Updated Common Rule: Key Changes for Research Using Stored Biospecimens

December 10, 2018 Updated Common Rule: Key Changes for Research Using Stored Biospecimens On January 19, 2017, the Department of Health and Human Services (HHS) and 15 other federal departments and agencies jointly published a final rule to amend the uniform set of regulations—known as the Common Rule—that govern the ethical conduct of research supported by these agencies involving humans (82 Federal Register 7149). According to HHS, the purpose of the final rule is to modernize, simplify, and strengthen the Common Rule to better protect human research subjects, while facilitating new research and reducing burden and ambiguity for investigators. The Common Rule had remained virtually unchanged since it was adopted in 1991, while the research landscape has undergone significant transformation. Traditionally, the Common Rule has protected the rights and welfare of individuals participating in clinical trials and other interventional research. However, much of today’s health research involves the analysis of health information rather than direct interactions with research subjects due to the growth in health data analytics, that is, using large databases of clinical, genomic, and other types of data in health research. Consequently, the primary risk for these research participants is no longer physical harm, but rather loss of privacy and loss of control over the use of their information. The rapid growth of research involving biospecimens, which increasingly are collected and used for whole genome sequencing and other genetic analysis, in particular has resulted in new challenges in the protection of human research subjects. Repositories store biospecimens for possible use in future (i.e., secondary) research that may be unrelated to the primary clinical or research use of the material. For example, the All of Us research program—part of the Precision Medicine Initiative (PMI) to accelerate research on personalized treatments tailored to a patient’s characteristics—seeks to establish a national cohort of at least 1 million Americans who will contribute biospecimens for genome sequencing and other unspecified analyses. The final rule made a series of changes to the Common Rule, including, among others, making the informed consent process more transparent and imposing strict new requirements on the information given to prospective research subjects; changes to existing and creation of new exemptions to the requirements; and definitional changes, among other things. Many of these changes together create a new approach to regulating research with identifiable private information and biospecimens, and it is these changes that have generally received the most attention. The general compliance date of the revised common rule (referred to as the “2018 Rule” or the “2018 Requirements”) was delayed initially to July 19, 2018 (83 Federal Register 2885), and again to January 21, 2019 (83 Federal Register 28497), from the original compliance date of January 19, 2018. Definition of Human Subject Research The Common Rule defines human subject research to include not only studies that obtain data “through intervention or interaction with an individual,” but also studies that obtain “identifiable private information.” Thus, it applies to noninterventional research using biospecimens and stored data provided the specimens and data are identifiable. The Common Rule states that information is identifiable if the subject’s identity “may readily be ascertained” by the researcher. A biospecimen or genome sequence stripped of any accompanying identifiers (e.g., name, address, social security number) is not considered to be readily identifiable. The final rule modifies the definition of human subject research to clarify the current interpretation of the regulations by explicitly stating that it includes obtaining and analyzing “information and biospecimens through intervention,” as well as research that “obtains, uses, analyzes, or generates identifiable private information or identifiable biospecimens.” Research using nonidentifiable private information and nonidentifiable biospecimens remains outside the scope of the Common Rule. IRB Review and Informed Consent Under the Common Rule, research protocols must be reviewed and approved by an Institutional Review Board (IRB) to ensure that the rights and welfare of the research subjects are protected. The regulation lists several criteria for IRB approval, including the requirement that researchers obtain and appropriately document the informed consent of their research subjects. The informed consent process includes an explanation of the purpose of the research, a description of the research procedures, and a description of the risks and benefits of the research, among other things. An IRB may decide to waive the informed consent requirement if it determines that the research poses no more than minimal risk to the subjects, the waiver will not adversely affect their rights and welfare, and the research is not practicable without a waiver. The final rule adds new informed consent requirements relating to any research involving the collection of identifiable biospecimens or private information. Specifically, it requires that the informed consent include either a statement that de-identified biospecimens may be used in future research without additional consent or that the subject’s biospecimens or private information will never https://crsreports.congress.gov Updated Common Rule: Key Changes for Research Using Stored Biospecimens be used in future research (45 C.F..R §46.116(b)(9)). In addition, it requires, where applicable, that the consent include statements about the possibility of commercial profit from such research where that exists and whether the research will include whole genome sequencing (45 C.F.R. §46.116(c)(7) and (9)). Currently, if an IRB reviewing a secondary research project concludes that the original informed consent document does not adequately describe the secondary research—which can be challenging given details of the research may be hard to predict—then the researchers must either find the research subjects and obtain their informed consent (unless waived by the IRB) to conduct the new research or strip the identifiers from the research material. To help address