conditions of the exemption are met. Paragraphs (d)(2)(i) and (ii) of
this section may apply only to research activities that are subject to
subpart D involving educational tests or the observation of public
behavior when the investigator(s) do not participate in the activities
being observed. Paragraph (d)(2)(iii) of this section may not be
applied to research that is subject to subpart D, because protections,
including IRB review and parental permission, are appropriate for
research involving children and educational tests, surveys or interview
procedures, or observation of public behavior when the information
collected may be individually identified and sensitive in nature.
    The final rule does not make revisions to the HHS regulations at 45
CFR part 46, subparts B, C, and D. Throughout this rulemaking process,
the intent has been to revise subpart A, and to address revisions to
subparts B, C, and D at a later time. However, particular consideration
has been given to the specific issue of whether the proposed exemption
categories should apply in the context of research that is aimed at a
broad population and only incidentally includes prisoners. We concur
with the comments expressing support for this change.
    In such instances, the specific protections required by subpart C
are frequently not relevant to the research subjects. The permitted
inclusion of this subset of prisoners under the exemptions at Sec.
__.104 is intended to allow an appropriate reduction in IRB
administrative burden while preventing IRBs from necessarily
prohibiting the participation of this group in exempt research
activities, assuming the conditions of the exemptions are fully
satisfied.
    We believe this subpart C change is narrow in scope, affecting only
a small subset of subjects who are prisoners. This change will permit,
for example, the exempt secondary research use of information or
biospecimens from subjects who are prisoners, if that analysis is not
seeking to examine prisoners as a population and only incidentally
includes prisoners in the broader study. Such inclusion would
previously have required IRB review under subpart C, including review
by an IRB prisoner representative, followed by certification to and
authorization by OHRP. In addition, if the research did not fit into a
Sec.  46.306(a)(2) subpart C category of permissible research,
prisoners could not be included as subjects in the study, thereby
causing problems involving identifying and removing these subjects from
the analysis of repositories and databases.
    Similarly, the narrow expansion would allow a subject to continue
participation in exempt research if he or she became a prisoner during
the course of an exempt study, assuming the study was aimed at a broad
nonprisoner population, without the need for subpart C IRB review and
certification to OHRP. For example, an exempt study that recruited
subjects from a local community center to participate in a comparison
of HIV educational materials would continue to be exempt, and would not
trigger the need for review under subpart C, even if some of the
subjects became prisoners after enrollment. On the other hand, a study
that recruited subjects from a jail or prison to participate in a
comparison of HIV educational materials would continue to be nonexempt
under the final rule and require both subpart A and subpart C review,
including certification to OHRP.

B. Exemption Determination

1. Background and Pre-2018 Requirements
    The pre-2018 rule did not specify who at an institution may
determine that research is exempt. However, in the past, OHRP has
recommended that because of the potential for conflict of interest,
investigators not be given the authority to make an independent
determination that their human subjects research is exempt. OHRP has
recommended that institutions implement exemption policies that most
effectively address the local setting and programs of research. OHRP
has recognized that this may result in a variety of configurations of
exemption authority, any of which were acceptable assuming compliance
with the pre-2018 regulations. In addition, OHRP guidance provided that
institutional policies and procedures should identify clearly who is
responsible for making exemption decisions. We note that under the pre-
2018 and final rule a Common Rule department or agency retains final
authority as to whether a particular human subjects research study
conducted or supported by that department or agency is exempt from the
Common Rule.
2. NPRM Proposals
    The NPRM proposed to adopt a requirement that exemption
determinations be documented, and that such determinations could be
made only in two specified ways. To assist investigators and
institutions in making a timely and accurate determination of exemption
status the NPRM proposed that federal departments or agencies would
develop one or more exemption determination tools (the use of which
would constitute one of the ways in which determinations could be
made). Federal departments or agencies would create their own tool, or
rely on a tool created by another department or agency (including a
web-based tool created by HHS). Institutions would have discretion as
to whether or not to implement such a tool. As proposed in the NPRM, it
would be designed in such a way that if the person using the tool
inputs accurate information about the study, the tool would produce a
determination of whether the study is exempt. Institutions could rely
on the use of the federally developed tool by investigators as a ``safe
harbor'' for this determination. Use of the tool would be voluntary,
and each institution and agency would decide whether to rely on the
decision tool for their determinations, and if so, who would be allowed
to use it. Institutions that chose not to use the tool for particular
determinations would be required to have such determinations made by an
individual who is knowledgeable about the exemption categories and who
has access to sufficient information to make an informed and reasonable
determination. In general, as envisioned in the NPRM, it was expected
that investigators would not be allowed to make exemption
determinations for themselves without the use of the decision tool, due
to considerations of a conflict of interest.
    The NPRM requested public comment on several aspects of the
proposal to develop a decision tool: (1) The likelihood of an
institution allowing investigators to use the tool; (2) the ease of
investigators contriving answers in using the tool; (3) whether use of
the tool should be restricted to certain exempt categories of research;
(4) whether deployment of such a tool would erode public trust in
research; and (5) what additional information should be required to be
kept as a record other than the information submitted into the decision
tool.
    The NPRM also proposed that the institution or IRB be required to
maintain records of exemption determinations, which records must
include, at a minimum, the name of the research study, the name of the
investigator, and the exemption category applied to the research study.
As described in the NPRM, maintenance of the output of the completed
decision tool would fulfill this recordkeeping

requirement. Although the NPRM did not propose an auditing requirement
for assessing the accuracy of exemption determinations, it sought
public comment about the need for one.
3. Public Comments
    This was one of the more commented-on provisions of the NPRM,
receiving approximately 280 comments. Public comment was generally
mixed, with approximately half supporting and half opposing this
proposal. A large majority noted that they felt unable to adequately
respond to this proposal without seeing the decision tool first. Many
of those who indicated general support for this proposal noted
substantial qualifications to their support, such as the need to see
the tool before deciding. Some requested that this proposal not be
included in a final rule, and that a separate NPRM be issued specific
to this proposal. Many commenters said that for simplicity and
consistency, one tool should be agreed on by all of the sponsoring
departments and agencies and that the departments and agencies should
involve research administration professionals in developing such a tool
so that it would have field-friendly workability and produces
trustworthy results. Further, they thought that the tool should be
pilot tested and validated by institutions and investigators before
being deployed. For those who supported the concept of a decision tool,
they felt that its use would speed the review process for exempt
research. Some cited long wait times to receive an exemption
determination from their institution's IRB.
    Some commenters stated that the tool should clearly indicate that
although it determines exemption from federal regulations, state
restrictions still apply. A large academic center argued that though
the tool could be useful, for institutions that provide services,
treatment, and care for vulnerable populations it might be prudent to
have someone with expertise in human research protections independently
review research proposals to determine whether they are exempt or
excluded from IRB review, rather than rely on the tool.
    One large research university questioned the need for such a tool,
asserting that properly designed oversight and review of exempt
research should take minimal time and ensure that only exempt research
is conducted without IRB approval. This commenter preferred
comprehensive guidance on exempt research to support IRBs in making
efficient and expeditious exemption determinations. A large academic/
research organization concurred, pointing out confusion among
investigators about exempt categories, which requires careful
conversation with IRB officers to understand how their project fits
into the human protection framework. This organization believed that
these conversations promote safe and effective research decision making
and argued that use of the tool could fail to properly educate
investigators about the complexities of exempt research determinations.
    Some commenters noted that the decisions produced by the tool would
be only as good as the tool and the materials and guidance that
accompany it. Some commenters added that it is unlikely, however, that
the use of a federal decision tool would shield the institution or
investigator from liability in third-party actions. Still others went
so far as to say that they doubted their institution would allow its
use, at least for some time after which it was proven. To the extent
institutions are not engaged in the exemption determination process
through the tool, some argued that institutions should not be held
accountable for any unintended outcomes.
    Of those who commented on whether investigators should be allowed
and trusted to use the exemption determination tool, some noted that it
seemed inappropriate and a conflict of interest for investigators to be
allowed to use the tool to generate exemption determinations for their
own research activities. Others noted that an investigator might be
able to use the tool, but that the proposed exemptions categories were
so nuanced that experienced IRB staff might have difficulty determining
what qualifies for an exemption. To that end, these comments noted that
the tool would need to be accompanied with substantial guidance for an
investigator to be able to accurately input information into it.
Finally, some commenters expressed concern about the possibility that
investigators might enter inaccurate or misleading information into the
tool to ``game the system,'' while others noted that that possibility,
although remote, exists in the current protocol submission process and
that a well-developed tool could include a means for validating certain
types of inputs to assess accuracy.
4. Response to Comments and Explanation of the Final Rule: Exemption
Determination
    The final rule does not adopt the NPRM proposal at this time.
Therefore, the final rule does not require that exemption
determinations be documented, as had been proposed in the NPRM, and
continues to permit flexibility in how exemption determinations are
made. We recognize it was difficult to provide detailed feedback in the
absence of an exemption decision tool to evaluate. However, we continue
to believe that a well-designed, tested, and validated exemption
decision tool could offer an expedient mechanism for determining
whether research studies are exempt. Thus, we will continue to explore
development of an exemption decision tool. If and when an exemption
decision tool is developed, we would issue a subsequent (separate)
Federal Register notice for public comment. The notice would also give
the public the opportunity to comment on whether the use of the tool
would be appropriate in making exemption determinations under this
final rule. Thus, members of the public would be afforded a sufficient
opportunity to provide meaningful comments on such a proposed decision
tool.

C. Categories of Exempt Research

    The following sections describe the categories of exempt research
found in the final rule. Note that several categories of activities
proposed in the NPRM as exclusions appear in the final rule as
exemptions.
1. Background and Pre-2018 Rule
    Under the pre-2018 rule, a research activity qualified for
exemption from the Common Rule if it fell into one or more of six
categories at Sec.  __.101(b)(1)-(6). Such studies were fully exempt
from the regulations. That is, so long as a study did indeed fall
within a category, it did not need to satisfy any other regulatory
requirements that it needed to satisfy under the pre-2018 rule.
2. NPRM Proposals
    The NPRM proposed that all exemption language would be found at
Sec.  __.104. The NPRM proposed retaining all of the exemption
categories in the pre-2018 rule in one form or another except for the
exemption pertaining to research involving the use of educational
tests, survey or interview procedures or observation of public behavior
if the subjects are elected or appointed officials, or if the
confidentiality of the information were protected by statute. However,
the NPRM proposed re-classifying some of the pre-2018 rule's exemptions
as exclusions under the NPRM (and thus they would not have been subject
to administrative or IRB review), while retaining some of the pre-2018
rule's

