Updated Common Rule: Research Using Stored Biospecimens
link to page 2 
May 16, 2017
Updated Common Rule: Research Using Stored Biospecimens
On January 19, 2017, the Department of Health and Human
researchers obtain and appropriately document the informed
Services (HHS) and 15 other federal departments and
consent of their research subjects.
agencies jointly published a final rule to amend the uniform
The informed consent process includes an explanation of
set of regulations—known as the Common Rule—that
the purpose of the research, a description of the research
govern the ethical conduct of research supported by these
procedures, and a description of the risks and benefits of the
agencies involving humans (82 Federal Register 7149). The
research, among other things. An IRB may decide to waive
Common Rule has remained virtually unchanged since it
the informed consent requirement if it determines that the
was adopted in 1991, while the research landscape has
research poses no more than minimal risk to the subjects,
undergone enormous transformation.
the waiver will not adversely affect their rights and welfare,
One key area of change is the rapid growth of research
and the research is not practicable without a waiver.
involving biospecimens (e.g., human blood, tissue, and
The Common Rule defines human subject research to
other biological specimens), which increasingly are
include not only studies that obtain data “through
collected and used for whole genome sequencing and other
intervention or interaction with an individual” but also
genetic analysis. Repositories store biospecimens for
studies that obtain “identifiable private information.” Thus,
possible use in future (i.e., secondary) research that may be
it applies to non-interventional research using biospecimens
unrelated to the clinical or research use of the material at
and stored data provided the specimens and data are
the time it was collected. The All of Us research program—
identifiable.
part of the Precision Medicine Initiative to accelerate
research on personalized treatments tailored to a patient’s
The final rule modifies the definition of human subject
genetic and other characteristics—seeks to establish a
research to clarify the current interpretation of the
national research cohort of at least 1 million Americans
regulations by explicitly stating that it includes obtaining
who will contribute biospecimens for genome sequencing
and analyzing “information and biospecimens through
and other analyses (see CRS Insight IN10227, The
intervention,” as well as research that “obtains, uses,
Precision Medicine Initiative).
analyzes, or generates identifiable private information or
identifiable biospecimens.” Nonidentifiable private
Traditionally, the Common Rule has protected the rights
information and nonidentifiable biospecimens remain
and welfare of individuals participating in clinical trials and
outside the scope of the Common Rule.
other interventional research. But with the enormous
growth in health data analytics—using large databases of
The Common Rule states that information is identifiable if
clinical, genomic, and other types of data—much of today’s
the subject’s identity “may readily be ascertained” by the
health research involves the analysis of health information
researcher. A biospecimen or genome sequence stripped of
rather than direct interactions with research subjects.
any accompanying identifiers (e.g., name, address, social
Consequently, the primary risk for these research
security number) is not considered readily identifiable.
participants is no longer physical harm but loss of privacy.
During the informed consent process, researchers may seek
According to HHS, the purpose of the final rule is to
consent to store identifiable information and biospecimens
modernize, simplify, and strengthen the Common Rule to
obtained during the primary research study for use in
better protect human research subjects, while facilitating
secondary research. But providing an adequate description
new research and reducing burden and ambiguity for
of the secondary research is a challenge. Currently, if an
investigators.
IRB reviewing a secondary research project concludes that
the original informed consent document does not
The final rule makes a series of important changes to the
adequately describe the secondary research, then the
Common Rule, almost all of which take effect on January
researchers must either find the research subjects and obtain
19, 2018. They include making the informed consent
their informed consent (unless waived by the IRB) to
process more transparent and imposing strict new
conduct the new research or strip the identifiers from the
requirements on the information given to prospective
research material.
research subjects. But it is the treatment of biospecimens
that has attracted by far the most public comment.
