Source: https://www.federalregister.gov/articles/2011/07/26/2011-18792/human-subjects-research-protections-enhancing-protections-for-research-subjects-and-reducing-burden
Timestamp: 2015-11-29 01:35:50
Document Index: 656870085

Matched Legal Cases: ['art 46', 'art 46', '§ 46', '§ 46', 'art 46', 'art 22', 'art 46', 'art 160', 'art 164', 'art 46', '§ 46', 'art 46', 'art 160', 'art 164', 'art 160', 'art 164']

Federal Register | Human Subjects Research Protections: Enhancing Protections for Research Subjects and Reducing Burden, Delay, and Ambiguity for Investigators
A Proposed Rule by the Health and Human Services Department and the Food and Drug Administration on
-44531 (20 pages)
Document Number: 2011-18792
Shorter URL: https://federalregister.gov/a/2011-18792 Action
U.S. Federal regulations governing the protection of human subjects in research have been in existence for more than three decades. Twenty years have passed since the “Common Rule,” (codified at Subpart A of 45 CFR part 46) was adopted by 15 U.S. Federal departments and agencies in an effort to promote uniformity, understanding, and compliance with human subject protections.
Since the Common Rule was developed, the landscape of research activities has changed dramatically, accompanied by a marked increase in the volume of research. It is estimated that total spending on health-related research and development by the drug industry and the Federal government has tripled since 1990.
While traditional biomedical research conducted in academic medical centers continues to flourish, many studies are now also conducted at community hospitals, outpatient clinics, or physician-based practices. Clinical research is regularly conducted at multiple institutions across the U.S. and other countries. Recruitment firms, bioinformatics specialists, clinical trial coordinating centers, protocol developers, data analysts, contract research organizations (CROs), data and safety monitoring committees, community-based organizations, and other entities have joined investigators and sponsors as part of the clinical research enterprise.
The rapid growth and expansion of human subjects research has led to many questions about whether the current regulatory framework is adequate and appropriate for the protection of human subjects in the 21st century. Furthermore, decades of experience have revealed a great deal about the functioning—and limitations—of existing regulations, and prompted critical evaluations by the Institute of Medicine (IOM),
the U.S. Government Accountability Office,
and many scholars.
Federal consideration of such revisions to the regulatory schema, in addition to the issues that suggest a need for revision, is not without precedent. In its 2001 concluding report, the National Bioethics Advisory Commission (NBAC) made 30 recommendations that addressed areas including the scope and structure of the oversight system, the level of review applied to research, emphasizing the informed consent process, documentation and waiver of informed consent, protecting privacy and confidentiality, adverse event reporting, and review of cooperative or multi-site research studies.
NBAC's recommendations are one source for the revisions in the Common Rule currently being considered. Addressing these considerations now is timely and consistent with the President's Executive Order requiring Federal agencies to review existing significant regulations to determine whether they should be modified, streamlined, expanded, or repealed to make the agency's regulatory program more effective or less burdensome in achieving the regulatory objective.
The concerns about the current Common Rule can roughly be categorized into seven areas. First, the system has been criticized as not adequately calibrating the review process to the risk of research. Critics have raised concerns that some IRBs spend considerable time reviewing minimal risk research, and that some IRBs have a tendency to overestimate the magnitude and probability of reasonably foreseeable risks.
Because significantly more research studies require convened IRB review, this greater IRB workload diverts time and resources from review of research that poses greater risks, theoretically resulting in inadequate attention to research that could seriously harm subjects.
Questions have been raised about the appropriateness of the review process for social and behavioral research.
The nature of the possible risks to subjects is often significantly different in many social and behavioral research studies as compared to biomedical research, and critics contend that the difference is not adequately reflected in the current rules. While physical risks generally are the greatest concern in biomedical research, social and behavioral studies rarely pose physical risk but may pose psychological or informational risks. Some have argued that, particularly given the paucity of information suggesting significant risks to subjects in certain types of survey and interview-based research, the current system over-regulates such research.
Further, many critics see little evidence that most IRB review of social and behavioral research effectively does much to protect research subjects from psychological or informational risks.
Over-regulating social and behavioral research in general may serve to distract attention from attempts to identify those social and behavioral research studies that do pose threats to the welfare of subjects and thus do merit significant oversight.
Second, critics have commented about the inefficiencies of review by multiple IRBs for multi-site studies, which add bureaucratic complexity to the review process and delay initiation of research projects without evidence that multiple reviews provide additional protections to subjects.
There also has been a concern that the current multiple review system might actually be leading to weaker protections for subjects than if there were fewer reviews but greater responsibility on the part of the IRBs involved.
Third, questions have been raised about the extent and quality of the protections afforded by current informed consent requirements and practices. A variety of critics have highlighted problems with consent forms. In some research studies, consent forms have become lengthy and are often written in highly technical terms.
Many also claim that consent forms have evolved to protect institutions rather than to actually provide salient information to potential human subjects.
This is especially problematic if the forms fail to include information that is crucial for making a decision about participation, including appropriate information about financial relationships between researchers and study sponsors, or are written in a way that potential subjects are likely to fail to notice such information. At the same time, others raise concerns about the rigid application of written consent to all forms of research, especially research involving surveys, interviews, focus groups, or other similar methodologies.