exemptions as exemptions (versus exclusions).
    The NPRM proposed eight exemptions divided into three categories:
(1) Low-risk interventions for which there would have been no other
requirement (e.g., informed consent and privacy safeguards) other than
the determination and recording requirements; (2) research activities
that would have required application of privacy safeguards; and (3)
secondary research involving biospecimens and identifiable private
information that would have required application of privacy safeguards,
broad consent, and limited IRB review. The NPRM proposed to have some
exempt studies meet certain other regulatory requirements while not
having to meet other requirements, making them not ``fully exempt'' in
the sense of the pre-2018 rule.
    The NPRM proposed retaining exemption categories Sec.
__.101(b)(1), (5), and (6) from the pre-2018 rule. The NPRM proposed
clarifying the exemption for research on public benefit programs or
demonstration projects in the pre-2018 rule and explained that OHRP's
guidance would be changed to include the applicability of the exemption
to cover research on public benefit and service programs that an agency
does not itself administer through its own employees or agents. The
NPRM proposed requiring federal departments or agencies conducting such
studies to publish a list of studies under this exemption.
    The NPRM proposed that new exemptions would be created for:
     Certain research involving benign interventions;
     Certain research involving educational tests, survey or
interview procedures, or observation of public behavior where
identifiable private information was recorded, so long as data
protection standards are met;
     Secondary research use of identifiable private information
originally collected for nonresearch purposes;
     Activities relating to storing and maintaining
biospecimens and identifiable private information for secondary
research use, if subjects provided broad consent;
     Secondary research studies that would use the biospecimens
and identifiable private information stored or maintained under the
above exemption.
    The NPRM asked for public comment on several aspects of these
proposals, as they appeared as either exemptions or exclusions and
whether their placement in the NPRM was appropriate with regard to
protecting human subjects in research. Comment was requested on whether
guidance would be needed to help make exemption determinations and
whether the scopes of the proposed exemptions or proposed exclusions
were appropriate. That is, whether particular exclusions or exemptions
were either too narrow or too broad. For example, several questions
were posed about whether research should be exempt if it involved
psychological risks. The NPRM asked about whether notice should be
given to subjects for any of the activities. The public was asked to
comment on whether and how exempt activities could comply with the
NPRM's proposed privacy safeguards.
    The NPRM also inquired whether the exemption category related to
research conducted in established or commonly accepted educational
settings should apply only to research activities in which notice is
given to prospective subjects or their legally authorized
representatives as a regulatory requirement, when not already required
under the Privacy Act of 1974. If so, comment was sought on the type of
information to include in the notice and on how such notice should be
delivered.
    The NPRM asked for feedback on whether the proposed privacy
safeguards should apply to research included in the proposed exempt
category related to research conducted in established or commonly
accepted educational setting, given that such research may involve risk
of disclosing identifiable private information. The public was also
asked to comment on whether the protections provided by the HIPAA Rules
for identifiable health information used for health care operations,
public health activities, and research activities are sufficient to
protect human subjects involved in such activities, and whether the
current process of seeking IRB approval meaningfully adds to the
protection of subjects involved in such research studies.
    The NPRM asked about the extent to which the HIPAA Rules and the
Health Information Technology for Economic and Clinical Health (HITECH)
Act \33\ adequately address the beneficence, autonomy, and justice
considerations related to collecting new information and whether any
exemption for such collection should be limited to data collected or
generated in the course of clinical practice.
---------------------------------------------------------------------------

    \33\ The legislative language can be found at https://www.healthit.gov/sites/default/files/hitech_act_excerpt_from_arra_with_index.pdf.
---------------------------------------------------------------------------

    With regard to the proposed exemption related to research and
demonstration projects conducted or supported by a federal department
or agency, the public was asked to comment on: (1) Whether notice
should be given to prospective subjects and the nature of such notice;
(2) whether such activities can involve greater than minimal risk and
whether they are appropriate as exemptions; and (3) whether existing
privacy safeguards for such activities were sufficient.
    A proposed new exemption category was intended to facilitate
secondary research using identifiable private information that would
have been or would be collected or generated for nonresearch purposes,
when prior notice had been given and privacy safeguards and
prohibitions on re-use of the information were in place. The public was
asked to comment on what types of research should fall under this
proposed exemption, whether it should be limited to research in which
individuals have been informed of the potential for future research use
of their information and given the opportunity to opt out, and whether
the exemption would be appropriate for clinical data registries.
    Finally, public comment was sought on two related proposed
exemptions for research involving the use of biospecimens or
identifiable private information that would have been stored or
maintained for secondary research use, if consent for the storage and
maintenance of the information and biospecimens had been obtained using
a broad consent template that the NPRM proposed would be developed by
the Secretary of HHS.
3. Public Comments, Response to Comments, and Explanation of the Final
Rule: Exemption Categories
    All exemption categories, of which there are eight, appear at Sec.
__.104 in the final rule. Four of the exemption categories were
proposed as exclusions under the NPRM. In addition, the proposed
exclusion concerning certain research involving educational tests,
survey or interview procedures, or observation of public behavior has
been combined with the exemption regarding additional research
activities using the same research methods. The rule includes four
exemptions for research involving normal educational practices,
research involving benign behavioral interventions, research involving
public benefit or service programs, and research involving taste and
food quality, all of which were also proposed in the NPRM.
    Three exemptions pertain to secondary research uses of identifiable
private information or identifiable

biospecimens. One exemption, at Sec.  __.104(d)(4), which concerns
secondary research for which consent is not required, which consists of
three of the proposals for exclusions in the NPRM. A second exemption,
at Sec.  __.104(d)(7), pertains to storage or maintenance of
identifiable private information or identifiable biospecimens for which
broad consent is required, and a third exemption, at Sec.
__.104(d)(8), concerns secondary use of identifiable private
information or identifiable biospecimens for which broad consent is
required. As will be discussed in more detail below, some of the
conditions associated with the finalized exemptions differ from what
was proposed in the NPRM.
    In the final rule, similar to what was proposed in the NPRM,
``exempt'' does not always mean exempt from all of the requirements of
the Common Rule; the activity must fit the description of the exempt
category and not include nonexempt research activities. For example,
the exemption categories in the final rule at Sec.  __.104(d)(7) and
(8) identify specific regulatory requirements that must be met (e.g.,
limited IRB review, the use of broad consent) as a condition of being
exempt from other regulatory requirements.
    Public comments, responses to comments, and explanations of the
final rule for each exemption category follow.
a. Research Conducted in Established or Commonly Accepted Educational
Settings When It Specifically Involves Normal Educational Practices
(Sec.  __.104(d)(1))
i. Public Comments
    Approximately 50 comments discussed this exemption, which was a
slight modification of an exemption that existed in the pre-2018 rule.
The NPRM asked two questions about this exemption: (1) whether it
should require some type of notice and if so, how notice should be
delivered; and (2) whether the proposed privacy safeguards should apply
to this exemption.
    One commenter (a research dean from a university) suggested that
the wording of the exemption be modified from ``research conducted in
established or commonly accepted educational settings'' to ``research
conducted in established or commonly accepted educational or other
settings'' in order to allow more flexibility in how this exemption
could be applied.
    Other commenters noted a need for guidance on how this exemption
should be interpreted. For example, one comment suggested that a wide
array of ``normal'' educational practices exists, and the intention of
this language was difficult to discern. Another comment noted that
clarification was needed about permissible data collection methods
under this exemption.
    One commenter discussing the addition of the limitation that the
study should not be likely to adversely affect students' opportunity to
learn noted that it might be difficult to predict ahead of time if the
research contemplated under this exemption might have this adverse
impact.
    Several commenters discussed whether notice should be required. The
majority of these comments indicated that some type of notice should be
required. A few specifically discussed the importance of notifying
subjects of these activities (with one commenter stating that parental
consent should be required), stating that lack of notice could erode
public trust in research.
    Groups representing AI/AN tribal interests argued that notice for
this type of research should be required. Specifically, they asserted
that transparency around research-related activities and policies,
especially in school settings, can build trust among AI/AN populations
and ensure that individual and community benefits of participation in
research are achieved. They also noted that tribal consultation
facilitates decisions about appropriate ways to implement such notices,
and observed that the rural nature of many AI/AN communities requires
the use of multiple modes of communication and more time spent reaching
the intended audience. The commenter also noted that potential subjects
should be given the opportunity to opt out of research activities.
    One commenter argued that notice is generally an insufficient
standard for this type of research and is not a suitable substitute for
informed consent.
    Approximately 20 comments discussed whether the proposed privacy
safeguards that appeared at Sec.  __.105 in the NPRM should apply to
this exclusion. Comments were generally mixed about whether this would
be appropriate, with a small majority indicating that the privacy
safeguards should not apply. These comments generally argued that if an
activity is exempt, no additional requirements should be placed on that
research activity.
    A privacy advocacy organization that supported both notice and
attaching the proposed privacy safeguards to this provision, stated
that notice in this context is also important because other federal
standards (e.g., Family Educational Rights and Privacy Act [FERPA; 20
U.S.C. 1232g; 34 CFR part 99], Protection of Pupil Rights Amendment
[PPRA; 20 U.S.C. 1232h; 34 CFR part 98]) are not acceptable proxies for
privacy protection. This commenter indicated that the notice should be
robust with detailed information presented to parents directly. As
justification for providing additional protections in this context,
this group noted that the consequences for misuse of data are greater
for children; that is, lost, misused, or leaked information about
children could have lifelong consequences. The commenter argued that if
an exemption is proposed for this class of research, then the lack of
IRB oversight should require that researchers must comply with
appropriate privacy safeguards.
ii. Response to Comments and Explanation of the Final Rule: Exemption
for Certain Research Conducted in Certain Educational Settings
    The final rule includes an exemption at Sec.  __.104(d)(1) for
research conducted in established or commonly accepted educational
settings that specifically involves normal educational practices, so
long as the research is not likely to adversely affect students'
opportunity to learn required educational content or the assessment of
educators who provide instruction. This includes most research on
regular and special education instructional strategies, and research on
the effectiveness of, or the comparison among, instructional
techniques, curricula, or classroom management methods.
    This exemption is a revised version of the first exemption in the
pre-2018 rule and a modified version of the exemption as proposed in
the NPRM. This change is based on concerns about whether the conduct of
some research projects of this type might draw enough time and
attention away from the delivery of the regular educational curriculum
that they could have a detrimental effect on student achievement. The
wording of the exemption has been modified to include a condition that
the research is not likely to have these adverse impacts. This was the
original intent of the NPRM proposal, and it is an important
qualification that should apply to any research activity that is exempt
under this provision. It also drops the phrase ``in that educational
setting,'' because that phrase is redundant.
    The exemption is retained to allow for the conduct of education
research that may contribute to the important public good of improving
education, consistent with the principle of beneficence. The

