[Federal Register Volume 80, Number 173 (Tuesday, September 8, 2015)]
[Proposed Rules]
[Pages 53931-54061]
[FR Doc No: 2015-21756]

Vol. 80

Tuesday,

No. 173

September 8, 2015

Part II

Department of Homeland Security

-----------------------------------------------------------------------

6 CFR Part 46

Department of Agriculture

-----------------------------------------------------------------------

7 CFR Part 1c

Department of Energy

-----------------------------------------------------------------------

10 CFR Part 745

National Aeronautics and Space Administration

-----------------------------------------------------------------------

14 CFR Part 1230

Department of Commerce

-----------------------------------------------------------------------

15 CFR Part 27

Social Security Administration

-----------------------------------------------------------------------

20 CFR Part 431

Agency for International Development

-----------------------------------------------------------------------

22 CFR Part 225

Department of Justice

-----------------------------------------------------------------------

28 CFR Part 46

Department of Labor

-----------------------------------------------------------------------

29 CFR Part 21

Department of Defense

-----------------------------------------------------------------------

32 CFR Part 219

Department of Education

-----------------------------------------------------------------------

34 CFR Part 97

Department of Veterans Affairs

-----------------------------------------------------------------------

38 CFR Part 16

Environmental Protection Agency

-----------------------------------------------------------------------

40 CFR Part 26

Department of Health and Human Services

-----------------------------------------------------------------------

45 CFR Part 46

National Science Foundation

-----------------------------------------------------------------------

45 CFR Part 690

Department of Transportation

-----------------------------------------------------------------------

49 CFR Part 11

-----------------------------------------------------------------------

Federal Policy for the Protection of Human Subjects; Proposed Rules

Federal Register / Vol. 80 , No. 173 / Tuesday, September 8, 2015 /
Proposed Rules

-----------------------------------------------------------------------

DEPARTMENT OF HOMELAND SECURITY

6 CFR Part 46

DEPARTMENT OF AGRICULTURE

7 CFR Part 1c

DEPARTMENT OF ENERGY

10 CFR Part 745

NATIONAL AERONAUTICS AND SPACE ADMINISTRATION

14 CFR Part 1230

DEPARTMENT OF COMMERCE

15 CFR Part 27

SOCIAL SECURITY ADMINISTRATION

20 CFR Part 431

AGENCY FOR INTERNATIONAL DEVELOPMENT

22 CFR Part 225

DEPARTMENT OF JUSTICE

28 CFR Part 46

DEPARTMENT OF LABOR

29 CFR Part 21

DEPARTMENT OF DEFENSE

32 CFR Part 219

DEPARTMENT OF EDUCATION

34 CFR Part 97

DEPARTMENT OF VETERANS AFFAIRS

38 CFR Part 16

ENVIRONMENTAL PROTECTION AGENCY

40 CFR Part 26

DEPARTMENT OF HEALTH AND HUMAN SERVICES

45 CFR Part 46

RIN 0937-AA02

NATIONAL SCIENCE FOUNDATION

45 CFR Part 690

DEPARTMENT OF TRANSPORTATION

49 CFR Part 11

Federal Policy for the Protection of Human Subjects

AGENCY: Department of Homeland Security; Department of Agriculture;
Department of Energy; National Aeronautics and Space Administration;
Department of Commerce; Social Security Administration; Agency for
International Development; Department of Justice; Department of Labor;
Department of Defense; Department of Education; Department of Veterans
Affairs; Environmental Protection Agency; Department of Health and
Human Services; National Science Foundation; and Department of
Transportation.

ACTION: Notice of proposed rulemaking.

-----------------------------------------------------------------------

SUMMARY: The departments and agencies listed in this document propose
revisions to modernize, strengthen, and make more effective the Federal
Policy for the Protection of Human Subjects that was promulgated as a
Common Rule in 1991. This NPRM seeks comment on proposals to better
protect human subjects involved in research, while facilitating
valuable research and reducing burden, delay, and ambiguity for
investigators. This proposed rule is an effort to modernize, simplify,
and enhance the current system of oversight. The participating
departments and agencies propose these revisions to the human subjects
regulations because they believe these changes would strengthen
protections for research subjects while facilitating important
research.

DATES: To be assured consideration, comments must be received at one of
the addresses provided below, no later than 5 p.m. on December 7, 2015.

ADDRESSES: You may submit comments, identified by docket ID number HHS-
OPHS-2015-0008, by one of the following methods:
     Federal eRulemaking Portal:http://www.regulations.gov.
Enter the above docket ID number in the ``Enter Keyword or ID'' field
and click on ``Search.'' On the next Web page, click on ``Submit a
Comment'' action and follow the instructions.
     Mail/Hand delivery/Courier [For paper, disk, or CD-ROM
submissions] to: Jerry Menikoff, M.D., J.D., OHRP, 1101 Wootton
Parkway, Suite 200, Rockville, MD 20852.
    Comments received, including any personal information, will be
posted without change to http://www.regulations.gov.

FOR FURTHER INFORMATION CONTACT: Jerry Menikoff, M.D., J.D., Office for
Human Research Protections (OHRP), Department of Health and Human
Services, 1101 Wootton Parkway, Suite 200, Rockville, MD 20852;
telephone:<PHONE_NUMBER> or 1-866-447-4777; facsimile:<PHONE_NUMBER>;
email<EMAIL_ADDRESS>
SUPPLEMENTARY INFORMATION:

Executive Summary

Purpose of the Regulatory Action
Summary of the Major Provisions of the Proposed Regulatory Actions
Estimated Costs and Benefits

I. The Rationale for Modernizing the Common Rule
    A. The Changing Nature of Research
    B. Public Comments, Expert Advice, Stakeholder Dialogue
    C. Guiding Principles for Proposed Changes
    1. Question for Public Comment
    D. Organization of the NPRM
II. Major Proposals To Modernize the Common Rule
    A. Proposed Changes to the Scope and Applicability of the
Regulations
    1. Expanding the Definition of Human Subject to Cover Research
With Non-identified Biospecimens (NPRM at Sec. Sec.  __.102(e) and
__.101(b)(3)(i))
    a. NPRM Goals
    b. Current Rule
    c. ANPRM Discussion
    d. NPRM Proposal
    i. Alternative Proposals
    e. What would change in the definition of ``human subject''
under the primary proposal?
    f. Questions for Public Comment
    2. Explicit Exclusion of Activities From the Common Rule
    a. Exclusion of Activities That Are Deemed Not Research (NPRM at
Sec.  __.101(b)(1))
    i. Program Improvement Activities (NPRM at Sec.
__.101(b)(1)(i))
    (1) NPRM Proposal
    (2) Questions for Public Comment
    ii. Oral History, Journalism, Biography, and Historical
Scholarship Activities (NPRM at Sec.  __.101(b)(1)(ii))
    (1) ANPRM Discussion
    (2) NPRM Proposal
    iii. Criminal Justice Activities (NPRM at Sec.
__.101(b)(1)(iii))
    (1) NPRM Proposal
    iv. Quality Assurance and Quality Improvement Activities (NPRM
at Sec.  __.101(b)(1)(iv))
    (1) NPRM Proposal
    v. Public Health Surveillance (NPRM at Sec.  __.101(b)(1)(v))
    (1) NPRM Proposal
    (2) Question for Public Comment
    vi. Intelligence Surveillance Activities (NPRM at Sec.
__.101(b)(1)(vi))
    (1) NPRM Proposal
    b. Exclusion of Activities That Are Low-Risk and Already Subject
to Independent Controls (NPRM at Sec.  __.101(b)(2))
    i. NPRM Goals
    ii. ANPRM Discussion
    iii. Educational Tests, Survey Procedures, Interview Procedures,
or Observation of Public Behaviors (NPRM at Sec.  __.101(b)(2)(i))
    (1) NPRM Proposal
    (2) Questions for Public Comment
    iv. Research Involving the Collection or Study of Information
That Has Been or

Will Be Collected (NPRM at Sec.  __.101(b)(2)(ii))
    (1) Current Rule
    (2) ANPRM Discussion
    (3) NPRM Proposal
    (4) Questions for Public Comment
    v. Research Conducted by a Government Agency Using Government-
Generated or Government-Collected Data (NPRM at Sec.
__.101(b)(2)(iii))
    (1) NPRM Proposal
    (2) Questions for Public Comment
    vi. Certain Activities Covered by HIPAA (NPRM at Sec.
__.101(b)(2)(iv))
    (1) ANPRM Discussion
    (2) NPRM Proposal
    (3) Questions for Public Comment
    c. Applicability of Exclusions to the Subparts
    i. Current Rule
    ii. NPRM Proposals
    iii. Questions for Public Comment
    3. Proposed Exemptions (NPRM at Sec.  __.104)
    a. Making Exempt Research Determinations (NPRM at Sec.
__.104(c))
    i. NPRM Goal
    ii. Current Rule
    iii. ANPRM Discussion
    iv. NPRM Proposal
    v. Questions for Public Comment
    b. Exemptions Subject to the Documentation Requirements of Sec.
__.104(c) and No Other Section of the Proposed Rule
    i. Research Conducted in Established or Commonly Accepted
Educational Settings (NPRM at Sec.  __.104(d)(1); current Rule at
Sec.  __.101(b)(1))
    (1) NPRM Goal
    (2) Current Rule
    (3) NPRM Proposal
    (4) Questions for Public Comment
    ii. Research and Demonstration Projects Conducted or Supported
by a Federal Department or Agency (NPRM at Sec.  __.104(d)(2);
Current Rule at Sec.  __.101(b)(5))
    (1) NPRM Goal
    (2) Current Rule
    (3) ANPRM Discussion
    (4) NPRM Proposal
    (5) Questions for Public Comment
    iii. Research Involving Benign Interventions in Conjunction With
the Collection of Data fFrom an Adult Subject (NPRM at Sec.
__.104(d)(3))
    (1) NPRM Goal
    (2) Current Rule
    (3) ANPRM Discussion
    (4) NPRM Proposal
    (5) Questions for Public Comment
    iv. Taste and Food Quality Evaluation and Consumer Acceptance
Studies (NPRM at Sec.  __.104(d)(4); Current Rule at Sec.
__.101(b)(6))
    (1) Question for Public Comment
    c. Exemptions Subject to the Documentation Requirements of Sec.
__.104(c) and the Privacy Safeguards Described in Sec.  __.105
    i. Questions for Public Comment
    ii. Research Involving Educational Tests, Surveys, Interviews,
or Observation of Public Behavior if the Information Is Recorded
With Identifiers and Even if the Information Is Sensitive (NPRM at
Sec.  __.104(e)(1))
    (1) NPRM Goals
    (2) Current Rule
    (3) ANPRM Discussion
    (4) NPRM Proposal
    (5). Questions for Public Comment
    iii. Secondary Research Use of Identifiable Private Information
(NPRM at Sec.  __.104(e)(2))
    (1) NPRM Goal
    (2) Current Rule
    (3) ANPRM Discussion
    (4) NPRM Proposal
    (5) Questions for Public Comment
    d. Exemptions Subject to the Documentation Requirements of Sec.
__.104(c), the Privacy Safeguards Described in Sec.  __.105, Limited
IRB Review as Described in Sec.  __.111(a)(9), and Broad Consent in
Accordance With Sec.  __.116(c)
    i. NPRM Goals
    ii. Current Rule
    iii. ANPRM Discussion
    iv. NPRM Proposals
    (1) Exemption for the Storage or Maintenance of Biospecimens or
Identifiable Private Information for Secondary Research Use (NPRM at
Sec.  __.104(f)(1))
    (2) Exemption for Secondary Research Use of Biospecimens or
Identifiable Private Information Where Broad Consent Has Been Sought
and Obtained (NPRM at Sec.  __.104(f)(2))
    v. Questions for Public Comment
    e. Applicability of Exemptions to the Subparts (NPRM at Sec.
__.104(b); Current Rule at Footnote 1)
    i. Current Rule
    ii. NPRM Proposals
    ii. Questions for Public Comment
    f. What would change in the exemptions?
    B. Proposed Changes To Obtaining, Waiving, and Documenting
Informed Consent (Sec. Sec.  __.116 and__.117)
    1. Required Elements of Informed Consent (NPRM at Sec.
__.116(a), (b))
    a. NPRM Goal
    b. Current Rule
    c. ANPRM Discussion
    d. NPRM Proposals
    e. What would change?
    f. Question for Public Comment
    2. Broad Consent to the Storage, Maintenance and Secondary
Research Use of Biospecimens and Identifiable Private Information
(NPRM at Sec.  __.116(c), (d))
    a. NPRM Goal
    b. Current Rule
    c. ANPRM Discussion
    d. NPRM Proposal
    e. What would change?
    f. Questions for Public Comment
    3. Waiver of Informed Consent or Documentation of Informed
Consent (NPRM at Sec. Sec.  __.116(e), (f) and __.117)
    a. NPRM Goals
    b. Current Rule
    c. ANPRM Discussion
    d. NPRM Proposals
    e. What would change?
    f. Questions for Public Comment
    4. Posting of Consent Forms
    a. NPRM Goals
    b. NPRM Proposal
    c. What would change?
    C. Proposed Changes To Protect Information and Biospecimens
(NPRM at Sec.  __.105)
    1. NPRM Goal
    2. Current Rule and Other Regulatory or Statutory Requirements
    3. ANPRM Discussion
    4. NPRM Proposals
    5. What would change?
    6. Questions for Public Comment
    D. Harmonization of Agency Guidance (NPRM at Sec.  __.101(j))
    1. NPRM Goal
    2. Current Rule
    3. ANPRM Discussion
    4. NPRM Proposal
    5. What would change?
    6. Question for Public Comment
    E. Cooperative Research (NPRM and Current Rule at Sec.  __.114)
and Proposal To Cover Unaffiliated IRBs Not Operated by an
Institution Holding a Federalwide Assurance (NPRM at Sec.
__.101(a))
    1. NPRM Goal
    2. Current Rule
    3. Relevant Prior Proposals and Discussions
    4. NPRM Proposals
    5. What would change?
    6. Questions for Public Comment
    F. Changes To Promote Effectiveness and Efficiency in IRB
Operations
    1. Continuing Review of Research (NPRM at Sec.  __.109(f);
Current Rule at Sec.  __.109(e))
    a. NPRM Goal
    b. Current Rule
    c. ANPRM Discussion
    d. NPRM Proposals
    e. What would change?
    2. Expedited Review Procedures and the Definition of ``Minimal
Risk'' (NPRM at Sec. Sec.  __.110 and __.102(j))
    a. NPRM Goal
    b. Current Rule
    c. ANPRM Discussion
    d. NPRM Proposal
    e. What would change?
    f. Questions for Public Comment
    G. Proposed Changes to IRB Operational Requirements
    1. Proposed Criteria for IRB Approval of Research (NPRM at Sec.
__.111)
    a. NPRM Goals
    b. Current Rule
    c. ANPRM Discussion
    d. NPRM Proposals
    e. What would change?
    f. Questions for Public Comment
    2. Proposed Revisions To IRB Operations, Functions, and
Membership Requirements
    a. NPRM Goal
    b. Current Rule
    c. NPRM Proposal
    d. What would change?
    e. Question for Public Comment
    H. Other Proposed Changes
    1. Proposal To Extend the Common Rule to All Clinical Trials
(With Exceptions) (NPRM at Sec.  __.101(a)(1))
    a. NPRM Goals