In these types of research, it has been argued that written documentation of consent is unnecessary and that answering questions should be sufficient to indicate individual consent to participate.
Fourth, increasing use of genetic information, existing (i.e., stored) biospecimens, medical records, and administrative claims data in research has changed the nature of the risks and benefits of research participation. Risks related to these types of research are not physical but informational (e.g., resulting from the unauthorized release of information about subjects). The Privacy Rule promulgated under the Health Insurance Portability and Accountability Act of 1996 (HIPAA)
addresses some of these informational risks by imposing restrictions on how certain identifiable health information collected by health plans, healthcare clearinghouses, and certain healthcare providers (“covered entities”) may be used and disclosed, including for research. In addition, the HIPAA Security Rule requires that these entities implement certain administrative, physical, and technical safeguards to protect this information when in electronic form from unauthorized use or disclosure. However, the HIPAA Rules apply only to covered entities (and in certain respects to their business associates), and not all investigators are part of a covered entity (or business associates of a covered entity). Separate from the HIPAA Rules, the Privacy Act of 1974, as amended (5 U.S.C. 552a
) requires Federal agencies to protect personally identifiable information in their possession and control. However, it does not apply to non-Federal researchers.
Fifth, the monitoring and evaluation of the current system for protecting human subjects has been criticized.
Sixth, concerns have been expressed that the current regulatory system does not adequately protect all research subjects.
For instance, only some research studies funded by certain Federal agencies or those that involve the development of products subject to regulation by the FDA, are subject to the Common Rule or similar protections. As a result, there are many studies that are not subject to any such Federal oversight, even though they may involve substantial risks to the subjects.
Seventh, the multiple, differing regulatory requirements that can apply to a single research study have been criticized as complex, inconsistent, and lacking in clarity, which results in unwarranted variability across institutions and their IRBs in how the requirements are interpreted and implemented.
For example, Federal agencies that have adopted the Common Rule have issued guidance and developed norms of implementation that sometimes differ and may, in certain instances, even conflict with guidance from other Common Rule agencies. Similarly, the overlapping and sometimes, arguably, inconsistent requirements of the Common Rule and the HIPAA Privacy Rule have been criticized as being overly complex, causing confusion and frustration among investigators, IRBs, and others trying to comply with both sets of requirements.
We believe the proposals we are considering uphold and better reflect the ethical principles upon which the Common Rule is based. We recognize that this ANPRM is both lengthy and detailed. However this level of detail reflects the importance and types of changes that have been proposed by the Institute of Medicine (IOM), NBAC, and other commentators and are now being considered for adoption. Comment is now sought on these proposals and on the broader question of how to modernize, simplify, and enhance the current system. The intent is to revise the Common Rule
recognizing that other laws and regulations, such as the other subparts of the HHS human subjects protection regulations (Subparts B, C, and D, which deal with particular populations of vulnerable subjects, and Subpart E of 45 CFR part 46), FDA regulations, and the HIPAA Privacy Rule most likely will be affected and will need to be harmonized, as appropriate, with any proposed regulatory changes made to the Common Rule.
As we consider how the current regulations governing human subjects research should be revised, we will take into account the deliberations of the Presidential Commission for the Study of Bioethical Issues. We will also consider the public comments received on the request for information that the Commission issued on March 2, 2011, that sought public comment on the current Federal and international standards for protecting the health and well-being of participants in scientific studies supported by the Federal Government.
II. Ensuring Risk-Based Protections Back to Top
2. The next level of review is expedited review.
This generally involves review by a single IRB member. A study is eligible for expedited review if the research appears on a list published by the Secretary of HHS of categories of research eligible for such review, and the research is found by the reviewer(s) to involve no more than minimal risk.
3. Certain studies are exempt from IRB review.
The regulations specify six “exemption” categories; a study must fall within one or more of these six categories to be exempted from IRB review altogether. Although these studies are not subject to the Common Rule, and no review is actually required, guidance issued by the Office for Human Research Protection (OHRP) recommends that there be some type of review by someone other than the investigator to confirm that the study qualifies as exempt, and many institutions do indeed impose such a requirement.
There has been criticism about this regulatory framework for reviewing research studies. Although it does attempt to match the level of review to the type of risks posed by a study, many argue that it does so in a less than ideal manner. For instance, many surveys that are unlikely to lead to any harm to subjects nonetheless undergo review by a convened IRB.
Further, arguments have been made that some of the lines drawn between review categories are vague and difficult to apply.
Studies have shown that different levels of review are sometimes required by different IRBs for the same study. 43 44
In response to these concerns, the IOM report on research protections recommended revising the current approach: “The degree of scrutiny, the extent of continuing oversight, and the safety monitoring procedures for research proposals should be calibrated to a study's degree of risk. Minimal risk studies should be handled diligently, but expeditiously, while studies involving high risk should receive the extra time and attention they require.”
The IOM surmised that this would reduce burdens that do not translate into meaningful protections of human subjects and would limit unnecessary drain on resources, enabling IRBs to give more attention to high risk studies and critical protection activities while improving the efficiency with which research projects are reviewed and overseen.