exemption retains the condition that the research activity takes place
in established or commonly accepted educational settings, because
otherwise IRB review would be warranted for such research activities
being conducted in unconventional settings.
    We recognize that providing notice for this type of research could
involve a significant administrative burden and that it is not always
appropriate, and therefore have decided not to include it as a
regulatory requirement at this time. We note that making these
activities exempt does not mean that there ought not to be tribal
consultation about the research activities, and that such consultation
may lead to a notice requirement. Where appropriate or mandated by
tribal law, tribal consultation should take place irrespective of
whether the activity has to meet the requirements of this final rule.
Such consultation would represent a free-standing legal obligation, as
is referred to in Sec.  __.101(f).When appropriate, investigators may
provide notice in a manner that is appropriate to the research activity
and the cultural context in which it occurs.
    This exemption is largely unchanged from the pre-2018 rule, and
does not add requirements for safeguarding privacy at this time.
b. Research That Includes Only Interactions Involving Educational Tests
(Cognitive, Diagnostic, Aptitude, Achievement), Survey Procedures,
Interview Procedures, or Observation of Public Behavior (Including
Visual or Auditory Recording), If at Least One of Three Criteria Is Met
(Sec.  __.104(d)(2))
    This exemption in the final rule is a revised version of an
exemption in the pre-2018 rule, and is a combination of a provision
proposed as an exclusion in the NPRM, and a provision proposed as an
exemption in the NPRM. Thus, public comments on both of these proposals
follow here.
i. Public Comments
    Approximately 80 comments discussed this proposed exclusion, which
was an exemption in the pre-2018 rule. Public comments were mixed. Some
felt that moving these activities from the exemption to exclusion
category would streamline this type of low-risk, common research
activity and allow IRBs to focus time and attention on more complicated
and higher risk activities. Others, including SACHRP and many research
universities, argued that based on their experience, investigators have
difficulty making the assessments required to determine whether an
activity falls under this exemption. For example, investigators have a
difficult time determining whether disclosure outside of the research
context might put someone at risk of criminal or civil liability.
    Commenters also expressed concern about whether the three statutes
cited in the third prong of the proposed exclusion would provide a
comparable level of protections to human subjects as does the Common
Rule. Many of these commenters noted that they simply were not sure
what types of protections would be afforded to subjects under the
Privacy Act, the Paperwork Reduction Act, and the E-Government Act of
2002. Others noted that the main protections provided by these statutes
involved notice and not ethics review.
    The NPRM requested comment on the extent to which covering
educational tests, survey procedures, interview procedures, or
observation of public behavior under the Common Rule would
substantially add to the protections provided to human subjects. Public
comment was mixed, but the majority of commenters felt that these
activities should be exempt rather than excluded. One commenter
indicated that contrary to the primary justification for excluding
these categories of research, these activities cannot always be
considered to be low risk and could pose significant risks depending on
the nature of the research and sensitivity of the data collected.
    One commenter expressed strong opposition to excluding these
activities from Common Rule protections, indicating that excluding them
would compromise the rights and welfare of research subjects. The
commenter emphasized that consent cannot be inherent to participation
in the activity because researchers cannot know with certainty that
participants are familiar with common forms of educational tests,
surveys, and interview procedures and the potential risks inherent to
information disclosure. In addition, the commenter pointed out,
assuming that even vulnerable subjects know the risks associated with
participation in surveys and interviews is contrary to the Belmont
Report's assertion that vulnerable subjects need additional protection.
    Some comments were mixed, for example, suggesting that observation
of public behavior might be an acceptable exclusion, whereas surveys
and interviews ought to remain exempt. One commenter indicated that it
might be reasonable for these activities to be excluded if an exclusion
determination tool was available to help investigators make the
decision. Another commenter suggested that whether the activities are
exempt or excluded, notice should be required, to indicate the purpose
of the activity, describe privacy safeguards, state that participation
is voluntary, and provide information on opting out.
    Other commenters expressed concern that investigators might not be
able to effectively make these determinations, and pointed out that
IRBs, with a broad range of experience and expertise in data
identifiability, provide a check for researchers' judgment and are
better placed to make consistent and informed decisions about
exemptions.
    Even so, some other commenters felt that Common Rule protections do
not substantially add to the protection of human subjects in these
categories of activities. Thus, categorizing them as an exemption just
adds administrative burden.
    The NPRM asked whether this exclusion should apply only to research
activities in which notice is given to prospective subjects or their
legally authorized representatives as a regulatory requirement, and if
so, what information should be included in the notice. Some commenters
supported a requirement for notice or at a minimum, some sort of
tracking system for these activities. One emphasized that the ethical
principle of respect for persons demands some sort of notice. Some
indicated that requiring notice prevents these activities from being
excluded and might necessitate including them on the list of activities
for expedited review rather than deeming them exempt activities.
    Other commenters expressed concern about the proposed exclusion.
For example, one indicated that it might not be correct to assume that
people agree to participate, and understand that they can opt out, by
virtue of their participation, and another reiterated concern about
assuming that these activities are inherently low risk and expressed a
desire to keep these activities in the exempt category to maintain a
level of IRB oversight.
    The NPRM asked whether it is reasonable to rely on investigators to
make self-determinations for the types of research activities covered
in this particular exclusion category, and if so, whether documentation
of any kind should be generated and retained. One commenter expressed a
strong opinion that investigators should be allowed make these self-
determinations. However, the majority of comments responding to this
question felt that investigators should not be solely responsible for
making these determinations.

    Some commenters felt that self-determination might work in certain
cases or with certain groups but that there would be too much
variability to allow it generally. One suggested a screening system
that might check whether determinations were being made correctly.
    Many commenters pointed out that it is unreasonable to expect
investigators to be able to reliably discern levels of risk inherent to
disclosure of information, and that what might seem innocuous to
researchers could cause real harm to others. Other commenters expressed
concern about conflicts of interest, and that investigators might be
more likely to make a determination to not delay their research.
Another commenter emphasized that oversight is necessary to avoid
situations in which investigators inaccurately assume that subjects
understand that they are participating in research, or that they are
being recorded, for example.
    The NPRM requested comment on whether some or all of these
activities should be exemptions rather than exclusions. Response to
this question was mixed. Some commenters felt that these activities
should be excluded. Others felt that surveys and interview should be
considered exempt while educational tests and observation of public
behavior should be excluded. Still others felt that all should be
exemptions except for observations of public behavior, which could be
excluded.
    The NPRM asked whether these exclusions should be narrowed such
that studies with the potential for psychological risk are not included
and whether certain topics that involve sensitive information should
not be covered by this exclusion. There was general agreement among
responses to this question that the exclusions should be narrowed so
that studies with the potential for psychological risk were not
included in the exclusion. Some commenters, however, indicated that it
would be unrealistic to expect investigators to make this determination
reliably, that it might be challenging to implement such a policy, and
that guidance would be required from regulatory bodies.
    Commenters felt that these activities should be exemptions rather
than exclusions, to preserve a level of IRB oversight. One commenter
pointed out that circumstances that occur in research for which
psychological risks are possible are fairly common in this category of
activities and that excluding them would leave the risk unaddressed.
One professional organization emphasized that the ``potential for
serious psychological harms that may be associated with participation
in nonbiological research . . . [is] not merely the result of
inappropriate disclosure of information.'' It also indicated that ``the
probability and magnitude of this risk may vary by characteristics of
individual participants, clinical expertise of the interviewer(s), as
well as the risk-minimizing protections that are in place.''
    The NPRM requested comment on whether for activities captured under
the third element of this exclusion, the statutory, regulatory, and
other policy requirements cited provide enough oversight and protection
that being subject to expedited review under the Common Rule would
produce minimal additional subject protections. If so, the NPRM asked
whether the exclusion should be broadened to also cover secondary
analysis of information collected pursuant to such activities. Of the
few responses to this question, one commenter felt that existing
protections are sufficient if information is stored in a secure
information technology (IT) infrastructure.
    Other organizations expressed strong sentiments that neither the
Paperwork Reduction Act nor the Privacy Act were protective in the
research context and that current privacy protections are inadequate.
They stressed the importance of safeguarding IT and cyber
infrastructure and provided examples of large data breaches.
    The NPRM asked about the extent to which excluding any of these
research activities from the Common Rule could result in an actual or
perceived reduction or alteration of existing rights or protections
provided to human subjects. That is, does excluding these research
activities from the Common Rule pose any risks to scientific integrity
or public trust? Commenters who responded to this question generally
felt that excluding any of these research activities could result in an
actual or perceived reduction or alteration of existing rights or
protections provided to human subjects. One indicated that reduction in
oversight would lead to subjects being exposed to unintended risks that
otherwise would be preventable. Other commenters felt that improper
assumptions about low levels of risk in these activities and allowing
for self-determination could lead to a reduction in protections for
human subjects.
ii. Public Comments on the Proposed Exemption for Research Involving
Educational Tests, Surveys, Interviews, or Observation of Public
Behavior If the Information Is Recorded With Identifiers, and Even If
the Information Is Sensitive
    Approximately 50 comments discussed the proposal to exempt
educational tests, surveys, interviews, or observation of public
behavior if the information is recorded with identifiers and even if
the information is sensitive. Public comment here was mixed, with some
agreeing that by mandating privacy safeguards, the proposal effectively
addresses the primary risk that occurs in this type of research. Others
argued that this type of research still benefits from some type of IRB
review and thus should be considered covered rather than exempted
research. Yet other comments noted that it was impossible to make a
determination about this proposed exemption without seeing the proposed
privacy safeguards that were proposed in the NPRM.
    Several commenters noted that the parameters of this exclusion
might be acceptable if it excluded sensitive topics or if it excluded
research studies that posed psychological harm to potential subjects.
One comment by a professional organization of psychology professionals
noted that IRBs often misunderstand and overstate psychological risks
in research. Because of this, this group argued that the rule should
not include a limitation based on psychological risks because IRBs are
not able to effectively assess psychological risks.
    The NPRM also asked whether this exemption should be extended to
research involving children. The majority of those who responded to
this question were opposed to such an extension.
iii. Response to Comments and Explanation of the Final Rule: Exemption
for Certain Research Involving Educational Tests, Surveys, Interviews,
or Observation of Public Behavior Under Specific Conditions
    The final rule includes an exemption at Sec.  __.104(d)(2) that is
a revised version of an exemption in the pre-2018 rule. The exemption
applies to research that only includes interactions involving
educational tests (cognitive, diagnostic, aptitude, achievement),
survey procedures, interview procedures, or observation of public
behavior (including visual or auditory recording) uninfluenced by the
investigator if at least one of three criteria is met:

     The information obtained is recorded by the investigator
in such a manner that the identity of the human subject cannot readily
be ascertained, directly or through identifiers linked to the subjects;
     Any disclosure of the human subjects' responses outside
the research would not reasonably place the subjects at risk of
criminal or civil liability or be damaging to the subjects' financial
standing, employability, educational advancement, or reputation; or
     The information obtained is recorded by the investigator
in such a manner that the identity of human subjects can readily be
ascertained, directly or through identifiers linked to the subjects,
and an IRB conducts a limited IRB review to make the determination
required by Sec.  __.111(a)(7) (which relate to there being adequate
provisions for protecting privacy and maintaining confidentiality).
    The final rule does not include the language proposed in the NPRM
that offered as one prong of the exemption (proposed as an exclusion)
that the research be subject to the Privacy Act, the Paperwork
Reduction Act, or the E-Government Act of 2002. The final rule simply
includes Sec.  __.104(d)(2)(iii), which requires limited IRB review as
described at Sec.  __.111(a)(7) if identifiable private information
will be obtained and recorded in such a way that the identity of human
subjects can readily be ascertained, either directly or through
identifiers linked to the subject.
    This exemption is based on the assumption that the potential risks
raised by this category are largely informational and that subjects are
aware of them, and thus the most important role that an IRB might play
with respect to reducing potential harms is to ensure the application
of privacy safeguards. Under this assumption, the exemption is
consistent with the principle of respect for persons and the
preservation of autonomy. In the case of observation of public
behavior, even if the subject does not know that an investigator is
watching his or her actions, the subject's behavior is public and could
be observed by others, and thus the research observation is not
inappropriately intrusive.
    The term ``survey'' as used here refers to information collected
about individuals through questionnaires or similar procedures (e.g.,
the Current Population Survey conducted by the U.S. Census). ``Human
subjects'' do not include organizations or businesses. ``Survey,'' as
used here, does not include the collection of biospecimens. Thus, an
activity that included the collection of a biospecimen (e.g., a cheek
swab), in addition to collecting verbal or written responses to
questions, could not qualify for this exemption.
    This exemption includes the research activities that appeared at
Sec.  __.101(b)(2) in the pre-2018 rule, as well as some additional
information collection research activities using the same methods. As
in the pre-2018 rule, this exemption includes research studies whose
methods consist of the use of educational tests, survey or interview
procedures, or observation of public behavior that does not involve an
intervention, if the data are recorded anonymously, or the information
is recorded with identifiers, but is not sensitive such that its
disclosure could result in harm to the subjects. The exemption provides
a list of the specific harms that must be considered, as did the pre-
2018 rule, with the addition of the specific harm of potential damage
to the subjects' educational advancement. This potential harm has been
added because of the obvious relevance to the effects of the disclosure
of responses in research involving educational tests.
    This exemption has been expanded to include research using the same
methods involving identifiable private information that might be
sensitive or potentially harmful if disclosed, so long as the
investigators adhere to the limited IRB requirements outlined in Sec.
__.111(a)(7), and the research is not subject to Subpart D. The limited
IRB review requirements are designed to provide privacy safeguards to
reduce the chances that the disclosure of identifiable private
information will occur and lead to harm.
    The wording of the exemption is clarified to indicate (consistent
with the interpretation of Sec.  __.101(b)(2) in the pre-2018 rule)
that the research cannot include interventions in addition to the
educational tests, survey or interview procedures, or observation of
public behavior. Research involving interventions that are distinct
from those information collection methods allowable under this
exemption do not satisfy the conditions of this exemption. For example,
if a research study were to randomly assign students to take an
educational test in a quiet room or in a room with a moderate level of
noise, or to consume a snack (or not) before taking the test, this
research would not be exempt under this exemption. It should be noted,
however, that educational tests may include exposing test takers to
certain materials as part of the test, and that such materials do not
constitute interventions distinct from the test. For example, reading
comprehension tests may direct test takers to read a passage, and a
geography test may present test takers with a map, and ask them to draw
information from that map. Likewise, survey procedures may contain some
information that the respondents are asked questions about, which would
not be considered distinct interventions. However, research in which
the purpose of the research is to see whether respondents answer survey
questions differently depending on the gender of the interviewer would
not satisfy the conditions of the exemption, because the manipulation
of the interviewer would be a distinct intervention. Research involving
observation of public behavior does not qualify for this exemption if
the investigator intervenes with subjects, for example, by offering
them an ostensibly lost wallet to see if they will accept it.
    Part of the rationale for exempting the research activities at
Sec.  __.104(d)(2) from the Common Rule, even when the research is not
otherwise subject to additional federal controls, is that for education
tests, survey or interview procedures, agreement to participate is
inherent in participation and that for much of this research the risks
most likely to be experienced by subjects are related to disclosure of
anonymous, nonsensitive information and are thus categorized as
``low.'' In general, it is reasonable to expect that individuals,
including vulnerable populations (other than children), would
understand that actively providing responses to educational tests,
surveys, or interview procedures constitutes agreement to participate
and that the risks associated with such participation would be related
to disclosure of the information they provided. The exemption of this
type of activity rests in large part on the idea that all individuals,
regardless of the setting or context in which the activity will take
place, are generally familiar with common forms of educational tests
and survey and interview procedures that they experience in their daily
lives, and do not need additional measures to protect themselves and
their privacy from investigators who seek their involvement in research
activities involving these procedures. They can decline to participate,
or to answer some questions. In addition, if the information collected
is both identifiable and sensitive or potentially harmful, the
safeguards offered by the limited IRB review requirements at Sec.
__.111(a)(7) apply. This is accomplished through the added provision at
Sec.  __.104(d)(2)(iii).
    Concerns have also been raised about psychological risks of
participating in