    b. Current Rule
    c. ANPRM Discussion
    d. NPRM Proposal
    e. What Would Change?
    f. Questions for Public Comment
    2. Changes to the Assurance Process (NPRM at Sec. Sec.  __.103
and __.108; Current Rule at Sec.  __.103)
    a. NPRM Goal
    b. Current Rule
    c. NPRM Proposals
    d. What would change?
    e. Question for Public Comment
    3. Department or Agency Discretion About Applicability of the
Policy (NPRM at Sec.  __.101(c), (d), (i)) and Discretion Regarding
Additional Requirements Imposed by the Conducting or Supporting
Department or Agency (NPRM and Current Rule at Sec.  __.124)
    a. NPRM Goals
    b. Current Rule
    c. NPRM Proposals
    4. Research Covered by This Policy Conducted in Foreign
Countries (NPRM at Sec.  __.101(h))
    I. Effective and Compliance Dates of New Rule (NPRM at Sec.
__.101(k))
    1. Effective Dates
    2. Transition Provisions
    a. Research Initiated Prior to the Effective Date of This
Subpart (NPRM at Sec.  __.101(k)(1))
    b. Use of Prior Collections of Biospecimens (NPRM at Sec.
__.101(k)(2))
III. Regulatory Impact Analyses
IV. Environmental Impact
V. Paperwork Reduction Act
VI. Summary of Comments Received on the 2011 Common Rule ANPRM
VII. Regulatory Text

Executive Summary

Purpose of the Regulatory Action

    Individuals who are the subjects of research may be asked to
contribute their time and assume risk to advance the research
enterprise, which benefits society at large. U.S. federal regulations
governing the protection of human subjects in research have been in
existence for more than three decades. The Department of Health,
Education, and Welfare (HEW) first published regulations for the
protection of human subjects in 1974, and the Department of Health and
Human Services (HHS) revised them in the early 1980s. During the 1980s,
HHS began a process that eventually led to the adoption of a revised
version of the regulations by 15 U.S. federal departments and agencies
in 1991. The purpose of this effort was to promote uniformity,
understanding, and compliance with human subject protections as well as
to create a uniform body of regulations across Federal departments and
agencies (subpart A of 45 CFR part 46), often referred to as the
``Common Rule'' for the Protection of Human Subjects.
    Since the Common Rule was promulgated, the volume and landscape of
research involving human subjects have changed considerably. Research
with human subjects has grown in scale and become more diverse.
Examples of developments include: An expansion in the number and type
of clinical trials, as well as observational studies and cohort
studies; a diversification of the types of social and behavioral
research being used in human subjects research; increased use of
sophisticated analytic techniques for use with human biospecimens; and
the growing use of electronic health data and other digital records to
enable very large data sets to be analyzed and combined in novel ways.
Yet these developments have not been accompanied by major change in the
human subjects research oversight system, which has remained largely
unchanged over the last two decades.
    The regulations are codified in each department or agency's title
or chapter of the Code of Federal Regulations (CFR). The Common Rule
was based on HHS' regulations, 45 CFR part 46, subpart A, and includes
identical language in the separate regulations of each department and
agency.
    Although they have not issued the Common Rule in regulations, three
departments and agencies currently comply with all subparts of the HHS
protection of human subjects regulations at 45 CFR part 46. These are
the Central Intelligence Agency (CIA), the Department of Homeland
Security (DHS), and the Social Security Administration (SSA). DHS, and
SSA are joining this proposed rulemaking with the intent of codifying
the final rule in their own agency regulations.
    Pursuant to Executive Order 12333 of December 4, 1981, as amended,
elements of the Intelligence Community must comply with the guidelines
issued by the Department of Health and Human Services regarding
research on human subjects found in 45 CFR part 46. This proposed
rulemaking does not supersede the Executive Order. The Office of the
Director of National Intelligence and the CIA will continue to adhere
to the HHS guidelines, pursuant to the Executive Order, when the final
rule is implemented.
    DHS, created after issuance of the Common Rule, is required by
statute (Pub. L. 108-458, title VIII, section 8306) to comply with 45
CFR part 46, or with equivalent regulations promulgated by the
Secretary of Homeland Security or his designee. This proposed
rulemaking initiates the process of promulgating equivalent
regulations, consistent with statute. Once DHS executes a final rule,
DHS will comply with the DHS regulations as the requirements will be
equivalent to compliance with HHS regulations at 45 CFR part 46,
subpart A.
    SSA was separated from HHS in 1995 and, pursuant to the transition
rules provided in Section 106 of title 1 of Public Law 103-296, must
apply all regulations that applied to SSA before the separation, absent
action by the Commissioner. Once the final rule is codified in SSA
regulations, SSA will follow the SSA regulations instead of HHS
regulations at 45 CFR part 46, subpart A. See Public Law 103-296 Sec.
106(b), 108 Stat. 1464, 1476.
    Another department is joining this proposed rulemaking. The
Department of Labor (DOL) is not a signatory to the current Common
Rule, and is joining this proposed rulemaking in order to promulgate
the Common Rule in DOL regulations and to apply the regulations to
human subjects research that DOL may conduct or support, pending the
scope of the final rule.
    Finally, note that there are two current Common Rule agencies that
are not listed as part of this proposed rulemaking. The Department of
Housing and Urban Development (HUD) supports this proposal, but due to
certain statutory prepublication requirements governing HUD rules, HUD
will adopt this proposal through a separate rulemaking. The Consumer
Product Safety Commission (CPSC), subject to Commission vote, also
intends to adopt this proposed rule through a separate rulemaking.
    On July 26, 2011, the Office of the Secretary of HHS, in
coordination with the Executive Office of the President's Office of
Science and Technology Policy (OSTP), published an advanced notice of
public rulemaking (ANPRM) to request comment on how current regulations
for protecting human subjects who participate in research might be
modernized and revised to be more effective.\1\ The ANPRM sought
comment on how to better protect human subjects who are involved in
research while facilitating valuable research and reducing burden,
delay, and ambiguity for investigators.
---------------------------------------------------------------------------

    \1\ 76 FR 44512 (Jul. 26, 2011).
---------------------------------------------------------------------------

    Since the publication of the ANPRM, science has continued to
advance, as has the dialogue regarding the changing nature of research
and the preferred balance of protections for research participants
among the principles of respect for persons, beneficence, and justice.
Important elements of that debate have centered on the appropriate
level of transparency in government and medicine and how patient and
research participant expectations should be incorporated into
government policies.

These factors have helped shape the development of the regulatory
actions proposed in this NPRM.
    The proposal also benefits from public comments submitted in
response to more recent policy proposals regarding specific topics such
as informed consent through the Office for Human Research Protection
(OHRP)'s Draft Guidance on Disclosing Reasonably Foreseeable Risks in
Research Evaluating Standards of Care \2\ and the use of a single
institutional review board (IRB) for multi-site research studies
through the National Institutes of Health (NIH)'s Draft Policy on the
Use of a Single Institutional Review Board for Multi-Site Research.\3\
---------------------------------------------------------------------------

    \2\ 79 FR 63630 (Oct. 24, 2014).
    \3\ National Institutes of Health. (2014, December 14). Request
for Comments on the Draft NIH Policy on the Use of a Single
Institutional Review Board for Multi-Site Research. See more at:
http://grants.nih.gov/grants/guide/notice-files/NOT-OD-15-026.html#sthash.fmjlNRi6.dpuf. Retrieved from National Institutes of
Health, Office of Extramural Research: http://grants.nih.gov/grants/guide/notice-files/NOT-OD-15-026.html.
---------------------------------------------------------------------------

    Finally, the NPRM more thoroughly addresses behavioral and social
science research perspectives and the broader types of research
conducted or otherwise supported by the other Common Rule agencies.
Similarly, the proposal benefits from continuing efforts at HHS to
harmonize human subjects policies, particularly between OHRP and the
U.S. Food and Drug Administration (FDA).