Most research risks to the individual can be categorized into one of three types: physical, psychological, and informational risks. (Although there are other harms, such as legal, social, and economic harms, these can usually be viewed as variations on those core categories.) Physical risks are the most straightforward to understand—they are characterized by short term or long term damage to the body such as pain, bruising, infection, worsening current disease states, long-term symptoms, or even death. Psychological risks can include unintentional anxiety and stress including feelings of sadness or even depression, feelings of betrayal, and exacerbation of underlying psychiatric conditions such as post traumatic stress disorder. Psychological risks are not necessarily restricted to psychiatric or social and behavioral research.
Currently, IRBs evaluate all three categories of risk. IRB review or oversight of research posing informational risks may not be the best way to minimize the informational risks associated with data on human subjects. It is not clear that members have appropriate expertise regarding data protections. The current assumption that IRBs are responsible for reviewing and adequately addressing informational risks appears to lead to inconsistent protections and some cases in which there are inadequate protections for the information.
Furthermore, review of informational risk is an inefficient use of an IRB's time. Standardized data protections, rather than IRB review, may be a more effective way to minimize informational risks.
Under the Common Rule, a new research study can receive expedited review if the research activities to be conducted appear on the list of activities published by the Secretary of HHS that are eligible for such review (http://www.hhs.gov/ohrp/policy/expedited98.html), and is found by the reviewer(s) to involve no more than minimal risk. For research that will receive expedited review, three changes are being considered: (1) Revising the criteria that make research studies eligible for expedited review, (2) eliminating the requirement of routine annual continuing review of expedited studies, and (3) streamlining submission requirements.
As noted, currently a study can undergo expedited review if all of the activities involved appear on the list of eligible research activities and the study is found to be minimal risk. The current definition of minimal risk encompasses research activities where “the probability and magnitude of harm or discomfort anticipated in the research are not greater in and of themselves than those ordinarily encountered in daily life or during the performance of routine physical or psychological examinations or tests.”
Since the listed activities are ones with which there is a great deal of experience, and their risks are well known, it should be a rare instance in which a study that uses only the listed activities will, as a whole, pose more than minimal risk. Yet many studies which use only those activities—particularly those in the social and behavioral field—are frequently required to undergo review by a convened IRB.
We are accordingly considering providing a default presumption in the regulations that a study which includes only activities on the list is a minimal risk study and should receive expedited review. A reviewer would have the option of determining that the study should be reviewed by a convened IRB, when that conclusion is supported by the specific circumstances of the study.
4. Informed consent will be sought from each prospective subject or the subject's legally authorized representative, in accordance with, and to the extent required by § 46.116.
5. Informed consent will be appropriately documented, in accordance with, and to the extent required by § 46.117.
Question 7: What research activities, if any, should be added to the published list of activities that can be used in a study that qualifies for expedited review? Should any of the existing activities on that list be removed or revised? For instance, should the following be included as minimal risk research activities:
2. We are considering whether to include on the list of Excused studies certain types of social and behavioral research, conducted with competent adults, that would involve specified types of benign interventions beyond educational tests, surveys, focus groups, interviews, and similar procedures, that are commonly used in social and behavioral research, that are known to involve virtually no risk to subjects, and for which prior review does little to increase protections to subjects. These would be methodologies which are very familiar to people in everyday life and in which verbal or similar responses would be the research data being collected. For example, a researcher might ask subjects to watch a video, or read a paragraph or solve puzzles, and then ask them some questions to elicit word associations or time performance of activities. The specific methodologies might be spelled out in regulations, or they might be promulgated via a periodic mechanism to announce and update lists similar to the list that is published for activities that allow a study to be expedited.
In most instances, the consent requirements described above would have been met at the time that the biospecimens or data were initially collected, when the subject would have signed a standard, brief general consent form allowing for broad, future research. This brief consent could be broad enough to cover all data and biospecimens to be collected related to a particular set of encounters with an institution (e.g. hospitalization) or to any data or biospecimens to be collected at anytime by the institution. Importantly, this standardized general consent form would permit the subject to say no to all future research. In addition, there are likely to be a handful of special categories of research with biospecimens that, given the unique concerns they might raise for a significant segment of the public, would be dealt with by check-off boxes allowing subjects to separately say yes or no to that particular type of research (e.g., perhaps creating a cell line, or reproductive research). Participation in a research study (such as a clinical trial) could not be conditioned on agreeing to allow future open-ended research using a biospecimen. With regard to the secondary research use of pre-existing data, on those occasions when oral consent was acceptable under the regulations for the initial data collection, it is envisioned that subjects would have typically provided their oral consent for future research at the time of the initial data collection; a written consent form would not have to be signed in that circumstance. Table 1 at the end of Section V illustrates the consent requirements for pre-existing data in the context of the data security and information protection requirements which would also apply.