surveys or interviews, and of situational risks where the simple
awareness that someone was surveyed or interviewed poses a risk. We
recognize that this is possible, but believe that this is rare enough
that it does not warrant adding additional conditions to the exemption
category.
    With respect to applying this exemption to research with children,
two subcategories of this exemption--concerning information recorded so
that subjects cannot be identified (Sec.  __.104(d)(2)(i)), and
concerning disclosures of the subjects' responses that would not place
them at certain kinds of risk or create certain kinds of damage (Sec.
__.104(d)(2)(ii))--may apply to research involving children under
subpart D if the research involves educational tests or observation of
public behavior and the investigator does not participate in the
activities being observed. The final subcategory of this exemption
(Sec.  __.104(d)(2)(iii)), which allows for obtaining and recording
identifiable private information, may not be applied to research
involving children under subpart D.
c. Research Involving Benign Behavioral Interventions in Conjunction
With the Collection of Information From an Adult Subject (Sec.
__.104(d)(3))
i. Public Comments
    Approximately 50 comments discussed the NPRM proposed exemption
involving benign interventions in conjunction with collecting
information from an adult subject. Public comments here were mixed,
with a majority favoring this exemption, and with the majority of
commenters indicating that guidance will be needed for this exemption
to be implemented properly. For example, one large research university
stated, ``The proposed category involving benign interventions needs
further revision. While we are supportive of this category in general,
the words `benign intervention' without definition leaves too much room
for different interpretations and these terms are not easily applicable
to social science research, a context in which these types of
activities are likely to occur.'' Those that favored this exemption
generally agreed with the argument put forth in the NPRM that these
activities were low in risk and IRB review did not provide subjects
meaningful additional protections in this context.
    Several comments requested clarification on the extent to which
medical interventions might be covered under this exemption. For
example, to what extent could proven diagnostic methods that introduce
energy but are not invasive (e.g., magnetic resonance imaging,
ultrasound, computerized tomography scan) be considered a ``benign
intervention'' for the purpose of this exemption? Another comment asked
whether the provision included the use of medical devices, such as
blood pressure monitors or thermometers.
    Those who did not support this exemption offered a variety of
reasons. One comment from a research university indicated that it did
not support this exemption because it could cause studies like the
``Milgram Obedience Experiment'' \34\ and the ``Stanford Prison Study''
\35\ to occur without IRB review. Another comment reiterated the
general stance that all research activities should require IRB review
and informed consent.
---------------------------------------------------------------------------

    \34\ Milgram S. Behavioral Study of Obedience. The Journal of
Abnormal and Social Psychology, 1963; 67(4):371-378. Retrieved from
http://www.columbia.edu/cu/psychology/terrace/w1001/readings/milgram.pdf.
    \35\ Haney C, Banks WC, and Zimbardo PG. A study of prisoners
and guards in a simulated prison. Naval Research Review, 1973, 30:4-
17. Retrieved from http://www.simplypsychology.org/zimbardo-paper.pdf.
---------------------------------------------------------------------------

    One comment from a research ethics, public education, and
professional organization noted that if the final rule includes an
expansion of exemption categories such as the proposed benign
intervention exemption in the NPRM, then investigator education on
human subjects protection should be mandated.
    Another comment noted that it should be clarified in the regulatory
text that withholding the investigator's hypothesis from subjects is
not deception.
    The majority of commenters indicated that no additional
requirements, be it notice or the proposed privacy safeguards, should
be applied to this exemption category. A minority of comments indicated
that some kind of notice should be required with this provision,
generally asking for that notice to include the purpose of the study,
the privacy and confidentiality protections in place, a statement that
participation is voluntary, information on how to opt out of the study,
and information about who to contact for more information. Comments
that favored notice suggested that the notice should be study-specific.
    Although commenters generally felt the examples of activities that
would satisfy this exemption included in the regulatory text were
sufficient, commenters also indicated that many of the terms used in
this exemption needed additional explanation, for example, ``brief in
duration,'' ``painless,'' and ``physically invasive.'' A large research
university noted that the proposed language raised questions about what
sorts of impact are significant and how long is ``lasting.''
    One large professional organization representing research
universities and organizations noted that the term ``benign
intervention'' did not seem to encapsulate the types of activities that
the NPRM contemplated. Specifically, this organization argued that
``benign intervention'' connotes a medical procedure, when the NPRM
preamble suggested that this exemption encompasses nonmedical ``benign
interventions'' generally. This organization also suggested that the
activities contemplated by this exemption are more like interactions
than interventions.
    In response to a question about whether the decision tool could be
relied on for making this exemption determination, a majority of those
who responded indicated that it would be impossible to answer this
question without first seeing the decision tool. Others indicated that
without better definition of terms like ``benign intervention,''
``prospectively agree,'' ``long lasting,'' and ``significant impact,''
it would be impossible for a tool to provide accurate determinations
for this exemption.
ii. Response to Comments and Explanation of the Final Rule: Exemption
for Certain Research Involving Benign Behavioral Interventions in
Adults
    This exemption at Sec.  __.104(d)(3) was not in the pre-2018 rule,
but was proposed in the NPRM. In response to public comments that
expressed concern over the need to further clarify the term ``benign
interventions,'' the word ``behavioral'' has been inserted to modify
the type of intervention which may be included. The intent of this
change is to exclude the use of medical interventions (including
medical tests, procedures and devices). The exemption being finalized
is specifically for research involving benign ``behavioral''
interventions in conjunction with the collection of information from an
adult subject through verbal or written responses (including data
entry) or audiovisual recording if the subject prospectively agrees to
the intervention and information collection and at least one of the
following is met:
     The information obtained is recorded by the investigator
in such a manner that the identity of the human subjects cannot readily
be ascertained

directly or through identifiers linked to the subjects;
     Any disclosure of the human subjects' responses outside
the research would not reasonably place the subjects at risk of
criminal or civil liability or be damaging to the subjects' financial
standing, employability, educational advancement, or reputation; or
     The information obtained is recorded by the investigator
in such a manner that the identity of the human subjects can readily be
ascertained, directly or through identifiers linked to the subject, and
an IRB conducts a limited IRB review to make the determination required
by Sec.  __.111(a)(7).

    For the purpose of this provision, the exemption describes benign
behavioral interventions as being brief in duration, harmless,
painless, not physically invasive, not likely to have a significant
adverse lasting impact on the subjects, and the investigator has no
reason to think the subjects will find the interventions offensive or
embarrassing. Provided all such criteria are met, examples of such
benign behavioral interventions include having the subjects play an
online game, solve puzzles under various noise conditions, or decide
how to allocate a nominal amount of received cash between themselves
and someone else.
    Unlike the exemption at Sec.  __.104(d)(2), this exemption allows
for the intervention to be distinct from the data collection method;
for example, a research study comparing test performance of test takers
in quiet or noisy surroundings would qualify for this exemption. Also
subjects could be asked to perform cognitive tasks, and audiovisual
recording could be used to collect the data, without any educational
test, survey or interview procedure occurring, and this research would
qualify for this exemption.
    If the research involves deceiving the subjects about the nature or
purposes of the research, this exemption would not be applicable unless
the subject authorizes the deception. For the purpose of this
provision, authorized deception would be prospective agreement by the
subject to participate in research where the subject is informed that
he or she will be unaware of or misled regarding the nature or purposes
of the research. The final rule allows this type of research to occur
without the requirements of informed consent because the intervention
is not likely to result in harm or offense to the subject, and the
subject must prospectively agree to the intervention and the data
collection.
    Subjects must be adults, but the provision does not specify that
they must be competent, and therefore tests of competency are not
necessary. However, the presumption is that, in keeping with the
principle of respect for persons, such subjects will not be exploited.
    This new exemption category is added because respect for persons is
accomplished through the prospective subject's forthcoming agreement or
authorization to participate, the research activities pose little risk
to subjects, and the use of this exemption for many social or
behavioral studies will enable IRBs to devote more time and attention
to research studies involving greater risks or ethical challenges. We
note that the requirement for the agreement of the subject effectively
serves as a kind of notice, because the subject is asked to agree to
participate in the research, and the request will be tailored to the
nature of the specific research study.
    The final rule includes another condition that was not included in
the NPRM, which broadens the type of research that may meet this
exemption. The final rule at Sec.  __.104(d)(3)(i)(C) permits
investigators to obtain and record information in such a manner that
the identity of the human subjects can readily be ascertained, directly
or through identifiers linked to the subject, provided the research has
undergone limited IRB review in accord with Sec.  __.111(a)(7). This
alternative condition was added to the final rule for reasons similar
to the exemption at Sec.  __.104(d)(2), as a way of providing
additional protections when investigators obtain and record information
in such a manner that human subjects can be identified directly or
through identifiers linked to the subject. Because the risk associated
with enabling investigators to obtain and record identifiable private
information can be addressed by requiring adherence to the privacy
safeguards provided through limited IRB review, we believe it is
appropriate to allow such research to be exempt.
    In addition, the final rule permits the collection of data through
audiovisual recording, not just video recording, as was proposed in the
NPRM. We believe that broadening the exemption in this way provides
more flexibility to the permissible data collection methods without
creating greater risk of harm to research subjects.
    We acknowledge that guidance may be useful for interpreting some of
the terms in this exemption, and that some cases will be debatable.
However, we also believe that a substantial number of research
activities will plainly fit this exemption, and should be allowed to
proceed without IRB review. We agree that investigator education is
often desirable, but that the provisions of the exemption are not
difficult to understand. We believe that Milgram's obedience
experiments and the Stanford Prison Experiment would obviously not
qualify for this exemption, because investigators had reason to think
some subjects would find the interventions offensive or embarrassing.
We acknowledge that in this exemption the word ``deception'' is used to
include withholding the purpose of the research, which is consistent
with how the term is often used in this context.
d. Secondary Research Use of Identifiable Private Information and
Identifiable Biospecimens for Which Consent Is Not Required (Sec.
__.104(d)(4))
i. Overview
    The final rule exemption at Sec.  __.104(d)(4) is for secondary
research use of identifiable private information and identifiable
biospecimens for which consent is not required. This particular
exemption combines several NPRM exclusion proposals. It exempts
secondary research use of identifiable private information and
identifiable biospecimens when:
     The identifiable private information or identifiable
biospecimens are publicly available;
     The information is recorded by the investigator in such a
way that the identity of subjects cannot readily be ascertained, and
the investigator does not contact subjects or try to re-identify
subjects;
     The secondary research activity is regulated under HIPAA;
or
     The secondary research activity is conducted by or on
behalf of a federal entity and involves the use of federally generated
nonresearch information provided that the original collection was
subject to specific federal privacy protections and continues to be
protected.