Summary of the Major Provisions of the Proposed Regulatory Action

    The goals of the NPRM are to increase human subjects' ability and
opportunity to make informed decisions; reduce potential for harm and
increase justice by increasing the uniformity of human subject
protections in areas such as information disclosure risk, coverage of
clinical trials, and coverage of IRBs; and facilitate current and
evolving types of research that offer promising approaches to treating
and preventing medical and societal problems through reduced ambiguity
in interpretation of the regulations, increased efficiencies in the
performance of the review system, and reduced burdens on researchers
that do not appear to provide commensurate protections to human
subjects. It is hoped that these changes will also build public trust
in the research system.
    An example of some major changes being proposed that will better
protect research subjects and help build public trust are the rules
relating to informed consent. With regard to informed consent in
general (such as consent to participating in clinical trials), the
rules would be significantly tightened to make sure that the process
becomes more meaningful. Consent forms would no longer be able to be
unduly long documents, with the most important information often buried
and hard to find. They would need to give appropriate details about the
research that is most relevant to a person's decision to participate in
the study, such as information a reasonable person would want to know,
and present that information in a way that highlights the key
information. In addition, to assure that these rules do indeed change
current practices, there will be a one-time posting requirement for the
consent forms for clinical trials, so that anyone drafting a consent
form will do so knowing that it will eventually be subject to public
scrutiny.
    In addition, informed consent would generally be required for
secondary research with a biospecimen (for example, part of a blood
sample that is left over after being drawn for clinical purposes), even
if the investigator is not being given information that would enable
him or her to identify whose biospecimen it is. Such consent would not
need to be obtained for each specific research use of the biospecimen,
but rather could be obtained using a ``broad'' consent form in which a
person would give consent to future unspecified research uses.
    The NPRM also attempts to strengthen the effectiveness and
efficiency of the oversight system by making the level of review more
proportional to the seriousness of the harm or danger to be avoided.
Research that poses greater risk to subjects should receive more
oversight and deliberation than less risky research. The NPRM seeks to
avoid requirements that do not enhance protection and impose burden,
which can decrease efficiency, waste resources, erode trust, and
obscure the true ethical challenges that require careful deliberation
and stakeholder input. Cumbersome and outdated regulatory standards
overwhelm and distract institutions, IRBs, and investigators in ways
that stymie efforts to appropriately address the real risks and
benefits of research.
    The result of these types of changes, as the NPRM proposes to
implement them, is that some studies that currently require IRB review
would now become exempt. Some that are currently exempt would
specifically be declared as outside the scope of the regulations
(``excluded''), and thus would not require any administrative or IRB
review. Further, in terms of determining when a study is exempt, a web-
based ``decision tool'' will be created. That decision tool will
provide a determination of whether or not a study is exempt. That
result, so long as the tool was provided with accurate information,
will be presumed by the Common Rule agencies to be an appropriate
determination of exempt status. Thus, it is expected that in many
instances the tool would be used by the investigators themselves, thus
obviating both the need for further review and the concern that the
institution might be subjecting itself to future liability by allowing
investigators to use the tool. For all of the excluded and exempt
research activities, this NPRM also affirms the importance of applying
the ethical principle of respect for persons, in addition to the
importance of abiding by this principle in fully regulated non-exempt
research involving human subjects.
    The following list encompasses the most significant changes to the
Common Rule proposed in the NPRM:
    (1) Improve informed consent by increasing transparency and by
imposing stricter new requirements regarding the information that must
be given to prospective subjects, and the manner in which it is given
to them, to better assure that subjects are appropriately informed
before they decide to enroll in a research study.
    (2) Generally require informed consent for the use of stored
biospecimens in secondary research (for example, part of a blood sample
that is left over after being drawn for clinical purposes), even if the
investigator is not being given information that would enable him or
her to identify whose biospecimen it is. That consent would generally
be obtained by means of broad consent (i.e., consent for future,
unspecified research studies) to the storage and eventual research use
of biospecimens.
    (3) Exclude from coverage under the Common Rule certain categories
of activities that should be deemed not to be research, are inherently
low risk, or where protections similar to those usually provided by IRB
review are separately mandated.
    (4) Add additional categories of exempt research to accommodate
changes in the scientific landscape and to better calibrate the level
of review to the level of risk involved in the research. A new process
would allow studies to be determined to be exempt without requiring any
administrative or IRB review. Certain exempt and all non-exempt
research would be required to provide privacy safeguards for
biospecimens and identifiable private information. New categories
include:
    a. certain research involving benign interventions with adult
subjects;

    b. research involving educational tests, surveys, interviews or
observations of public behavior when sensitive information may be
collected, provided that data security and information privacy
protections policies are followed;
    c. secondary research use of identifiable private information
originally collected as part of a non-research activity, where notice
of such possible use was given;
    d. storing or maintaining biospecimens and identifiable private
information for future, unspecified secondary research studies, or
conducting such studies, when a broad consent template to be
promulgated by the Secretary of HHS is used, information and
biospecimen privacy safeguards are followed, and limited IRB approval
of the consent process used is obtained.
    (5) Change the conditions and requirements for waiver or alteration
of consent such that waiver of consent for research involving
biospecimens (regardless of identifiability) will occur only in very
rare circumstances.
    (6) Mandate that U.S. institutions engaged in cooperative research
rely on a single IRB for that portion of the research that takes place
within the United States, with certain exceptions. To encourage the use
of IRBs that are otherwise not affiliated with or operated by an
assurance-holding institution (``unaffiliated IRBs''), this NPRM also
includes a proposal that would hold such IRBs directly responsible for
compliance with the Common Rule.
    (7) Eliminate the continuing review requirement for studies that
undergo expedited review and for studies that have completed study
interventions and are merely analyzing data or involve only
observational follow-up in conjunction with standard clinical care.
    (8) Extend the scope of the policy to cover all clinical trials,
regardless of funding source, conducted at a U.S. institution that
receives federal funding for non-exempt human subjects research.
    In sum, the proposed modifications described above are designed to
continue to uphold the ethical principles upon which the Common Rule is
based, as applied to the current social, cultural, and technological
environment.
    The legal authority for the departments and agencies that are
signatories to this action is as follows:
    Department of Homeland Security, 5 U.S.C. 301; Public Law 107-296,
sec. 102, 306(c); Public Law 108-458, sec. 8306. Department of
Agriculture, 5 U.S.C. 301. Department of Energy, 5 U.S.C. 301; 42
U.S.C. 7254. National Aeronautics and Space Administration, 5 U.S.C.
301. Department of Commerce, 5 U.S.C. 301. Social Security
Administration, 5 U.S.C. 301; 42 U.S.C. 289(a). Agency for
International Development, 5 U.S.C. 301. Department of Justice, 5
U.S.C. 301; 28 U.S.C. 509-510. Department of Labor, 5 U.S.C. 301; 29
U.S.C. 551. Department of Defense, 5 U.S.C. 301. Department of
Education, 5 U.S.C. 301; 20 U.S.C. 1221e-3, 3474. Department of
Veterans Affairs, 5 U.S.C. 301; 38 U.S.C. 501, 7331, 7334.
Environmental Protection Agency, 5 U.S.C. 301. Department of Health and
Human Services, 5 U.S.C. 301; 42 U.S.C. 289. National Science
Foundation, 5 U.S.C. 301. Department of Transportation, 5 U.S.C. 301.

Estimated Costs and Benefits

    Table 1 summarizes the quantified and non-quantified benefits and
costs of all proposed changes to the Common Rule. Over the 2016-2025
period, present value benefits of $2,629 million and annualized
benefits of $308 million are estimated using a 3 percent discount rate;
present value benefits of $2,047 million and annualized benefits of
$291 million are estimated using a 7 percent discount rate. Present
value costs of $13,342 million and annualized costs of $1,564 million
are estimated using a 3 percent discount rate; present value costs of
$9,605 million and annualized costs of $1,367 million are estimated
using a 7 percent discount rate. Non-quantified benefits include
improved human subjects protections in clinical trials and biospecimen
research not currently subject to oversight; enhanced oversight of
research reviewed by unaffiliated IRBs; increased uniformity in
regulatory requirements among Common Rule agencies; standardization of
human subjects protections when variation among review IRBs is not
warranted; revised informed consent forms and processes; improved
protection of biospecimens and individually identifiable private
information; and increased transparency of Common Rule agency-supported
clinical trials to inform the development of new consent forms. Non-
quantified costs include the time needed for consultation among Common
Rule agencies before federal guidance is issued; and the time needed by
investigators to obtain, document, and track the permissible uses of
biospecimens and identifiable private information for secondary
research use.

                     Table 1--Accounting Table of Benefits and Costs of All Proposed Changes
----------------------------------------------------------------------------------------------------------------
                                             Present value of 10 years  by    Annualized value over 10 years  by
                                            discount rate (millions of 2013    discount rate  (millions of 2013
                Benefits                               dollars)                            dollars)
                                         -----------------------------------------------------------------------
                                              3 Percent         7 Percent         3 Percent         7 Percent
----------------------------------------------------------------------------------------------------------------
Quantified Benefits.....................            2,629             2,047               308               291
----------------------------------------------------------------------------------------------------------------
Non-quantified Benefits
    Improved human subjects protections in clinical trials and biospecimen research not currently subject to
     oversight; enhanced oversight in research reviewed by unaffiliated IRBs; increased uniformity in regulatory
     requirements among Common Rule agencies; ethical benefit of respecting an individual's wishes in how his or
     her biospecimens are used in future research; standardization of human subjects protections when variation
     among review IRBs is not warranted; improved informed consent forms and processes; improved protection of
     biospecimens and individually identifiable private information; better ensuring availability of
     biospecimens for future research activities; and increased transparency of Common Rule-supported clinical
     trials to inform the development of new consent forms......................................................
----------------------------------------------------------------------------------------------------------------
                  Costs                       3 Percent         7 Percent         3 Percent         7 Percent
----------------------------------------------------------------------------------------------------------------
Quantified Costs                                   13,342             9,605             1,564             1,367
----------------------------------------------------------------------------------------------------------------
Non-quantified Costs
    Time for consultation among Common Rule agencies before federal guidance is issued; time for investigators
     to obtain consent for secondary use of biospecimens or identifiable private information....................
----------------------------------------------------------------------------------------------------------------

I. The Rationale for Modernizing the Common Rule

A. The Changing Nature of Research

    In the last two decades there has been a paradigm shift in how
research is conducted. Evolving technologies, including imaging, mobile
technologies, and the growth in computing power have changed the scale
of information collected in many disciplines. Computer scientists,
engineers, and social scientists are developing techniques to integrate
different types of data so they can be combined, mined, analyzed, and
shared. Research has also increased, evolved, and diversified in other
areas, such as national security, crime and crime prevention,
economics, education, and the environment, using a wide array of
methodologies in the social sciences and multidisciplinary fields. The
advent of sophisticated computer software programs, the internet, and
mobile technology has created new areas of research activity,
particularly within the social and behavioral sciences. In biomedical
science, the Human Genome Project laid the foundation for precision
medicine and promoted an environment of data sharing and innovation in
analytics and technology, and drew attention to the need for policies
that support a changing research landscape. New technologies, including
genomic sequencing, have quickly led to exponential growth in the data
to which investigators have access. The sheer volume of data that can
be generated in research, the ease with which it can be shared, and the
ways in which it can be used to identify individuals were simply not
possible, or even imaginable, when the Common Rule was first adopted.
    Research settings are also shifting. While much biomedical research
continues to be conducted in academic medical centers, more research is
being conducted in clinical care settings, thus combining research and
medical data. Biospecimen repositories and large databases have made it
easier to do research on existing biospecimens and data. Clinical
research networks connected through electronic health records (EHRs)
have developed methods for extracting clinical data for research
purposes and are working toward integration of research data into EHRs
in a meaningful way. The overall volume of research has increased
across the board, with growing reliance on research networks and multi-
site studies. Large cohort studies number well into the hundreds in the
United States alone and many collect biospecimens and data on the same
people over many years. Recent trends clearly show that the scientific
community recognizes the value of data sharing and open-source
resources and understands that pooling intellectual resources and
capitalizing on efficient uses of data and technology represent the
best ways to advance knowledge.
    At the same time, the level of public engagement in the research
enterprise has changed; more people want to play an active role in
research, particularly related to health, and they have different
expectations than when the Common Rule was first established. A more
participatory research model is emerging in social, behavioral, and
biomedical research, one in which potential research subjects and
communities express their views about the value and acceptability of
research studies. This participatory model has emerged alongside a
broader trend in American society, facilitated by the widespread use of
social media, in which Americans are increasingly sharing identifiable
personal information and expect to be involved in decisions about how
to further share the personal information, including health-related
information that they have voluntarily chosen to provide. In many ways,
these changes are extensions of the fact that over the past half-
century, rather than being passive recipients of health advice and
treatment, patients have gradually become more active in decisions
about their health and health care. The shift from a paternalistic
research environment to one where participants are active partners in
biomedical and behavioral research is a critical development in human
subjects research.
    As technology evolves, so does the nature of the risks and benefits
of participating in certain types of research. Many studies do not
involve interaction with research subjects, but instead involve, for
example, analyzing information obtained from medical records,
administrative claims data, education records, criminal justice
records, research data shared through data repositories, and existing
biospecimens stored in repositories. Risks related to these types of
research studies are largely informational, not physical; that is,
harms could result primarily from the inappropriate release of
information and not from the research interventions themselves.
Nonetheless, those harms can be significant.
    New methods, more powerful computers, and easy access to large
administrative datasets produced by local, state, and federal
governments have meant that some types of data that formerly were
treated as non-identified can now be re-identified through combining
large amounts of information from multiple sources. In 2013, scientists
demonstrated that the identity of individual research subjects could be
ascertained by collating and analyzing certain types of genomic data,
including genomic data from publicly available information sources.\4\
Thus, the possibility of fully identifying biospecimens and some types
of data from which direct identifiers had been stripped or did not
originally include direct identifiers has grown, requiring vigilance to
ensure that such research be subject to appropriate oversight. Most
importantly, people want to be asked for their permission. A growing
body of survey data show that many prospective participants want to be
asked for their consent before their biospecimens are used in
research.5 6 7 8
---------------------------------------------------------------------------