this issue, the final rule added a new category of broad consent, which allows researchers to gain consent for secondary research studies at the time of the initial study and consent process. Broad Consent for Storage, Maintenance, and Secondary Research Broad consent for the storage, maintenance, and secondary research use of identifiable information or biospecimens differs from study-specific informed consent. It includes some but not all of the core elements of informed consent, as well as several additional elements. For example, broad consent must include a general description of the types of research that may be conducted with the identifiable information or biospecimens; a description of the identifiable information or biospecimens that might be used in the research; whether sharing of identifiable information or biospecimens might occur; and the types of institutions and researchers that might conduct the research. Under the final rule, researchers now have the option of obtaining—subject to limited IRB review—“broad consent” for the storage, maintenance, and yet-to-be specified secondary research use of identifiable private information or biospecimens, rather than having to undergo full IRB review and obtain study-specific informed consent (unless waived by the IRB). The final rule creates a new pair of partial exemptions to the Common Rule requirements for secondary research on identifiable biospecimens or information where broad consent has been obtained. The first exemption allows researchers to store and maintain identifiable information or biospecimens for secondary research use, provided an IRB conducts a limited review to determine that broad consent has been obtained and appropriately documented (45 C.F.R. §46.104(d)(7)). The second exemption allows researchers to conduct secondary research on the stored identifiable information or biospecimens, provided an IRB conducts a limited review to confirm that (1) broad consent was obtained and appropriately documented, and (2) the secondary research falls within its scope (45 C.F.R. §46.104(d)(8)). The IRB also must determine that there are adequate privacy protections in place. personal health information (PHI) may not be used or disclosed for research purposes without the individual’s authorization, unless authorization is waived by an IRB (or equivalent privacy board). These HIPAA requirements often apply concurrently with the Common Rule if, for example, the human subject research is conducted by a HIPAA-covered entity such as a hospital or any other health care facility. To minimize duplicative regulation, the final rule exempts from the Common Rule any secondary research on identifiable information or biospecimens that is subject to the Privacy Rule. An example of this type of research would be research that takes place at a HIPAAregulated institution and that involves the investigator’s use of PHI. Periodic Reexamination of Identifiability Privacy advocates question whether the current definition of identifiability is sufficient to protect individual privacy. They point to new technologies that are making it easier to re-identify information or biospecimens considered to be nonidentifiable. For example, it is possible to re-identify supposedly de-identified genomic data by matching it with identifiable information from other public databases. In response to these concerns, the final rule requires regulators—within one year and every four years thereafter—to reexamine the definition of identifiable and assess which technologies and techniques can produce identifiable information and biospecimens. Genomic sequencing is expected to be one of the first technologies to be evaluated. Harmonization with FDA’s Human Research Subjects Regulations The Food and Drug Administration (FDA) has issued its own set of Human Subject Regulations, which are similar, but not identical, to the Common Rule (21 C.F.R. Parts 50 and 56). FDA generally applies these regulations to all the research it regulates, including clinical trials of new drugs and medical devices, regardless of the source of funding for the research. In certain cases, where a clinical study is both federally funded and is investigating an FDA-regulated medical product, researchers will be subject to both sets of regulations. Section 3023 of the 21st Century Cures Act (P.L. 114-255) requires the HHS Secretary, to the extent possible, to harmonize differences between the Common Rule and the FDA Human Subject Regulations. This harmonization must be completed by no later than December 13, 2019. The FDA has indicated its intention to undertake rulemaking in 2019 in the fall 2018 Unified Regulatory Agenda to accomplish harmonization. In the interim, the agency acknowledges that given the revisions to the Common Rule and a lack of harmonization with FDA regulations, confusion may arise for researchers subject to both sets of regulations. Therefore, FDA has published guidance entitled “Impact of Certain Provisions of the Revised Common Rule on FDA-Regulated Clinical Investigators” to help clarify how to meet requirements of both sets of regulations, where necessary. Amanda K. Sarata, Specialist in Health Policy HIPAA-Regulated Secondary Research Under the Health Information Portability and Accountability Act (HIPAA) Privacy Rule, an individual’s https://crsreports.congress.gov IF11043 Updated Common Rule: Key Changes for Research Using Stored Biospecimens Disclaimer This document was prepared by the Congressional Research Service (CRS). CRS serves as nonpartisan shared staff to congressional committees and Members of Congress. It operates solely at the behest of and under the direction of Congress. Information in a CRS Report should not be relied upon for purposes other than public understanding of information that has been provided by CRS to Members of Congress in connection with CRS’s institutional role. CRS Reports, as a work of the United States Government, are not subject to copyright protection in the United States. Any CRS Report may be reproduced and distributed in its entirety without permission from CRS. However, as a CRS Report may include copyrighted images or material from a third party, you may need to obtain the permission of the copyright holder if you wish to copy or otherwise use copyrighted material. https://crsreports.congress.gov | IF11043 · VERSION 2 · NEW