Broad Consent for Storage,
Common Rule: IRB Review and
Maintenance, and Secondary Research
Informed Consent
Under the final rule, researchers will now have the option
of obtaining—subject to limited IRB review—“broad
Under the Common Rule, research protocols must be
consent” for the storage, maintenance, and yet-to-be
reviewed and approved by an Institutional Review Board
specified secondary research use of identifiable private
(IRB) to ensure that the rights and welfare of the research
information or biospecimens, rather than having to undergo
subjects are protected. The regulations list several criteria
full IRB review and obtain study-specific informed consent
for IRB approval, including the requirement that
(unless waived by the IRB); see Figure 1.
https://crsreports.congress.gov
Updated Common Rule: Research Using Stored Biospecimens
The final rule creates a pair of partial exemptions to the
health information may not be used or disclosed for
Common Rule requirements. The first exemption allows
research purposes without the individual’s authorization,
researchers to store and maintain identifiable information or
unless authorization is waived by an IRB (or equivalent
biospecimens for secondary research use, provided an IRB
privacy board). These HIPAA requirements often apply
conducts a limited review to determine that broad consent
concurrently with the Common Rule if, for example, the
has been obtained and appropriately documented (unless
human subject research is conducted by a HIPAA-covered
documentation is waived). The second exemption allows
entity such as a hospital or any other health care facility.
researchers to conduct secondary research on the stored
To minimize duplicative regulation, the final rule exempts
identifiable information or biospecimens, provided an IRB
from the Common Rule any secondary research on
conducts a limited review to confirm that broad consent
identifiable information or biospecimens that is subject to
was obtained and the secondary research falls within its
the Privacy Rule. As example would be research that takes
scope. The IRB also must determine that there are adequate
place at a HIPAA-regulated institution and involves the
privacy protections in place.
investigator’s use of identifiable health information.
Broad consent for the storage, maintenance, and secondary
research use of identifiable information or biospecimens
Periodic Reexamination of Identifiability
differs from study-specific informed consent. It includes
Privacy advocates question whether the current definition
some but not all of the core elements of informed consent,
of identifiability is sufficient to protect individual privacy.
as well as several additional elements. For example, broad
They point to new technologies that are making it easier to
consent must include a general description of the types of
re-identify information or biospecimens considered to be
research that may be conducted with the identifiable
nonidentifiable. For example, it is possible to re-identify
information or biospecimens, a description of the
supposedly de-identified genomic data by matching it with
identifiable information or biospecimens that might be used
identifiable information from other public databases.
in the research, whether sharing of identifiable information
In response to these concerns, the final rule requires
or biospecimens might occur, and the types of institutions
regulators—within one year and every four years
and researchers that might conduct the research.
thereafter—to reexamine the definition of identifiable and
Broad consent also must indicate how long the identifiable
assess which technologies and techniques can produce
information and biospecimens may be stored and
identifiable information and biospecimens. Genomic
maintained, and how long the identifiable information and
sequencing is expected to be one of the first technologies to
biospecimens may be used for research purposes. In both
be evaluated.
instances that period of time could be indefinite.
HIPAA-Regulated Secondary Research
Under the Health Information Portability and
Accountability Act (HIPAA) Privacy Rule, an individual’s
Figure 1. Primary and Secondary Research with Identifiable Private Information and Biospecimens
Updated Common Rule, Effective January 19, 2018
Source: Adapted by CRS from “A New Day for Oversight of Human Research,” Health Affairs Blog, February 6, 2017.
IF10653
C. Stephen Redhead, Specialist in Health Policy
https://crsreports.congress.gov
Updated Common Rule: Research Using Stored Biospecimens
Disclaimer
This document was prepared by the Congressional Research Service (CRS). CRS serves as nonpartisan shared staff to
congressional committees and Members of Congress. It operates solely at the behest of and under the direction of Congress.