    \4\ Gymrek M et al. ``Identifying personal genomes by surname
inference''. Science 339.6117(2013) 0: 321-324.
    \5\ Kaufman DJ et al. Public opinion about the importance of
privacy in biobank research. American Journal of Human Genetics 2009
Nov;85(5):643-654.
    \6\ Vermeulen E et al. A trial of consent procedures for future
research with clinically derived biological samples. British Journal
of Cancer 2009 Nov 3;101(9):1505-1512.
    \7\ Trinidad SB et al. Research practice and participant
preferences: The growing gulf. Science 2011 Jan 21; 331(6015):287-
288.
    \8\ Simon CM et al. Active choice but not too active: Public
perspectives on biobank consent models. Genetics in Medicine. 2011
Sep;13(9):821-831.
---------------------------------------------------------------------------

    Because of these shifts in science, technology, and public
engagement expectations, a wide range of stakeholders have raised
concerns about the limitations of the existing framework, arguing for a
re-evaluation of how the fundamental principles that underlie the
Common Rule --respect for persons, beneficence, and justice--are
applied in practice to the myriad new contexts in which U.S. research
is conducted in the 21st century.9 10 Dialogue focuses
around whether the current system:
---------------------------------------------------------------------------

    \9\ Emanuel EJ, Wood A, Fleischman A, et al. Oversight of human
participants research: Identifying problems to evaluate reform
proposals. Annals of Internal Medicine 2004;141(4):282-291.
    \10\ Maschke K. Human research protections: Time for regulatory
reform? Hastings Center Report. 2008 Mar-Apr; 38(2):19-22.
---------------------------------------------------------------------------

     Is sufficiently supportive of a participant-centered
research model that adequately respects participants as partners;
     is not sufficiently risk-based, resulting in both over-
and under-regulation of research activities; 11 12 13
---------------------------------------------------------------------------

    \11\ Kim S, Ubel P, De Vries R. Pruning the regulatory tree.
Nature 2009 Jan 29;457(7229):534-535.
    \12\ Wendler D, Varma S. Minimal risk in pediatric research.
Journal of Pediatrics. 2006 Dec;149(6):855-861.
    \13\ Infectious Disease Society of America. Grinding to a halt:
The effects of the increasing regulatory burden on research and
quality improvement efforts. Clinical Infectious Diseases 2009 Aug
1;49(3):328-335.

---------------------------------------------------------------------------

     is sufficiently tailored to new and emerging areas of
research, including social and behavioral research and research
involving the collection and use of genetic information;
14 15 16 17 18 19
---------------------------------------------------------------------------

    \14\ National Research Council. Protecting Participants and
Facilitating Social and Behavioral Sciences Research. Washington,
DC: National Academies Press, 2003.
    \15\ Anderlik M. Commercial biobanks and genetic research:
Ethical and legal issues. American Journal of Pharmacogenomics
2003;3(3):203-215.
    \16\ Schrag ZM. How talking became human subjects research: The
Federal regulation of the social sciences, 1965-1991. Journal of
Policy History 2009 January; 21(01):3-37.
    \17\ Hansson MG et al. Should donors be allowed to give broad
consent to future biobank research? Lancet Oncology 2006 Mar;
7(3):266-269.
    \18\ Murphy J et al. Public perspectives on informed consent for
biobanking. American Journal of Public Health 2009 December;
99(12):2128-2134.
    \19\ Kaufman DJ et al. Public opinion about the importance of
privacy in biobank research. American Journal of Human Genetics 2009
Nov; 85(5):643-654.
---------------------------------------------------------------------------

     effectively informs subjects of psychological,
informational, or privacy risks; 20 21 22
---------------------------------------------------------------------------

    \20\ Paasche-Orlow MK, Taylor HA, Brancati F. Readability
standards for informed-consent forms as compared with actual
readability. New England Journal of Medicine 2003 Feb 20;
348(8):721-726.
    \21\ Schneider CE. The Hydra. Hastings Center Report 2010 Jul-
Aug; 40(4):9-11.
    \22\ Albala I, Doyle M, Appelbaum PS. The evolution of consent
forms for research: A quarter century of changes. IRB Ethics & Human
Research 2010 May-June; 32(3):7-11.
---------------------------------------------------------------------------

     adequately accounts for the needs of a ``learning''
healthcare system for continual quality improvement;
23 24 25
---------------------------------------------------------------------------

    \23\ Faden RR, Beauchamp TL, Kass NE. Informed consent,
comparative effectiveness, and learning health care. New England
Journal of Medicine 2014 Feb 20;370(8):766-768.
    \24\ Dziak K et al. Variations among institutional review board
reviews in a multisite health services research study. Health
Services Research 2005 Feb; 40(1):279-290.
    \25\ Lynn J et al. The ethics of using quality improvement
methods in health care. Annals of Internal Medicine 2007 May
1;146(9):666-673.
---------------------------------------------------------------------------

     provides sufficient mechanisms to ensure the consistency,
quality, and accountability of IRB decision-
making.26 27 28 29
---------------------------------------------------------------------------

    \26\ Heimer CA et al. Regulating creativity: Research and
survival in the IRB iron cage. Northwestern University Law Review
2007; 101:593-641.
    \27\ Green LA et al. Impact of institutional review board
practice variation on observational health services research. Health
Services Research 2006 Feb; 41(1):214-230.
    \28\ Jansen LA. Local IRBs, multicenter trials, and the ethics
of internal amendments. IRB 2005 Jul-Aug;27(4):7-11.
    \29\ Schrag Z. Ethical Imperialism. Baltimore, MD: Johns Hopkins
University Press, 2010.
---------------------------------------------------------------------------

B. Public Comments, Expert Advice, Stakeholder Dialogue

    The revisions to the Common Rule proposed here are based upon a
variety of sources of public, stakeholder, and expert comments and
advice. First, the NPRM more thoroughly addresses social science and
behavioral research perspectives, benefiting from guidance provided by
a National Research Council's consensus report entitled ``Proposed
Revisions to the Common Rule for the Protection of Human Subjects in
the Behavioral and Social Sciences.'' \30\ The Report was commissioned
to ensure that the issues related to research involving human subjects
in social and behavioral research would be addressed appropriately, in
view of what had been said in the ANPRM. The Panel made numerous
recommendations, including recommendations about what research studies
should not undergo review, about calibrating the level of IRB review to
the level of risk, about the desirability of privacy and
confidentiality protections in social and behavioral research other
than those of the Health Insurance Portability and Accountability Act
of 1996 (HIPAA), and about improving informed consent by placing
greater emphasis on the process of consent. The NPRM revises some of
the ANPRM proposals in light of those recommendations.
---------------------------------------------------------------------------

    \30\ National Research Council of the National Academies.
(2014). Proposes Revisions to the Common Rule for the Protections of
Human Subjects in the Behavioral and Social Science. The National
Academies Press, 13-168. Retrieved from http://www.nap.edu/catalog/18614/proposed-revisions-to-the-common-rule-for-the-protection-of-human-subjects-in-the-behavioral-and-social-sciences.
---------------------------------------------------------------------------

    Second, since the publication of the ANPRM, HHS has continued to
solicit public comment on a variety of human subjects related issues,
including consent, the use of a single IRB for multi-site studies, and
sharing of genomic data. Although these policies were more specific
than the issues raised in the ANPRM, the responses received from public
comments provide insight for refining the proposals initially put
forward in the ANPRM. Of particular interest:
     NIH's proposal that it expects the use of a single IRB for
all multi-site research studies funded or conducted by the NIH.\31\
Under that proposal, all domestic sites of a multi-site study would be
expected, as a condition of NIH funding, to use a single IRB of record.
In response to this proposal, NIH received 165 comments from a range of
stakeholders, including investigators, IRB members, and members of the
public. The majority of respondents were supportive; however concerns
were raised that it would be expensive and time-consuming to identify a
single IRB for each new multi-site study.
---------------------------------------------------------------------------

    \31\ National Institutes of Health. (2014, December 14). Request
for Comments on the Draft NIH Policy on the Use of a Single
Institutional Review Board for Multi-Site Research. See more at:
http://grants.nih.gov/grants/guide/notice-files/NOT-OD-15-026.html#sthash.fmjlNRi6.dpuf. Retrieved from National Institutes of
Health, Office of Extramural Research: http://grants.nih.gov/grants/guide/notice-files/NOT-OD-15-026.html.
---------------------------------------------------------------------------

     OHRP's draft guidance discussing the required content of
consent language for research done within the standard of care.\32\ In
August of 2013, prior to the publication of the draft guidance
document, HHS held a public meeting to hear from the community on
issues raised during the debate surrounding the SUPPORT study.\33\ The
public meeting and the draft guidance document spurred a significant
public discussion about the nature of the information included in
informed consent forms, specifically how investigators should
communicate the risks of research studies done within the standard of
care. A total of 93 comments were received from bioethicists,
investigators and research institutions, hospitals and physicians, IRB
members, patient advocates, and industry.
---------------------------------------------------------------------------

    \32\ 79 FR 63630 (Oct. 24, 2014).
    \33\ 78 FR 48163 (Aug 7, 2013).
---------------------------------------------------------------------------

     To enhance human subject protections and reduce regulatory
burden, OHRP and FDA have been actively working to harmonize the
agencies' regulatory requirements and guidance for human subject
research, and the FDA's draft guidance, ``Use of Electronic Informed
Consent in Clinical Investigations'' was developed as part of these
efforts. The draft guidance was issued in conjunction with an OHRP
Federal Register notice soliciting comment on the whether joint final
guidance would be useful for the regulated community, and whether FDA's
draft guidance would be appropriate for all research regulated under 45
CFR part 46, such as social and behavioral research studies. Comments
were received largely favoring joint guidance, but with separate
sections addressing research regulated solely by 45 CFR part 46.
     NIH's proposal to promote sharing of large-scale human
genomic data generated from studies funded or conducted by NIH.\34\ The
policy lays out an expectation that investigators generating genomic
data get consent for future research use of those data. The NIH
received 107 comments on the policy, including many that addressed

the concept of broad consent for unspecified future research use.
---------------------------------------------------------------------------

    \34\ 79 FR 51345 (Aug. 28, 2014).
---------------------------------------------------------------------------

    There have also been developments on the legislative front that
have informed the discussions leading up to this NPRM. In December of
2014, the Newborn Screening Saves Lives Reauthorization Act of 2014
(Pub. L. 113-240), was signed into law. The new law makes a number of
changes relevant to the HHS regulations for protecting research
subjects, including declaring that research with newborn dried blood
spots that is federally funded pursuant to the Public Health Service
Act is to be considered research with human subjects, and the
provisions allowing IRBs to waive consent will not apply. These changes
will be effective until updates to the Common Rule are promulgated. In
addition, in April of 2015, the Medicare Access and CHIP
Reauthorization Act of 2015 (Pub. L. 114-10) was passed. That law
requires HHS to issue a clarification or modification of the Common
Rule with regard to how they apply to activities involving clinical
data registries.
    Most recently, with the launch of the President's Precision
Medicine Initiative (PMI),35 36 the Federal Government is
proposing a new research cohort based on a model that puts participants
at the center.\37\ To understand participant preferences the White
House and PMI agencies have been hosting a series of roundtables and
public workshops about public expectations for how participants want to
engage in research today. These discussions have included individuals
from many sectors, including prospective research participants,
patients and patient advocates, privacy experts, bioethicists, academic
and industry investigators, data scientists, technology innovators,
healthcare institutions and providers. The government has heard many
perspectives, with much alignment around the central tenet that
participants should be active partners in research, and not merely
passive subjects of research studies. Many are seeking a research
environment where they can contribute to the greater good and have
transparency into the research being conducted using their specimens
and data. The conversations have focused on promoting the ethical
principles of respect for persons, beneficence, and justice, as well as
promoting other protections, such as data security and privacy.
---------------------------------------------------------------------------

    \35\ The White House, Office of the Press Secretary. (2015,
January 30). Fact Sheets: President Obama's Precision Medicine
Initiative. Retrieved from The White House: https://www.whitehouse.gov/the-press-office/2015/01/30/fact-sheet-president-obama-s-precision-medicine-initiative.
    \36\ Collins FS, Varmus H. A New Initiative on Precision
Medicine. N Engl J Med 2015 Feb; 372:793-795.
    \37\ See also http://www.scientificamerican.com/article/big-precision-medicine-plan-raises-patient-privacy-concerns/, http://www.nih.gov/precisionmedicine/, and http://www.nih.gov/precisionmedicine/.
---------------------------------------------------------------------------

