would be required. They argued that the current policy works and there
has been no evidence provided that it needs to be fixed.
---------------------------------------------------------------------------

    \19\ Kwok P, et al. Harder Than You Think: A Case Study of Re-
Identification Risk of HIPAA-Compliant Records. NORC at The
University of Chicago and Office of the National Coordinator for
Health Information Technology. 2011. Retrieved from http://www.amstat.org/meetings/jsm/2011/onlineprogram/AbstractDetails.cfm?abstractid=302255.
---------------------------------------------------------------------------

    The NPRM specifically asked whether the final rule should include a
definition of ``biospecimen'' to assist the regulated community in
understanding what types of activities might fall under the rule.
Approximately 100 comments answered this question. A majority of these
comments did not provide a suggestion for how biospecimen should be
defined, but suggested that the Federal Government convene panels and
solicit input from governmental and nongovernmental experts.
    One university emergency medical department suggested including in
this definition biological samples from human subjects which contain
DNA and are being obtained for the purpose of medical analysis and
provided examples of biospecimens which would fall under this
definition, including excised tissue (fresh, fixed, or paraffin
embedded), whole blood, urine (when hematuria is known to exist), and
saliva among others. The commenter also provided examples of
biospecimens which would not fit in this definition, including serum or
plasma, urine (when no hematuria is known to exist), and processed
tissues where the DNA has been removed as a part of the processing.
    Others indicated that the definition of biospecimen used by the
National Cancer Institute \20\ seemed appropriate and workable for this
rule.
---------------------------------------------------------------------------

    \20\ NCI defines ``biospecimen'' as, ``A quantity of tissue,
blood, urine, or other human-derived material. A single biopsy may
generate several biospecimens, including multiple paraffin blocks or
frozen biospecimens. A biospecimen can comprise subcellular
structures, cells, tissue (e.g., bone, muscle, connective tissue,
and skin), organs (e.g., liver, bladder, heart, and kidney), blood,
gametes (sperm and ova), embryos, fetal tissue, and waste (urine,
feces, sweat, hair and nail clippings, shed epithelial cells, and
placenta). Portions or aliquots of a biospecimen are referred to as
samples (NCI Best Practices working definition).'' Retrieved from
http://biospecimens.cancer.gov/bestpractices/got/#B. Last modified
March 16, 2016.
---------------------------------------------------------------------------

    A majority of comments on the definition of ``biospecimen'' asked
for explicit clarification on how certain biospecimens would be treated
under the rule. Several comments asked whether microbiology
biospecimens would be considered covered under the NPRM proposal. One
research university requested specification that biologic material of
organisms that use human biospecimens merely as a host (e.g., bacteria,
viruses, fungi) not be considered to involve human subjects.
    The NPRM also asked whether covering only biospecimens that include
nucleic acids would be a reasonable definition. A majority of those who
responded to this said it would not be a good line to draw. One
commenter specifically noted that the presence of nucleic acids does
not guarantee re-identification.
b. Public Comments on Alternative NPRM Proposals A and B
    Some of the alternative NPRM proposals were partly based on the
premise that biospecimens could at some point become readily
identifiable as a result of increasingly sophisticated technology. Many
public commenters stated that a better approach to protecting privacy
than requiring consent is to impose sanctions against investigators who
aim to or do re-identify biospecimens without authorization by an IRB
or other body. Such an approach, they said, would be less onerous for
the entire enterprise, and if accompanied by clear guidance from
funding agencies, would do more to protect privacy and guard against
potential harms to subject rights and welfare.
    Few commenters, approximately 20, explicitly supported Alternative
A or B over the NPRM proposal or the pre-2018 rule.
    The Presidential Commission for the Study of Bioethical Issues
explicitly supported Alternative B, noting that it is the most forward-
looking of all three proposals, using ``bio-unique'' data as human
subjects research with a focus on the technology and its ability to
identify donors using small amounts of data, as opposed to tying the
definition of human subjects research to a particular kind of data.\21\
Another commenter identified alternative B as the best proposal to keep
pace with advances in technology (including technologies driving
personalized medicine), protect research participants, respect
autonomy, increase trust, and close the gap in protection in the
current regulations.
---------------------------------------------------------------------------

    \21\ The Commission had previously addressed related issues in
its October 2012 report, Privacy and Progress in Whole Genome
Sequencing. Washington, DC: Presidential Advisory Commission for the
Study of Bioethical Issues. Retrieved from http://bioethics.gov/sites/default/files/PrivacyProgress508_1.pdf.
---------------------------------------------------------------------------

    Those who supported the primary NPRM proposal--to expand the
definition of ``human subject'' to include all biospecimens--indicated
that Alternatives A and B would not give individuals who wanted to
control the use of their biospecimens the opportunity to do so.
    Approximately 250 commenters (about 12 percent of the total
comments received) said that they endorsed the pre-2018 policy, but
that if the Federal Government must do something other than maintain
the current definition of human subject, Alternative A would be
preferable to the NPRM proposal or to Alternative B. These comments
argued that Alternative A would be the least disruptive to the research
enterprise, but that the pre-2018 policy would be better.
    However, the majority of those commenters addressing the
alternative proposals indicated that neither struck an appropriate
balance among the Belmont Report principles. A research university
concluded that both alternatives lack balance, emphasizing respect for
persons with little regard for the principles of beneficence and
justice.
    Additional concerns about Alternative A included the fact that
while limiting the expansion of the scope of activities covered by the
rule to whole genome sequencing may be a reasonable line for inclusion
today, that line might not be inclusive enough in the future.
    Additional concerns about Alternative B included that by requiring
continual re-review of technologies and databases by the federal
government, there would be an ``inevitable lag'' between when a
technology might be identified and when it would be added to the list.
Thus, these commenters argued that the list might end up being useless.

c. Alternative Proposals Offered by Public Commenters
    Many commenters proposed or endorsed alternatives to the NPRM
proposals. Generally, these alternatives involved maintaining the
existing schema, developing a system of notice and opt out, engaging in
a public education campaign about how the research enterprise works,
and developing penalties and sanctions for re-identification of
biospecimens and information. A policy that requires notice, opt out,
and public education were generally endorsed or discussed together.
    The Secretary's Advisory Committee on Human Research Protections
(SACHRP) offered one of the most detailed alternative proposals. SACHRP
indicated that existing practices of research with biospecimens and
data that have been collected for nonresearch uses (most often in the
course of clinical care) should be revised to better protect subjects
through greater transparency, public education about research with
biospecimens, more exacting standards for protecting against dignity
harms, allowing individuals to opt out, requiring IRB or institutional
review and approval of specific research uses of identified
biospecimens and identified data, and through strict legal consequences
for re-identification of de-identified biospecimens and data that have
been shared for research purposes.
    SACHRP also proposed that data security protections be developed to
safeguard biospecimen-associated data and identified data against
unauthorized release or access, and focused review of the storage,
maintenance, or secondary research use of identified biospecimens and
identified data to determine whether the proposed activity is likely to
be objectionable.
    A professional organization of investigative pathologists urged
consideration of opt-out broad consent models for nonidentified
biospecimens collected in research and nonresearch settings, and
suggested that this model would bring consent for the broad use of
nonidentified biospecimens in line with HIPAA privacy practices,
preserving the ability for an individual to decide not to participate
in research efforts. This organization asserted that this option would
be less burdensome and an inclusive, respectful, and functional way to
promote ethically conducted biomedical research on biospecimens.
d. Public Comments on Identifiability
    Approximately 40 comments were received in response to the request
to comment on the definition of identifiable private information.
Comments were mixed. The largest proportion of those comments
(approximately 13) supported the definition in the pre-2018 rule.
Others felt that the pre-2018 definition of identifiable private
information was sufficient, but that additional guidance would be
needed to implement it. Another group of commenters supported adopting
a different identifiability standard in the final rule (such as the
federal government's personally identifiable information standard, or
the HIPAA identifiability standard).
    Several public comments claimed that the meaning of
``identifiable'' with regard to information and biospecimens will
change as technology advances. They indicated that the technique of
whole genome sequencing altered the conversations about the
identifiability of biospecimens and future technological advances using
advanced computing and large databases could provide methods for easily
aggregating disparate data for the purposes of identifying an
individual.
    Public comments received from a large professional association
related to the definition of identifiable private information noted
that the modifier ``may be readily ascertained'' that was included in
the definition of identifiable private information within the
definition of human subject allows for changes in scientific technology
and data sharing over time since what was readily ascertainable 10
years ago has changed and will be different 10 years from now. The
commenter noted that this allows IRBs and investigators to assess
identifiability based on current technology, data sharing and computing
capabilities, rather than comparing it to an enumerated list of
identifiers or scientific technologies.
    Some commenters expressed a desire for guidance to be issued on
these definitions or for the definitions to be better clarified and
explained in the regulatory text. Several comments specifically
suggested a need for a definition of or guidance on the term ``readily
ascertainable.''
    Approximately 10 comments endorsed replacing the Common Rule's
identifiability standard with either the Federal Government's concept
of personally identifiable information (PII) or HIPAA's concept of
protected health information (PHI).
    One academic medical center felt that the concept of PII would
unnecessarily broaden the scope of the Common Rule and create a larger
administrative burden due to the vagueness of the PII definition
without providing substantial added protection to human subjects, and
suggested replacing the term ``identifiable private information'' with
the definition of ``protected health information,'' which can be found
at 45 CFR 160.103.
    Those who supported the use of the PII concept noted that it would
harmonize other definitions of identifiability used in other Federal
Government regulations. One state department of health and human
services noted that adopting PII would be consistent with other
confidentiality laws, policies, and industry standards that require
organizations to protect the privacy and security of PII, achieving
consistency across standards and helping organizations comply with the
various privacy and security requirements. The commenter felt that
replacing the identifiable private information standard with the
concept of PII should not be overly burdensome on the research
community since exemptions and waivers of informed consent would likely
apply in many contexts.
    A few commenters also noted that regardless of how identifiability
might be defined, some concerns about group harms still were not
addressed in the NPRM.
    Several other commenters noted that a change to the definition of
PII would not increase public trust or understanding of the system, nor
would it likely clarify for investigators whether biospecimens or
private information are identifiable.
    A majority of the commenters noted that whatever direction the
final rule takes; additional guidance will be necessary to reduce
ambiguity within the regulated community.
e. Public Comments on Newborn Dried Blood Spots
    Approximately 50 comments discussed how issues related to research
use of residual newborn dried blood spots (DBS) were addressed by the
proposal to expand the definition of human subject. Of those comments,
35 supported the idea of parental consent for research with DBS.
Thirty-two comments stated that specific consent should be required for
all research uses, in other words, that the exemptions and exclusion
categories should not apply to research involving DBS. Those who felt
that parental consent should always be required for the research use of
DBS expressed the need to respect autonomy and parents' rights, and
frequently conveyed a distrust of medicine and scientists. These
individuals generally supported the spirit of the main NPRM

