involving human subjects. The
and already subject to independent controls.
proposed changes seek to enhance the protections for
research subjects while facilitating important new research.
https://crsreports.congress.gov
Updating the Common Rule in an Era of Big Health Data
But it is the treatment of biospecimens that has attracted the
process, which they argue would relieve investigators from
most scrutiny. The proposal would expand the definition of
having to obtain informed consent for secondary research
human subject research to include any study that obtains,
on stored information or biospecimens. And they dispute
uses, or analyses biospecimens regardless of identifiability.
the notion that the proposed broad consent process would
This represents a significant expansion of the Common
provide sufficient information about possible future
Rule. It potentially would make all secondary research on
research to allow individuals to make an informed decision,
stored biospecimens subject to full IRB review, requiring
potentially years before the research is conducted.
investigators to obtain informed consent from the
individuals who originally donated the specimens, unless
The research community strongly opposes the proposal to
the IRB waives consent.
abandon indentifiability as the test for determining whether
the Common Rule applies to research involving
Having expanded the definition of human subject research
biospecimens. They also are critical of the broad consent
to include all research using biospecimens, the proposed
mechanism, which they argue will create a significant
rule then creates two exemptions to facilitate the secondary
administrative burden on researchers.
research use of identifiable information and biospecimens.
The first exemption would allow the collection, storage, and
In an effort to address some of these concerns, the proposed
maintenance of identifiable information and biospecimens
rule also discusses a pair of alternative options for
without the need for full IRB review, provided (1) the
expanding the definition of human subject research. Rather
researchers obtain “broad consent” (i.e., consent for future,
than considering human subject research to include all
unspecified research studies); and (2) security standards for
research involving biospecimens, one alternative would be
the repository are in place. The second exemption would
to expand the definition to encompass only research
then permit investigators to conduct secondary research on
involving whole genome sequencing (WGS) data. Under
the stored information and biospecimens without a separate
this alternative, researchers using WGS data could not
IRB review or consent process.
avoid Common Rule oversight by removing identifiers
from the data because WGS data would by itself meet the
Broad consent for secondary research would differ from the
definition of a human subject.
regular informed consent process for primary research
studies. It would include some but not all of the core
This alternative definition of human subject research would
elements of informed consent, as well as several elements
be narrower in scope than the primary proposal to extend
specific to the collection, storage, and future research use of
Common Rule oversight to research involving all
identifiable information or biospecimens. For example,
biospecimens. But it would capture research (including
broad consent would have to include a description of the
secondary research) in which WGS data was generated
types of information or biospecimens that will be collected,
from biospecimens.
details of how the information or biospecimens will be
stored, a general description of the types of research that
Importantly, HHS also would create an exemption under
may be conducted using the information or biospecimens,
this alternative proposal to allow secondary research on
and an indication of how long researchers may continue to
WGS data without IRB review, provided broad consent is
study the stored information or biospecimens. Notably, the
obtained up-front, and security standards are in place to
proposal would permit broad consent for future research on
protect the stored information or biospecimens.
information or biospecimens for an indefinite period time.
The proposals to make research involving all biospecimens
The proposed rule states that HHS will create a broad
or WGS data subject to Common Rule oversight, regardless
consent template to guide the process. If anyone uses that
of identifiability, would be a significant shift from the
template, then IRB review of the broad consent document
current requirement that biospecimens or WGS data must
would not be required. In addition, for the exemptions to
be readily identifiable for the Common Rule to apply.
apply, any repository of information or biospecimens would
While WGS data, by itself, is uniquely identifiable (except
have to implement and maintain reasonable and appropriate
in the case of identical siblings), HHS currently does not
security safeguards to protect the stored information or
consider genomic data stripped of accompanying identifiers
biospecimens from unintentional or unauthorized use or
to be readily identifiable under the Common Rule.
disclosure. The proposed rule indicates that HHS will issue
standards for biorepositories, which would also have the
The proposed changes in policy come at a time when
option of applying the HIPAA health information security
bioethicists and data analysts question whether de-
standards.
identification is a reliable mechanism for privacy
protection. They point to recent studies in which analysts
Compliance with the modified definition of human subject
were able to re-identify supposedly de-identified genomic
research would be delayed until three years after a final rule
data by matching it with identifiable information from other
is published. The rule’s provisions would apply to
publicly available databases (see CRS Report R44026,
biospecimens collected from that date forward.
Genomic Data and Privacy: Background and Relevant
Law).
An Alternative Proposal for Genomic Data
These proposed changes have met with considerable
C. Stephen Redhead, Specialist in Health Policy
criticism from stakeholders. Privacy and patients’ rights
IF10380
advocates are critical of the front-loaded broad consent
https://crsreports.congress.gov
Updating the Common Rule in an Era of Big Health Data
Disclaimer
This document was prepared by the Congressional Research Service (CRS). CRS serves as nonpartisan shared staff to
congressional committees and Members of Congress. It operates solely at the behest of and under the direction of Congress.
Information in a CRS Report should not be relied upon for purposes other than public understanding of information that has
been provided by CRS to Members of Congress in connection with CRS’s institutional role. CRS Reports, as a work of the
United States Government, are not subject to copyright protection in the United States. Any CRS Report may be
reproduced and distributed in its entirety without permission from CRS. However, as a CRS Report may include
copyrighted images or material from a third party, you may need to obtain the permission of the copyright holder if you
wish to copy or otherwise use copyrighted material.
https://crsreports.congress.gov | IF10380 · VERSION 2 · NEW