C. Guiding Principles for Proposed Changes

    In 1979, the Belmont Report \38\ was predicated on three principles
that were felt to be central to shaping an ethical framework for the
conduct of research with human subjects. The three ethical principles
are respect for persons, beneficence, and justice. Interpretation of,
and balancing among, these three principles played a major role in
shaping what became the development the federal regulations that have
become known as the Common Rule. The preamble to the proposal considers
whether and how the interpretation of these fundamental principles
might be updated within the context of the current technological,
social, cultural, and ethical environment. That consideration involves
explicitly identifying the interplay among the principles. The Common
Rule provides a framework for how researchers and IRBs weigh the often
conflicting implications of these three principles.
---------------------------------------------------------------------------

    \38\ National Commission for the Protection of Human Subjects of
Biomedical and Behavioral Research. (1979). Belmont Report.
Washington, DC: U.S. Department of Health & Human Services.
Available at: http://www.hhs.gov/ohrp/humansubjects/guidance/belmont.html.
---------------------------------------------------------------------------

    Beneficence: Individuals who participate in research contribute
their time and may assume significant risks to advance the research
enterprise. Their valuable contributions produce knowledge that
benefits society at large. The Belmont Report describes the principle
of beneficence as the goal of maximizing possible benefits of research
and minimizing possible harms. This principle has been interpreted to,
in part, emphasize the benefit associated with the knowledge that might
be generated by a research study. Evaluating beneficence requires
examining the likelihood that knowledge would be generated, and how
important or useful that knowledge might be to the population. When
more weight is given to research that has the potential to generate a
great deal of knowledge, particularly knowledge that could be very
useful to society (such as how to treat serious diseases that are
currently untreatable), policies would lean in favor of encouraging and
facilitating more of that type of research.
    A distinct aspect of the principle of beneficence concerns the
benefits and risks to the specific persons who would be participating
in a particular research study. In the example of a randomized clinical
trial comparing two treatments for a disease, the benefits and risks to
the subjects in the trial are distinct from the possible benefits to
society as a whole from learning which of the two treatments is better.
This aspect of beneficence assumes that there are limits on the risks
to which people should be subject, even if they are willing to undergo
those risks.
    Society is in an information age. In all facets of one's life
information about that person is generated, stored, shared, analyzed,
and often provides tremendous societal value. People share information
about themselves with large numbers of people with the click of a
button, and this trend of rapid and widespread sharing is only likely
to grow. The increase in concern about unauthorized and inadvertent
information disclosure, in combination with newer research techniques
that increase the volume and nature of identifiable data suggest the
need for the Common Rule to more explicitly address data security and
privacy protection.
    Of particular interest for this proposal is addressing risks from
inappropriate disclosure of information generated from biospecimens.
One way to protect subjects from such risks is to bring under oversight
research for which risks are greater of subjects being identified and
information being inappropriately disclosed. Although it may be
difficult to identify individuals from their non-identified
biospecimens at present, and most investigators would have no need to
do so unless they were seeking additional associated phenotypic
information, certain technologies and methods can be used to generate
data that are unique to the individual who provides the biospecimen,
and those data can sometimes be combined with other data sources to
identify the individual. In the future, technologies will facilitate
the use and analysis of greater variety and volumes of information, and
there is a possibility that it will be increasingly difficult, if not
impossible, to make biospecimens fully non-identified. In fact, a
number of reports have already demonstrated the ability to re-identify
individuals from biospecimens or data that lack direct
identifiers.39 40 As analytic techniques become more
sophisticated and large

datasets become more accessible, it will not be possible to guarantee
that an individual could never be identified from a biospecimen or
combination or data sources, particularly if whole genome sequencing is
conducted.
---------------------------------------------------------------------------

    \39\ Rothstein MA. Is deidentification sufficient to protect
health privacy in research? American Journal of Bioethics Sep 2010;
10(9): 3-11.
    \40\ El Emam K et al. A systematic review of re-identification
attacks on health data. PLoS One 2011; 6(12):e28071.
---------------------------------------------------------------------------

    Respect for Persons: The Belmont Report describes this concept as
the notion of treating people as autonomous agents, and allowing them
to make choices based on their own judgments and opinions. Inherent in
the principle of autonomy is the concept of transparency--clearly
providing the information necessary for the research participant to
make such judgments. Transparency requires a clear articulation of
risks, potential benefits, and alternatives to participating in a
research study, as well as the purpose of the research. The principle
of autonomy encompasses the value ascribed to an individual's right to
know how one's data is being used and who will have access to it. As
such autonomy also covers the paired concept of protecting those
persons who lack the capability to make such decisions. There are a
variety of different ways of demonstrating respect for persons.
    Obtaining informed consent from human subjects for the collection
and analysis of information about them is one means of implementation
of respect for persons in the research context. Informed consent is
designed to ensure that each individual approached to participate in a
research study fully understands the risks and potential benefits of
the study so that they have sufficient information to make an
individualized calculation as to whether or not the tradeoffs inherent
in participation are worth it for them to agree to participate. Both
the potential harms and benefits tend to be greater in the context of a
clinical trial where subjects are randomized to one or another of two
possible treatments with significantly different suspected risks than
in situations where subjects are simply asked to provide, for instance,
a urine sample.
    Notice, in which individuals are informed about how data will be
used, but explicit consent is not obtained, is another means of
facilitating transparency. Notice is sometimes used in the context of
informing people about how data collected for non-research purposes
(e.g., when providing information in the context of applying for public
benefits) might be used for either general or specific research
purposes. Another method for showing respect for persons with regard to
using data about them for research could be providing them with a right
to opt out of such research, by, for example, filing a form stating
such a wish with the holder of the data.
    Related, implicit consent might be obtained when a research subject
completes a questionnaire. If they did not wish to provide the
information, presumably they would not be answering the questions. The
NPRM contains a number of provisions that are designed to further
promote respect for participants through increases in both transparency
and opportunities for consent.
    Justice: The Belmont Report describes this principle as being about
fairness in terms of who receives the benefits from research and who
bears its burdens. One of the most direct applications of the principle
of justice to the Common Rule relates to determining who is studied and
how subjects are selected. This principle also is relevant to
protection of vulnerable populations. In addition, the idea of justice
is relevant to one of core goals of this NPRM: Clarifying important
aspects of the Common Rule where there has been ambiguity in
interpretation. To the extent that IRBs and others interpret the
regulations in significantly different ways, the result is that
participants in research can end up being treated in very different
ways, even when they are participating in the same study. Thus this
idea is embedded in all of the NPRM's attempts to make sure that these
rules are applied in a more uniform and consistent manner.
    The three ethical principles of the Belmont Report often cannot all
be fulfilled at the same time. In many cases, it will be necessary to
choose which of those principles will deserve the greatest adherence.
This NPRM, at its heart, represents an attempt to evaluate the weights
to be applied to each of these three core principles in a variety of
specific contexts. Giving greater weight to one of the principles will
frequently mean a decreased ability to fulfill one of the other
principles. By necessity, value judgments, influenced by the social
norms of the time, drive the implementation of the broad principles
underlying the Belmont Report. The efficacy of the oversight system
also requires proportionality in weighing the application of these
three principles. This is reflected in the analysis that follows, in
terms of evaluating the specific aspects of beneficence, respect for
persons, and justice that relate to a particular issue, and weighing
those aspects against one another. Research that poses greater risk
should receive more attention and deliberation than less risky
research, and the degree and type of oversight should be commensurate
with the level of risk. In addition, requirements that do not enhance
protection but that impose burden can increase inefficiency, waste
resources, erode trust, and obscure the ethical challenges that require
careful deliberation and stakeholder input. Cumbersome and outdated
regulatory standards overwhelm and distract oversight bodies and other
stakeholders from appropriately addressing the real risks and benefits
of research.
    There is tremendous support for research in this country. American
society values advances in knowledge and has reaped the reward of many
key insights that have led to increases in quality of life and a
doubling of our life expectancy in the last century. There would not
have been such strides in medical and behavioral research without the
willingness of individuals to join research studies. Participants are
told that they are not likely to benefit directly from any given study,
yet they choose to participate for the greater good. Beneficence is a
powerful driver. On the other hand, members of the public deserve, and
indeed now expect, to know how publicly-funded research is being
conducted and overseen, and need to have confidence that the interests
of research participants are adequately protected. Transparency is key
for developing trust, especially between investigators, funders,
regulators, and the public.
    Our reassessment of these ethical principles in the context of
current technology and social norms suggests the need for changes to
the Common Rule that: (1) Increase subject autonomy by increasing human
subjects' ability and opportunity to make informed decisions; (2)
reduce potential for harm and increase justice by increasing the
uniformity of human subject protections in areas such as information
disclosure risk, coverage of clinical trials, and coverage of IRBs; and
(3) increase beneficence by facilitating current and evolving types of
research that offer promising approaches to treating and preventing
medical and societal problems though reduced ambiguity in
interpretation of the regulations, increased efficiencies in the
performance of the review system, and reduced burdens on researchers
that do not appear to provide commensurate protections to human
subjects. If a reasonable balance is struck between protecting human
research subjects, minimizing the administrative burden of the system,
and engendering public trust, this should maximize beneficence and
raise all ships.
    Public comment is sought not only on the provisions outlined below,
but on whether the proposals strike a reasonable balance among the core

ethical principles. A better balance among the core principles should
increase the strength of the partnership between the research
enterprise and the public, and even greater scientific understanding
and innovation will be fostered.
    Finally, it is important to note that, to the extent appropriate,
the intent is to eventually amend the other subparts of the HHS human
subjects protection regulations in 45 CFR part 46 (subparts B, C, D,
and E), and consider the need for updates to FDA regulations and other
relevant Federal departmental or agency regulations with overlapping
scope.
1. Question for Public Comment
    1. Public comment is sought on whether the proposed changes will
achieve the objectives of (i) decreasing administrative burden, delay
and ambiguity for investigators, institutions, and IRBs, and (ii)
strengthening, modernizing, and making the regulations more effective
in protecting research subjects.

D. Organization of the NPRM

    Section II of the NPRM, which immediately follows, describes in
detail the major proposals for revisions to the Common Rule. In
general, the changes that are likely to be of greatest significance are
discussed in the earlier parts of section II of this preamble. Section
II.A is devoted to changes that affect which activities are subject to
the Common Rule. Following that section are discussions devoted to
changes relating to informed consent (section II.B), changes relating
to privacy safeguards for the research use of information and
biospecimens (section II.C), and a proposal to encourage greater
harmonization of guidance across the agencies that adhere to the Common
Rule (section II.D). Discussions of changes relating to how IRBs
operate, including a proposal to reduce the number of reviews by
different IRBs that take place for multi-site studies, are in the
several sections that follow (sections II.E, F and G). The final
section (section II.H) collects a variety of other changes, including
expanding the scope of the rule to cover clinical trials that are not
federally funded but are conducted at institutions that received some
federal funding for research with human subjects.
    The three sections that follow then discuss various administrative
review requirements: Regulatory Impact Analyses (section III),
Environmental Impact (section IV), and Paperwork Reduction Act (section
V). The final section of the document (section VII) provides the full
regulatory text of the proposed changes to the Common Rule. Section VI
provides a comprehensive summary of responses received to the 2011
Common Rule ANPRM.