    By ``secondary research,'' this exemption is referring to re-using
identifiable information and identifiable biospecimens that are
collected for some other ``primary'' or ``initial'' activity. The
information or biospecimens that are covered by this exemption would
generally be found by the investigator in some type of records (in the
case of information) or some type of tissue repository (such as a
hospital's department for storing clinical pathology specimens).

    It is important to recognize that this exemption does not cover any
primary collections of either information or biospecimens. For example,
if an investigator wants to collect information directly from research
subjects by asking them to complete a questionnaire, that would not be
covered by this exemption. If an investigator wants to collect
biospecimens by having subjects swab their cheek, that would similarly
not be covered by this exemption. On the other hand, an investigator
who wants to use information that is in some databank, or use
biospecimens that are in a pathology laboratory, or use the ``excess''
portion of blood that was drawn for clinical purposes, could use this
exemption assuming all of the relevant conditions are met.
    Also, note that unlike the pre-2018 rule's exemption relating to
certain secondary uses of information and biospecimens, the final rule
has no requirement that the information and biospecimens must be pre-
existing at the time that the investigator begins a particular research
study. For example, an investigator could start a study that involves
using biospecimens from clinical pathology laboratories, and could
include specimens that are added to the laboratories during the course
of the study (again assuming that the other conditions of the exemption
are met).
    Public comments on each of the exclusions proposed in the NPRM and
combined in this exemption follow.
(1) Public Comments on the Proposed Exclusion for Research Involving
the Collection or Study of Identifiable Private Information or
Identifiable Biospecimens That Are Publicly Available or Recorded by
the Investigator Without Identifiers
    Approximately 50 commenters discussed this proposed exclusion about
identifiable private information or identifiable biospecimens that are
publicly available or recorded by the investigator without identifiers.
Public comments were mixed, with many indicating that investigators
should not themselves be allowed to determine whether their research
fits under this exclusion, and many indicating that this should be an
exemption rather than an exclusion. A majority supported the clarifying
language that this category of activities could include information
that will be collected.
    One commenter indicated that the prohibition on re-identification
should apply to activities in publicly available data sets. This
commenter also indicated that any research involving re-identification
should undergo IRB oversight. Another commenter suggested that there
should also be a prohibition in this category against the release or
publication of information that would lead to re-identification.
    One commenter indicated that the terminology used in this provision
needed clarification. Specifically, the commenter wondered how one
should interpret the term ``recorded by the investigator'' with respect
to electronic data?
    In response to a question posed in the NPRM about whether any of
the exclusion categories should include biospecimens, a majority of
those who responded to the question indicated that biospecimens should
be included in this category.
    The NPRM also asked whether this exclusion should apply to
activities involving prisoners. Of those who responded to this
question, responses were mixed with some indicating that this exclusion
should apply to research with prisoners and others indicating that it
would be inappropriate for research with prisoners to be allowed. One
commenter indicated that allowing prisoners in this type of research
would be a weakening of protections in activities involving vulnerable
populations.
(2) Public Comments on the Proposed Exclusion for Certain Activities
Covered by HIPAA
    Approximately 50 comments discussed the NPRM proposal to exclude
certain activities subject to HIPAA. Public comments were mixed, with
many indicating that the protections required under HIPAA for ``health
care operations,'' ``research,'' and ``public health activities,'' were
sufficient, and that for the types of activities identified by the
exclusion, review under the Common Rule did not provide meaningful
protections. In contrast, others argued that because the scope of a
privacy review board is narrower than for an IRB, these activities
should not receive a blanket exclusion from the Common Rule.
    Under the HIPAA Privacy Rule, health information is de-identified
and thus exempt from that rule only if it neither identifies nor
provides a reasonable basis to believe that the information can be used
to identify an individual. The HIPAA Privacy Rule provides two ways to
de-identify information: (1) A formal determination by a qualified
expert that the risk is very small that an individual could be
identified; or (2) the removal of all 18 specified identifiers of the
individual and of the individual's relatives, household members, and
employers, as long as the covered entity has no actual knowledge that
the remaining information could be used to identify the individual (45
CFR 164.514(b)).
    Otherwise, the HIPAA Privacy Rule addresses some informational
risks by imposing restrictions on how individually identifiable health
information collected by health plans, health care clearinghouses, and
most health care providers (``covered entities'') may be used and
disclosed, including for research. In addition, the HIPAA Security Rule
(45 CFR parts 160 and subparts A and C of part 164) requires that these
entities implement certain administrative, physical, and technical
safeguards to protect this information, when in electronic form, from
unauthorized use or disclosure. However, the HIPAA Rules apply only to
covered entities (and in certain situations to their business
associates). Not all investigators are part of a covered entity and
thus some investigators are not required to comply with those rules.
Moreover, the HIPAA Rules do not apply specifically to biospecimens in
and of themselves.
    One commenter proposed that the exclusion be expanded so that
investigators from noncovered entities (as defined in the HIPAA Rules)
would be eligible for the exclusion as well. Another commenter
suggested that the HIPAA exclusion should be expanded to cover business
associates and researchers that comply with HIPAA.
    The NPRM asked whether the protections provided by the HIPAA Rules
for identifiable health information used for health care operations,
public health activities, and research activities are sufficient to
protect human subjects involved in such activities, and whether the
current process of seeking IRB approval meaningfully adds to the
protection of human subjects involved in such research studies.
Approximately half of the comments that addressed this question
suggested that HIPAA protections are sufficient and that no additional
safeguards were needed. Others expressed concern, and suggested that in
some, if not all, of the categories in the HIPAA exclusion, HIPAA
protections would not be sufficient.
    One commenter suggested that this exclusion might be appropriate
for health care operations or public health activities, but that the
HIPAA rules were not sufficiently protective for research activities.
Specifically, one commenter expressed concern that excluding from the
Common Rule the use of PHI for research activities in HIPAA-covered
entities would weaken protections for patients, because HIPAA's privacy
safeguards were never intended to

replace human subject protections and associated ethical and scientific
review.
    One commenter also noted that other HHS preambles to rules have
discussed the differences between the Common Rule and HIPAA, and these
preambles noted that HIPAA was not intended to replace the Common Rule.
This commenter suggested that given the language included in previous
HHS preambles, additional justification for this exclusion would be
needed before being included in a final rule.
    One commenter felt that the HIPAA rules and HITECH adequately
address the Belmont Report principles with respect to these exclusions
from the Common Rule, but felt the exclusion should not be limited to
covered entities. The commenter suggested that the exclusion be
extended to noncovered entities that receive PHI and are required to
apply HIPAA safeguards in addition to institutions with equivalent
protections. Others suggested that the HIPAA and HITECH standards are
too protective for much research.
    Other commenters felt that this set of exclusions violates the
protective mandate because HIPAA's provisions are narrow and do not
reflect research ethics concerns. They noted that HITECH addresses
technical data security for covered PHI for health care use but not for
research use, especially if the data are sent elsewhere. Commenters
felt that data used for research should be subject to HITECH data
security standards and should not be excluded from Common Rule
coverage.
    Few commented on whether additional collections (i.e., collections
beyond what would ordinarily be collected through routine medical care)
should be covered by this exclusion, and those that did suggested that
they should be subject to the Common Rule unless those additional
collections are covered by another exemption and exclusion.
    The NPRM asked whether additional or fewer activities regulated
under the HIPAA Privacy Rule should be included in this exclusion. One
commenter expressed concern that the HIPAA Privacy Rule was not
appropriate because it both underregulates and overregulates research.
Another commenter felt that the exclusion creates confusion because HHS
has, in other contexts, discussed the differences between the Common
Rule and HIPAA and the differing needs in separate contexts.
(3) Public Comments on Research Conducted by a Government Agency Using
Government-Generated or Government-Collected Data Obtained for
Nonresearch Activities
    Approximately 20 comments discussed this proposed exclusion. Public
comment was mixed, with several commenters suggesting that they did not
understand the full scope of the information generated or collected by
the government that would fall under this exclusion. A minority of
comments indicated that this category of activities should be exempt
rather than excluded.
    The NPRM also asked whether this or a separate exclusion should
also include research involving information collected for nonresearch
purposes by nonfederal entities where comparable privacy safeguards
have been established by state law or regulation. Few responded to this
question. Of these, several indicated that this exclusion should not be
expanded to cover nonresearch data, and should not be expanded to cover
activities conducted by nongovernmental investigators using government-
generated or -collected data. Several comments indicated that this
category was acceptable as an exclusion, with a few commenters
suggesting that the category could be further broadened.
    One commenter suggested that this provision should apply to
nonfederal entities if state laws are as protective as the federal laws
cited. This commenter indicated that for these types of activities, the
Common Rule protections did not provide meaningful additional
protections to subjects. In contrast, several other commenters
expressed concern that the privacy safeguards identified in this
exclusion were not as protective of subjects as the Common Rule. One
commenter indicated that clarifying what constitutes appropriate
nonfederal use of this exclusion would be needed.
    One commenter suggested that this exclusion might be reasonable as
an exclusion if there were a public posting requirement for activities
conducted under this exclusion. If this were the case, this commenter
indicated that investigator self-determination of whether an activity
fit under this exclusion would be reasonable.
    In response generally to the question of whether any of the
exclusions should apply to activities involving prisoners, a small
number of comments addressed this question in the context of this
exclusion. Of these responses, comments were mixed.
ii. Response to Public Comments and Explanation of the Final Rule:
Exemption for Secondary Research for Which Consent Is Not Required
    This exemption at Sec.  __.104(d)(4) is for secondary research uses
of identifiable private information or identifiable biospecimens when
consent is not required, if at least one of the following criteria is
met:
     The identifiable private information or identifiable
biospecimens are publicly available;
     Information, which may include information about the
biospecimens, is recorded by the investigator in such a manner that the
identity of human subjects cannot readily be ascertained directly or
through identifiers linked to the subjects, the investigator does not
contact the subjects, and the investigator will not re-identify
subjects;
     The research involves only information collection and
analysis involving the investigator's use of identifiable health
information when that use is regulated under 45 CFR parts 160 and 164,
subparts A and E, for the purposes of ``health care operations'' or
``research'' as those terms are defined at 45 CFR 164.501 or for
``public health activities and purposes'' as described under 45 CFR
164.512(b); or
     The research is conducted by, or on behalf of, a federal
department or agency using government-generated or government-collected
information obtained for nonresearch activities, if the research
generates identifiable private information that is or will be
maintained on information technology that is subject to and in
compliance with section 208(b) of the E-Government Act of 2002, 44
U.S.C. 3501 note, if all of the identifiable private information
collected, used, or generated as part of the activity will be
maintained in systems of records subject to the Privacy Act of 1974, 5
U.S.C. 552a, and, if applicable, the information used in the research
was collected subject to the Paperwork Reduction Act of 1995, 44 U.S.C.
3501 et seq.