proposal, but objected to any exemptions, exclusions, and waivers of
informed consent.
    Fifteen comments expressed concerns that the biospecimen proposals
in the NPRM would impede research involving DBS, which could negatively
affect the expansion and improvement of newborn screening programs due
to, among other things, a possible lack of resources for obtaining
consent. In this regard, an employee of a California state health
department described the health department's experience of seeking and
obtaining consent for the research use of DBS. This individual noted
that 52 percent of new parents were offered the opportunity to consent.
Of those offered the opportunity, 90 percent said yes. This employee
was thus concerned that due to staffing constraints, the majority of
new parents simply would not be asked to provide consent to future
research uses of DBS.
    Others indicated that some kind of notice and opt-out process would
be acceptable, but that as a general matter the research community
would benefit from guidance on the extent to which the exemptions and
exclusions apply to this type of work.
4. Response to Comments and Explanation of the Final Rule: Definition
of Human Subject
    The final rule does not implement the proposed expansion of the
definition of ``human subject'' to include all biospecimens regardless
of identifiability. It is clear from the comments received that the
public has significant and appropriate concern about both the need for
obtaining consent before using such biospecimens for research, and the
potential negative impacts of implementing that proposal on the ability
to conduct research. And, while it does not substantially change the
definition of ``identifiable private information,'' the final rule
includes a new process by which Common Rule departments and agencies
can regularly assess the scientific and technological landscape to
determine whether new developments merit reconsideration of how
identifiability of either information or biospecimens is interpreted in
the context of research. Because the final rule does not implement the
NPRM's proposed expansion to the definition of ``human subject,'' it
also does not implement the NPRM proposal to exclude certain research
activities involving nonidentified biospecimens.
    With regard to changing the definition of ``human subject'' to
include all biospecimens, the majority of commenters who addressed this
expansion opposed it for a variety of reasons, as described above. As
explained in the NPRM, one of the core reasons for proposing that the
rule be broadened to cover all biospecimens, regardless of
identifiability, was based on the premise that continuing to allow
secondary research with biospecimens collected without consent for
research places the publicly funded research enterprise in an
increasingly untenable position because it is not consistent with the
majority of the public's wishes, which reflect legitimate autonomy
interests. However, the public comments on this proposal raise
sufficient questions about this premise such that we have determined
that the proposal should not be adopted in this final rule.
    Further, the current regulatory policy appears to sufficiently
protect against the unauthorized research use of identifiable
biospecimens. Under the pre-2018 rule, if an investigator funded by a
Common Rule department or agency uses nonidentified biospecimens and
manages to re-identify them, that investigator would then be conducting
human subjects research without IRB approval, in violation of the
rules. It should also be noted that the position adopted in the final
rule does not eliminate any authority, separate and apart from the
Common Rule, that Common Rule departments and agencies have to
establish policies with additional requirements related to consent for
research involving nonidentifiable biospecimens or nonidentifiable
private information, or preclude them from exercising such authority.
    Nonetheless, we acknowledge the need to also appropriately respect
and promote autonomy interests. Any future proposals aimed at promoting
autonomy should jointly evaluate the importance of the autonomy
interests at issue, as well as explicitly quantify the potential
negative impacts the proposal might have on the ability to conduct
research, including such consequences on the representativeness of
biospecimens available for research.
    In the final rule, we have added requirements to the informed
consent process to increase transparency so that potential subjects
will have more information about how their biospecimens or private
information might be used. Specifically, prospective subjects will be
told that identifiers might be removed from their biospecimens or
private information and used for future research, if this might be a
possibility. Finally, as some public comments addressed the desire to
share in any profits that might accrue as a result of research use of
their biospecimens, an additional element of consent will require, as
appropriate, a statement that the subject's biospecimens may be used
for commercial profit and whether the subject will or will not share in
this commercial profit. We believe that this increased attention to
transparency in the consent process will allow individuals to make
informed choices about whether they want to consent to current or
future research uses of their biospecimens. A few clarifying changes
are made in the final rule pertaining to the definition of ``human
subject'' and the components within that definition, particularly
referring to both information and biospecimens as key determinants of
whether a human subject is involved in research.
    With respect to the definition of ``identifiable private
information,'' although the pre-2018 definition of ``identifiable'' did
not incorporate a specific process for considering the growing volume
of information being generated and shared in research (including from
biospecimens), or consider how evolving technology can ease and speed
the ability to re-identify information or biospecimens previously
considered nonidentifiable, we appreciate that a change in that
definition could have collateral implications with respect to imposing
unwarranted consent requirements on activities that were not subject to
the regulations. We appreciate the commenter requests for more guidance
on how they should interpret the definition of identifiable private
information. Thus, although the final rule only makes minor changes to
the existing definition of ``identifiable private information,'' it
sets in place a process (Sec.  __.102(e)(7), discussed below) that will
help facilitate any necessary future updates to the understanding of
that term.
    In the final rule the language at Sec.  __.102(e)(1)(i) relating to
information obtained through intervention or interaction with an
individual was adopted and modified by replacing the reference to data,
as proposed in the NPRM, with a reference to information or
biospecimens, and by adding the NPRM-proposed language relating to
using, studying, or analyzing the information or biospecimens. The
explicit reference to biospecimens in this context is intended as a
mere clarification of the previous understanding of how the pre-2018
rule operated.
    Likewise, the final rule adopts the NPRM-proposed language at Sec.
__.102(e)(1)(ii) relating to obtaining identifiable private
information, but

modifies it by adding an explicit reference to ``identifiable
biospecimens.'' This is also intended as a mere clarification of the
previous understanding of how the pre-2018 rule operated as applied to
biospecimens. Similarly, the definition of intervention has been
modified to clarify that information or biospecimens might be gathered,
replacing the former reference only to data. This, too, is merely a
clarification of the existing understanding of that concept.
    A definition of ``identifiable biospecimen'' has been added at
Sec.  __.102(e)(6). This new definition was not added as a result of
any substantive change, but rather to enable greater clarity in other
provisions of these regulations in explaining when a particular
provision relates to either identifiable private information alone (not
including biospecimens), or identifiable biospecimens alone, or both.
The pre-2018 rule's concept of ``identifiable private information'' had
encompassed the concept of an identifiable biospecimen, whereas under
the final rule that concept has been ``cleaved off'' from that
definition and given its own definition. Note that a biospecimen is
deemed to include private information (consistent with the
understanding of this concept under the pre-2018 rule), so there is no
need to add the adjective ``private'' in the definition of an
``identifiable biospecimen.'' In effect, once a biospecimen becomes
identifiable (for example, by being tagged with the name or other
information that indicates the person from whom the biospecimen was
obtained), then an investigator using that biospecimen is already using
something to which Sec.  __.102(e)(1)(ii) would apply. There is no need
to make any additional determination about the ``private'' aspects of
what is taking place.
    In addition, the minor clarifying change in the language for the
concept of ``private information'' that was proposed in the NPRM,
namely adding the phrase ``shared or,'' was not adopted. It was decided
that because any information that should not be shared would always
meet the standard of being information that should not be made public,
this change would not actually expand the amount of information that is
considered private information.
    Although the description of when private information is
identifiable was not significantly changed, a new provision has been
added at Sec.  __.102(e)(7) requiring federal departments and agencies
that implement the Common Rule to regularly, upon consultation with
appropriate experts, reexamine the meaning of the terms ``identifiable
private information,'' as defined in Sec.  __.102(e)(5), and
``identifiable biospecimen,'' as defined in Sec.  __.102(e)(6). Such
reexamination shall take place at least every 4 years. This new
provision specifically requires that the federal departments and
agencies implementing this policy collaborate on this process to avoid
a duplication of efforts and in order to have a consistent
interpretation of these terms.
    This new process responds to the growing volume of information
being generated and shared in research (including from biospecimens),
and evolving technology that can ease and speed the ability to re-
identify information or biospecimens previously considered
nonidentifiable. With an increase in the number of exemptions included
in this final rule, it will be important to reconsider the potential
identifiability of information and biospecimens and facilitate uniform
interpretation to ensure adequate privacy and security measures are in
place.
    Section 102(e)(7) also provides that, after conducting this
process, if it is determined to be appropriate and permitted by law,
Common Rule departments and agencies could alter the interpretation of
identifiable private information or identifiable biospecimens,
including through the use of guidance.
    In addition, there will occur, also at least every 4 years and as a
collaborative process among those federal departments and agencies,
upon consultation with appropriate experts, an assessment as to whether
there are analytic technologies and techniques that should be
considered by investigators to generate identifiable private
information or identifiable biospecimens. The ultimate goal is to
implement the Common Rule in a way that is aligned with the evolving
understanding of the concept of identifiability while protecting
subjects and encouraging and facilitating valuable research.
    To the extent that this process leads to a determination that
particular analytic technologies or techniques, when applied to
information or biospecimens that are not identified, do lead to the
generation of identifiable private information or identifiable
biospecimens, those technologies or techniques will be placed on a list
of technologies and techniques satisfying that determination, and
recommendations might accordingly be made with regard to relevant
issues relating to consent and privacy and data security protections.
The result may be that such technologies and techniques could therefore
only be used in instances where the person has provided their consent
(broad or study-specific) which meets the requirements of the Common
Rule, or where an IRB has waived the requirement for consent.
    Notice and the opportunity for public comment would take place
before a technology or technique could be placed on this list. The
expectation is that whole genome sequencing will be one of the first
technologies to be evaluated to determine whether it should be placed
on this list.
    It is important to note that an investigator who possesses
information or biospecimens to which such a technology or technique
might be applied is not to be considered in possession of identifiable
private information or identifiable biospecimens merely as a result of
such a circumstance: that would only be true were the investigator to
actually apply the technology or technique to generate identifiable
private information or identifiable biospecimens.
    This new provision is not being added as a result of any pre-
conceived determination that there is indeed a need to change, whether
by guidance or otherwise, the interpretation of ``individually
identifiable'' as that concept is currently interpreted. Consistent
with a core theme underpinning the process that led to this final rule,
it would be inappropriate to expand the scope of coverage of the Common
Rule with regard to activities that usually involve very little risk
absent good reason to think that there is a problem that the added
administrative burden will be correcting. The public comments on both
the ANPRM and the NPRM do not identify a specific problem, but
clarification from the regulatory agencies might be useful. Thus, apart
from the consequences of placing technologies and techniques on the new
list, the most significant effect of Sec.  __.102(e)(7) may be the
issuance of guidance from time to time that facilitates understanding
of and compliance with existing interpretations.
    Finally, with regard to the use of newborn DBS, retaining the pre-
2018 approach toward nonidentified biospecimens resolves many of the
concerns expressed by commenters who felt that important research
involving newborn screening would be halted or inhibited under the
NPRM. The Newborn Screening Saves Lives Reauthorization Act of 2014
(Pub. L.

113-240) will no longer be effective following the effective date of
this final rule, given that its changes applied only until changes to
the Common Rule were promulgated. As a result, under the final rule,
secondary research with nonidentified newborn DBS would be treated in
the same way as secondary research with any other type of nonidentified
biospecimen. Such research would not be considered research with human
subjects under the final rule, and thus would not be subject to the
rule.