II. Major Proposals To Modernize the Common Rule

A. Proposed Changes to the Scope and Applicability of the Regulations

1. Expanding the Definition of Human Subject to Cover Research with
Non-identified Biospecimens (NPRM at Sec. Sec.  __.102(e) and
__.101(b)(3)(i))
    This section focuses on the ethical principles associated with the
secondary research use of biospecimens. These biospecimens may have
been originally collected from either research or non-research settings
(e.g., leftover portion of tissue from a clinical biopsy).
a. NPRM Goals
    One of the goals of this NPRM is facilitating cutting edge research
in genomics and other `omics' such as the transcriptome and the
microbiome, which generate a wealth of data from biospecimens designed
to inform the development of treatments and preventative measures for
chronic diseases such as cancer. Facilitating such research, however,
requires navigating complex ethical issues. The key question is, under
what circumstances should the Common Rule govern what research
investigators are able to do with biospecimens that have been collected
for some other (e.g., clinical) purpose? (Note that if a researcher
interacted with an individual to actually collect a biospecimen for
research purposes--for example, obtaining a saliva sample--that
``primary'' research activity is already covered under the current
regulations, and is not the focus of the change discussed in this
section.) In this case, maximizing the societal value of research would
mean reducing barriers to the secondary use of biospecimens to the
extent possible.
    However, there is a growing recognition that many people want to
have some degree of control over the circumstances in which an
investigator can derive information about them, above and apart from
their interest in whether or not that information might be
inappropriately disclosed. More specifically, a growing body of
literature shows that in general people prefer to have the opportunity
to consent (or refuse to consent) to research involving their own
biological materials.\41\ Furthermore, in 2012, the Presidential
Commission for the Study of Bioethical Issues highlighted the ethical
importance of obtaining consent for genomics research and recommended
that ``unauthorized whole genome sequencing without the consent of the
individual from whom the sample came'' be prohibited.\42\ Their
rationale for reaching this conclusion was based on concerns relating
to privacy as well as autonomy.
---------------------------------------------------------------------------

    \41\ See supra notes 5-8.
    \42\ Presidential Commission for the Study of Bioethical Issues.
(2012). Privacy and Progress in Whole Genome Sequencing. Washington,
DC: Presidential Commission for the Study of Bioethical Issues.
Retrieved from http://bioethics.gov/sites/default/files/PrivacyProgress508_1.pdf.
---------------------------------------------------------------------------

    In assigning weights to the principles of beneficence and respect
for persons in the context of research with biospecimens, strong
consideration was given to the fact that failure to acknowledge and
give appropriate weight to this distinct autonomy interest in research
using biospecimens could, in the end, diminish public support for such
research, and ultimately jeopardize our ability to be able to conduct
the appropriate amount of future research with biospecimens. To that
end, the proposals given below are designed to meet the goals of
increasing transparency in when and how biospecimens collected in a
variety of circumstances will be used for research purposes and
increasing opportunities for consent. Various ways in which these goals
might be achieved are the subject of alternative proposals discussed
below.
b. Current Rule
    The application of the current regulations to secondary research
use of a biospecimen is tied to the identifiability of the biospecimen
in the hands of the researcher. In particular, the definition of human
subject in the current Common Rule at Sec.  __.102(f) states that a
human subject is a living individual about whom an investigator
(whether professional or student) conducting research obtains data
through intervention or interaction with the individual, or
identifiable private information. Private information is described as
information that is individually identifiable (i.e., the identity of
the subject is or may readily be ascertained by the investigator or
associated with the information) in order for obtaining the information
to constitute research involving human subjects.
    Consistent with historical interpretation of identifiable private
information under the Common Rule, the terms ``non-identified'' or
``non-identifiable'' are used throughout this

NPRM to signify biospecimens or data that have been stripped of
identifiers such that an investigator cannot readily ascertain a human
subject's identity. Re-identification of non-identified or non-
identifiable biospecimens or information may be possible, depending on
the circumstances. The term ``de-identified'' is distinct; it is only
used in this proposal to refer specifically to the HIPAA standard of
non-identifiability.
    Thus, where there is no intervention or interaction with an
individual, central to determining whether human subjects are involved
in a research activity covered by the current Common Rule is
determining the meaning of ``identifiable.'' Under the current Rule,
provided the biospecimens and data were collected for purposes other
than the currently proposed research, it is permissible for
investigators to conduct research on biospecimens and data that have
been stripped of all identifiers without obtaining consent because the
non-identified biospecimens and data do not meet the regulatory
definition of human subject.
    It is, however, worth noting that although informed consent is not
strictly required by the current regulations when research takes place
using non-identified biospecimens, some IRBs have indicated that they
are requiring that investigators explicitly obtain consent for future
analysis of biospecimens collected in the research setting, and some
are refusing to waive consent for use of biospecimens collected in non-
research contexts.
c. ANPRM Discussion
    The ANPRM asked whether consent should be required before an
investigator could conduct research on a non-identified biospecimen. It
further asked, if consent were to be required, could such consent be
obtained by having a person provide consent for unspecified future
research with the biospecimen, instead of requiring that specific
consent be obtained each time that the biospecimen would actually be
used in a research study.
    Although HHS does not consider whole genome analysis to produce
identifiable private information unless additional information is
available to the investigator that would enable the investigator to
``readily ascertain'' the identity of the individual, it is
acknowledged that a time when investigators will be able readily
ascertain the identity of individuals from their genetic information
may not be far away. The ANPRM suggested that, regardless of what
information is removed, it is theoretically possible to extract DNA
from a biospecimen itself and potentially link it to otherwise
available data to identify individuals. In addition, irrespective of
whether biospecimens are considered individually identifiable, the
ANPRM sought comment on whether the regulations should be changed to
allow human subjects to decide whether their biospecimens would be
available for research.
    The ANPRM asked whether some types of genomic data should be
considered identifiable and, if so, which types (e.g., genome-wide
single nucleotide polymorphism [SNP] analyses or whole genome
sequences). It also asked whether a human biospecimen should be
considered inherently identifiable.
    The ANPRM also suggested that the definition of identifiability in
the Common Rule be modified to better harmonize it with other
regulatory definitions of identifiability within HHS. The ANPRM
considered adopting the HIPAA Privacy Rule's standards of what
constitutes individually identifiable information, a limited data set,
and de-identified information (as defined under HIPAA), in order to
address inconsistencies regarding these definitions and concepts
between the HIPAA Privacy Rule and the Common Rule.
    More specifically, as described above, private information is not
considered to be identifiable under the current Rule if the identity of
the subject is not or may not be ``readily ascertained'' by the
investigator from the information or associated with the information.
In contrast, under the HIPAA Privacy Rule, health information is de-
identified and thus exempt from that rule only if it neither identifies
nor provides a reasonable basis to believe that the information can be
used to identify an individual. The HIPAA Privacy Rule provides two
ways to de-identify information: (1) A formal determination by a
qualified expert that the risk is very small that an individual could
be identified; or (2) the removal of all 18 specified identifiers of
the individual and of the individual's relatives, household members,
and employers, as long as the covered entity has no actual knowledge
that the remaining information could be used to identify the individual
(45 CFR 164.514(b)).
    The HIPAA Privacy Rule addresses some informational risks by
imposing restrictions on how individually identifiable health
information collected by health plans, health care clearinghouses, and
most health care providers (``covered entities'') may be used and
disclosed, including for research. In addition, the HIPAA Security Rule
(45 CFR parts 160 and, subparts A and C of part 164) requires that
these entities implement certain administrative, physical, and
technical safeguards to protect this information, when in electronic
form, from unauthorized use or disclosure. However, the HIPAA Rules
apply only to covered entities (and in certain situations to their
business associates), and thus not all investigators are part of a
covered entity and required to comply with those rules. Moreover, the
HIPAA Rules do not apply specifically to biospecimens in and of
themselves.
    Public comments in response to the 2011 ANPRM regarding covering
all biospecimens raised a series of important concerns. A majority of
the commenters opposed the ANPRM's suggested requirement of consent for
research use of all biospecimens, regardless of identifiability,
particularly if applied to samples collected before the effective date
of the regulation. Some commenters cited lack of convincing evidence of
harm caused by research use of non-identified clinical biospecimens
without consent; they noted that they were not convinced that the
principle of autonomy outweighs or trumps the principle of beneficence.
They expressed concern that doing so would significantly slow advances
in research and human health.
    Others acknowledged the erosion of public trust that can result
from high-profile disputes involving the use of non-identified
biospecimens collected during research.\43\ Commenters cited the costs
to collect, log, and track consent status of data and biospecimens
collected in a clinical setting to ensure that any restrictions on the
research use of such resources were honored. However, it is important
to note that it appears that many commenters were reacting to concerns
that any change in the Common Rule with respect to consent for use of
biospecimens would be applied retroactively--that is, to samples
already collected.
---------------------------------------------------------------------------

    \43\ National Congress of American Indians. Havasupai Tribe and
the lawsuit settlement aftermath. Retrieved on November 17, 2014,
from http://genetics.ncai.org/case-study/havasupai-Tribe.cfm.
---------------------------------------------------------------------------

    Some patient advocacy organizations also expressed concerns about
the consequences of requiring consent for the use of non-identified
biospecimens. Other commenters noted that the recommendation to require
consent might inappropriately give greater weight to the Belmont
Report's principle of autonomy over the principle of justice, because
requiring consent could result in lower participation rates in research
by

minority groups and marginalized members of society. Yet, most of the
comments from individual members of the public strongly supported
consent requirements for use of their biospecimens, regardless of
identifiability.
    Many commenters expressed the opinion that the existing regulatory
framework is adequate and that current practices should be maintained,
stressing that the research use of non-identified data or biospecimens
does not involve risk to the research participant. Furthermore, several
commenters noted that, although it is theoretically plausible to
identify a person based on their biospecimen, the likelihood remains
remote enough to argue against the presumption that the sources of all
biospecimens are identifiable and cited a study showing that the risk
of re-identification from a system intrusion of databases was only
0.22%.\44\ In contrast, some commenters supported the idea of requiring
consent for research use of all biospecimens, with one commenter noting
simply that ``research use of data initially collected for non-research
purposes should always require informed consent.''
---------------------------------------------------------------------------

    \44\ Kwok P et al. Harder Than You Think: A Case Study of Re-
Identification Risk of HIPAA-Compliant Records. NORC at The
University of Chicago and Office of the National Coordinator for
Health Information Technology. 2011. http://www.amstat.org/meetings/jsm/2011/onlineprogram/AbstractDetails.cfm?abstractid=302255.
---------------------------------------------------------------------------

    Several commenters stated that if the Common Rule were modified
such that all biospecimens were covered under the rule regardless of
identifiability there still might be some activities involving
biospecimens that should be considered exempt or excluded from
coverage. Suggestions included:

 Identifying markers for cancer prognosis or prediction of
response to cancer therapy, or identifying cancer molecular targets
(molecular research)
 Basic science research (including analysis of biological
processes)
 Research on rare conditions and diseases
 Pediatric research
 Research with samples that lack potentially identifying
information, such as serum or plasma not containing DNA
 Biospecimens lacking nucleic acids (such as certain red blood
cells, expiratory gases)
 Blood culture bacteria
 Bacterial and viral specimens (this was listed in a comment as
a public health issue)
 Protein analysis
 Statistical method development (to the extent that this
development is related to biospecimens)
 New molecular methods to detect infectious agents
 Use of specimens to develop and validate new assays for
infectious agents
 Archival paraffin blocks

    With respect to the 2011 proposal to adopt the HIPAA Privacy Rule's
definition of identifiability, a majority of the public commenters
strongly opposed the idea. They indicated that the HIPAA Privacy Rule's
standard of identifiability would expand what is considered
identifiable for purposes of the Common Rule and thus greatly impede
relatively low-risk research without adding meaningful protections for
human subjects. In particular, they asserted that the HIPAA standards
were created to protect against disclosure of health information
contained in medical records. As such, commenters argued, they are not
appropriate for many types of research that would be covered by the
Common Rule (e.g., behavioral and social science research). Others said
this would be an extreme change in response to an as yet unidentified
or clear problem. Commenters said that the information most at risk for
inappropriate disclosure is the type of private health information that
is already protected under the HIPAA Rules. Commenters feared that such
a change in policy, while ``harmonizing'' the Common Rule to certain
HIPAA standards, would create inordinate burdens in terms of new
documentation requirements and result in a requirement to apply the
HIPAA standards to all types of research, regardless of the level of
risk.
d. NPRM Proposal
    Regardless of the scale on which harms may have occurred in the
past, continuing to allow secondary research with biospecimens
collected without consent for research places the publicly-funded
research enterprise in an increasingly untenable position because it is
not consistent with the majority of the public's wishes, which reflect
legitimate autonomy interests. As such, one of the most fundamental
changes proposed in this NPRM is to the definition of human subject
(proposed Sec.  __.102(e)). The proposal is for the obtaining, use,
study, or analysis of biospecimens to be covered under the Common Rule,
regardless of identifiability. Covering biospecimens regardless of
identifiability avoids codifying any given interpretation of the
quickly evolving debates regarding whether certain analytic results
(e.g., decoding the whole genome) should be considered to yield
identifiable data. (Accompanying this proposal are some minor wording
changes to other portions of that definition that are merely intended
to clarify how the word ``obtains'' is currently interpreted by OHRP.)
    Thus, the focus of this proposal is to require informed consent for
research involving biospecimens in all but a limited number of
circumstances. The consent would not need to be obtained for each
specific study using the biospecimen, but could instead be obtained
through broad consent for future unspecified research (described in
more detail in sections II.A.3.d and II.B of this preamble).
    An increase in trust and partnership is likely to increase
participation rates in research; using individuals' samples and data
without permission will hinder true partnership. Better communication
and community engagement with patients, particularly in geographic
areas and for population subgroups where consent rates are lower than
average, should be a priority for the research community.
    In response to comments received about the 2011 ANPRM, the NPRM
proposes to have the new definition of human subject apply
prospectively, that is, it will only apply to research involving
biospecimens that will be collected in the future. Additionally, in
recognizing that this proposal will have major implications for the
operational functioning of the research enterprise, compliance with
this provision would be delayed until three years after publication of
a final rule.
    Also consistent with comments received on the ANPRM, it is proposed
that a subset of secondary research on stored biospecimens would be
allowed without consent. Specifically, research designed to only
generate information about the person that is already known would be
considered outside of the scope of the Common Rule. This exclusion
would include but not be limited to the development and validation of
certain tests and assays (such as research to develop a diagnostic test
for a condition using specimens from individuals known to have the
condition and those known not to have the condition), quality assurance
and control activities, and proficiency testing. This provision would
be implemented through a new exclusion from the regulations at Sec.
__.101(b)(3)(i), which has specifically been designed to reflect the
underlying ethical principles.
    If the research is designed not to generate any new information
about the