    The criteria for this exemption were proposed in the NPRM as three
exclusions. The final rule modifies the NPRM proposal to allow this
exemption to apply to secondary research involving identifiable
biospecimens, provided that the exemption's conditions are met. Note
that because the NPRM proposal to alter the definition of a human
subject to extend to research involving nonidentified biospecimens was
not adopted, an exemption for research with such biospecimens is not
needed. Accordingly, this exemption is only

relevant to secondary research use of identifiable biospecimens.
    The goal of the exemption at Sec.  __.104(d)(4) is to facilitate
secondary research using identifiable private information or
identifiable biospecimens that have been or will be collected or
generated for nonresearch purposes or from research studies other than
the proposed research study. Unlike two other new exemptions that also
relate to secondary research (the ones at Sec.  __.104(d)(7) and Sec.
__.104(d)(8), discussed below), this exemption does not depend on any
consent requirements imposed by the Common Rule being met.
    The first two provisions of this exemption (Sec.  __.104(d)(4)(i)
and (ii)) are a modified version of the fourth exemption under the pre-
2018 rule. The modified provisions allow the exemption to include
research with information and biospecimens that do not yet exist when
the research study is proposed for exemption (i.e., that could be
collected, for purposes not related to the proposed research study, in
the future).
    The third and fourth provisions of the exemption have no precursors
in the pre-2018 rule. The third provision applies the exemption to
secondary research using identifiable private information covered under
HIPAA, and the fourth provision applies the exemption to secondary
research using identifiable private information collected for
nonresearch purposes by the Federal Government, if compliant with the
three cited federal statutes. These new rules will allow investigators
to see identifiable private information, and also allow them to retain
and record that information (including the identifiers) as part of
their research records.
    We also note that, according to new language at Sec.  __.104(b)(2)
adopted as part of this final rule, this exemption permits the
secondary research use of identifiable private information or
identifiable biospecimens obtained from subjects who are prisoners, if
the research is not designed in a way that seeks to recruit prisoners
as a population but rather only incidentally (i.e., not intentionally)
includes prisoners.
(1) Response to Public Comments and Explanation of the Final Rule:
Research Involving the Collection or Study of Identifiable Private
Information or Identifiable Biospecimens That Are Publicly Available
    The exemption criterion at Sec.  __.104(d)(4)(i) is for secondary
research if the identifiable private information or identifiable
biospecimens are publicly available. This would apply to secondary
research use of archives in a public library, for example, or to
government or other institutional records where public access is
provided on request, or from a commercial entity if the information is
provided to members of the public on request or if the only requirement
for obtaining the information is paying a user fee, registering or
signing in as a visitor to an archive. It would also apply if a
commercial entity made identifiable biospecimens publicly available to
anyone on request or for a fee. This exemption effectively acknowledges
that for secondary research with publicly available information or
biospecimens, IRB review would not reduce the risk.
(2) Response to Public Comments and Explanation of the Final Rule:
Research Involving the Collection or Study of Information (Which May
Include Information About Biospecimens) That Has Been or Will Be
Collected and Is Recorded Without Identifiers
    The provision at Sec.  __.104(d)(4)(ii) exempts research involving
identifiable private information, which may include information about
biospecimens, if information is recorded by the investigator in such a
manner that the identity of human subjects cannot readily be
ascertained directly or through identifiers linked to the subjects, the
investigator does not contact the subjects, and the investigator will
not re-identify subjects. As with the provision at Sec.
__.104(d)(4)(i), this provision is related to an exemption that existed
in the pre-2018 rule. In this instance, that prior exemption is being
extended to now also cover research with information for which
identifiers have been removed when the original collection of
information or biospecimens occurs in the future.
(3) Response to Public Comments and Explanation of the Final Rule: The
HIPAA Exclusion
    The provision at Sec.  __.104(d)(4)(iii) permits the secondary
research use of identifiable private information or identifiable
biospecimens when the research involves only information collection and
analysis involving the investigator's use of identifiable health
information when that use is regulated under 45 CFR parts 160 and 164
(the HIPAA Privacy Rule), subparts A and E, for the purposes of
``health care operations'' or ``research'' as those terms are defined
at 45 CFR 164.501, or for ``public health activities'' as described
under 45 CFR 164.512(b).
    With regard to the criterion at Sec.  __.104(d)(4)(iii), HIPAA also
provides protections in the research context for the information that
would be subject to this exemption (e.g., clinical records), such that
additional Common Rule requirements for consent should be unnecessary
in those contexts. Under HIPAA, these protections include, where
appropriate, requirements to obtain the individual's authorization for
future, secondary research uses of protected health information, or
waiver of that authorization by an IRB or HIPAA Privacy Board. This
provision introduces a clearer distinction between when the Common Rule
and the HIPAA Privacy Rule apply to research in order to avoid
duplication of regulatory burden. We believe that the HIPAA protections
are adequate for this type of research, and that it is unduly
burdensome and confusing to require applying the protections of both
HIPAA and an additional set of protections.
    This provision was not part of the pre-2018 rule, and was proposed
as an exclusion in the NPRM. It is included as a component of an
exemption in the final rule, consistent with public comments supporting
the proposal.
(4) Response to Public Comments and Explanation of the Final Rule:
Research Conducted by a Government Agency Using Government Generated or
Government Collected Data Obtained for Nonresearch Activities
    The provision at Sec.  __.104(d)(4)(iv) did not exist in the pre-
2018 rule and was proposed as an exclusion in the NPRM. It appears as a
component of an exemption in the final rule. The exemption permits the
use of identifiable private information or identifiable biospecimens
for secondary research conducted by, or on behalf of, a federal
department or agency using government-generated or government-collected
information obtained for nonresearch activities, if the information
originally involved a collection that adheres to the federal standards
for safeguarding privacy as described in this part of the exemption.
    We believe that the privacy protections are adequate for this type
of research, and that it is unduly burdensome and confusing to require
these protections and an additional set of protections. This provision
has been modified to apply the federal statutory privacy safeguards
identified in the exemption provision to both the original collection
of the information, and to the secondary research use of the
information to which the exemption applies.

e. Research and Demonstration Projects Conducted or Supported by a
Federal Department or Agency (Sec.  __.104(d)(5))
i. Public Comments
    Approximately 35 comments discussed the changes proposed in the
public benefit or service program exemption. Few of the comments
discussed the proposed expansion in OHRP's interpretation of this
exemption to include the applicability of the exemption to cover
research on public benefit and service programs that an agency does not
itself administer through its own employees or agents, with a majority
supporting the NPRM proposed expansion. One research university
indicated that OHRP should not expand its interpretation of this
exemption, and that it should be limited to ``federally funded studies
evaluating federal programs.'' This institution did not offer
justification for its comment.
    Few comments were received about the proposed requirement for
exemption designation of research or demonstration projects to be
posted to a publicly available federal Web site. The comments
discussing this proposed requirement supported it.
    The majority of comments indicated that no additional requirements
or limitations should be imposed on this exemption. These institutions
argued that because this exemption represented a mechanism through
which the Federal Government evaluated its own programs, additional
limitations and restrictions in the Common Rule did not seem
appropriate.
    Specifically, with respect to whether or not some sort of notice
should be required here, several commenters noted that any notice would
need to be meaningful. One commenter indicated that because meaningful
notice would be difficult, a notice requirement should not be imposed.
One comment suggested that notice should only be required if opt-out
would be permitted, and if not, no notice requirement should be
imposed. Groups representing AI/AN populations supported the notice
requirement and indicated that it should be required at a minimum.
ii. Response to Comments and Explanation of the Final Rule: Exemption
for Certain Research and Demonstration Projects Conducted or Supported
by a Federal Department or Agency
    The final rule includes this exemption as a modified version of an
exemption proposed in the NPRM. The exemption at Sec.  __.104(d)(5) in
the final rule applies to research and demonstration projects involving
public benefit or service programs, and is a slightly revised version
of the exemption in the pre-2018 rule. This revision is designed to
clarify the scope of the exemption so that more research studies would
be eligible, and to make the exemption easier to apply. It is also
designed to allow the Federal Government to carry out important
evaluations of its public benefit and service programs to ensure that
those programs are cost effective and provide the intended benefits or
services, consistent with the principle of beneficence. The wording of
the exemption has added ``improve'' to the purposes of these
activities, to make more explicit the idea that the Federal Government
conducts these activities in order to enable them to make the public
benefit and service programs better, and not just to gauge their
current quality.
    This exemption is for research and demonstration projects that are
conducted or supported by a federal department or agency, or otherwise
subject to the approval of department or agency heads. It applies to
activities that are designed to study, evaluate, improve, or otherwise
examine public benefit or service programs, including, but not limited
to: Procedures for obtaining benefits or services under those programs;
possible changes in or alternatives to those programs or procedures; or
possible changes in methods or levels of payment for benefits or
services under those programs.
    In addition, the final rule clarifies the language of the exemption
to conform to OHRP's previous interpretation of public benefit and
service programs that are being evaluated as part of the research. This
interpretation includes public benefit or service programs that a
Common Rule department or agency does not itself administer or conduct
through its own employees or agents, but rather supports through a
grant or contract program. Therefore, the exemption applies to research
and demonstration projects supported through, for example, federal
grants or cooperative agreements. These changes would bring the
regulatory language into conformance with other provisions of the rule
that refer to research ``conducted or supported'' by federal
departments and agencies. These methods of administration are, of
course, always subject to department or agency head approval, either
directly or by delegation. In addition, some of these research and
demonstration projects are conducted through waivers, interagency
agreements, or other methods that also require agency head approval.
Accordingly, both the previous and revised language allow for the full
panoply of methods by which research and demonstration projects on
public benefit or service programs can be carried out.
    The wording of the exemption also is clarified to specifically
include projects involving waivers of otherwise mandatory requirements
using authorities such as sections 1115 and 1115A of the Social
Security Act, in order to make it plain that such research projects on
public benefit or service programs qualify for the exemption. The
relevant sections of the Social Security Act were also cited when this
exemption was published in 1983.
    In the interest of transparency, as was proposed in the NPRM, the
final rule requires that each federal department or agency conducting
or supporting the research and demonstration projects must establish,
on a publicly accessible federal Web site or in such other manner as
the department or agency head may determine, a list of the research and
demonstration projects the federal department or agency conducts or
supports under this provision. The research or demonstration project
must be published on this list before beginning the research involving
human subjects. The department or agency head can determine what sort
of information will be included on this list and maintains its
oversight. Departments and agencies that already publish research and
demonstration projects on a publicly accessible Web site could satisfy
this proposed requirement if the existing Web site includes a statement
indicating which of the studies were determined to meet this exemption.
    The goal of this proposed requirement is to promote transparency of
federally conducted or supported activities affecting the public that
are not subject to oversight under the Common Rule. It should not cause
any delay to the research. HHS will develop a resource that all Common
Rule departments and agencies may use to satisfy the requirement at
Sec.  __.104(d)(5)(i). Alternatively, an agency can create or modify
its own Web site for this purpose.
    The exemption is not modified to require notice, to apply only to
minimal risk research activities, or to require the privacy safeguards,
for reasons reflected in the public comments. We agree with the public
comments that argued that in many cases notice would be difficult or
impossible to achieve effectively, and that this exemption enables the
Federal Government to conduct important evaluations of its own programs
that provide significant benefits to the public. In addition, federal
departments