E. Legally Authorized Representative (Sec.  __.102(i))

1. Background and Pre-2018 Requirements
    The Common Rule contains a definition of legally authorized
representative to clarify who can consent on behalf of a prospective
subject who is unable to consent to research participation on his or
her own behalf. Under the pre-2018 rule, a legally authorized
representative was defined as an individual or judicial or other body
authorized under applicable law to consent on behalf of a prospective
subject to the subject's participation in the procedure(s) involved in
the research.
    As there is no federal legal standard as to who, or what entity, is
authorized to serve as a legally authorized representative to provide
consent to a subject's research participation, the issue of who can
serve as a legally authorized representative has been determined by the
laws of the jurisdiction in which the research will be conducted.
Within the United States, this generally means state or local law.
``Applicable law'' could be a state statute or regulation, case law on
point, an opinion of a State Attorney General, or a combination of
these.
    Some states and jurisdictions have statutes, regulations, or common
law that specifically address consent by someone other than the subject
for participation in research. Most states and jurisdictions have no
law specifically addressing the issue of consent in the research
context. In these states and jurisdictions, law that addresses who is
authorized to give consent on behalf of another person to specific
medical procedures or generally to clinical care may be relevant if
those types of procedures are the procedures involved in the research.
The long-standing interpretation by OHRP has been that such laws
relating to surrogate consent in the clinical context can be used for
purposes of the Common Rule.
    In every state, a legally authorized representative can be
authorized through an advance directive or by a court through
guardianship proceedings. However some states have no law specifically
addressing the issue of consent by a surrogate in the research setting,
and some states have no applicable statutes, regulations, or common law
specifying when an individual can provide consent for another to
medical treatment. In the absence of such law, it is usually the case
that community or other standards (such as institutional policies)
define hierarchies or identify individuals who are allowed to provide
consent, for medical treatment purposes, on behalf of others who cannot
consent for themselves.
    SACHRP and the Presidential Commission for the Study of Bioethical
Issues have raised concerns that the definition of legally authorized
representative may be inappropriately hindering the conduct of research
with subjects who lack capacity to consent. In the second part of its
report on neuroscience and ethics, Gray Matters: Topics at the
Intersection of Neuroscience, Ethics, and Society (Volume 2), the
Commission recommended that federal regulatory agencies establish clear
requirements to identify who can serve as legally authorized
representatives for individuals with impaired decision-making capacity
to support their responsible inclusion in research.\22\
---------------------------------------------------------------------------

    \22\ Presidential Commission for the Study of Bioethical Issues.
Gray Matters: Topics at the Intersection of Neuroscience, Ethics,
and Society (Volume 2). Washington, DC: Presidential Commission for
the Study of Bioethical Issues, 2015. Retrieved from http://bioethics.gov/sites/default/files/GrayMatter_V2_508.pdf
---------------------------------------------------------------------------

2. NPRM Proposal
    Although the NPRM did not propose regulatory text that would change
the definition of ``legally authorized representative,'' it requested
public comment on whether we should modify the definition in light of
the definition's reference to persons or entities ``authorized under
applicable law.''
    The NPRM sought comment on whether expansion of the current
definition to permit a legally authorized representative to be defined
by an accepted common practice standard within a state or jurisdiction
that lacks applicable state law for determining who can legally consent
to clinical care would be consistent with the ethical principles
underlying the Common Rule. The NPRM proposed to allow use of this
alternative standard only in jurisdictions in which there is also no
applicable law affirmatively authorizing a legally authorized
representative to provide consent to the subject's research
participation.
3. Public Comments
    Approximately 60 commenters discussed the Common Rule's definition
of ``legally authorized representative.'' A clear majority supported
the goal of addressing the barrier that the regulatory definition of
``legally authorized representative'' poses in jurisdictions that have
no applicable law affirmatively authorizing an individual to provide
consent for another. Commenters also favored the suggested approach and
responded that including the allowance of an accepted common practice
standard would still appropriately protect subjects. About one-third of
the commenters responding to this question, including disability rights
organizations, advocacy organizations, and academic institutions, did
not agree with the direction of the contemplated modification or
whether this issue should be addressed through regulatory change.
    Those supporting a modified definition generally agreed that
broadening the definition to cover anyone considered acceptable to
provide consent for another individual in the clinical setting would be
appropriate, would represent an alignment with accepted common
practice, and would bring consistency to the consent process for the
jurisdictions that are silent on both who may provide consent for
clinical care and who may provide consent for research. A number of
commenters who supported the proposal for modification noted that state
law authorizing individuals to provide consent would continue to apply.
    Among the commenters who opposed the modification, several said
state law provides sufficient guidance regarding the hierarchy of those
who can consent for an adult incapable of consenting on his or her own
behalf, and reduces the institution's liability in the event that an
inappropriate person consents for the subject. A research institution
recommended that we reassess this proposal and include more specific
requirements and details as to the role and authority of the legally
authorized representative. A disability rights organization, while
recognizing that the pre-2018 standard is not acceptable, commented
that the problem is not solved by incorporating broad discretion among
different jurisdictions. The organization also opined that a common
practice standard does not provide

sufficient guidance to assess and balance reasonable risk, considering
that a legally authorized representative's consent is not equivalent to
an autonomous decision by the subject. A research subject advocacy
organization expressed concern that such a change would not provide
sufficient oversight of investigators, who might use this standard in a
way that would violate local law. Another commenter stated that certain
individuals may be considered able to give consent for participation in
clinical procedures for individuals unable to do so for themselves, but
may not have the best interests of the individual in mind.
    Commenters responded specifically to the solicitation of comment on
the proposed standard of ``accepted common practice'' and indicated
that practices for surrogate consent should be those used in clinical
settings. Several commenters provided ideas for a more specific
approach to interpreting the terms ``accepted'' and ``common.'' A
researchers' association commented that interpretation of these terms
should include standards that define hierarchies or identify
individuals who may provide legally acceptable consent, for clinical
purposes, on behalf of others who cannot consent for themselves. One
commenter supporting the modification suggested that the terms could be
defined to refer to the historically used form of governing and
familial decision making within the group of subjects. A research
institution commented that an IRB's careful review and documentation of
who may serve as a legally authorized representative would be
preferable to an accepted common practice standard, as that standard is
vague. A research institution commenting in support of broadening the
definition to those who are allowed to consent to clinical procedures
advised that this would reduce confusion between physicians and
researchers as to who can consent for whom in research situations, and
suggested that the terms ``accepted'' and ``common'' should refer to
the conducting institution's own policies on who can provide consent to
clinical procedures.
4. Responses to Comments and Explanation of the Final Rule: Definition
of Legally Authorized Representative
    The definition of legally authorized representative in the final
rule at Sec.  __.102(i) has been modified to address jurisdictions in
which no applicable law authorizes a legally authorized representative
to provide consent on behalf of a prospective research subject. In
these jurisdictions, an individual recognized by institutional policy
as acceptable for providing consent in the nonresearch context to the
subject's participation in the procedures involved in the research,
will now be considered a legally authorized representative for purposes
of this rule.
    The change made from the NPRM discussion that ``accepted common
practice'' could be used to identify a legally authorized
representative is in response to objections to the vagueness of these
terms and the potential for confusion in implementation, which was
expressed by the majority of commenters opposed to the proposal. We
agree with the commenters' suggestion that an institution's own
policies as to surrogate consent may be a better touchstone than
``accepted common practice,'' as a standard referencing institutional
policy will provide additional clarity as to who may serve as a legally
authorized representative at that particular institution.
    The final rule also differs from the NPRM discussion in that it
allows institutional policies applicable to surrogate consent in either
the clinical context, or other nonresearch contexts, to authorize a
legally authorized representative. We expect that implementation of
this aspect of the final rule definition will in large part rely on
institutional policies for determining surrogates for clinical decision
making. In those instances, there is relatively little risk that this
rule will have inappropriate consequences, as far more significant
considerations, not related to the Common Rule, play a role in shaping
and constraining an institution's policies relating to surrogate
decision making in the clinical context.
    However, we recognize that some studies could be taking place that
do not relate to the types of decisions that are involved in clinical
care, or that do not involve procedures utilized in the clinical
context. If the institution has a policy relating to who acts as a
surrogate outside of the research context for those types of decisions,
then such a policy could be employed in the research context. Similar
to our assessment of policies relating to surrogate decision making in
the clinical context, we expect that considerations not related to the
Common Rule would constrain the institution's design and implementation
of policies in other nonresearch contexts, and thus see relatively
little risk that this added regulatory flexibility will have
inappropriate consequences.
    Maintaining the pre-2018 standard would have continued to allow
disparate results in terms of when research can take place in those
states that have specific laws governing either surrogate clinical
consent or research consent, and those that do not. Accepting that the
Common Rule has been interpreted to allow the use of laws governing
surrogate consent in the clinical context to be applied to surrogate
decision making in the research context, it is difficult to see why
there should be different outcomes in terms of what research is
allowable based on whether the standards for surrogate consent in the
clinical context in a state are based on specific laws or some other
accepted regime.
    This outcome also appears inconsistent with the Belmont Report
principle of justice. Individuals who lack the capacity to consent to
research ought not be inappropriately excluded from research
participation based solely on these circumstances. Research that an IRB
has approved as ethical to conduct with the participation of subjects
with impaired decision-making capacity ought not be prohibited in the
few states and jurisdictions in which no affirmative law authorizing a
legally authorized representative exists, while being allowed to
proceed in the vast majority of states and jurisdictions that have laws
specifically authorizing consent by a legally authorized representative
in the clinical or research context.
    Reduced ambiguity in the interpretation of the regulatory
requirements will facilitate research that may offer the promise of
improved medical treatment for this subject population, thus increasing
beneficence. This approach reflects the calls for increased clarity in
the regulatory requirements regarding who may serve as a legally
authorized representative, which will serve to facilitate the
responsible inclusion of subjects who cannot consent on their own
behalf to research participation.

F. Minimal Risk (Sec.  __.102(j))

1. Background and Pre-2018 Requirements
    The concept of ``minimal risk'' is central to numerous aspects of
the Common Rule, as it affects the type of review required, the
permissibility of waiver of informed consent, considerations for IRBs
in the review process, and the frequency of review. In sum, the review
process has been calibrated, for the most part, to the risk of the
research. For example, under the pre-2018 rule at Sec.  __.110, a
research study could receive expedited review if the research
activities to be conducted

appeared on the list of activities published by the Secretary of HHS
that are eligible for such review,\23\ and found by the reviewer(s) to
involve no more than minimal risk. Under an expedited review procedure,
the review could be carried out by the IRB chairperson or by one or
more experienced reviewers designated by the chairperson.
---------------------------------------------------------------------------

    \23\ HHS. Office for Human Research Protections . Categories of
Research That May Be Reviewed by the Institutional Review Board
(IRB) through an Expedited Review Procedure. November 9, 1998.
Retrieved from http://www.hhs.gov/ohrp/policy/expedited98.html.
---------------------------------------------------------------------------

    The definition of ``minimal risk'' in the pre-2018 rule at Sec.
__.102(i) encompassed research activities where the probability and
magnitude of harm or discomfort anticipated in the research are not
greater in and of themselves than those ordinarily encountered in daily
life or during the performance of routine physical or psychological
examinations or tests. IRBs report challenges in assessing the level of
risk presented by some studies in order to make the critical minimal
risk determination. This is, in part, due to the difficulties in
applying the definition of minimal risk under the pre-2018 rule,
particularly because the terms ``ordinarily encountered in daily life''
and ``routine physical or psychological examinations or tests'' are not
clarified.
2. NPRM Proposal
    The NPRM did not propose to modify the definition of ``minimal
risk,'' but rather proposed adding to the definition a requirement that
the Secretary of HHS create and publish a list of activities that
qualify as ``minimal risk.'' This list would be re-evaluated
periodically, but at least every 8 years, based on recommendations from
federal departments and agencies and the public. This would not be an
exhaustive list of all activities that should be considered minimal
risk under the Common Rule, but would allow IRBs to rely on the
determination of minimal risk for activities appearing on the list.
IRBs would still need to make minimal risk determinations about
activities that do not appear on this list. The public was asked to
comment on whether 8 years was a reasonable time period for updating
the list and whether advice should be solicited from outside parties
when updating the list. The public was also asked to comment on whether
the Secretary's list would be a useful tool for the research community,
and whether it would represent a loss of IRB flexibility in risk
determinations.
3. Public Comments
    Approximately 100 comments were received on this proposal. A strong
majority supported the proposal, stating that it would be useful to
have such a list, and some even suggested that the list of minimal risk
activities should be reviewed more often than once every 8 years. One
research university suggested that it is impossible to determine the
future direction of human research and therefore a list of minimal risk
activities would need to be updated at least yearly.
    Several commenters, including those who supported this proposal
generally, stated that even though this list of minimal risk activities
was a good idea in theory, it should be developed separately from a
final rule to allow for more time to work collaboratively with other
Common Rule departments and agencies and with members of the regulated
community. Some of those who supported the proposal asked that there be
widely solicited public input on the list. Others who supported the
proposal noted the list does not represent a loss of flexibility
because the IRB can still override the presumption of minimal risk as
long as the rationale is documented. One large research university felt
that the Secretary's list should not replace the IRB's discretion to
review a study, particularly if it will only be updated periodically.
One commenter was opposed to the NPRM proposal that the list be further
codified, suggesting that it should instead be eliminated as a
regulatory yardstick to simplify the regulations and remove added
administrative burden.
4. Response to Comments and Explanation of the Final Rule: Definition
of Minimal Risk
    Although this proposal received significant support, several
commenters expressed concern that the Secretary's list was another NPRM
deliverable that the public did not have a chance to see and comment on
during the NPRM public comment period. These commenters suggested that
this proposal be removed from a final rule and developed on a separate
track. We agree that this list should be developed as a separate
process from the final rule promulgation, and thus this proposal has
not been included in the final rule.
    Thus, no change is made to the definition of ``minimal risk'' in
the final rule at Sec.  __.102(j). We still intend to publish guidance
on this issue and could still pursue publication of such a list in the
future.