Question 23: Under what circumstances should it be permissible to waive consent for research involving the collection and study of existing data and biospecimens as described in Section 3(a)(3) above? Should the rules for waiving consent be different if the information or biospecimens were originally collected for research purposes or non-research purposes? Should a request to waive informed consent trigger a requirement for IRB review? Question 24: The Common Rule has been criticized for inappropriately being applied to—and inhibiting research in— certain activities, including quality improvement, public health activities, and program evaluation studies. 50 51 52 Regarding quality improvement, for example, these activities are in many instances conducted by health care and other organizations under clear legal authority to change internal operating procedures to increase safety or otherwise improve performance, often without the consent of staff or clients, followed by monitoring or evaluation of the effects. It is far from clear that the Common Rule was intended to apply to such activities, nor that having it apply produces any meaningful benefits to the public. Indeed, its application to such activities, and requiring IRB review and compliance with informed consent requirements, might have a chilling effect on the ability to learn from, and conduct, important types of innovation. We seek comment on whether and, if so, how, the Common Rule should be changed to clarify whether or not oversight of quality improvement, program evaluation studies, or public health activities are covered. Are there specific types of these studies for which the existing rules (even after the changes proposed in this Notice) are inappropriate? If so, should this problem be addressed through modifications to the exemption (Excused) categories, or by changing the definition of “research” used in the Common Rule to exclude some of these studies, or a combination of both? And if the definition of research were to be changed, how should the activities to be excluded be defined (e.g.,“quality improvement” or “program evaluation”)? Are there some such activities that should not be excluded from being subject to the Common Rule because the protections provided by that rule are appropriate and no similar protections are provided by other regulations? With regard to quality improvement activities, might it be useful to adopt the distinction made by the HIPAA Privacy Rule (45 CFR 164.501(1)), which distinguishes between “health care operations” and “research” activities, defining “health care operations” to include “conducting quality assessment and improvement activities, including outcomes evaluation and development of clinical guidelines, provided that the obtaining of generalizable knowledge is not the primary purpose of any studies resulting from such activities”?
Question 27: The Common Rule currently states (45 CFR 46.111(a)(2)) that an IRB “should not consider possible long-range effects of applying knowledge gained in the research (for example, the possible effects of the research on public policy) as among the research risks that fall within the purview of its responsibility.” Do IRBs correctly interpret this provision as meaning that while they should be evaluating risks to the individual subjects participating in a study, it is not part of their mandate to evaluate policy issues such as how groups of persons or institutions, for example, might object to conducting a study because the possible results of the study might be disagreeable to them?
If that is not how the provision is typically interpreted, is there a need to clarify its meaning?
III. Streamlining IRB Review of Multi-Site Studies Back to Top
Currently, a substantial amount of research takes place by means of multi-site studies wherein a single research study is conducted at numerous institutions. Multi-site studies are particularly common in clinical trials, survey epidemiology, and education contexts. While the Common Rule does require that each institution engaged in a multi-site research study obtain IRB approval of the study, it does not require that a separate local IRB at each institution conduct such review. (Note: While the Common Rule does not require local IRB review by each institution engaged in a multi-site research study, the statute that pertains to FDA's regulation of device investigations requires sponsors to submit the protocol to the “local institutional review committee which has been established in accordance with regulations of the Secretary to supervise clinical testing of devices in the facilities where the proposed clinical testing is to be conducted.” The only statutory exception is if a local IRB does not exist or its review is determined to be “inadequate” (21 U.S.C. 360j(g)(3)(A)). Accordingly, the change proposed in this ANPRM regarding the use of one IRB of record for multi-site studies would not apply to FDA-regulated device studies.) However, in many cases, a local IRB for each institution does independently review the research protocol, informed consent documents and other materials, sometimes resulting in hundreds of reviews for one study. When any one of these IRBs requires changes to the research protocol that are adopted for the entire study, investigators must re-submit the revised protocol to all of the reviewing IRBs. This process can take many months and can significantly delay the initiation of research projects. Separately, there are reports showing that there can be widely differing outcomes regarding the level of review required from IRB to IRB, even for identical studies.
The choice to have multi-site research reviewed by a central IRB, or by an IRB at another institution, is voluntary. In practice, most institutions have been reluctant to replace review by their local IRBs with review by a central IRB. 55 56 Participants in two meetings on alternative IRB models that OHRP co-sponsored in November 2005 and November 2006 indicated that one of the key factors influencing institutions' decisions about this issue is OHRP's current practice of enforcing compliance with the Common Rule through the institutions that were engaged in human subjects research, even in circumstances when the regulatory violation is directly related to the responsibilities of an external IRB.
claim that multiple IRB reviews do not enhance the protection of human subjects and may, in fact, divert valuable resources from more detailed reviews of other studies. Relevant local contextual issues (e.g., investigator competence, site suitability) pertinent to most clinical studies can be addressed through mechanisms other than local IRB review. For research where local perspectives might be distinctly important (e.g., in relation to certain kinds of vulnerable populations targeted for recruitment) local IRB review could be limited to such consideration(s), but again, IRB review is not the only mechanism for addressing such issues. The evaluation of a study's social value, scientific validity, and risks and benefits, and the adequacy of the informed consent document and process generally do not require the unique perspective of a local IRB.
To respond to this concern, central IRBs have been developed. The National Cancer Institute created a central IRB for adult research studies in 2001 and a central pediatric oncology IRB in 2004. Similarly, the Department of Veterans Affairs has required review of certain multi-site protocols by a single national IRB since 2008. Also, certain groups of private institutions have joined together to develop their own central IRBs. These central IRBs reduce the workload for local IRBs and may minimize institutional conflicts of interest. Since 2006, FDA has endorsed the use of a centralized IRB review process in multi-site clinical trials of investigational new drugs and has issued guidance intended to assist sponsors, institutions, IRBs, and clinical investigators on its implementation.