Information in a CRS Report should not be relied upon for purposes other than public understanding of information that has
been provided by CRS to Members of Congress in connection with CRS’s institutional role. CRS Reports, as a work of the
United States Government, are not subject to copyright protection in the United States. Any CRS Report may be
reproduced and distributed in its entirety without permission from CRS. However, as a CRS Report may include
copyrighted images or material from a third party, you may need to obtain the permission of the copyright holder if you
wish to copy or otherwise use copyrighted material.
https://crsreports.congress.gov | IF10653 · VERSION 2 · NEW
May 16, 2017
Updated Common Rule: Research Using Stored Biospecimens
On January 19, 2017, the Department of Health and Human
researchers obtain and appropriately document the informed
Services (HHS) and 15 other federal departments and
consent of their research subjects.
agencies jointly published a final rule to amend the uniform
The informed consent process includes an explanation of
set of regulations—known as the Common Rule—that
the purpose of the research, a description of the research
govern the ethical conduct of research supported by these
procedures, and a description of the risks and benefits of the
agencies involving humans (82 Federal Register 7149). The
research, among other things. An IRB may decide to waive
Common Rule has remained virtually unchanged since it
the informed consent requirement if it determines that the
was adopted in 1991, while the research landscape has
research poses no more than minimal risk to the subjects,
undergone enormous transformation.
the waiver will not adversely affect their rights and welfare,
One key area of change is the rapid growth of research
and the research is not practicable without a waiver.
involving biospecimens (e.g., human blood, tissue, and
The Common Rule defines human subject research to
other biological specimens), which increasingly are
include not only studies that obtain data “through
collected and used for whole genome sequencing and other
intervention or interaction with an individual” but also
genetic analysis. Repositories store biospecimens for
studies that obtain “identifiable private information.” Thus,
possible use in future (i.e., secondary) research that may be
it applies to non-interventional research using biospecimens
unrelated to the clinical or research use of the material at
and stored data provided the specimens and data are
the time it was collected. The All of Us research program—
identifiable.
part of the Precision Medicine Initiative to accelerate
research on personalized treatments tailored to a patient’s
The final rule modifies the definition of human subject
genetic and other characteristics—seeks to establish a
research to clarify the current interpretation of the
national research cohort of at least 1 million Americans
regulations by explicitly stating that it includes obtaining
who will contribute biospecimens for genome sequencing
and analyzing “information and biospecimens through
and other analyses (see CRS Insight IN10227, The
intervention,” as well as research that “obtains, uses,
Precision Medicine Initiative).
analyzes, or generates identifiable private information or
identifiable biospecimens.” Nonidentifiable private
Traditionally, the Common Rule has protected the rights
information and nonidentifiable biospecimens remain
and welfare of individuals participating in clinical trials and
outside the scope of the Common Rule.
other interventional research. But with the enormous
growth in health data analytics—using large databases of
The Common Rule states that information is identifiable if
clinical, genomic, and other types of data—much of today’s
the subject’s identity “may readily be ascertained” by the
health research involves the analysis of health information
researcher. A biospecimen or genome sequence stripped of
rather than direct interactions with research subjects.
any accompanying identifiers (e.g., name, address, social
Consequently, the primary risk for these research
security number) is not considered readily identifiable.
participants is no longer physical harm but loss of privacy.
During the informed consent process, researchers may seek
According to HHS, the purpose of the final rule is to
consent to store identifiable information and biospecimens
modernize, simplify, and strengthen the Common Rule to
obtained during the primary research study for use in
better protect human research subjects, while facilitating
secondary research. But providing an adequate description
new research and reducing burden and ambiguity for
of the secondary research is a challenge. Currently, if an
investigators.
IRB reviewing a secondary research project concludes that
the original informed consent document does not
The final rule makes a series of important changes to the
adequately describe the secondary research, then the
Common Rule, almost all of which take effect on January
researchers must either find the research subjects and obtain
19, 2018. They include making the informed consent
their informed consent (unless waived by the IRB) to
process more transparent and imposing strict new
conduct the new research or strip the identifiers from the
requirements on the information given to prospective
research material.
research subjects. But it is the treatment of biospecimens
that has attracted by far the most public comment.