G. Public Health Authority (Sec.  __.102(k))

    The pre-2018 rule did not provide a definition of ``public health
authority.'' As proposed in the NPRM, the final rule now defines the
term so that references to it in the definition of research are
understood. Specifically, because the definition of ``research'' (Sec.
__.102(l)(2)) removes from that definition public health surveillance
activities that are conducted, supported, requested, ordered, required,
or authorized by a public health authority, this definition of ``public
health authority'' clarifies the scope of the activities removed from
the definition of ``research'' for the purposes of this final rule.
    In the final rule, as in the NPRM, the term ``public health
authority'' \24\ means an agency or authority of the United States, a
state, a territory, a political subdivision of a state or territory, an
Indian tribe, or a foreign government, or a person or entity acting
under a grant of authority from or contract with such public agency,
including the employees or agents of such public agency or its
contractors or persons or entities to whom it has granted authority,
that is responsible for public health matters as part of its official
mandate. We received no public comments on this definition.
---------------------------------------------------------------------------

    \24\ Consistent with 45 CFR 164.501 in the Privacy Rule.
---------------------------------------------------------------------------

H. Research (Sec.  __.102(l))

1. Background and Pre-2018 Requirements
    The pre-2018 rule defined ``research'' as a systematic
investigation, including research development, testing, and evaluation,
designed to develop or contribute to generalizable knowledge.
Activities that met this definition constituted research for the
purposes of that rule. An activity was only subject to that rule if it
met this definition (in addition to meeting various other criteria).
The pre-2018 rule also included categories of research involving human
subjects that would be considered exempt from the rule.
    The pre-2018 rule was criticized for not being clear about how to
interpret which activities were covered by the rule and which were not.
Some commenters also criticized the pre-2018 rule for extending to
activities that should not be covered and for inhibiting the conduct of
certain activities. According to some, the definition of ``research''
did not provide a sufficiently clear and precise way to distinguish
between similar activities in a way that made it immediately obvious
which

activities fell under the definition and which did not.

2. NPRM Proposals

    The NPRM proposed creating a new section in the regulations
referred to as ``exclusions.'' By proposing exclusion categories, the
NPRM intended to make clear that these activities would not have to
satisfy the regulatory requirements of the Common Rule. That is, the
proposed excluded activities would have been outside the scope of the
Common Rule.
    Three of the proposed exclusions sought to reduce uncertainty about
whether certain internal program improvement activities, historical or
journalistic inquiries, or quality assurance or improvement activities
satisfied the Common Rule's definition of research.
    Another three proposed exclusions pertained to activities that are
part of inherently governmental functions with purposes other than
research, such as responsibilities to protect public health and welfare
(i.e., criminal investigations, public health surveillance, and
national security missions). It was proposed that these activities
promote recognized specific goods that are crucial to the public
welfare.
    An additional four categories of proposed exclusions included human
subjects research activities that were either considered low risk, or
for which there were appropriate safeguards already in place
independent of the Common Rule. These four categories pertained to: (1)
Research that involves the use of educational tests, survey procedures,
interview procedures, or observation of public behavior uninfluenced by
the investigators; (2) research involving the collection or study of
information that has been or will be acquired solely for non-research
activities or were acquired for research studies other than the
proposed research study; (3) research conducted by a federal government
agency using federal government-generated non-research information when
certain criteria are met; and (4) research regulated as ``health care
operations,'' ``public health activities,'' or ``research'' under
HIPAA. As noted in the NPRM, in these categories the principle of
beneficence alone could support the conduct of these activities after
considering the level of risk, potential benefits, and nature of human
participation in these activities, without the need to add the
protections of the Common Rule.
    A final proposed exclusion would have applied to research involving
the secondary use of nonidentified biospecimens when the research was
limited to generating information about the subject that is already
known by the subject (e.g., disease diagnosis). As such, this research
would not need any additional protections provided by these
regulations. This proposed exclusion was directly related to the
proposed changes in the definition of ``human subject'' to include all
biospecimens, regardless of whether they are identifiable (as discussed
above in Section III, that proposal has not been adopted).
3. Public Comments, Response to Comments, and Description of the Final
Rule: Definition of Research
a. Overview
    Approximately 375 public comments discussed at least one aspect of
the proposed NPRM exclusions. General concerns about the exclusions
included that they added a layer of unnecessary complexity in
determining what studies fall under the Common Rule, and that
overlapping categories of exclusions and exemptions were proposed.
Comments also expressed the concern about the lack of requirements on
who would decide whether an activity met the criteria for an exclusion,
including investigators, or whether those decisions would be documented
in any way.
    In response to the public comments, the NPRM's general approach of
designating various categories of activities as excluded has not been
adopted. Instead, the final rule reverts to the general structure of
the pre-2018 rule and integrates some of the categories proposed for
exclusion in the NPRM into that structure, with some changes to the
categories.
    The final rule retains the wording of the pre-2018 definition of
research, and explicitly removes four categories of activities from
activities that would meet that definition. These revisions are
intended to make the rule simpler, more familiar to readers who are
aware of the pre-2018 rule and its definition of research, and easier
to understand.
    The four categories of activities removed from the definition of
research are set out in order to make clear that they are not within
the jurisdiction of the rule. The four categories pertain to certain
scholarly and journalistic activities, public health surveillance
activities, criminal justice activities, and authorized operational
activities in support of national security missions. These categories
were proposed as exclusions in the NPRM; the final rule retains these
categories, with some changes made in the wording for clarity, in
response to public comments.
    The category of certain scholarly or journalistic activities is
removed from the definition in order to resolve long-standing debate
and uncertainty about whether these activities are considered research
in the sense of the regulatory definition. We believe that these
activities should not be considered research in the context of the
Common Rule, and that making this explicit in the final rule will help
to resolve the uncertainty.
    The final rule includes a simpler definition of national security
missions not considered to be human subject research, as a response to
concern that the earlier draft language in the NPRM could be
interpreted too broadly or too narrowly due to the specific activities
listed, such as surveys, interviews, surveillance activities and
related analyses, and the collection and use of biospecimens. These
authorized operational activities, as determined by each agency, do not
include research activities as defined by the Common Rule, nor have
they ever in the past been considered regulated by the Common Rule.
This category of activity is removed from the definition of research to
make explicit that the requirements of the final rule do not apply to
authorized operational activities in support of national security
missions.
    The other two categories of activities deemed not to be research
under the final rule (pertaining to public health surveillance
activities and criminal justice activities) include many activities
that under the pre-2018 rule do not fit the definition of research, and
some activities that otherwise might. These categories are included in
the final rule in order to make it explicit that the requirements of
the final rule do not apply to them.
    Three categories of activities proposed as exclusions have been
eliminated from the final rule. The proposed exclusion for certain
quality assurance/quality improvement (QA/QI) activities has been
dropped because it could create more confusion than it resolved, and it
might have inadvertently created inappropriate obstacles to those QA/QI
activities that should not fall under the rule. The proposed exclusion
for internal program improvement activities has been dropped due to
similar considerations. The category regarding secondary research
involving nonidentified biospecimens designed only to generate
information about an individual that is already known has been dropped
because it is no longer necessary given that the NPRM proposal

to modify the definition of human subject to include all biospecimens
regardless of identifiability is not included in the final rule. The
discussion of the proposed exclusion for certain research activities
with nonidentified biospecimens appears in additional detail in Section
III.D.
    The four exclusions proposed in the NPRM that are incorporated into
the exemptions in the final rule are: (1) The proposed exclusion for
certain educational tests, survey or interview procedures or
observation of public behavior; (2) the proposed exclusion for
secondary research use of information that is publicly available or
recorded without identifiers; (3) the proposed exclusion regarding
secondary research use of information collected by the Federal
Government for other purposes and subject to certain privacy laws; and
(4) the proposed exclusion regarding secondary research use of
information covered by HIPAA protections.
b. Scholarly and Journalistic Activities (e.g., Oral History,
Journalism, Biography, Literary Criticism, Legal Research, and
Historical Scholarship) (Sec.  __.102(l)(1))
i. Public Comments
    Approximately 50 comments discussed the NPRM proposal to exclude
scholarly and journalistic articles from coverage by the rule. The
majority of these comments supported the intent of the exclusion,
although several comments suggested possible changes. The minority of
the comments expressed concerns. Those who opposed this exclusion
generally opposed all exclusions, arguing that investigators should be
required to get permission from subjects before engaging in these
activities.
    One commenter expressed concern about an exclusion that would
permit oral history activities with tribal nations without oversight.
This commenter noted that some oral history with tribal nations is
tantamount to cultural appropriation, and the concern of tribal nations
might not be adequately protected by the ethical standards of various
professions.
    Several commenters discussed that the wording of the NPRM
regulatory text here might be more restrictive than necessary.
Specifically, several commenters noted that in calling out specific
disciplines and methodologies, the regulatory text seems counter to the
NPRM policy goal of allowing this type of research (as opposed to
research in these specific fields) to occur.
    A few commenters discussed the need for ethnographic research to be
explicitly called out in this exclusion. One commenter also raised
cultural anthropology as another academic discipline that should be
referenced in this exclusion.
    Several commenters, including academic discipline advocacy groups,
noted that the exclusion conflated broad disciplines (journalism) with
methodologies (oral history), which could be confusing to those
attempting to implement the exclusion.
    Several commenters also questioned whether the provision ``that
focus directly on the specific individuals about whom the information
is collected'' applied only to historical scholarship activities or to
all of the activities and disciplines noted in the exclusion. Several
other commenters indicated that they supported a full exclusion of all
oral history, journalism, biographical, and historical scholarship
activities, suggesting that those several individuals do not presume
that the provision ``that focus directly on the specific individuals
about whom the information is collected'' served as a limitation on
what activities were covered under this exclusion.
    A minority of commenters--including accreditation bodies, human
research protection experts, and research universities--suggested that
an exclusion for these activities was not needed, and that this topic
could be addressed through guidance. These comments also indicated that
addressing this topic in guidance might be clearer to the regulated
community as well. Others indicated that the exclusion is not warranted
because the excluded activities are those that would not contribute to
generalizable knowledge and thus already would not fall under the rule.
    The NPRM also asked whether biospecimens should be included in this
exclusion. Very few individuals answered this question, and those that
did indicated that biospecimens should not be included.
    One research university indicated that with respect to oral
history, the exclusion should make a distinction between oral history
projects that meet the definition of research and those that do not,
suggesting that the exclusion should not exempt all projects that might
fall under the ``oral history'' banner. One commenter noted that oral
history should be defined in order to distinguish that activity from
interviews.
ii. Response to Comments and Explanation of the Final Rule: Scholarly
and Journalistic Activities
    The final rule explicitly removes a category of activities
consisting of certain scholarly and journalistic activities from the
definition of research and the scope of the regulations. This category
of activities concerns certain activities in various fields that focus
directly on the specific individuals about whom information are
collected. As described above, this category is removed from the
definition in order to resolve long-standing debate and uncertainty
about whether these activities are considered research in the sense of
the regulatory definition. We believe that these activities should not
be considered research in the context of the Common Rule, and that
making this explicit in the final rule will help to resolve the
uncertainty.
    In these activities, the ethical requirement is to provide an
accurate and evidence-based portrayal of the individuals involved, and
not necessarily to protect them from public scrutiny. For example, a
biographer might collect and present factual information to support the
biographer's opinion about the character of an individual to show that
the individual does not deserve the positive reputation he or she
enjoys in society. These fields of research have their own codes of
ethics, according to which, for example, consent is obtained for oral
histories. We note that this consent standard should address the issue
of oral histories of tribal members. For these reasons, we have
determined that it is appropriate to remove these activities from the
definition of research and from the scope of the Common Rule.
    In response to public comments, Sec.  __.102(l)(1) refers to more
fields and methodological traditions than were proposed in the NPRM.
The final rule also explicitly cites those fields and traditions as
examples, in order to clarify that the focus is on the specific
activities that collect and use information about specific individuals
themselves, and not generalizing to other individuals, and that such
activities occur in various fields of inquiry and methodological
traditions. Literary criticism has been added as an example because
while a piece of literary criticism might focus on information about
the author(s), it would typically focus on the specific author(s) in
view. Legal research has been added as an example because it would
often focus on the circumstances of specific plaintiffs or parties
involved in a case. It is not the particular field