person, but only confirm something about them that is already known,
then the interest in respecting the person's autonomy would appear to
be relatively weak. As an example, imagine that a person is known to
have a particular genetic disease, and the research involves evaluating
a new product that might in a few minutes, at low cost, produce a
result showing whether a person has that disease. The person's autonomy
interest in whether or not such a study could take place would seem
little different from that of anyone in a study that involved secondary
use of identifiable information about them.
    In addition, the proposal permits IRBs to waive the requirement for
informed consent, but the requirements for approval of such waivers
would be very strict, and such waivers will only occur in rare
circumstances. Note also that the exclusions proposed in Sec.
;____.101(b)(1)(i), (iii)-(vi) would also allow for the use of
biospecimens without consent in certain limited circumstances; these
additional exclusions are discussed in section II.A.2 of this preamble,
below.
    This proposal would not modify the Common Rule standard of
identifiability (in contrast to what was discussed in the 2011 ANPRM).
That is, the standard for determining when an investigator has
sufficient information to readily ascertain the identity of an
individual is not being changed under this proposal. Thus, coverage of
information derived from biospecimens (whether or not the biospecimen
was initially collected in the research or non-research context), or
indeed any other type of information, would be the same under this
proposal as is the case under the current Common Rule.
i. Alternative Proposals
    In this section, we discuss two alternative proposals, both of
which maintain ``identifiability'' as the lynchpin for determining
applicability of the Common Rule to biospecimens. These models increase
transparency and opportunities for consent over and above what is
provided for in the current Common Rule, but in a smaller set of
circumstances than provided for under the primary proposal discussed
above.

Alternative Proposal A: Expand the Definition of ``Human Subject'' To
Include Whole Genome Sequencing (WGS)

    Rather than consider all research using biospecimens as
constituting human subjects research, this alternative proposal would
expand the definition of human subjects to include only specifically
whole genome sequencing data, or any part of the data generated as a
consequence of whole genome sequencing, regardless of the individual
identifiability of biospecimens used to generate such data. Under this
alternative, whole genome sequencing would be considered the sequencing
of a human germline or somatic biospecimen with the intent to generate
the genome or exome sequence of that biospecimen.
    Thus, under this alternative, the regulations would then apply both
to research that would generate whole genome sequencing data, the use
of any part of the generated data, and to research involving secondary
use of any part of whole genome sequencing data that was originally
generated for other purposes than the proposed research. Investigators
conducting whole genome sequencing research could not avoid the need to
comply with the Common Rule by removing identifiers from biospecimens
or data, because whole genome sequence data in and of itself would meet
the definition of human subject. Under this alternative, a new
exemption would also be created that would allow such research to be
considered exempt if consent to secondary future research use were
obtained in accordance with proposed new requirements at Sec.
__.116(c) and standards were met for protecting information and
biospecimens as proposed at Sec.  __.105. A waiver of consent would be
permitted, but would be modeled on the more stringent waiver criteria
proposed for research involving biospecimens at Sec.  __.116(f)(2).
    Explicit consent to conduct research using whole genome sequencing
data can be considered ethically important because such data can
provide important insights into the health of individuals as well as
their relatives. Moreover, whole genome sequence data gathered for one
purpose may reveal important information, perhaps unanticipated and
unplanned for, years later. Finally, whole genome sequence data are
unique for each individual, or at the very least, highly unlikely to be
the same as any other individual. Thus, the current allowable practice
of removing identifiers from biospecimens and data to conduct whole
genome sequencing research without consent might not sufficiently
protect both the privacy and autonomy interests of the subject.
    As is currently the case, under this alternative, investigators'
use of individually identifiable biospecimens, collected for purposes
other than the currently proposed research study, would continue to be
considered human subjects research. However, the secondary research use
of non-identified information or non-identified biospecimens would
continue to fall outside of the scope of the Common Rule, with the
exception of whole genome sequence data as described above.
    One of the less obvious differences in scope between the primary
proposal and this Alternative A relates to what research could be done
with the data generated from whole genome sequencing that had taken
place for clinical purposes. Under the primary proposal, the data
produced by such sequencing could continue to be used for research,
without additional consent, so long as it did not meet the definition
of being identifiable private information. (HHS does not currently
consider whole genome sequencing data to meet that definition for
purposes of the Common Rule.) Under this Alternative A, consent would
be required before using that data for research purposes.
    In contrast with the primary proposal in this NPRM, this
Alternative Proposal A could be viewed as giving greater weight to the
principle of beneficence, while giving less weight to the principle of
respecting the autonomy of persons. It would require consent only for
the type of studies that many people seem most concerned about (genomic
research, including secondary use of genomic information that was
produced for clinical purposes). And given that at the moment there is
relatively little whole genome sequencing research taking place (in
comparison to other types of biospecimen research; see section III.F of
this preamble for more information), it would appear to currently
impose a somewhat lesser burden in terms of obtaining and tracking
consent than the main NPRM proposal.
    The major concern with this alternative proposal is that it would
codify only a single technology as producing information that would be
subject to the Common Rule, necessitating a re-evaluation of the scope
of the Rule when technologies now in development to study, for
instance, other ``omics,'' become more widespread.

Alternative Proposal B: Classifying Certain Biospecimens Used in
Particular Technologies as Meeting the Criteria for ``Human Subject''

    This Alternative Proposal B would expand the definition of human
subjects to include the research use of information that was produced
using a

technology applied to a biospecimen that generates information unique
to an individual such that it is foreseeable that, when used in
combination with publicly available information, the individual could
be identified. Information that met this standard would be referred to
as bio-unique information. This proposal is conceptually very similar
to Alternative Proposal A. The main difference is that the scope is
somewhat broader: Whereas Alternative A requires consent for whole
genome sequencing, Alternative B would require consent for genomic
sequencing of even small portions of a person's genome, and also
require consent for the use of other technologies that might be
developed that similarly can generate information unique to a person.
    There are three separate conditions that would all need to be met
before information would constitute bio-unique information: (1) It
would have to have been produced by applying to a biospecimen a
technology that is capable of producing information that is unique to
an individual; (2) The technology would have to be used to produce
enough information such that the information produced is likely to be
unique to an individual; and (3) There would need to be publicly
available information that, when combined with the information produced
by the use of the technology, would create the possibility that some of
the individuals whose biospecimens were analyzed using the technologies
could be identified.
    The major concern with this alternative proposal is that, in order
to make such a requirement responsive to scientific and technological
developments, HHS would have to continually evaluate new technologies
and the nature and amount of information produced using such
technologies. Not only would this involve resources and expertise that
may not be available to Federal departments and agencies, it would
introduce ongoing uncertainty that may actually increase delays in
important research.
e. What would change in the definition of ``human subject'' under the
primary proposal?
     It is anticipated that the compliance date for the
proposed expansion of the definition would be three years after the
publication date. The main consequence of this change would be that
informed consent (which could be broad, as described in sections
II.A.3.d and II.B of this preamble) would generally be required before
research use of biospecimens not covered by an exclusion.
     All biospecimens used for research purposes that do not
fall under an exclusion (see proposed Sec.  __.101(b)(3)(i), and also
Sec.  __.101(b)(1)(i), (iii)-(vi)) and are collected after the
compliance date would be subject to the requirements of this rule,
regardless of identifiability.
f. Questions for Public Comment
    2. Would providing a definition of biospecimen be helpful in
implementing this provision? If so, how might the definition draw a
line between when a biospecimen is covered by the Common Rule, and when
processing of biological materials (e.g., to create a commercial
product used for treatment purposes) has sufficiently altered the
materials so that they should not be subject to the regulations? Would
only covering biospecimens that include nucleic acids draw an
appropriate line?
    3. To what extent do the issues raised in this discussion suggest
the need to be clearer and more direct about the definition of
identifiable private information? How useful and appropriate is the
current modifier ``may be readily ascertained'' in the context of
modern genomic technology, widespread data sharing, and high speed
computing? One alternative is to replace the term ``identifiable
private information'' with the term used across the Federal Government:
Personally identifiable information (PII). The Office of Management and
Budget's \45\ concept of PII refers to information that can be used to
distinguish or trace an individual's identity (such as their name,
social security number, biometric records, etc.) alone, or when
combined with other personal or identifying information which is linked
or linkable to a specific individual, such as date and place of birth,
mother's maiden name, etc. It is acknowledged that replacing
``identifiable private information'' with ``PII'' would increase the
scope of what is subject to the Common Rule. However, the practical
implications of such an expansion, other than the need to ensure that
the data are security stored and otherwise protected against
disclosure, may be minimal. Public comment is requested on the
advantages and disadvantages of such a change.
---------------------------------------------------------------------------

    \45\ Executive Office of the President, Office of Management and
Budget. (2007). Memorandum for the Heads of Executive Departments
and Agencies. Retrieved from The White House: https://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2007/m07-16.pdf.
---------------------------------------------------------------------------

    4. Which of the three proposals regarding the definition of human
subject achieves the most reasonable tradeoff between the principles of
autonomy (including transparency and level of trust) versus beneficence
(as measured by facilitating valuable research)?
    5. Public comment is sought regarding any concerns that you have
about each of the three proposals, including concerns about
implementation or burden to investigators and institutions.
2. Explicit Exclusion of Activities From the Common Rule
    The NPRM creates a new section in the regulations referred to as
``exclusions.'' This section outlines eleven specific types of
activities that will be outside the scope of the regulations. These
activities will therefore not have to satisfy any regulatory
requirements, nor is it expected (unlike exempt research) that they
will undergo any type of review process to determine this status. The
exclusions will eliminate uncertainty regarding some activities that
are not research, and identify some activities that arguably might be
judged to be research, but whose contribution to public welfare is so
imperative that they should proceed without having to satisfy the
regulatory requirements. The exclusions also identify certain research
activities that are sufficiently low-risk and nonintrusive that the
protections provided by the regulations are an unnecessary use of time
and resources, whereas the potential benefits of the research are
substantial.
    The Common Rule has been criticized for not being clear about how
to interpret what activities are covered by the policy and for
inappropriately being applied to and inhibiting certain activities. The
first six exclusion categories are for activities that are deemed not
to be research for the purposes of this policy, without needing to
consider whether the regulatory definition applies. The definition of
research does not provide such a clear and precise way of
distinguishing among similar activities that it is immediately obvious
which activities fall under the definition and which do not. By
creating exclusion categories that are deemed not research, these
activities are more clearly distinguished as not having to satisfy the
regulatory requirements.
    Three of the exclusions seek to eliminate any uncertainty about
whether certain internal program improvement activities, historical or
journalistic inquiries, or quality assurance or improvement activities
satisfy the definition of research. The other three exclusions include
some