Public comment is requested on the feasibility, advantages, and disadvantages of mandating that all domestic sites in a multi-site study rely upon a single IRB as their IRB of record for that study. (This would apply regardless of whether the study underwent convened review or expedited review.) This proposal would only affect which IRB would be designated as the IRB of record for institutional compliance with the IRB review requirements of the Common Rule. It would not relieve any site of its other obligations under the regulations to protect human subjects. Nor would it prohibit institutions from choosing, for their own purposes, to conduct additional internal ethics reviews, though such reviews would no longer have any regulatory status in terms of compliance with the Common Rule (and could be discouraged). To address institutions' concerns about OHRP's practice of enforcing compliance with 45 CFR part 46 through the institutions that are engaged in human subjects research, appropriate accompanying changes would be made in enforcement procedures to hold external IRBs directly accountable for compliance with certain regulatory requirements (see, e.g., the proposal on IRB accountability released by OHRP in 2009, at http://www.hhs.gov/ohrp/newsroom/rfc/com030509.html)
IV. Improving Informed Consent Back to Top
Currently, under the Common Rule and FDA regulations, investigators generally must obtain and document the subjects' informed consent to participate in research.
The regulations currently require that the consent forms include at least eight specific items of information. Various aspects of the consent forms have been heavily criticized, as has the amount of time IRBs devote to editing and revising consent forms.
In addition, consent forms may frequently fail to include some of the most important pieces of information that a person would need in order to make an “enlightened decision” (to quote the Nuremberg Code) to enroll in a research study.
Instead of presenting the information in a way that is most helpful to prospective subjects—such as explaining why someone might want to choose not to enroll—the forms often function as sales documents, instead of as genuine aids to good decision-making.
While the regulations have changed in only relatively modest ways since 1974, the average length of consent forms has been increasing since then,
and the forms have become excessively long and legalistic, even for relatively routine and low risk research studies.
For example, it is not uncommon for the documents to stretch to 15 or even 30 pages in length. Moreover, studies have shown that the reading level of many of these documents is above the desired 8th grade level. 65 66 67 Length and high reading levels may inhibit people from reading the full document and from understanding relevant information. Further, some have argued that the requirements for obtaining waivers of informed consent or waivers of documentation of informed consent are confusing and inflexible, which leads to inconsistent application.
These problems may not be inherent in the language of the Common Rule, but there may be some changes to the regulations or clarifications as to how to interpret and implement such regulations that could improve informed consent documents and process.
Currently the Common Rule permits an IRB to waive the requirements for obtaining informed consent under two sets of circumstances (45 CFR 46.116 (c) or (d)).
The most common set of circumstances requires that four specific criteria be satisfied (45 CFR 46.116(d)). Many commentators have argued that these conditions for waiver of consent are vague and applied haphazardly at different institutions. 70 71 In response to these concerns, the Secretary's Advisory Committee on Human Research Protections (SACHRP), through its Subcommittee on Subpart A, developed several recommendations regarding the interpretation of these waiver criteria.
Critics of the existing rules have observed that the current requirements for informed consent for future research with pre-existing data and biospecimens are confusing and consume substantial amounts of researchers' and IRBs' time and resources. Under the Common Rule and the HIPAA Privacy Rule, if identifiers are removed, specimens and data that have been collected for purposes other than the proposed research can be used without any requirement for informed consent or a HIPAA authorization. When these identifiers have not been removed, under the Common Rule, investigators may be allowed in certain situations to obtain a general consent for future research with existing biospecimens and other information stored in databases. Conversely, the Department's current interpretation of the HIPAA Privacy Rule requires that authorizations for research be study-specific. Thus, the Privacy Rule currently has not been interpreted to permit general authorizations for future unspecified research uses of health information. Importantly, the HHS Office for Civil Rights (OCR) has recently sought and is currently reviewing public comment on the extent to which a single general authorization may cover a range of future research uses of an individual's health information (see 75 FR 40868, 40893 available at http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/nprmhitech.pdf).
Because biospecimens and data that have been collected for clinical use or purposes other than for the proposed research are often an important source of information and material for investigators, and the reuse of existing data and materials can be an efficient mechanism for conducting research without presenting additional physical or psychological risks to the individual, it seems prudent to consider changes to current regulations. As the IOM recently stated in Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research, it is important to “facilitate important health research by maximizing the usefulness of patient data associated with biospecimens banks and in research databases, thereby allowing novel hypotheses to be tested with existing data and materials as knowledge and technology improve.”
Some critics, including potential and former research subjects, object to research performed on a person's biospecimens without consent. This was recently highlighted in the book, The Immortal Life of Henrietta Lacks.
Conversely, investigators are concerned that the need for informed consent for every use of a biospecimen will greatly inhibit research. 75 76 77 They worry that obtaining individual consent for each separate research study will create unmanageable logistical demands, making valuable research impossible. They also worry that research will be skewed by individuals who refuse consent, undermining the scientific validity of the research. An accumulating body of data indicates that while most individuals want to be able to decide whether their biospecimens are available for research, they often do not desire to have control over which specific researchers use their samples, for which diseases, at which institutions. 78 79 80
Question 47: Should there be a change to the current practice of allowing research on biospecimens that have been collected outside of a research study (i.e.“left-over” tissue following surgery) without consent, as long as the subject's identity is never disclosed to the investigator?
Question 53: In cases in which consent for future research use is not obtained at the time of collection, should there be a presumption that obtaining consent for the secondary analysis of existing biospecimens or identifiable data would be deemed impracticable, such that consent could be waived, when more than a specified threshold number of individuals are involved? (SACHRP provided the Secretary with recommendations on this issue.