that removes the activity from the definition, but rather the
particular activity's focus on specific individuals.
    Activities described in Sec.  __.102(l)(1) may sometimes be
performed in the fields of anthropology or sociology, but not all
activities characteristic of these fields are outside of the rule.
Studies using methods such as participant observation and ethnographic
studies, in which investigators gather information from individuals in
order to understand their beliefs, customs, and practices, and the
findings apply to the studied community or group, and not just the
individuals from whom the information was obtained, fall within the
scope of the definition of research of the final rule.
c. Public Health Surveillance (Sec.  __.102(l)(2))
i. Public Comments
    Approximately 80 comments discussed the proposed exclusion for
certain public health surveillance activities. Public comments were
generally mixed with many comments suggesting that the regulated
community will need to see additional examples of activities that
satisfy this exclusion and activities that fall outside its scope.
Those who supported this exclusion generally said that this would
streamline important public health surveillance activities.
    Several comments discussed the importance of this exclusion with
respect to residual newborn DBS screening programs. These comments
generally expressed the opinion that most state mandated public health
reporting of such program activities would fall under this exclusion.
Commenters requested additional explanation of what aspects of these
state newborn screening programs would be covered under this exclusion,
and listed components of the program that should be covered, including
validity testing and test development. Others suggested that this
exclusion should also exclude minimal risk efforts to evaluate
surveillance methods. Others suggested that this exclusion should also
exclude minimal risk efforts to evaluate surveillance methods. Another
comment suggested that a final rule address, in this exclusion or
elsewhere, the issue of research that must be conducted during public
health emergencies, citing the example of HHS's emergency use provision
with a waiver of informed consent, which describes limited
circumstances in which a patient is physically incapacitated or
otherwise unable to give consent.
    Those who opposed excluding these activities argued that in some
cases, research activities for which informed consent should be sought
and obtained are sometimes conducted under the auspices of public
health surveillance; the importance of the activity itself should not
be an argument to avoid seeking and obtaining consent. Others argued
that consent should always be sought and obtained for research
activities and that all of the exemptions and exclusions discussed in
the NPRM should be covered activities. One institution indicated that
this exclusion was simply not needed because the activities described
did not meet the definition of ``research'' and thus were not subject
to the Common Rule.
    Another commenter indicated that while the intent of the exclusion
seemed reasonable, implementation of the regulatory intent would be
difficult, and there are many examples of modern public health
surveillance activities where informed consent would have been
appropriate.
    A few comments that opposed the exclusion indicated concern that it
might be abused, and cited the Tuskegee Syphilis study \25\ as an
example of what they feared might be included under this exclusion
category. We do not think that study would fall within this category,
because it involved research interventions with the subjects, including
the provision of substandard treatment and efforts to prevent subjects
from obtaining effective treatment, which under no circumstances could
be considered surveillance about a condition of public health
importance.
---------------------------------------------------------------------------

    \25\ The Tuskegee Syphilis study ``initially involved 600 black
men--399 with syphilis, 201 who did not have the disease. The study
was conducted without the benefit of patients' informed consent.
Researchers told the men they were being treated for `bad blood,' a
local term used to describe several ailments, including syphilis,
anemia, and fatigue. In truth, they did not receive the proper
treatment needed to cure their illness. In exchange for taking part
in the study, the men received free medical exams, free meals, and
burial insurance. Although originally projected to last 6 months,
the study actually went on for 40 years.
    The [federal government panel investigating this study] found
that the men had agreed freely to be examined and treated. However,
there was no evidence that researchers had informed them of the
study or its real purpose. In fact, the men had been misled and had
not been given all the facts required to provide informed consent .
. . The men were never given adequate treatment for their disease.
Even when penicillin became the drug of choice for syphilis in 1947,
researchers did not offer it to the subjects. The advisory panel
[investigating this study] found nothing to show that subjects were
ever given the choice of quitting the study, even when this new,
highly effective treatment became widely used.'' Source: ``The
Tuskegee Timeline.'' Centers for Disease Control and Prevention,
last updated 19 Feb 2016. Retrieved from http://www.cdc.gov/tuskegee/timeline.htm.)
---------------------------------------------------------------------------

    The NPRM asked whether the parameters of this exclusion were
sufficiently clear, and if not, how the exclusion could be clarified.
In response, one private organization conducting public health research
stated that it was unclear if this only applies to governmental
entities like the Centers for Disease Control and Prevention (CDC), or
if it applies to other organizations as well. Another institution
suggested that the community needed additional clarification of what
types of activities fall under this exclusion. One research university
requested clarification on whether public health surveillance
activities falling under this exclusion is subject to subpart B and C,
that is, research involving pregnant women or prisoners, respectively.
One organization indicated that it would be helpful for the examples
used in the NPRM preamble to be published as a separate guidance
document.
    Another comment noted that the examples included in the preamble
only addressed acute infectious disease surveillance and no other types
of public health surveillance activities, specifically, chronic disease
surveillance and biomonitoring for toxic chemical compounds and
metabolites, which should be covered under this exclusion.
    Another research organization noted that the regulatory text and
examples provided might be too narrow, suggesting the exclusion be
broadened to clarify that it applies to public health monitoring aimed
at evaluating the degree to which affected individuals seek and obtain
treatment, barriers to care, quality of care, treatment outcomes, and
health disparities.
    Commenters also requested additional explanation of what aspects of
state newborn screening programs would be covered under this exclusion,
and listed a variety of components of the program, including validity
testing and development of new tests, that should be covered by the
exclusion. Commenters asked that clarification of the parameters of the
public health exclusion be provided so that state newborn screening
programs can undertake the activities necessary for new test
development. They added that if the parameters are not clarified, given
the past controversies associated with the retention and secondary use
of newborn DBS, many programs may not undertake activities for which
they have not been given express permission to pursue.

ii. Response to Comments and Explanation of the Final Rule: Public
Health Surveillance
    The final rule adopts the NPRM proposal related to deeming certain
public health surveillance activities as explicitly outside of the
scope of the Common Rule. Several editorial modifications have been
made to this category to improve readability. Additionally, the final
rule explicitly specifies that the collection of information is
permitted under this category of activities.
    The final rule codifies the current interpretation that the
definition of research does not include a category of activities that
solely involve public health surveillance, including collecting and
testing information or biospecimens in activities that are conducted,
supported, requested, ordered, required, or authorized by a public
health authority and that are limited to those necessary to allow the
public health authority to identify, monitor, assess, or investigate
potential public health signals, onsets of disease outbreaks, or
conditions of public health importance. Such surveillance activities
can include collecting information about trends, signals, risk factors,
patterns in diseases, or increases in injuries from using consumer
products. Such activities include those associated with providing
timely situational awareness and priority-setting during the course of
an event or crisis that threatens public health, including natural or
man-made disasters.
    This codification of public health surveillance activities as
outside the definition of research is designed to remove uncertainty,
but is not intended to change the scope of activities subject to or not
subject to the Common Rule. When a public health authority conducts
public health surveillance activities to fulfill its legal mandate to
protect and maintain the health and welfare of the populations it
oversees, the regulatory protections of the Common Rule should not
impede that authority's ability to accomplish its mandated mission of
promoting this recognized public good, in keeping with the principle of
beneficence. Other protections independent of the Common Rule exist
that serve to protect the rights and welfare of individuals
participating in such activities, including federal and state policies
to protect privacy, confidentiality, and security safeguards for the
information collected.
    Public health surveillance refers to collecting, analyzing, and
using data to target public health and disease prevention. It is the
foundation of public health practice. Surveillance uses data from a
variety of sources, including mandatory reporting of certain
conditions, routine monitoring, vital records, medical billing records,
and public health investigations. The line between public health
surveillance and epidemiological research can be difficult to draw, as
the same epidemiological techniques may be used in both. Generally, the
difference between the activities is the purpose or context in which
the investigation is being conducted and the role of the public health
authority.
    The following are examples of public health surveillance activities
being codified as outside of the definition of research in this
regulation:
     Safety and injury surveillance activities designed to
enable a public health authority to identify, monitor, assess, and
investigate potential safety signals for a specific product or class of
products (for example, the surveillance activities of the FDA's Adverse
Event Reporting System,\26\ the Vaccine Adverse Event Reporting
System,\27\ Manufacturer and User Facility Device Experience
database,\28\ the Medical Product Safety Network,\29\ and the Sentinel
Initiative); \30\
---------------------------------------------------------------------------

    \26\ See http://www.fda.gov/Drugs/InformationOnDrugs/ucm135151.htm.
    \27\ See https://vaers.hhs.gov/index.
    \28\ See http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/PostmarketRequirements/ReportingAdverseEvents/ucm127891.htm.
    \29\ See http://www.fda.gov/MedicalDevices/Safety/MedSunMedicalProductSafetyNetwork/.
    \30\ See http://www.fda.gov/Safety/FDAsSentinelInitiative/ucm2007250.htm.
---------------------------------------------------------------------------