and agencies are already subject to other laws and policies that
protect the interests of research subjects (e.g., the Privacy Act).
f. Taste and Food Quality Evaluation and Consumer Acceptance Studies
(Sec.  __.104(d)(6))
i. Public Comments
    Approximately 20 comments discussed this exemption for taste and
food quality evaluation and consumer acceptance studies. The NPRM did
not propose changes to this exemption from what appeared in the pre-
2018 rule. However, it did ask whether this exemption should be
narrowed to apply only to activities for which prospective subjects
have been given prior notice, and if so, how that notice should be
issued. The NPRM further asked whether subjects should be allowed to
opt out of exempt research.
    A majority of comments received indicated that the final rule
should maintain this exemption without any additional requirements.
Commenters generally did not include explanation of this position. A
small minority of commenters indicated that subjects should explicitly
be provided the opportunity to opt out of this type of activity. In
addition, a small minority of commenters indicated that subjects should
be given notice before participation. One comment suggested that this
exemption include ``odor'' evaluations as well.
ii. Response to Comments and Explanation of the Final Rule: Exemption
for Taste and Food Quality Evaluation and Consumer Acceptance Studies
    The final rule retains the exemption from the pre-2018 rule, which
was proposed in the NPRM without any change, for taste and food quality
evaluation and consumer acceptance studies. This exemption applies if
wholesome foods without additives are consumed, or if a food is
consumed that contains a food ingredient at or below the level and for
a use found to be safe, or agricultural, chemical or environmental
contaminant at or below the level found to be safe by FDA or approved
by the Environmental Protection Agency or the Food Safety and
Inspection Service of the U.S. Department of Agriculture. This
exemption is retained unchanged from the pre-2018 rule.
g. Secondary Research Use of Identifiable Private Information or
Identifiable Biospecimens (or Storage or Maintenance for Such Secondary
Research Use) for Which Broad Consent Is Required (Sec.  __.104(d)(7)
and (8))
    The final rule includes two exemptions related to the secondary
research use (including storage or maintenance for such use) of
identifiable private information and identifiable biospecimens that
require a subject's broad consent.
    The first of these exemptions is in the final rule at Sec.
__.104(d)(7), and applies to storing and maintaining identifiable
private information or identifiable biospecimens for secondary research
use.
    The second of these exemptions is in the final rule at Sec.
__.104(d)(8) and applies to the secondary research use of identifiable
private information and identifiable biospecimens for specific
secondary research studies. Secondary research under this exemption
would generally be conducted with the information or biospecimens
stored and maintained under the exemption at Sec.  __.104(d)(7).
    Both of these exemptions for the secondary use of identifiable
private information and identifiable biospecimens require broad consent
and are discussed in detail below. As with the secondary use exemptions
that do not require the subject's broad consent (discussed above in
Section V.3.d. of the preamble), the two exemptions at Sec.
__.104(d)(7) and (8) are also limited to ``secondary research.'' These
exemptions pertain only to research that involves re-using information
or biospecimens that were or will be collected for some other
``primary'' or ``initial'' activity distinct from using them in
secondary research. These exemptions do not cover any primary
collections of either information or biospecimens. In other words, if
an investigator wants to collect information directly from research
subjects, for example, by asking them to complete a questionnaire, that
would not be covered by these exemptions. Or if an investigator wants
to collect biospecimens by having subjects swab their cheeks, that
collection would similarly not be covered by these exemptions. On the
other hand, an investigator who wants to use information that is in
some databank, or to use biospecimens that are in a pathology
laboratory, could use these exemptions, assuming all of the relevant
conditions of the exemptions were met.
i. Public Comments on the Proposed Exemptions for Secondary Research
Use of Identifiable Private Information or Identifiable Biospecimens
(or Storage or Maintenance for Such Secondary Research Use) for Which
Broad Consent Is Required
    In combination, approximately 150 comments discussed these
proposals. Although commenters generally supported creating a pathway
for low-risk research with biospecimens to occur without IRB review, a
majority opposed the overarching proposal that these exemptions would,
for the most part, be the only way (besides study-specific consent) for
research with biospecimens to occur. Many of the arguments for and
against these exemptions were outlined in section III.D, summarizing
public comments received on the proposal to define ``human subject'' as
including all biospecimens used in research, regardless of
identifiability.
    Many commenters opposed the idea that the exemption should allow
specific secondary studies involving biospecimens retained with
identifiers to occur without IRB review. These commenters noted that
IRBs are required to assess more than privacy and confidentiality
protections, and whether informed consent was sought and obtained.
Other commenters noted that by effectively encouraging the retention of
identifiers with biospecimens (which would likely be required to track
which specimens could be used in research at an institution), the NPRM
proposals effectively introduced new privacy and confidentiality risks
to subjects that did not exist under the pre-2018 rule.
    Some commenters who supported the expanded definition of human
subject to include all biospecimens did not support these exemptions.
These comments were mostly from members of the public and they
generally argued that study-specific consent should be sought and
obtained from subjects for every study involving that person's
biospecimens. These comments expressed concern that, with broad
consent, investigators could still engage in research activities
without the individuals' knowledge.
    Several commenters expressed opposition to the NPRM proposal that
the exemption could not be used if the investigator intended to return
research results to subjects. These commenters saw this as a
disincentive to return research results and also noted that it seemed
at odds with existing law (e.g., HIPAA) and policy. Specifically, they
argued, because patients are entitled

under HIPAA to the contents of their medical records, investigators
must always be ready to return research results to subjects enrolled in
their studies.
    The NPRM inquired about whether the proposed exemption was the best
option, or whether there is a better way to balance respect for persons
with facilitating research. Responses to this question were mixed, with
a majority indicating that the proposed exemptions were not the best
option. One comment indicated that broad consent would be reasonable if
the consent was meaningful.
    Other commenters opposed the proposal as written. One felt it
provided too little information and another found the language too
complex and subject to misinterpretation. One institution asserted that
the exemption would pose a burden on the research enterprise, would
make a significant subset of studies impracticable, and would increase
costs.
    Still other commenters indicated that consent should not be
required for secondary research with biospecimens, noting that it was
contradictory to determine that a type of research was exempt but still
require consent, or that this exemption should not apply to state-
mandated newborn DBS programs. One commenter suggested, ``A far better
option would be to include an exemption for the secondary research use
of de-identified or nonidentified biospecimens, without the caveat of
requiring a broad consent.''
    The NPRM requested public comment on whether and how the provision
regarding the return of research results should be revised. Public
comment was mixed in response to this question. Several comments
indicated that the provision was too complex to follow.
    Comments that supported the provision about the return of research
results in the proposed exemption stressed the complexity of decisions
around returning results and many indicated support for required IRB
review of investigators' plans for returning research results. One
professional organization also emphasized the need to communicate to
potential participants during the informed consent process the policies
concerning the return of individual research results. Many commenters
also called for detailed OHRP guidance on this provision.
    One commenter suggested that the broad consent required when
biospecimens are collected for storage for future research use include
an indication as to whether potential subjects would like to be re-
contacted with individual research results if applicable.
    Other commenters were opposed to the provision as written. One
large health system indicated that the provision discourages
researchers from returning research results to participants and from
providing participants with easy access to their individual research
data. The commenter emphasized that ``Respecting research participants
as partners obligates us to avoid the assumptions that researchers, an
IRB, or even a panel of experts . . . know best.'' The commenter went
on to say: ``While the NPRM suggests researchers cannot use the Common
Rule as a shield from a request to deliver a designated record set upon
request, the policy seems to discourage equitable research practices
and allows informational disparities to continue. This does not serve
the interest of justice.''
    In addition, one professional organization indicated concern that
the provision might be interpreted by some to say that IRBs should not
allow return of results, which it felt would create a bad situation.
    The NPRM sought comment on whether there should be an additional
exemption that would permit the collection of biospecimens through
minimally invasive procedures (e.g., cheek swab, saliva). A strong
majority of commenters indicated no need for an additional exemption to
permit the collection of biospecimens through minimally invasive
procedures. One professional organization asserted that specimens
should not be treated differently based on how they were collected.
Other commenters indicated that obtaining specimens through minimally
invasive procedures is similar to data collection and should be treated
the same way.
ii. Explanation of the Final Rule: Exemptions for Secondary Research
Use of Identifiable Private Information or Identifiable Biospecimens
(or Storage or Maintenance for Such Secondary Research Use) for Which
Broad Consent Is Required
(1) Exemption for the Storage or Maintenance for Secondary Use of
Identifiable Private Information or Identifiable Biospecimens for Which
Broad Consent is Required (Sec.  __.104(d)(7))
    Section __.104(d)(7) is an exemption for the storage or maintenance
for secondary research use of identifiable private information or
identifiable biospecimens. It requires that an IRB conduct limited IRB
review to make the following determinations (required by Sec.
__.111(a)(8)):
     Broad consent for storage, maintenance, and secondary
research use of identifiable private information or identifiable
biospecimens is obtained in accordance with the requirements of Sec.
__.116(a)(1)-(4), and (a)(6), and (d);
     Broad consent is appropriately documented or waiver of
documentation is appropriate, in accordance with Sec.  __.117; and
     If a change is made for research purposes in the way the
identifiable private information or identifiable biospecimens are
stored or maintained, adequate provisions must be in place to protect
the privacy of subjects and to maintain the confidentiality of data.

    This exemption is similar to the exemption proposed in the NPRM at
Sec.  __.104(f)(1), but it has been modified in some respects, and the
operation of this exemption is also affected by other changes in the
final rule that are different from the NPRM. Namely, the exemption has
been modified to apply only to storage or maintenance for secondary
research use of identifiable private information or identifiable
biospecimens, because the final rule does not incorporate the NPRM
proposal to alter the definition of a human subject to extend to
research involving biospecimens regardless of their identifiability.
This exemption was also modified given the decision not to adopt the
privacy safeguards proposed in the NPRM at Sec.  __.105.
    In addition, the Secretary's template for broad consent is not
being finalized for this exemption. Instead, institutions will have the
flexibility to create their own consent forms that satisfy requirements
at Sec.  __.116(a)(1)-(4), (a)(6) and (d) (see Section XIV). The
consent form may be electronic.
    Given these changes from the NPRM proposal, the limited IRB review
requirement for this exemption provided at Sec.  __.111(a)(8) has been
expanded in the final rule to require that the IRB make the following
determinations, some of which are similar to those proposed in the
NPRM.
    The final rule requires that for the exemption to apply, the IRB
must determine that broad consent for storage, maintenance, and
secondary research use of identifiable private information or
identifiable biospecimens is obtained in accordance with the
requirements of Sec.  __.116(a)(1)-(4), (a)(6), and (d); This includes
the requirement proposed in the NPRM that there be IRB review of the
process through which broad consent will be obtained.