) If so, what threshold number should constitute impracticability? Is the number of potential human subjects the only measure of impracticability?
V. Strengthening Data Protections To Minimize Information Risks Back to Top
Separate from the HIPAA Rules, the Privacy Act of 1974, as amended (5 U.S.C. 552a
) binds Federal agencies to protect personally identifiable information in their possession and control. It prohibits the disclosure (without prior consent or notice) of records that are retrieved by personal identifiers. In addition, there are other Federal privacy provisions that may need to be considered, but all have a limited scope. For example, Title 5 of the E-Government Act,
entitled the “Confidential Information Protection and Statistical Efficiency Act of 2002,”(CIPSEA) provides additional protections for confidential statistical information collected by the Federal government. However, neither the Privacy Act nor CIPSEA generally apply to grant-funded investigators who are neither Federal employees nor contractors. (An additional example is the Department of Justice's set of regulations for protecting information collected in certain research and other programs, at 28 CFR part 22.)
Currently, the HIPAA Privacy Rule's standards for identifiable and de-identified information are not aligned with what is considered human subjects research under the Common Rule. Under the Common Rule research does not involve “human subjects” if the investigator does not obtain data about individuals through an interaction or intervention or obtain identifiable private information about individuals.
Under the regulatory definition of human subject, “private information” is described as “information about behavior that occurs in a context in which the individual can reasonably expect that no observation or recording is taking place, and information which has been provided for specific purposes by an individual and which the individual can reasonably expect will not be made public (for example, a medical record).” Private information is not considered to be identifiable under the Common Rule if the identity of the subject is not or may not be “readily ascertained” by the investigator from the information. Under the HIPAA Privacy Rule, health information is de-identified and thus exempt from the Rule, if it neither identifies nor provides a reasonable basis to identify an individual.
Question 55: What mechanism should be used to regularly evaluate and to recommend updates to what is considered de-identified information? Beyond the mere passage of time, should certain types of triggering events such as evolutions in technology or the development of new security risks also be used to demonstrate that it is appropriate to reevaluate what constitutes de-identified information?
As discussed in Section II(A), the majority of unauthorized disclosures of identifiable health information from investigators occur due to inadequate data security.
IRB review or oversight of research posing informational risks may not be the best way to minimize the informational risks associated with data on human subjects. Instead, informational risks may be best mitigated through compliance with stringent standards for data security and information protection that are effectively enforced through mechanisms such as periodic random audits.
We are considering three specific requirements that could strengthen the protections for research studies that pose informational risks. First, research involving the collection and use of identifiable data, as well as data in limited data set form, could be required to adhere to data security standards modeled on the HIPAA Security Rule.
In particular, for research involving individually identifiable information, all biospecimens, and limited data sets, data security standards could require the use of reasonable and appropriate encryption for data maintained or transmitted in electronic form and strong physical safeguards for information maintained in paper form, audit trails, and access controls that allow only authorized personnel to have access to the information. Further, investigators would be required to adhere to breach notification standards modeled on those applied to HIPAA covered entities for breaches of individually identifiable health information.
For research using limited data sets or de-identified information, investigators would be strictly prohibited from attempting to re-identify the subjects of the information. Requiring that investigators implement and adhere to these standard data security and information protection measures would lessen the need for investigators to enter into data use agreements to protect the limited data set, as is currently required under the HIPAA Privacy Rule. Because these mandatory protections would apply to all research studies, it should not be necessary for IRBs to review studies posing only informational risks or to consider informational risks in studies involving other risks to human subjects.
Question 64: For research involving de-identified data, is the proposed prohibition against a researcher re-identifying such data a sufficient protection, or should there in some instances be requirements preventing the researcher from disclosing the de-identified data to, for example, third parties who might not be subject to these rules?
Table 1—Proposal for the Excused Category of Research Involving Pre-Existing Information or Biospecimens Back to Top
Yes, which could be obtained in connection with the initial collection
Yes. Consent for future research typically obtained at the same time as consent for initial research (which, for data, could be oral when oral consent was permissible for the initial collection)
Yes. Same rule as for “Identifiable Information and All Biospecimens”
Yes. Same rule as for “Identifiable Information and All Biospecimens.”
Yes. Protections would include encryption, use only by authorized personnel with audit tracing, prompt breach notification, and periodic retrospective random audits
Yes. Same rule as for “Identifiable Information and All Biospecimens” plus a prohibition against re-identification
No, unless investigators plan to re-contact subjects with their individual research results
VI. Data Collection To Enhance System Oversight Back to Top
VII. Extension of Federal Regulations Back to Top
VIII. Clarifying and Harmonizing Regulatory Requirements and Agency Guidance Back to Top
In addition, other Federal laws and regulations have been enacted that relate to the protection of human subjects, most prominently, the research provisions of the HIPAA Privacy Rule. However, since the HIPAA regulations were developed mainly for the clinical context,
the rules are inconsistent with the Common Rule in certain areas. As noted above, one such inconsistency is the definition of identifiable data and another is the manner in which the two rules treat consent for future research.
Question 74: If all Common Rule agencies issued one set of guidance, would research be facilitated both domestically and internationally? Would a single set of guidance be able to adequately address human subjects protections in diverse populations and contexts, and across the broad range of research contexts (including biomedical, national security, education and other types of social and behavioral research)?