     Surveillance activities designed to enable a public health
authority to identify unexpected changes in the incidence or prevalence
of a certain disease in a defined geographic region where specific
public health concerns have been raised (e.g., the U.S. influenza
surveillance system, which allows CDC to find out when and where
influenza activity is occurring, track influenza-related illness,
determine what strains of influenza virus are circulating, detect
changes in influenza viruses, and measure the impact influenza is
having on hospitalizations and deaths in the United States);
     Surveillance activities designed to enable a public health
authority to identify the prevalence of known risk factors associated
with a health problem in the context of a domestic or international
public health emergency;
     Surveillance activities designed to enable a public health
authority to locate the range and source of a disease outbreak or to
identify cases of a disease outbreak;
     Surveillance activities designed to enable a public health
authority to detect the onset of disease outbreaks or provide timely
situational awareness during the course of an event or crisis that
threatens the public health, such as a natural or man-made disaster;
and,
     Surveillance activities designed to enable a public health
authority to identify the prevalence of a condition of public health
importance, known risk factors associated with a condition of public
health importance, or behaviors or medical practices related to
prevalence of a known condition of public health importance (e.g.,
surveillance of the prevalence of: tobacco use, exposure to secondhand
smoke, lung cancer, or use of smoking cessation treatments).
    On the other hand, subsequent research using information collected
during a public health surveillance activity, for instance, genetic
analysis of biospecimens, would not be removed from the definition.
    This clarification of current interpretation would not remove the
following activities from the definition of ``research'': exploratory
studies designed to better understand risk factors for chronic
diseases, including genetic predisposition, for chronic diseases;
exploratory studies designed to elucidate the relationships between
biomarkers of exposure and biomarkers of disease; and exploratory
studies of potential relationships between behavioral factors (e.g.,
diet) and indicators of environmental exposures. These types of
activities would be considered research because they would not be
conducted solely for the purposes described in Sec.  __.102(l)(2), and
thus would be covered by the Common Rule if they involved human
subjects, even if conducted by a federal agency with a public health
mandate. Again, they might fall within an exemption, depending on how
they are carried out.
    We note that this provision does apply to some activities
responding to emergencies, and that various department or agency
activities, not just those of HHS, will be affected. Research
evaluations of public health surveillance activities are not included
in this category because the nature of such evaluations is to create
generalizable knowledge. We also recognize that in some public health
surveillance activities, it may be appropriate to obtain consent from
the individuals from whom information or biospecimens are collected.
    We recognize the public comments stating that the boundaries of
public health surveillance activities being removed from the definition
of research

are not entirely clear. We recognize that some of the activities in
this category are not research, but believe that the inclusion of this
provision will help to resolve uncertainty in some circumstances about
whether the rule applies. We believe that developing guidance in this
area will be useful.
    Finally, to clarify what public health surveillance activities are
being removed from the definition of research, the final rule contains
a new definition of ``public health authority'' at Sec.  __.102(k).
d. Criminal Justice Activities (Sec.  __.102(l)(3)) and Authorized
Operational Activities in Support of National Security Missions (Sec.
__.102(l)(4))
i. Public Comments
    Approximately 60 comments discussed the exclusion for certain
criminal justice activities, the exclusion for intelligence
surveillance activities, or both. The majority of commenters opposed
these provisions.
    Several commenters stated that the two exclusions seemed to
contradict President Clinton's Memorandum of 1997, which stated that
classified research activities are subject to the Common Rule and
directed that the regulations be revised to include certain protections
specific to classified research activities.\31\
---------------------------------------------------------------------------

    \31\ Memorandum of March 27, 1997. Strengthened Protections for
Human Subjects of Classified Research. 62 FR 26367 (May 13, 1997).
Retrieved from http://www.fas.org/sgp/clinton/humexp.html.
---------------------------------------------------------------------------

    The majority of commenters discussing these provisions also
expressed concern about what appeared to be an expansion of activities
not covered by the Common Rule. These commenters also discussed
concerns about how this exclusion would affect human subjects
protections in classified research activities.
    Those who supported these exclusions generally did not provide the
rationale for why they supported them.
    One research organization noted that additional clarification on
the exclusion for certain criminal justice activities would be needed,
and noted that such activities should continue to be subject to the
Common Rule because this type of research often includes the collection
of sensitive, identifiable information, which, if disclosed could
present risks to the subjects.
ii. Response to Comments and Explanation of the Final Rule: Criminal
Justice Activities
    The final rule clarifies that, consistent with current practice,
data collection and analysis that enables the conduct of certain
activities carried out as part of the criminal justice system is not
research. The scope of these activities is collection and analysis of
information, biospecimens, or records by or for a criminal justice
agency for activities authorized by law or court order solely for
criminal justice or criminal investigative purposes. The activities are
necessary for the operation and implementation of the criminal justice
system. The final rule changes the wording of the category from that
proposed in the NPRM only by substituting the word ``information'' for
``data,'' for consistency with other parts of the rule.
    The provision essentially codifies current federal interpretation
that such activities are not considered to be research under the Common
Rule. Revising the regulations to explicitly remove such activities
from the scope of research subject to the rule is designed to avoid the
imposition of disparate requirements by IRBs with overlapping
jurisdictions when information collection or analysis encompasses the
development of methods required by law or court order for criminal
justice or criminal investigative purposes. For example, the Federal
Bureau of Investigation (FBI) is charged by law with setting standards
governing the collection and processing of DNA biospecimens and
information taken (forcibly if necessary) from certain federal and
state criminal suspects or offenders incident to their arrest or
conviction for prescribed offenses under the National DNA
Identification Act of 1994 and other acts. Similarly, the FBI is
charged by law with setting standards governing the collection and
processing of fingerprints and related biographical information taken
from federal and state criminal suspects or offenders and certain
sensitive civil employment applicants. Many criminal law enforcement
agencies routinely collect human biospecimens at crime scenes from or
relating to victims, suspects, and offenders both known and unknown.
Incident to these activities, the FBI is also charged with maintaining,
and authenticating through identification processes, the criminal
record history of criminal offenders for federal government agencies
and for the overwhelming majority of state governments that elect to
participate and share information through those systems. We have
determined that this category of activities does not meet the
definition of research in the final rule, so that these activities can
be conducted in accordance with the legitimate goals of the criminal
justice system.
    We do not believe that this provision contradicts President
Clinton's 1997 memorandum, which addressed the regulatory requirements
for certain activities that are considered research under the
regulations. This category pertains to activities that are outside of
the regulatory requirements.
    This category is also not intended to include social and behavioral
studies of the causes of criminal behavior. Such studies would be
considered research under the final rule.
iii. Response to Comments and Explanation of the Final Rule: Authorized
Operational Activities in Support of National Security Missions
    The final rule clarifies current federal practice that the
definition of research does not include authorized operational
activities (as determined by each agency) in support of intelligence,
homeland security, defense, or other national security missions. This
clarification codifies the interpretation of the pre-2018 Common Rule.
    As described above, the final rule includes a simpler reference to
authorized operational activities in support of national security
missions not considered to be human subject research, as a response to
concern that the NPRM proposal could be interpreted too broadly or too
narrowly due to the specific activities listed, such as surveys,
interviews, surveillance activities and related analyses, and the
collection and use of biospecimens. These authorized operational
activities, as determined by each agency, do not include research
activities as defined by the Common Rule, nor have they ever in the
past been considered regulated by the Common Rule. This category of
activity is removed from the definition of research to make explicit
that the requirements of the final rule do not apply to authorized
operational activities in support of national security missions. This
clarification is not intended to narrow the scope of the Common Rule.
    We do not believe that this category contradicts President
Clinton's Memorandum of 1997 regarding classified research, because
this category is merely clarifying what activities are not considered
to meet the definition of research. The Clinton Memorandum calls for a
number of requirements to be added to protections for classified
research activities, but it does not address activities that are not
considered research.

4. NPRM Exclusions Not Included in the Final Rule
a. Certain Quality Assurance and Quality Improvement Activities
i. Public Comments
    Approximately 90 comments discussed the proposed exclusion for
certain QA/QI activities in the NPRM involving the implementation of an
accepted practice. A majority of comments supported the concept of
excluding some QA/QI activities from the Common Rule, although some
stated that the QA/QI exclusion proposed in the NPRM was too narrow to
cover what has evolved as current practice.
    These commenters expressed concerns that: (1) The NPRM proposed to
exclude only the QA/QI activities that met the exclusion, and that all
other QA/QI activities would fall under the rule; or (2) the exclusion
would be interpreted to mean that the activities described in the
exclusion were the only QA/QI activities that could be considered not
covered by the rule.
    The most commonly discussed suggestions for expanding the scope of
this exclusion included:
     Expanding the exclusion beyond ``accepted practices''
     Permitting the collection of outcome measures in the
category of activities proposed to be excluded by the NPRM

    One hospital noted that QA/QI is not limited to implementation of
an ``accepted practice'' and that limiting the exclusion in this way
might impede innovation, for example, accessing an electronic medical
record system for QA/QI to test incorporating clinical information to
analyze and test best-practice pop-up alerts that signal important
information for healthcare providers in caring for a patient. This
commenter asserted that there is no current ``accepted practice'' for
activities like this, yet they should be excluded from the definition
of research to avoid confusion and to support ongoing innovation and
care improvement activities. This commenter also suggested that any QA/
QI exclusion should permit activities that allow medical centers to
analyze how they deliver care, improve outcomes, and modify processes
to achieve healthcare reform goals.
    One commenter also noted that the ``accepted practice'' limitation
would also be problematic in the social sciences. This commenter
disagreed that the proposed exclusion for quality improvement or
assurance practices should be limited to ``an accepted practice,'' and
felt that it should apply to the evaluation of alternative practices.
In social sciences research an ``accepted practice'' is generally not
as well defined, can evolve rapidly, and vary by considerations such as
timing, culture, geography, and nature of service. In social science
research, this limitation could severely limit the use of this
exclusion for research that is equally low in risk and therefore does
not require review.
    A few commenters explicitly referenced the importance of QA/QI
activities in the context of a learning health care system, and
discussed the need for a broader exclusion in order to achieve the
goals of a learning health system.
    A professional organization focused on advancing the fields of
health services research and health policy noted that a basic tenet of
the learning health system is the expectation of continuous learning
from routine care, which often is accomplished by evaluating health
outcomes. The intentional assessment of the outcomes related to a QI
activity by itself should not make the activity subject to the Common
Rule.
    A medical education membership organization felt that routine
evaluation of practices and continuous incorporation of knowledge
learned into patient care is fundamental to a learning health system
and should not be impeded by the regulatory framework. It stated that
the current Common Rule provides insufficient guidance to distinguish
research and improvement in care delivery in a consistent manner. The
organization indicated that the revised Common Rule explicitly
recognizes that efforts to improve care by evaluating an accepted
practice and the resulting effects are not research that should be
regulated under the Common Rule.
    Commenters suggested many other QA/QI activities that should be
explicitly excluded or exempted from the Common Rule, such as:
     Activities mandated by the Clinical Laboratory Improvement
Amendments (CLIA)
     Evaluations of systems-level interventions to improve
quality and safety
     Comparative assessment of alternative practices to
determine relative effectiveness
     All QA/QI research for the purpose of health care
operations, including patient-centered comparative effectiveness
research
     Evaluation of competing QA/QI strategies for
implementation of accepted medical practices, which should not be
subject to IRB review
     Evaluation of competing low-risk interventions that would
typically be implemented in a QA/QI framework without further research:
these typically are not direct medical treatments but ancillary aspects
of care.
     The use of other analytic assessment methods, such as
interrupted time series analysis, or randomization of clusters
(including stepped wedge designs)
     Dissemination of QA/QI results, or the intention to
disseminate results, including by publication, which should not by
itself make the activity subject to IRB review (consistent with current
OHRP guidance)
     Multi-institution collaborations of otherwise routine QA/
QI activities
     Public health-related QA/QI activities
     Comparative benchmarking

