Updated Common Rule: Research Using Stored Biospecimens

May 16, 2017 Updated Common Rule: Research Using Stored Biospecimens On January 19, 2017, the Department of Health and Human Services (HHS) and 15 other federal departments and agencies jointly published a final rule to amend the uniform set of regulations—known as the Common Rule—that govern the ethical conduct of research supported by these agencies involving humans (82 Federal Register 7149). The Common Rule has remained virtually unchanged since it was adopted in 1991, while the research landscape has undergone enormous transformation. One key area of change is the rapid growth of research involving biospecimens (e.g., human blood, tissue, and other biological specimens), which increasingly are collected and used for whole genome sequencing and other genetic analysis. Repositories store biospecimens for possible use in future (i.e., secondary) research that may be unrelated to the clinical or research use of the material at the time it was collected. The All of Us research program— part of the Precision Medicine Initiative to accelerate research on personalized treatments tailored to a patient’s genetic and other characteristics—seeks to establish a national research cohort of at least 1 million Americans who will contribute biospecimens for genome sequencing and other analyses (see CRS Insight IN10227, The Precision Medicine Initiative). Traditionally, the Common Rule has protected the rights and welfare of individuals participating in clinical trials and other interventional research. But with the enormous growth in health data analytics—using large databases of clinical, genomic, and other types of data—much of today’s health research involves the analysis of health information rather than direct interactions with research subjects. Consequently, the primary risk for these research participants is no longer physical harm but loss of privacy. According to HHS, the purpose of the final rule is to modernize, simplify, and strengthen the Common Rule to better protect human research subjects, while facilitating new research and reducing burden and ambiguity for investigators. The final rule makes a series of important changes to the Common Rule, almost all of which take effect on January 19, 2018. They include making the informed consent process more transparent and imposing strict new requirements on the information given to prospective research subjects. But it is the treatment of biospecimens that has attracted by far the most public comment. Common Rule: IRB Review and Informed Consent Under the Common Rule, research protocols must be reviewed and approved by an Institutional Review Board (IRB) to ensure that the rights and welfare of the research subjects are protected. The regulations list several criteria for IRB approval, including the requirement that researchers obtain and appropriately document the informed consent of their research subjects. The informed consent process includes an explanation of the purpose of the research, a description of the research procedures, and a description of the risks and benefits of the research, among other things. An IRB may decide to waive the informed consent requirement if it determines that the research poses no more than minimal risk to the subjects, the waiver will not adversely affect their rights and welfare, and the research is not practicable without a waiver. The Common Rule defines human subject research to include not only studies that obtain data “through intervention or interaction with an individual” but also studies that obtain “identifiable private information.” Thus, it applies to non-interventional research using biospecimens and stored data provided the specimens and data are identifiable. The final rule modifies the definition of human subject research to clarify the current interpretation of the regulations by explicitly stating that it includes obtaining and analyzing “information and biospecimens through intervention,” as well as research that “obtains, uses, analyzes, or generates identifiable private information or identifiable biospecimens.” Nonidentifiable private information and nonidentifiable biospecimens remain outside the scope of the Common Rule. The Common Rule states that information is identifiable if the subject’s identity “may readily be ascertained” by the researcher. A biospecimen or genome sequence stripped of any accompanying identifiers (e.g., name, address, social security number) is not considered readily identifiable. During the informed consent process, researchers may seek consent to store identifiable information and biospecimens obtained during the primary research study for use in secondary research. But providing an adequate description of the secondary research is a challenge. Currently, if an IRB reviewing a secondary research project concludes that the original informed consent document does not adequately describe the secondary research, then the researchers must either find the research subjects and obtain their informed consent (unless waived by the IRB) to conduct the new research or strip the identifiers from the research material. Broad Consent for Storage, Maintenance, and Secondary Research Under the final rule, researchers will now have the option of obtaining—subject to limited IRB review—“broad consent” for the storage, maintenance, and yet-to-be specified secondary research use of identifiable private information or biospecimens, rather than having to undergo full IRB review and obtain study-specific informed consent (unless waived by the IRB); see Figure 1. https://crsreports.congress.gov Updated Common Rule: Research Using Stored Biospecimens The final rule creates a pair of partial exemptions to the Common Rule requirements. The first exemption allows researchers to store and maintain identifiable information or biospecimens for secondary research use, provided an IRB conducts a limited review to determine that broad consent has been obtained and appropriately documented (unless documentation is waived). The second exemption allows researchers to conduct secondary research on the stored identifiable information or biospecimens, provided an IRB conducts a limited review to confirm that broad consent was obtained and the secondary research falls within its scope. The IRB also must determine that there are adequate privacy protections in place. Broad consent for the storage, maintenance, and secondary research use of identifiable information or biospecimens differs from study-specific informed consent. It includes some but not all of the core elements of informed consent, as well as several additional elements. For example, broad consent must include a general description of the types of research that may be conducted with the identifiable information or biospecimens, a description of the identifiable information or biospecimens that might be used in the research, whether sharing of identifiable information or biospecimens might occur, and the types of institutions and researchers that might conduct the research. Broad consent also must indicate how long the identifiable information and biospecimens may be stored and maintained, and how long the identifiable information and biospecimens may be used for research purposes. In both instances that period of time could be indefinite. health information may not be used or disclosed for research purposes without the individual’s authorization, unless authorization is waived by an IRB (or equivalent privacy board). These HIPAA requirements often apply concurrently with the Common Rule if, for example, the human subject research is conducted by a HIPAA-covered entity such as a hospital or any other health care facility. To minimize duplicative regulation, the final rule exempts from the Common Rule any secondary research on identifiable information or biospecimens that is subject to the Privacy Rule. As example would be research that takes place at a HIPAA-regulated institution and involves the investigator’s use of identifiable health information. Periodic Reexamination of Identifiability Privacy advocates question whether the current definition of identifiability is sufficient to protect individual privacy. They point to new technologies that are making it easier to re-identify information or biospecimens considered to be nonidentifiable. For example, it is possible to re-identify supposedly de-identified genomic data by matching it with identifiable information from other public databases. In response to these concerns, the final rule requires regulators—within one year and every four years thereafter—to reexamine the definition of identifiable and assess which technologies and techniques can produce identifiable information and biospecimens. Genomic sequencing is expected to be one of the first technologies to be evaluated. HIPAA-Regulated Secondary Research Under the Health Information Portability and Accountability Act (HIPAA) Privacy Rule, an individual’s Figure 1. Primary and Secondary Research with Identifiable Private Information and Biospecimens Updated Common Rule, Effective January 19, 2018 Source: Adapted by CRS from “A New Day for Oversight of Human Research,” Health Affairs Blog, February 6, 2017. IF10653 C. Stephen Redhead, Specialist in Health Policy https://crsreports.congress.gov Updated Common Rule: Research Using Stored Biospecimens Disclaimer This document was prepared by the Congressional Research Service (CRS). CRS serves as nonpartisan shared staff to congressional committees and Members of Congress. It operates solely at the behest of and under the direction of Congress. Information in a CRS Report should not be relied upon for purposes other than public understanding of information that has been provided by CRS to Members of Congress in connection with CRS’s institutional role. CRS Reports, as a work of the United States Government, are not subject to copyright protection in the United States. Any CRS Report may be reproduced and distributed in its entirety without permission from CRS. However, as a CRS Report may include copyrighted images or material from a third party, you may need to obtain the permission of the copyright holder if you wish to copy or otherwise use copyrighted material. https://crsreports.congress.gov | IF10653 · VERSION 2 · NEW