Broad Consent for Storage,
Common Rule: IRB Review and
Maintenance, and Secondary Research
Informed Consent
Under the final rule, researchers will now have the option
of obtaining—subject to limited IRB review—“broad
Under the Common Rule, research protocols must be
consent” for the storage, maintenance, and yet-to-be
reviewed and approved by an Institutional Review Board
specified secondary research use of identifiable private
(IRB) to ensure that the rights and welfare of the research
information or biospecimens, rather than having to undergo
subjects are protected. The regulations list several criteria
full IRB review and obtain study-specific informed consent
for IRB approval, including the requirement that
(unless waived by the IRB); see Figure 1.
https://crsreports.congress.gov
Updated Common Rule: Research Using Stored Biospecimens
The final rule creates a pair of partial exemptions to the
health information may not be used or disclosed for
Common Rule requirements. The first exemption allows
research purposes without the individual’s authorization,
researchers to store and maintain identifiable information or
unless authorization is waived by an IRB (or equivalent
biospecimens for secondary research use, provided an IRB
privacy board). These HIPAA requirements often apply
conducts a limited review to determine that broad consent
concurrently with the Common Rule if, for example, the
has been obtained and appropriately documented (unless
human subject research is conducted by a HIPAA-covered
documentation is waived). The second exemption allows
entity such as a hospital or any other health care facility.
researchers to conduct secondary research on the stored
To minimize duplicative regulation, the final rule exempts
identifiable information or biospecimens, provided an IRB
from the Common Rule any secondary research on
conducts a limited review to confirm that broad consent
identifiable information or biospecimens that is subject to
was obtained and the secondary research falls within its
the Privacy Rule. As example would be research that takes
scope. The IRB also must determine that there are adequate
place at a HIPAA-regulated institution and involves the
privacy protections in place.
investigator’s use of identifiable health information.
Broad consent for the storage, maintenance, and secondary
research use of identifiable information or biospecimens
Periodic Reexamination of Identifiability
differs from study-specific informed consent. It includes
Privacy advocates question whether the current definition
some but not all of the core elements of informed consent,
of identifiability is sufficient to protect individual privacy.
as well as several additional elements. For example, broad
They point to new technologies that are making it easier to
consent must include a general description of the types of
re-identify information or biospecimens considered to be
research that may be conducted with the identifiable
nonidentifiable. For example, it is possible to re-identify
information or biospecimens, a description of the
supposedly de-identified genomic data by matching it with
identifiable information or biospecimens that might be used
identifiable information from other public databases.
in the research, whether sharing of identifiable information
In response to these concerns, the final rule requires
or biospecimens might occur, and the types of institutions
regulators—within one year and every four years
and researchers that might conduct the research.
thereafter—to reexamine the definition of identifiable and
Broad consent also must indicate how long the identifiable
assess which technologies and techniques can produce
information and biospecimens may be stored and
identifiable information and biospecimens. Genomic
maintained, and how long the identifiable information and
sequencing is expected to be one of the first technologies to
biospecimens may be used for research purposes. In both
be evaluated.
instances that period of time could be indefinite.
HIPAA-Regulated Secondary Research
Under the Health Information Portability and
Accountability Act (HIPAA) Privacy Rule, an individual’s
Figure 1. Primary and Secondary Research with Identifiable Private Information and Biospecimens
Updated Common Rule, Effective January 19, 2018
Source: Adapted by CRS from “A New Day for Oversight of Human Research,” Health Affairs Blog, February 6, 2017.
IF10653
C. Stephen Redhead, Specialist in Health Policy
https://crsreports.congress.gov
Updated Common Rule: Research Using Stored Biospecimens
Disclaimer
This document was prepared by the Congressional Research Service (CRS). CRS serves as nonpartisan shared staff to
congressional committees and Members of Congress. It operates solely at the behest of and under the direction of Congress.
Information in a CRS Report should not be relied upon for purposes other than public understanding of information that has
been provided by CRS to Members of Congress in connection with CRS’s institutional role. CRS Reports, as a work of the
United States Government, are not subject to copyright protection in the United States. Any CRS Report may be
reproduced and distributed in its entirety without permission from CRS. However, as a CRS Report may include
copyrighted images or material from a third party, you may need to obtain the permission of the copyright holder if you
wish to copy or otherwise use copyrighted material.
https://crsreports.congress.gov | IF10653 · VERSION 2 · NEW