    Others expressed approval for the proposed exclusion, but suggested
that substantial guidance would be necessary for the regulated
community to apply this exclusion appropriately. Specifically, several
commenters asked about the extent to which OHRP's current guidance on
QA/QI activities would still apply. Others asked for clarification
about the extent to which the NPRM proposal would apply in situations
where a hospital system with several hospitals implemented different
accepted practices at different hospitals within the system, and
compared outcomes to determine which accepted practice would be best
for that hospital system.
    Several comments did not support the NPRM's QA/QI proposal. Reasons
included: believing that the activities excluded by the NPRM already
did not meet the definition of research and thus did not need to be
explicitly excluded; believing that these activities should be subject
to some type of review because of concerns about investigator self-
determination; and, believing that even in QA/QI activities, human
subjects should be offered the opportunity to know that they are
subjects in a research activity and should be offered the option to
consent.
    One patient advocacy group noted that because much research is done
in the guise of administration or QI, this proposed exclusion might
encourage researchers to evade human subjects protections while the
projects may put primary subjects and third parties at risk. It stated
that although some hospital-based projects might incur minimal risk to
primary subjects, they might pose greater risk to other parties, for
example, patients. Thus, the group argued that this exclusion should be

stricken and that if personal information and biospecimens are to be
collected and analyzed for purposes other than the individual patient's
care, then that activity should be subject to the Common Rule.
    One research institution felt that the proposed change suggests
that patient consent will be necessary for many activities designed to
ensure QA/QI in health care settings, and could interfere with the
imperative to design and evaluate new approaches to enhance patient
safety and clinical outcomes. The commenter added that the implications
of this provision should be assessed by clinical practitioners and
hospital administrators in addition to researchers and research
institutions.
    Another commenter noted that the proposed exclusion of QA/QI
activities fails to exclude important activities that are considered
``not research'' under the current Common Rule, arguing that the new
NPRM exclusion is more in line with evidence-based practice than with
QI. Institutions are required under The Joint Commission to perform
continuous QI activities, which typically are small, iterative changes
to improve clinical care; these activities are seen as part of hospital
operations rather than research. The commenter stated that the proposed
limitations would make certain QI activities subject to IRB review and
possible informed consent requirements, which could result in
overregulating an activity that is currently not subject to the Common
Rule.
    Several of these commenters generally indicated that they
interpreted the proposed exclusion as providing a definition of QA/QI,
as opposed to excluding a specific type of QA/QI activity. Several of
these commenters suggested deleting a QA/QI exclusion from the rule so
that IRBs and investigators would not be confused. One hospital
suggested eliminating quality activities from the NPRM since by
specifying that certain quality activities are not research, the NPRM
seems to designate all other quality activities as research by default.
ii. Response to Comments and Explanation of the Final Rule: Certain
Quality Assurance and Quality Improvement Activities
    The proposed exclusion for QA/QI activities is not included in the
final rule. The degree of concern expressed by the public comments on
this topic is significant. We recognize that human subject protections
would be meaningful and appropriate for some QA/QI research activities,
but not for others. However, to avoid increasing confusion and
unnecessary obstacles to innovation, the final rule does not single out
certain QA/QI activities as meeting or not meeting the definition of
research.
b. Program Improvement Activities
i. Public Comments
    Approximately 20 comments were received on this proposed exclusion
regarding data collection and analysis for internal operational
monitoring and program improvement purposes, with a strong majority in
support. Commenters indicated that the proposed exclusion would require
significant guidance because it was unclear what types of activities it
might include and when. Several commenters supported the proposed
exclusion, but noted that the exclusion should specifically reference
QI activities instead of just program improvement activities. One
commenter suggested that activities defined as ``health care
operations'' under HIPAA also be included in this exclusion. One
commenter opposed this exclusion because of the lack of specific
reference to QI. Another opposed this exclusion because they felt it
was too narrowly written.
    One large private research firm indicated opposition to this
proposal because it was too confusing. Further, this group questioned
the need for an exclusion that seemed to only reference activities that
would not be considered to fall under the rule because these activities
would not satisfy the definition of research (specifically, these
activities would not be designed to contribute to generalizable
knowledge).
    Of those who opposed this proposal, a minority suggested that the
proposed exclusion could be abused by investigators, especially given
that the NPRM did not propose to require any institutional oversight of
exclusion determinations. One commenter noted that because many
research activities might be conducted under the guise of internal
improvement activities, this exclusion seemed to be giving
investigators significant opportunities to conduct human research
activities outside the confines of the rule.
    One commenter who supported this provision suggested that it could
be merged with the QA/QI exclusion proposed in the NPRM. This commenter
also suggested that a definition of program improvement and operational
monitoring be provided.
    The NPRM asked whether the use of biospecimens should be permitted
in this exclusion. Of those who answered this question, a majority
indicated yes. This majority generally referenced a belief that many
activities with residual newborn DBS (see Section III.D) would fall
under this exclusion. One commenter who opposed the inclusion of
biospecimens in this excluded category indicated that if the goal of
the NPRM was to cover all nonidentified biospecimens, then this
exclusion should not include the research use of biospecimens.
ii. Response to Comments and Explanation of the Final Rule: Program
Improvement Activities
    The proposed exclusion for program improvement activities is not
included in the final rule. Based on the public comments it does not
seem useful for this category of activities to be singled out as not
meeting the definition of research. As with the NPRM proposed exclusion
regarding QI/QA activities implementing accepted practices, public
commenters raised concerns that this exclusion would have created more
misunderstanding and confusion than it would have resolved. As with QI/
QA activities, some program improvement activities involve research and
deserve the protections of the rule, while others are not research and
are not under the rule. We believe that this topic would be better
addressed through other means.
I. Written or in Writing (Sec.  __.102(m))
    The final rule includes a definition that was not included in the
NPRM nor in the pre-2018 rule. The definition of ``written or in
writing'' is included at Sec.  __.102(m) to clarify that, in accordance
with the longstanding interpretation of the pre-2018 rule, these terms
include electronic formats, which are increasingly used to fulfill many
of the documentation requirements that appear throughout the rule.
    Although public comments did not directly address this issue, we
are aware that some in the regulated community are uncertain of
whether, for example, consent forms may be in electronic formats. This
definition is intended to address this concern. Note that the
definition of ``written or in writing'' does not preclude the
possibility that consent forms could be in media other than paper or
electronic formats and still meet the requirements of the Common Rule.

IV. Ensuring Compliance With This Policy (Sec.  __.103)

A. Background and Pre-2018 Requirements

    Requirements in the pre-2018 rule at Sec.  __.103 delineated
procedural requirements for institutions and IRBs to follow to comply
with the rule. The

requirements pertained to written assurances (through FWAs) that
institutions engaged in research are in compliance with the regulations
and that the content of such assurances include: a statement of
principles governing the institution in the discharge of its
responsibilities to protect research subjects; designation of one or
more IRBs; a detailed IRB membership roster; and written procedures for
IRBs and reporting of unanticipated problems. A U.S. institution also
was able to voluntarily pledge to conduct all of its nonexempt human
subjects research, regardless of funding source, in compliance with the
Common Rule or the Common Rule and subparts B, C, and D of 45 CFR part
46--often referred to as ``checking the box'' on the assurance form.
    The pre-2018 rule also stated who will execute and evaluate
assurances. Finally, the rule described the process by which
institutions certify that nonexempt research has been reviewed and
approved by an IRB. There has been concern expressed by some that the
assurance process may have been unduly burdensome for institutions and
did not provide meaningful protections for human subjects.

B. NPRM Proposals

    The NPRM proposed a number of substantive and procedural
modifications to Sec.  __.103 of the Common Rule. First, the NPRM
proposed to move several requirements from Sec.  __.103 to Sec.
__.108, which pertains to IRB functions and operations: (1) The IRB
recordkeeping requirements; (2) the requirement in the pre-2018 rule
that IRBs have sufficient meeting space and staff to support IRB
reviews and record keeping requirements; and (3) the pre-2018
requirement that an up-to-date list of the IRB members and their
qualifications be included in an institution's assurance. The NPRM also
proposed to modify the IRB membership requirement such that this up-to-
date list would no longer be required as part of an institution's
assurance. Instead, an IRB or an institution would be required to
prepare and maintain a current list of IRB members.
    The NPRM proposed to delete several requirements found in the pre-
2018 rule: (1) The requirement that an institution provide a statement
of ethical principles by which the institution will abide, as part of
the assurance process; (2) the pre-2018 rule requirement that an
institution designate one or more IRBs on its FWA; (3) the provision
found in the pre-2018 rule that a department or agency head's
evaluation of an assurance will take into consideration the adequacy of
the proposed IRB(s) designated under the assurance, in light of the
anticipated scope of the institution's activities and the types of
subject populations likely to be involved, the appropriateness of the
proposed initial and continuing review procedures in light of the
probable risks, and the size and complexity of the institution; and (4)
the requirement that grant applications undergo IRB review and approval
for the purposes of certification.
    Note that under the NPRM federal departments or agencies would
retain the ability to ask for information about which IRBs review
research conducted at an institution as part of the assurance process,
even if providing this information is not explicitly mandated.
    According to the NPRM, an additional, nonregulatory change was
proposed for the assurance mechanism. The current option of ``checking
the box'' on an FWA (described in section IV.A above) would be
eliminated.
    To further strengthen the proposed new provision at Sec.
__.101(a), giving Common Rule departments and agencies explicit
authority to enforce compliance directly against IRBs that are not
operated by an assured institution, language was proposed requiring
that for nonexempt research involving human subjects that is covered by
this policy and takes place at an institution in which IRB oversight is
conducted by an IRB that is not operated by the institution, the
institution and the organization operating the IRB shall establish and
follow procedures for documenting the institution's reliance on the IRB
for oversight of the research and the responsibilities that each entity
will undertake to ensure compliance with the requirements of this
policy (e.g., a written agreement between the institution and the IRB,
or by implementation of an institution-wide policy directive providing
the allocation of responsibilities between the institution and an IRB
that is not operated by the institution).
    The NPRM requested public comment on whether protection for human
subjects in research would be enhanced if OHRP conducted routine
periodic inspections to ensure that the membership of IRBs designated
under FWAs satisfy the requirements of Sec.  __.107.

C. Public Comments

    Very few comments were received on the proposals at Sec.  __.103.
Four commenters expressed their views on the proposal to delete the
requirement that an institution provide a statement of ethical
principles as part of the assurance process, with three supporting the
proposal and one opposing it.
    Four commenters supported the proposal to eliminate the requirement
that an institution designate one or more IRBs on its FWA.
    Two comments were received, one in support and one opposed, on the
proposed elimination of the requirement that an up-to-date list of the
IRB members and their qualifications be included in an institution's
assurance. Two comments, one for and one against, were received on the
proposal to remove the requirement that a department or agency head's
evaluation of an assurance take into consideration the adequacy of the
proposed IRBs. Responses to the question about periodic inspections to
ensure IRBs were compliant were mixed, with most commenters saying that
it is not clear that ensuring IRBs are compliant would enhance human
subjects protections. Others questioned the need for this requirement,
given other incentives institutions have to ensure they have a duly
constituted IRB, and still others asked what was meant by ``periodic.''
    Approximately 30 commenters supported the proposal to delete the
requirement that the IRB review grant applications, with only one
commenter opposed to the proposal.