activities that fall into to a gray area that encompasses some
activities that arguably might be judged to be research, but that are
part of inherently governmental functions that have purposes other than
research, such as responsibilities to protect public health and welfare
(see exclusions for criminal investigations, public healthy
surveillance, and intelligence surveillance). These activities promote
recognized specific goods that are crucial to the public welfare, and
should be carried out without any hindrances that satisfying regulatory
requirements might impose. For these activities, the principles of
beneficence and justice outweigh any intrusions on individual autonomy
that the regulations might have prevented.
    The next four categories of proposed exclusions are for activities
that are considered low-risk either in themselves or because there are
appropriate safeguards already in place independent of the Common Rule.
Here the level of risk, the potential benefits, and the nature of human
participation in this research are such that the principle of
beneficence determines that the research activities may go forward
without the need to impose the protections of the Common Rule.
    The last exclusion applies to research involving the secondary use
of non-identified biospecimens when the research is limited to
generating information about the subject that is already known. As
such, this research does not need any additional protections provided
by these regulations and the potential benefits of this research
justify it under the principle of beneficence. Because this exclusion
directly relates to the proposed changes in the definition of ``human
subject'' to include all biospecimens, it is discussed above in section
II.A.1 of this preamble.
    It should be noted that the fact that the NPRM now specifically
includes a list of certain excluded activities should not be seen as
altering the fact that many other activities that do not meet the
criteria for being subject to the Common Rule remain outside the scope
of the rule. For example, an activity that does not meet the regulatory
definition of research, or does not involve human subjects, would still
not be subject to these regulations.
    Currently, the Common Rule excludes from coverage (1) activities
that do not meet the definition of research (Sec.  __.102(d) of the
current Rule); (2) activities that are not described as research
subject to regulation (Sec.  __.102(e) of the current Rule); and (3)
activities that do not involve a human subject (Sec.  __.102(f) of the
current Rule).
    The ANPRM asked questions about the definition of research and
whether various activities should be excluded from the Common Rule,
either by changing the definition of research or by adding exemptions,
or both. The ANPRM sought comment on whether and, if so, how, the
Common Rule should be changed to clarify whether quality improvement
activities, program evaluation studies, or public health activities are
covered. It also asked whether there are specific types of studies for
which the existing rules are inappropriate. If so, comments were sought
on whether this problem should be addressed through modifications to
the exemption categories, or by changing the definition of ``research''
used in the Common Rule to exclude some of these studies, or a
combination of both.
    If the definition of research were to be changed, public comment
was sought on how excluded activities should be defined (e.g.,
``quality improvement'' or ``program evaluation''). With regard to
quality improvement activities, the public was asked to comment on
whether it might be useful to adopt the distinction made by the HIPAA
Privacy Rule, which distinguishes between ``health care operations''
and ``research'' activities, defining ``health care operations'' to
include, among other activities, ``conducting quality assessment and
improvement activities, including outcomes evaluation and development
of clinical guidelines, provided that the obtaining of generalizable
knowledge is not the primary purpose of any studies resulting from such
activities.''
a. Exclusion of Activities that are Deemed Not Research (NPRM at Sec.
__.101(b)(1))
    The first set of six exclusions involve activities that will be
excluded from the regulations because they will be deemed to not
involve research. Three of the first six exclusions (discussed in
sections II.A.1.a.i, ii, and iv, below) provide clarity regarding the
applicability of the Common Rule to activities about which institutions
have raised questions in the past as to whether these activities meet
the regulatory definition of research. These exclusions aim to reduce
the time and effort involved trying to determine whether the
regulations apply, and in unnecessary reviews of these activities.
    The other three of these exclusions (discussed in sections
II.A.1.iii, v, and vi below) apply to activities that are largely
inherently government functions that have purposes other than research,
and, when conducted by a government employee or contractor, are subject
to a variety of other statutes, regulations, and polices that are
designed to protect individual privacy and data security, as well as
provide notice to those providing the information as to the uses to
which the information will be put (see, for example, the Privacy Act of
1974). These activities promote recognized specific goods that are
crucial to the public welfare, and because of this they should be
carried out without any hindrances that satisfying the Common Rule
regulatory requirements might impose. For these activities, the
principle of beneficence outweighs any intrusions on individual
autonomy that the regulations might have prevented, and this allows
these important activities to proceed without delay.
    The ANPRM asked whether various activities such as quality
improvement, public health activities, or program evaluations studies
should be excluded from the rule.
i. Program Improvement Activities (NPRM at Sec.  __.101(b)(1)(i))
(1) NPRM Proposal
    The first exclusion, proposed in the NPRM at Sec.  __.101(b)(1)(i),
is for data collection and analysis, including the use of biospecimens,
for an institution's own internal operational monitoring and program
improvement purposes, if the data collection and analysis is limited to
the use of data or biospecimens originally collected for any purpose
other than the currently proposed activity, or is obtained through oral
or written communications with individuals (e.g., surveys or
interviews). This category is excluded because these activities are
designed for various administrative purposes related to using
information to improve the quality of services provided by a specific
institution, and are not designed to produce generalizable knowledge. A
majority of commenters to the 2011 ANPRM supported excluding program
evaluation activities from the scope of the Common Rule. Many of these
commenters argued that the public benefits resulting from this type of
activity justified its practice, particularly given the generally low-
risk involved.
    An example of an activity that would satisfy this exclusion is a
survey of hospital patients to evaluate and improve the quality of
meals delivered to hospital patients. An example of an activity that
would not satisfy this exclusion is a prospective observational

study of patient treatments to analyze the comparative effectiveness of
two different standard of care treatments frequently used to treat the
same medical condition.
(2) Questions for Public Comment
    6. Public comment is sought for whether this excluded activity
should simply be discussed in the text of the final rule's preamble,
and guidance produced to assist investigators in making such a
determination, or whether any other similar exclusions should be
addressed.
    7. Public comment is sought for whether biospecimens should not be
included in any of these exclusion categories, and if so, which ones.
ii. Oral History, Journalism, Biography, and Historical Scholarship
Activities (NPRM at Sec.  __.101(b)(1)(ii))
(1) ANPRM Discussion
    The ANPRM asked whether there were any fields of study (such as
classics, history, languages, literature, and journalism) whose usual
methods of inquiry were not intended to or should not be covered by the
Common Rule.
(2) NPRM Proposal
    The second proposed exclusion, in the NPRM at Sec.
__.101(b)(1)(ii) is for oral history, journalism, biography and
historical scholarship activities that focus directly on the specific
individuals about whom the information is collected.
    The overwhelming majority of public comments to the 2011 ANPRM
responding to the question about excluding specific fields of study
from the regulatory requirements of the Common Rule supported
explicitly excluding certain activities from the definition of research
versus modifying the exemption categories. The overwhelming majority of
these comments focused on oral history. Some of the comments were
virtually identical and appear to have been coordinated. Many of the
comments reflected the view that the Common Rule was not designed or
intended to include oral history activities, and that the ethical codes
pertaining to oral history procedures are not consistent with the
application of the ethical principles reflected in the Common Rule.
    A smaller number of similar comments were submitted with respect to
various humanities disciplines and journalism. A significant minority
of commenters opposed the exclusion of any fields of study, arguing
that the activity itself rather than the academic discipline or
training of the investigator should be the basis for the assessment of
whether the activity should be excluded. Some of the commenters
recommended that the definition of research be focused more explicitly
by being limited to ``biomedical and behavioral research,'' in
accordance with the statutory provision underlying the Common Rule. A
significant number of commenters recommended that guidance should be
issued to clarify how the definition of research should be applied,
with cases and explanations.
    While the NPRM does not propose to modify the definition of
``research'', it does propose to explicitly exclude oral history,
journalism, biography, and historical scholarship activities that focus
directly on the specific individuals about whom the information or
biospecimens is collected. In the kinds of activities referred to here,
the ethical requirement is to provide an accurate and evidence-based
portrayal of the individuals involved, and not to protect them from
public scrutiny. Therefore, the protections afforded to individuals by
the Common Rule seem unhelpful in furthering the aforementioned ethical
goal in this context. Additionally, these fields of research have their
own codes of ethics, according to which, for example, consent is
obtained for oral histories. It is believed that because of these
reasons, explicit exclusion of these activities from the scope of the
Common Rule is appropriate.
iii. Criminal Justice Activities (NPRM at Sec.  __.101(b)(1)(iii))
(1) NPRM Proposal
    The third category of activities that the NPRM excludes from the
proposed rule encompasses data collection and analysis that enables the
uniform delivery of criminal justice. The scope of this exclusion is
collection and analysis of data, biospecimens, or records by or for a
criminal justice agency for activities authorized by law or court order
solely for criminal justice or criminal investigative purposes. The
activities excluded are necessary for the operation and implementation
of the criminal justice system.
    The provision would essentially codify current Federal
interpretation that such activities are not deemed to be research under
the Common Rule. The addition of this provision is designed to avoid
the imposition of disparate requirements by IRBs with overlapping
jurisdiction when a data collection or analysis activity encompasses
the development of methods required by law or court order for criminal
justice or criminal investigative purposes. For example, the Federal
Bureau of Investigation (FBI) is charged by law with setting standards
governing the collection and processing of DNA biospecimens and
information taken (forcibly if necessary) from certain federal and
state criminal offenders incident to their arrest or conviction for
prescribed offenses under the National DNA Identification Act of 1994
and other acts. Similarly, the FBI is charged by law with setting
standards governing the collection and processing of fingerprints and
related biographical information taken from federal and state criminal
offenders and certain sensitive civil employment applicants. At the
same time, through its Laboratory Division and other components the FBI
routinely collects human biospecimens at crime scenes from or relating
to victims and offenders both known and unknown. Incident to these
activities, the FBI is also charged with maintaining, and
authenticating through identification processes, the criminal record
history information of criminal offenders for the Federal Government
and for the overwhelming majority of state governments who elect to
participate and share information through those FBI systems.
iv. Quality Assurance and Quality Improvement Activities (NPRM at Sec.
__.101(b)(1)(iv))
(1) NPRM Proposal
    The fourth category of excluded activities covers quality assurance
or improvement activities involving the implementation of an accepted
practice to improve the delivery or quality of care or services
(including, but not limited to, education, training, and changing
procedures related to care or services) if the purposes are limited to
altering the utilization of the accepted practice and collecting data
or biospecimens to evaluate the effects on the utilization of the
practice. This exclusion does not cover the evaluation of an accepted
practice itself.
    As an example of an activity that would satisfy this exclusion,
assume that there is an accepted practice that is known to reduce the
likelihood of an infection after the insertion of a central line. A
randomized study in which half the participating institutions would be
assigned to have the staff undergo an educational intervention about
the need to use that accepted practice, and the other half would not
undergo that intervention, would satisfy this exclusion, since it would
only be intended to see if the intervention resulted in greater use of
the accepted practice. In contrast, imagine a different study that was
designed to determine

how well that accepted practice, when it is used, reduces infections.
That study would not satisfy this exclusion, since it would be studying
the effectiveness of the practice itself, in contrast to studying an
effort to increase use of the practice.
    Over the past several years, including in response to the 2011
ANPRM, OHRP has received comments from many individuals and
organizations expressing concern that some readings of the definition
of ``research'' would imply that the regulations apply to quality
improvement activities, thereby potentially interfering with the
ability of health care and other professionals to enhance the delivery
or quality of care or services involving the use of accepted practices.
Indeed, a majority of commenters to the 2011 ANPRM supported excluding
quality improvement activities from the scope of the Common Rule. These
quality improvement activities are in many instances conducted by
health care and other organizations under clear legal authority to
change internal operating procedures to increase safety or otherwise
improve performance, often without the consent of staff or clients,
followed by monitoring or evaluation of the effects. These activities
are generally conducted in circumstances where independent privacy,
confidentiality, and security safeguards are in place, minimizing the
chances of harm. These efforts, some of which could be judged to be
research, should be carried out because of the recognized public good
they achieve. This exclusion is intended to avoid impeding such efforts
where the Common Rule's requirements might have a chilling effect on
the ability to learn from, and conduct, important types of innovation.
    Recognizing that some quality improvement efforts should not be
considered to involve research as it is defined in the Common Rule can
allay many of these concerns. Thus, this exclusion is being proposed to
deal with quality improvement activities that are aimed at implementing
practices that are already accepted, with the goal of improving the
delivery or quality of treatments or services. This exclusion would
permit measuring and reporting provider performance data for practice
management, clinical, or administrative uses. As proposed, this
exclusion does not include evaluations of different accepted practices
themselves, however, such as activities designed to determine whether a
particular accepted medical treatment is or is not more effective than
another.
    This provision also covers quality improvement activities that are
not related to delivery of patient care, but rather involve the
delivery or quality of other public benefit or social services. For
example, institutions and other entities may provide social services,
educational offerings, or other beneficial activities where there is
empirical evidence of the value of those efforts, and they may wish to
evaluate different ways of enhancing the delivery or quality of those
existing services. This exclusion has been written broadly to include
such activities.