    Also, given that we are not finalizing the proposed requirement to
use the Secretary's template for broad consent, the final rule includes
in this requirement that an IRB determine that the broad consent
includes the requirements and elements of consent in accordance with
Sec.  __.116(a)(1)-4), (a)(6), and (d).
    The final rule also requires that the IRB determine that broad
consent is appropriately documented or waived in accordance with Sec.
__.117. Although written broad consent generally will be required for
this exemption to apply, the final rule also permits the exemption to
apply when broad consent is obtained and an IRB has waived the
documentation requirement for written informed consent under Sec.
__.117(c)(1).
    And because the proposed privacy safeguards proposed in the NPRM at
Sec.  __.105 are not included in the final rule, if a change will be
made for research purposes in the way the identifiable private
information or identifiable biospecimens are stored or maintained, the
IRB must determine that when appropriate, adequate provisions are in
place to protect the privacy of subjects and to maintain the
confidentiality of data. This is the same IRB determination related to
privacy and confidentiality that is required for nonexempt research.
Importantly, this IRB determination is required only when a change is
made for research purposes in the way the identifiable private
information or identifiable biospecimens are stored or maintained, and
only pertains to the aspects of storage and maintenance that are
changed for research purposes. In this circumstance, the investigators
are assuming responsibility for the manner in which the information and
biospecimens are stored and maintained, and the IRB should be required
to ensure that appropriate protections for the subjects are place with
regard to the aspects of storage or maintenance that were changed for
research purposes.
    If, on the other hand, no changes are being made for research
purposes to the storage or maintenance, then this IRB determination
does not apply. The institution storing and maintaining the information
or biospecimens of course still has its responsibility to determine
what protections distinct from those required by the Common Rule are
appropriate, which may include other legal or regulatory safeguards or
institutional policies. In light of application of such additional
safeguards, it appears unnecessary to require additional protections
through a requirement of this final rule simply because the individuals
providing broad consent have agreed that their biospecimens or
information could be used for research at some point in the future. And
of course this provision regarding changes made for research purposes
applies only when a Common Rule department or agency supports or
conducts the research activity.
    Note that in many instances the only change that results from a
person having signed a broad consent form for research relating to
storing and maintaining that person's biospecimens or information is
that the institution that is already holding the biospecimens or
information (for clinical purposes, for example) merely creates a
record indicating that this person has signed such a consent form. The
biospecimens and information could remain stored in whatever way (and
for whatever period of time) that the institution had previously been
storing them, based on the legitimate nonresearch or research-related
reasons that the institution has used for initially collecting and
storing those biospecimens and information. Any privacy and security
protections (outside of the Common Rule) that already may apply to the
institution's information record-keeping or biospecimen preservation
activities would continue to apply. The Common Rule's protections would
not apply before a change in storage or maintenance occurs for research
purposes, but rather the institution would continue to operate in
accordance with its pre-existing legitimate reasons for having and
storing the biospecimens and information. The fact that the broad
consent form has been signed does not by itself mean that there needs
to be any alteration of what the institution is already doing with the
biospecimens or information.
    Examples of changed aspects of storage or maintenance for research
purposes that would require the IRB to find, before those changes go
into effect, whether there are adequate provisions to protect the
privacy of subjects and maintain the confidentiality of data include
the following: If information or biospecimens are moved from one
electronic or physical storage location to another due to
considerations related to research plans; if information or
biospecimens will be stored for longer than they otherwise would have
been for the original purpose; if information or biospecimens are
placed in a research registry or repository created to serve as a
resource for investigators; or investigators are given electronic or
physical access to the information or biospecimens. The relevant
changes do not necessarily involve moving information or biospecimens
from one location to another. Rather, the relevant changes include any
change for research purposes that introduces or alters risks to the
privacy or security of the stored information or biospecimens,
including giving access to or transferring information or biospecimens
for research purposes to someone who otherwise would not have access.
    The rationale for this exemption is that with the requirement for
limited IRB review and the specified required IRB determinations,
including subjects' broad consent, this exemption respects subjects'
autonomy and provides appropriate privacy safeguards. More
specifically, we believe that broad consent provides some measure of
autonomy for individuals to decide whether to allow the research use of
their identifiable private information or identifiable biospecimens,
without imposing the kind of burden on investigators that would result
from a requirement for specific informed consent for each secondary
research study. We believe that it is appropriate to create a mechanism
for broad consent for secondary research use, even if it involves the
potential risk of having identifiers associated with the identifiable
private information or identifiable biospecimens. We believe the
administrative burden is also acceptable in order to allow for broad
consent for secondary research use.
(2) Exemption for Research Involving the Use of Identifiable Private
Information or Identifable Biospecimens for Which Broad Consent is
Required (Sec.  __.104(d)(8))
    Section __.104(d)(8) is an exemption that also requires that broad
consent has been obtained, and is for research involving the use of
identifiable private information or identifiable biospecimens. This
exemption will frequently be paired with the exemption at Sec.
__.104(d)(7), which permits the storage and maintenance of identifiable
private information and identifiable biospecimens for secondary
research use. The exemption at Sec.  __.104(d)(8) would apply to a
specific secondary research study, provided that the following criteria
are met:
     Broad consent for the storage, maintenance, and secondary
research use of the identifiable private information or identifiable
biospecimens was obtained in accordance with Sec.  __.116(a)(1)-(4),
(a)(6), and (d);
     Documentation of informed consent or waiver of
documentation of consent

was obtained in accordance with Sec.  __.117;
     An IRB conducts a limited IRB review to make the
determination required by Sec.  __.111(a)(7), and to make the
determination that the research to be conducted is within the scope of
the broad consent; and
     The investigator does not include returning individual
research results to subjects as part of the study plan. However, it is
permissible under this exemption to return individual research results
when required by law regardless of whether or not such return is
described in the study plan.
    This exemption could also apply if the investigator obtains
appropriate broad consent from the subject in addition to the consent
to an original specific study, and then proceeds to use the information
or biospecimen in a secondary study.
    The exemption at Sec.  __.104(d)(8) is similar to the exemption
proposed in the NPRM, but it has been modified in some respects. As
with the exemption at Sec.  __.104(d)(7), the operation of the
exemption at Sec.  __.104(d)(8) is also affected by other provisions in
the final rule that are different from what was proposed in the NPRM.
Namely, the exemption has been modified to apply only to storage or
maintenance for secondary research use of identifiable private
information or identifiable biospecimens because the final rule does
not incorporate the NPRM proposal to alter the definition of a human
subject to extend to research involving biospecimens regardless of
their identifiability.
    Due to the decision not to adopt the proposed privacy and security
safeguards proposed in the NPRM at Sec.  __.105, this exemption was
also modified to require that limited IRB review include an IRB
determination that, when appropriate, adequate provisions are in place
to protect the privacy of subjects and the confidentiality of data
(Sec.  __.111(a)(7)). This is the same IRB approval criteria related to
privacy and confidentiality that is required for nonexempt human
subjects research.
    In addition, because the final rule does not include a broad
consent template when a specific study has been proposed, it is
required that the study be reviewed by an IRB to determine whether the
proposed secondary analysis fits within the parameters of the broad
consent that was obtained for secondary research use.
    We believe that the final rule's requirement for limited IRB review
of the privacy and confidentiality protections and the adequacy of the
broad consent is responsive to commenters who believe that IRB
oversight should be retained for the secondary research use of
identifiable private information and identifiable biospecimens.
    We recognize commenters' point that this exemption does not provide
an incentive to investigators to provide individual research results to
subjects, but we believe that the challenges of how and when to return
such results warrant consultation with the IRB. We note that with the
other revisions to the NPRM proposals, other options for research
involving identifiable private information and identifiable
biospecimens exist, which would be consistent with having plans for
returning individual results. Although broad consent may include a
statement that clinically relevant research results might be returned
to subjects, we believe that when specific secondary studies include
such a plan to return research results, it would almost always be
appropriate for the study to be reviewed by an IRB, in part to better
ensure that research results are disclosed to subjects in an
appropriate manner. The only exceptions would be if the research
qualified for another exemption, an IRB waived informed consent under
Sec.  __.116(e) or (f), or the research was carried out under a
Secretarial waiver at Sec.  __.101(i). We expect that as part of the
IRB's review, the IRB would consider what subjects were told in the
broad consent regarding the return of research results.
    It should be noted that the two exemptions in the final rule at
Sec.  __.104(d)(7) and (8) create additional options for investigators
to conduct secondary research studies with identifiable private
information. The final rule retains, largely unchanged, the options
previously available to investigators in the pre-2018 rule. For
instance, the final rule retains the pre-2018 criteria for requesting a
waiver of consent in order to carry out those studies without obtaining
consent. Moreover, secondary research using nonidentified biospecimens
would not have to meet these requirements, because the final rule does
not finalize the NPRM proposal to alter the definition of a human
subject to include research involving nonidentified biospecimens under
the rule.
h. NPRM Proposal To Delete the Pre-2018 Rule's Exemption for Surveys
and Interviews of Public Officials
    The NPRM proposed to delete language found in the pre-2018 rule
that exempted surveys and interviews with public officials.
Approximately 100 comments discussed this proposed deletion and it was
almost universally opposed. Political science professors, students,
researchers, and academics from other disciplines generally addressed
this deletion.
    Comments argued that this deletion would have a chilling effect on
political science research and might make political science researchers
more vulnerable to law suits. Other comments noted that public
officials are generally treated differently in numerous laws, and it is
in fact appropriate for the Common Rule to have a different standard
for surveys and interviews with public officials. Comments also
suggested that this deletion could negatively affect the public's
ability to hold public officials accountable for their actions. One
commenter suggested that instead of deleting this exemption, a final
rule might consider explicitly limiting this exemption to studies that
relate to the public officials in their official capacity.
    The final rule removes the exemption category in the pre-2018 rule
at Sec.  __.101(b)(3)(i), which pertained to research involving the use
of educational tests, survey procedures, interview procedures, or
observation of public behavior, if the human subjects are elected or
appointed public officials or candidates for public office, or if
federal statute requires without exception that the confidentiality of
the personally identifiable information will be maintained throughout
the research and thereafter. We note that many of the public comment
concerns are addressed by other provisions in the final rule. Almost
all of the research activities in this category would already be
exempted under the final rule at Sec.  __.104(d)(2), without needing to
single out elected or appointed officials as being treated differently
in this way. If the research is designed to provide sensitive
generalizable knowledge about officials, then the identifiable private
information obtained should be kept confidential as required by this
final rule. If the purpose of the activity is in fact designed to hold
specific elected or appointed officials up for public scrutiny, and not
keep the information confidential, such an activity is not considered
research under the provision at Sec.  __.102(l)(2).
    Thus, the final rule adopts the NPRM proposal.
i. NPRM Proposal To Exempt Secondary Research Use of Identifiable
Private Information Where Notice Was Given
    One exemption proposed in the NPRM is not included in the final
rule. Note that exclusions proposed in the

NPRM and not included in the final rule also are described in Section
III.I.4 of this preamble.
    The NPRM proposed to exempt certain secondary research activities
involving identifiable private information where notice of such use had
been given. The proposed exemption was included, in part, to be
responsive to section 511 of the Medicare Access and CHIP
Reauthorization Act of 2015 (MACRA), which requires the Secretary to
issue a clarification or modification with respect to the application
of these regulations to certain activities involving clinical data
registries. The preamble for the Common Rule NPRM noted ``. . . this
exemption category might allow certain research activities of these
clinical data registries not otherwise covered by the proposed HIPAA-
related exclusion (i.e., when the clinical data registries are not part
of a HIPAA covered entity or acting as a business associate), such as
when a clinical data registry may receive information from a health
care entity for research purposes.''
    Approximately 70 comments discussed this proposal, with the vast
majority from institutions. A minority of commenters (14) supported the
NPRM proposal as drafted. In addition, 11 commenters who did not
indicate whether they supported the inclusion of this proposal in a
final rule asked questions about implementation and the meaning of
``notice'' under this proposal.
    A majority of commenters (41) opposed the proposal as drafted in
the NPRM, citing a variety of conflicting reasons:
     Sixteen commenters felt that the NPRM proposal was too