D. Response to Comments and Explanation of the Final Rule: Assuring
Compliance With the Policy

    As proposed in the NPRM, the final rule eliminates the pre-2018
rule requirement that an institution provide a statement of ethical
principles by which an institution will abide as part of the assurance
process. We believe this requirement is unnecessary. Further, for
international institutions that may receive federal funding for
research activities, it creates the impression that these international
institutions must modify their internal procedures to comport with the
set of principles designated on the FWA for activities conducted at
those institutions that receive no federal funding. OHRP has received
many questions about the extent to which international institutions
must adhere to the ethical principles designated as part of the
assurance process for research activities conducted by the institution
that receive no Common Rule department or agency funding. That such
measures are not required will be made clear by deletion of this
requirement in the final rule.
    Additionally, as proposed in the NPRM, the final rule eliminates
the

requirement that appeared in the pre-2018 rule that an up-to-date list
of the IRB members and their qualifications be included in an
institution's assurance. Instead, Sec. Sec.  __.108(a)(2) and
__.115(a)(5) in the final rule require that an IRB or the institution
prepare and maintain a current list of IRB members. This eliminates the
previous requirement that changes in IRB membership be reported to the
department or agency head, or to OHRP when the existence of an
assurance approved by HHS for federal-wide use is accepted. Of note,
SACHRP recommended in March, 2008 that OHRP pursue harmonizing the
Common Rule with FDA's human subjects protection regulations by
eliminating the requirement to submit IRB membership lists.
    The final rule, as proposed in the NPRM, also eliminates the
requirement that appeared in the pre-2018 rule that an institution
designate one or more IRBs on its FWA. Federal departments or agencies
retain the ability to ask for information about which IRBs review
research conducted at an institution as part of the assurance process,
even if that requirement is not explicitly mandated in the regulations.
    An additional, a nonregulatory change that was described in the
NPRM will be made to the assurance mechanism. The prior option that
enabled institutions with an active FWA to ``check the box'' (described
in section IV.A above) is being eliminated. Importantly, institutions
could, if they so desire, continue for purposes of their own internal
rules to voluntarily extend the regulations to all research conducted
by the institution, but this voluntary extension will no longer be part
of the assurance process and such research will not be subject to OHRP
oversight. We expect this change to have the beneficial effect of
encouraging some institutions to explore a variety of flexible
approaches to overseeing low-risk research that is not funded by a
Common Rule department or agency, without reducing protection of human
subjects, thus furthering the goal to decrease inappropriate
administrative burdens.
    In addition, as proposed in the NPRM, the final rule removes the
provision found in the pre-2018 rule that a department or agency head's
evaluation of an assurance will take into consideration the adequacy of
the proposed IRB(s) designated under the assurance in light of the
anticipated scope of the institution's activities and the types of
subject populations likely to be involved, the appropriateness of the
proposed initial and continuing review procedures in light of the
probable risks, and the size and complexity of the institution. We
believe this deletion aligns the regulations with changes made in
December 2000 to OHRP's implementation of the FWA process. Those
changes streamlined and simplified the assurance process and eliminated
OHRP's institution-specific evaluation of the adequacy of each IRB
designated under the assurance.
    Each FWA-holding institution continues to have responsibility for
ensuring that the IRBs on which it relies are registered with OHRP and
are appropriately constituted to review and approve the institution's
human subjects research, as required under Sec. Sec.  __.107 and __.108
of the final rule.
    The final rule contains language at Sec.  __.103(e) requiring that
for nonexempt research involving human subjects (or exempt research
that requires limited IRB review) that takes place at an institution
for which an IRB not operated by that institution exercises oversight,
the institution and the organization operating the IRB must document
the institution's reliance on the IRB for its research oversight. The
final rule also requires that this documentation include the
responsibilities of each entity to ensure compliance with the
requirements of the rule.
    The requirement included in the final rule for documenting an
institution's reliance on an IRB that it does not operate is more
flexible than what was proposed in the NPRM. The final rule only
requires that the reliance agreement between the institution and the
organization operating the IRB be documented. It does not include the
NPRM proposal that the institution and the organization operating the
IRB establish and follow procedures for documenting the institution's
reliance on the IRB for oversight of the research and delineating the
responsibilities that each entity would assume to ensure compliance
with the requirements of the rule.
    In considering the public comments, we determined that it was
unnecessary to require that such reliance relationships be described in
institutional procedures. Under the final rule, compliance with this
provision could be achieved in a variety of flexible ways, for example,
through a written agreement between the institution and a specific IRB,
through language contained in a protocol of a multi-institutional
study, or more broadly, by implementation of an institution-wide policy
directive providing the allocation of responsibilities between the
institution and all IRBs that are not operated by the institution.
Documenting the responsibilities of the institution and the IRB is
already a requirement under the terms of an FWA, but is now a
regulatory requirement. An additional requirement has been added at
Sec.  __.115(a)(9) that such documentation be part of the IRB records.
    We acknowledge that the new requirement could increase
administrative burden for some institutions, but believe that the
examples cited above reflecting the various options an institution may
use to document reliance on an IRB not operated by that institution are
generally already standard practice in the regulated community.
    Finally, the final rule eliminates the requirement in the pre-2018
rule at Sec.  __.103(f) that grant applications undergo IRB review and
approval for the purposes of certification. The grant application is
often outdated by the time the research study is submitted for IRB
review and contains detailed information about the costs of a study,
personnel, and administrative issues that go beyond the mission of the
IRB to protect human subjects. Therefore, experience suggests that
review and approval of the grant application is not a productive use of
IRB time.

V. Exempt Research (Sec.  __.104)

A. Applicability of Exemptions to Subparts B, C, and D

1. Background and Pre-2018 Requirements
    In the pre-2018 rule, the application of the exemptions to research
under subparts B, C, and D was specified through footnote 1, which
stated that the exemptions do not apply to research involving
prisoners, and are also limited in their application to research
involving children. Regarding the latter issue, the pre-2018 exemption
at Sec.  __.101(b)(2) for research involving educational tests, survey
or interview procedures or observations of public behavior did not
apply to subpart D (i.e., such research did not qualify for this
exemption), except for research involving educational tests, or
observations of public behavior when the investigator does not
participate in the activities being observed. The pre-2018 exemptions
did apply to subpart B.
2. NPRM Proposals
    Although some of the exemptions proposed in the NPRM were based
largely on exemptions in the pre-2018 rule, not all would have applied
to subparts B, C, and D. Language in the

NPRM explained how the proposed exemptions may have applied to the
subparts. The NPRM proposed that all of the exemptions be applied to
research conducted under subpart B, and that none of the exemptions may
be applied to research conducted under subpart C, except for research
aimed at a broader population that consists mostly of nonprisoners but
that incidentally includes some number of prisoners. The NPRM proposed
that some of the exemptions may be applied to research conducted under
subpart D. Under the NPRM, the exemption at proposed Sec.  __.104(e)(1)
(Research Involving Educational Tests, Surveys, Interviews, or
Observation of Public Behavior if the Information is Recorded with
Identifiers and even if the Information is Sensitive) could not be
applied to research involving children under subpart D. This was
because protections including IRB review and parental permission are
appropriate for research involving educational tests, surveys or
interview procedures, or observation of public behavior when the
information collected may be individually identified and sensitive in
nature.
    Although the NPRM did not propose changes to the HHS regulations at
45 CFR part 46, subparts B, C and D, consideration was given to whether
the proposed exemption categories should apply to research involving
prisoners under subpart C, either if the research consists mostly of
nonprisoners and only incidentally includes some number of prisoners,
or if the research intends to involve prisoners as research subjects.
Public comment was requested on whether the revised exemption
categories should be permitted to apply to research involving
prisoners. The NPRM explained considerations including the following:
The history of HHS subpart C research certifications to date; the
preponderance of low-risk, sociobehavioral research focused on prisoner
welfare, substance abuse treatment, community reintegration, and
services utilization; the occurrence of prisoner-subjects in databases
or registries; and the broad interpretation of the subpart C
``prisoner'' definition that includes, for example, subjects in court-
mandated residential substance abuse treatment.
    The NPRM posed a question asking whether language in the final rule
should resemble the 2003 waiver of the applicability of certain
provisions of the rule for HHS-conducted or -supported epidemiologic
research involving prisoners and state that the exemptions apply except
for research where prisoners are a particular focus of the
research.\32\ The language of the 2003 waiver criteria are broader than
what was proposed in the NPRM, and already familiar to the research
community. They apply to epidemiological research that presents no more
than minimal risk and no more than inconvenience to the prisoner/
subjects. A question was also asked whether the proposed application of
the exemptions to subparts B and D was appropriate.
---------------------------------------------------------------------------

    \32\ HHS. Waiver of the Applicability of Certain Provisions of
Department of Health and Human Services Regulations for Protection
of Human Research Subjects for Department of Health and Human
Services Conducted or Supported Epidemiologic Research Involving
Prisoners as Subjects. FR 68(119):36929 (June 20, 2003). Retrieved
from https://www.gpo.gov/fdsys/pkg/FR-2003-06-20/pdf/03-15580.pdf.
---------------------------------------------------------------------------

3. Public Comments
    Approximately 50 comments were received on the applicability of the
proposed exclusions and exemptions to the subparts of the rule. Eight
comments addressed the applicability of the exemptions to subparts B
and D. However, responses to the question, ``Is the proposed
application of the exemptions to subparts B and D appropriate?''
uniformly agreed with the proposal. A strong majority of the comments
addressed the applicability of the exemptions to subpart C.
    The NPRM sought comment on the proposal to allow the exemptions to
apply in research that only incidentally involves prisoners, but that
is enrolling a primarily nonprisoner population. This would represent a
policy shift in how the exemptions historically have been applied to
subpart C. Comments regarding this proposal were mixed. Some responses
claimed that the proposal expanded the application of the exemptions to
all research under subpart C, rather than a small subset of subpart C
research. Other comments opposed the proposal, pointing to the troubled
history of research with prisoners, and suggesting that research
involving prisoners, regardless of the risk level, should always go
through subpart C IRB review. A narrow majority of comments responded
that the exemptions should be permitted to apply to subpart C in a
limited way. However, responses regarding the proposed language or
which exemptions should be applicable to subpart C prisoners varied.
Some felt a study should be exempted only if it offered some benefit to
the prison population. Others felt it could be exempt so long as there
was no identifiable sensitive information or biospecimens involved.
Some who supported the proposal indicated that because the NPRM did not
propose to expand the applicability of the exemptions to research
targeting prisoners, the proposal seemed to be a reasonable expansion.
One comment noted that permitting a broader interpretation might enable
more prisoner-subjects to participate in potentially low-risk
beneficial research. A few commenters addressed whether the language
describing the applicability of the subparts to research involving
subpart C should resemble the 2003 epidemiological waiver criteria. Of
these, comments were mixed, with some indicating that the 2003
epidemiological waiver criteria would be too ambiguous, others
indicating that it would be appropriate language to use, and a final
minority reiterating their opinion that the exemptions should never be
permitted in research conducted under subpart C.
4. Response to Comments and Explanation of the Final Rule:
Applicability of Exemptions to Subparts
    The NPRM proposal regarding how the proposed exemptions may be
applied to the subparts is largely unchanged in the final rule. The
language at Sec.  __.104(b)(2) regarding subpart C has been modified
slightly to reduce ambiguity and potential administrative burden, and
in response to public comment, to narrow the scope of exemption
application. The final rule does not adopt the 2003 epidemiological
waiver language due to concerns from public comments that such language
would be ambiguous and difficult to interpret.
    The final rule section__.104(b)(1) states that all of the
exemptions at Sec.  __.104 may be applied to research conducted under
subpart B if the conditions of the exemption are met. Language at Sec.
__.104(b)(2) states that none of the Sec.  __.104 exemptions may be
applied to research conducted under subpart C, except for research
aimed at involving a broader subject population that only incidentally
includes prisoners. This is a modification of the NPRM language, which
proposed that the exemptions could apply if research consisted ``mostly
of nonprisoners and only incidentally'' included some number of
prisoners. The language was changed in order to avoid the implied need
(``mostly'') for institutions to project and track the percentage of
prisoners participating in nonexempt research. The revision also more
clearly describes and limits the circumstances in which exempt research
may include prisoners. The language at Sec.  __.104(b)(3) relevant to
subpart D has been modified to reflect the revised structure of the
final rule, and now

states that the exemptions at paragraphs (d)(1), and (d)(4)-(8) of this
section may be applied to research that is subject to subpart D if the