IX. Agency Request for Information Back to Top
The Federal Policy for the Protection of Human Subjects or the “Common Rule” was published in 1991 and codified in separate regulations by 15 Federal departments and agencies, as listed below (each agency includes in its chapter of the Code of Federal Regulations [CFR] section numbers and language that are identical to those of 45 CFR part 46, subpart A).
Federman DD, Hanna KE, Rodriguez LL, eds. Responsible Research: A Systems Approach to Protecting Research Participants. Washington, DC: National Academies Press; 2002.
Human Subjects Research: HHS Takes Steps to Strengthen Protections, But Concerns Remain. GAO-01-775T, May 23, 2001.
Scientific Research: Continued Vigilance Critical to Protecting Human Subjects. T-HEHS-96-102, Mar 12, 1996
Scientific Research: Continued Vigilance Critical to Protecting Human Subjects. HEHS-96-72, Mar 8, 1996.
Kim S, Ubel P, De Vries R. Pruning the regulatory tree: For human-subjects research, maximum regulation does not mean maximum protection. Nature 2009;457:534-535.
Emanuel EJ, Wood A, Fleischman A, et al. Oversight of human participants research: Identifying problems to evaluate reform proposals. Ann Int Med 2004;141(4):282-291.
Lynn J, Baily MA, Bottrell M, et al. The ethics of using quality improvement methods in health care. Ann Int Med 2007;146(9):666-673.
National Bioethics Advisory Commission, Ethical and Policy Issues in Research Involving Human Participants. Bethesda, MD; 2001.
Executive Order, Improving Regulation and Regulatory Review. January 18, 2011.
Wendler D, Varma S. Minimal risk in pediatric research. J Peds 2006;149:855-861.
Center for Advanced Study. The Illinois White Paper: Improving the System for Protecting Human Subjects: Counteracting IRB “Mission Creep.” 2005.
American Association of University Professors. Academic Freedom and the Institutional Review Board. 2006.
National Research Council, Protecting Participants and Facilitating Social and Behavioral Sciences Research. Washington, DC: National Academies Press; 2003.
Schrag Z. Ethical Imperialism. Baltimore, MD: Johns Hopkins University Press; 2010.
Schrag ZM. How talking became human subjects research: The federal regulation of the social sciences. J Policy History 2009;21(01):3.
Bledsoe CH, Sherin B, Galinsky AG, et al. Regulating creativity: Research and survival in the IRB iron cage. Northwestern U L Rev 2007;101:593-641.
Albala I, Doyle M, Appelbaum PS. The evolution of consent forms for research: A quarter century of changes. IRB: Ethics & Human Research 2010;32(3):7-11.
Paasche-Orlow MK, Taylor HA, Brancati F. Readability standards for informed-consent forms as compared with actual readability. N Engl J Med 2003;348:721-726.
Sharp MS. Consent documents for oncology trials: Does anybody read these things?Am J Clin Onc 2004;27:570-575.
Levine RJ. Informed consent: Some challenges to the universal validity of the western model. J Law Med Ethics 1991;19(3-4):207-213.
Cribb R. Ethical regulation and humanities research in Australia: Problems and consequences. Monash Bioethics Rev 2004;23(3):39-57.
Wertz DC. Public Perceptions: Surveys of Attitudes Toward Biotechnology. In: Murray TH, Mehlman MJ, eds. Encyclopedia of Ethical, Legal and Policy Issues in Biotechnology. John Wiley & Sons; 2002.
45 CFR part 160 and 45 CFR part 164, subparts A and E.
http://www.justice.gov/opcl/privstat.htm; and http://www.justice.gov/opcl/1974privacyact-overview.htm.
Coleman CH, Bouësseau MC. How do we know that research ethics committees are really working? The neglected role of outcomes assessment in research ethics review. BMC Med Ethics 2008;9:6.
Steinbrook R. Improving protection for research subjects. N Engl J Med 2002;346:1425-1430.
Pritts JL. The Importance and Value of Protecting the Privacy of Health Information: The Roles of the HIPAA Privacy Rule and the Common Rule in Health Research. 2008. http://www.iom.edu/&sim;/media/Files/Activity%20Files/Research/HIPAAandResearch/PrittsPrivacyFinalDraftweb.ashx.
Any references in this notice to the “Common Rule,” unless otherwise specified, should be understood as including the relevant portions of the FDA regulations.
76 FR 11482, March 2, 2011.
45 CFR 46.110.
45 CFR 46.101(b). [40]
http://answers.hhs.gov/ohrp/categories/1564.
Cann CI, Rothman KJ. IRBs and epidemiological research: How inappropriate restrictions hamper studies. IRB 1984;6(4):5-7.
Silverman H, Hull SC, Sugarman J. Variability among institutional review boards' decisions within the context of a multicenter trial. Crit Care Med.2001;29:235-241.
Dziak K, Anderson R, Sevick MA, Weisman CS, Levine DW, Scholle SH. Variations among institutional review board reviews in a multisite health services research study. Health Services Res 2005;40:279-290.
Hirshon JM, Krugman SD, Witting MD et al. Variability in institutional review board assessment of minimal-risk research. Acad Emerg Med 2002;9:1417-1420.
Green LA, Lowery JC, Kowalski CP, Wyszewianski L. Impact of institutional review board practice variation on observational health services research. Health Serv Res 2006;41:214-230.
45 CFR 46.102(i).
Gawande A. A Lifesaving Checklist. New York Times, December 30, 2007.
Kimmelman J. Valuing risk: The ethical review of clinical trial safety. Kennedy Inst Ethics J 2004;14:369-93.
Schrag Z. Ethical Imperialism. Baltimore, MD: Johns Hopkins University Press; 2010:45-46, 70-71.
Jansen LA. Local IRBs, multicenter trials, and the ethics of internal amendments. IRB,2005;27(4):7-11.
https://www.aamc.org/initiatives/clinicalresearch/irbreview/.
Infectious Disease Society of America. Grinding to a halt: The effects of the increasing regulatory burden on research and quality improvement efforts. Clin Infect Dis 2009;49:328-35.
http://www.fda.gov/downloads/RegulatoryInformation/Guidances/UCM127013.pdf.
For general requirements for informed consent see 45 CFR 46.116 and 21 CFR 50.25. There are provisions under 45 CFR part 46, subpart A, that allow for the waiver of some or all of the elements of informed consent. (See §§ 46.116(c) and 46.116.(d)). FDA's statute limits the circumstances under which informed consent can be waived. Thus, FDA regulations contain only two exceptions from informed consent under 21 CFR 50.23 and 50.24.
Menikoff J, Richards E. What the Doctor Didn't Say: The Hidden Truth about Medical Research. New York, NY: Oxford University Press; 2006:113-123.
Albala I, Doyle M, Appelbaum PS. The evolution of consent forms for research: A quarter century of changes. IRB 2010;32(3):7-11.
Schneider CE. The Hydra. Hastings Center Rep 2010;40(4):9-11.
Goldstein AO, Frasier P, Curtis P, Reid A, Kreher NE. Consent form readability in university-sponsored research. J Fam Pract 1996;42:606-611.
Philipson SJ, Doyle MA, Gabram SG, Nightingale C, Philipson EH. Informed consent for research: a study to evaluate readability and processability to effect change. J Investig Med 1995;43:459-467.
Under 45 CFR 46.116(c), an IRB may approve a consent procedure which does not include, or which alters, some or all of the elements of informed consent otherwise required under 45 CFR part 46, or waive the requirement to obtain informed consent provided the IRB finds and documents that: (1) The research or demonstration project is to be conducted by or subject to the approval of state or local government officials and is designed to study, evaluate, or otherwise examine: (i) public benefit or service programs; (ii) procedures for obtaining benefits or services under those programs; (iii) possible changes in or alternatives to those programs or procedures; or (iv) possible changes in methods or levels of payment for benefits or services under those programs; and (2) The research could not practicably be carried out without the waiver or alteration.
Sanders AB, Hiller K, Duldner J. Researchers' understanding of the federal guidelines for waiver of and exception from informed consent. Acad Emerg Med 2005;12:1045-1049.
http://www.dhhs.gov/ohrp/sachrp/sachrpletter013108.html.
Furness PN. One-time general consent for research on biological samples: Good idea, but will it happen?BMJ 2006;332(7542):665.
Anderlik M. Commercial biobanks and genetic research: ethical and legal issues. Am J Pharmacogenomics. 2003;3:203-215.
Hansson MG, Dillner J, Bartram CR, Carlson JA, Helgesson G.Should donors be allowed to give broad consent to future biobank research?. Lancet Oncol 2006;7:266-269.
Wendler D. One-time general consent for research on biological samples: is it compatible with the health insurance portability and accountability act?Arch Intern Med.2006;166:1449-1452.
Murphy J, Scott J, Kaufman D, Geller G, LeRoy L, Hudson K. Public perspectives on informed consent for biobanking. Am J Public Health 2009;99:2128-2134.
Kaufman DJ, Murphy-Bollinger J, Scott J, Hudson KL. Public opinion about the importance of privacy in biobank research, Am J Human Genet 2009;85:643-654.
Secretary's Advisory Committee on Human Research Protections. SACHRP letter to HHS Secretary. January 31, 2008. http://www.dhhs.gov/ohrp/sachrp/sachrpletter013108.html.
Privacy Act of 1974, as amended. http://www.justice.gov/opcl/privstat.htm; and Department of Justice, Office of Privacy and Civil Liberties. Overview of the Privacy Act of 1974. http://www.justice.gov/opcl/1974privacyact-overview.htm.
Pub. L. 107-347. http://www.whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/cipsea/cipsea_statute.pdf and Office of Management and Budget. Implementation Guidance for Title V of the E-Government Act, Confidential Information Protection and Statistical Efficiency Act of 2002. http://www.whitehouse.gov/sites/default/files/omb/assets/omb/fedreg/2007/061507_cipsea_guidance.pdf.
45 CFR part 160 and 45 CFR part 164, subparts A and C. [87]
45 CFR part 160 and 45 CFR part 164, subparts A and D.
The Common Rule evolved from a long series of measures designed to protect individual research subjects from physical and mental harm. In contrast, the HIPAA Privacy Rule evolved from data protection standards such as the Fair Information Practices. See Pritts JL (2008). The Importance and Value of Protecting the Privacy of Health Information: The Roles of the HIPAA Privacy Rule and the Common Rule in Health Research.