permissive as drafted, and that it would not provide adequate
protections to prospective subjects. Many of these commenters also
suggested that the proposal as drafted did not respect subject autonomy
interests sufficiently in not providing subjects with an ability to opt
out. They indicated that the exemption might be acceptable if
additional requirements (such as subject opt out), or additional
limitations (such as limiting the nonresearch information to which this
exemption applies to data governed by certain privacy-oriented laws)
were implemented.
     Fourteen commenters felt that the NPRM proposal was too
restrictive, and that as drafted it would not achieve the stated goal
of reducing administrative burden on IRBs. These commenters
specifically discussed the implementation burdens involved in providing
notice to prospective subjects. These commenters also noted that
providing an option to opt out would be very burdensome to IRBs and
investigators, an outcome that seemed counter to the justifications the
NPRM provided for this exemption.
     Five commenters felt that the type of research encompassed
by this proposal should not be exempted from the Common Rule, and that
IRB review or informed consent should be required instead.
    Approximately 25 comments discussed whether the NPRM proposal was
necessary to enable activities involving qualified clinical data
registries. A majority of these comments indicated that because the
activities would be subject to the HIPAA regulations, protection of
subjects would not be enhanced by the proposed NPRM exemption. Several
commenters pointed out that qualified clinical data registries also
might qualify for exclusion under the NPRM proposal at 101(b)(2)(ii).
Additional comments suggested that other NPRM exemptions and exclusions
would cover activities with qualified clinical data registries without
commenting on which exemptions and exclusions applied.
    The NPRM included the exemption at Sec.  __.104(e)(2), in part, to
be responsive to section 511 of MACRA, but commenters expressed little
support for this exemption, even for activities carried out by clinical
data registries. Section 511 of MACRA has directed the Secretary of HHS
to issue a clarification or modification with respect to the
application of the Common Rule to activities involving clinical data
registries, including quality improvement activities. With this final
rule, the Secretary of HHS is providing that clarification here.
Because clinical data registries are created for a variety of purposes,
and are designed and used in different ways, there is no simple, single
answer regarding how the Common Rule applies to clinical data
registries. The Secretary of HHS has received advice from SACHRP on
this topic, and SACHRP recommended that the pre-2018 rule was adequate
to apply to clinical data registries without those registries being
given any distinctive status. The Secretary of HHS believes that the
same is true for the final rule, and so has not created a specific
provision for clinical data registries.
    The final rule does not impose any requirements on a large portion
of the activities related to clinical data registries. The following
points are important: First, the rule does not apply to clinical data
registry activities not conducted or supported by a Common Rule
department or agency. Second, many clinical data registry activities,
including many quality improvement activities, do not meet the
definition of research, and so the Common Rule does not apply. For
example, the creation of a clinical data registry designed to provide
information about the performance quality of institutional care
providers, and whose design is not influenced or altered to facilitate
research, is not covered by this rule even if it is known that the
registry will be used for research studies. Third, the Common Rule does
not apply to a clinical data registry research study that only involves
obtaining and analyzing nonidentified information because that activity
would not involve a ``human subject'' as defined by the rule. Fourth,
some clinical data registry research activities may qualify for
exemption under the proposed provision at Sec.  __.104(d). Fifth, if an
institution solely releases identifiable private information that was
obtained in the course of patient clinical care to a clinical data
registry for research, that institution is considered to be not engaged
in human subjects research, and no requirements of the rule apply to
that institution.
    In contrast, if investigators receive funding from a Common Rule
department or agency to design a clinical data registry for research
purposes and the registry includes identifiable private information, or
involves interacting with individuals (e.g., a research survey), then
such an activity involves human subjects research, but may be exempt if
it meets one or more of the exemption categories under Sec.
__.104(d)(7). Similarly, if investigators use federal support to obtain
identifiable private information from a clinical data registry to
conduct a research study, then such secondary research use of clinical
registry information would involve human subjects research and the
requirements of the rule would apply, although the research may qualify
for exemption under Sec.  __.104(d)(8). This is comparable to how the
rule applies to a research study that involves chart review of
identifiable private information drawn directly from hospital medical
records.

VI. Protection of Identifiable Private Information and Identifiable
Biospecimens

A. Background and Pre-2018 Requirements

    Increasing research use of genetic information, information
obtained from analysis of biospecimens, and the ability to more easily
merge multiple sources of

administrative and survey datasets (e.g., medical records, claims data,
vital records, and information about lifestyle behaviors from surveys)
are some examples of how advances in research have increased the risks
of data breaches that reveal identifiable private information. For
example, the unauthorized release or use of information about subjects
such as the disclosure of Social Security or Medicare numbers may pose
financial risks, and disclosure of illegal behavior, substance abuse,
or chronic illness might jeopardize subjects' current or future
employment, or cause emotional or social harm.
    Based on questions from and conversations with members of the
regulated community, we are aware that IRBs are not always equipped
with the expertise needed to evaluate risks to privacy and
confidentiality, specifically regarding sophisticated IT security.
However, we note that no data suggest that IRBs are currently approving
research without requiring appropriate privacy and confidentiality
safeguards. Despite this, we recognized that setting standards could
assure appropriate privacy and confidentiality consideration and
consequent protections to all research subjects, without the
administrative burden of needing a specific committee review of the
privacy and confidentiality protections of each study. To that end, the
2011 ANPRM suggested establishing mandatory data security and
information protection standards for all studies that involve the
collection, generation, storage, or use of identifiable or potentially
identifiable information that might exist electronically or in paper
form or be contained in a biospecimen. It put forward the idea that
these standards might adopt the categories used in the HIPAA Rules and
asked a series of questions about how best to protect private
information.

B. NPRM Proposal

    A goal of the NPRM was to ensure that researchers protect the
privacy of their participants and the security of the data, calibrated
to the likelihood of identifiability and sensitivity of the information
being collected. The NPRM proposed to require that investigators and
institutions conducting research subject to the Common Rule implement
reasonable safeguards for protecting against risks to the security or
integrity of biospecimens or identifiable private information. Given
the significant concerns of public commenters about an idea discussed
in the 2011 ANPRM of adopting the standards solely modeled on certain
standards of the HIPAA Rules, the NPRM proposed several sets of
standards, and allowed a choice about which set to use.
    First, the NPRM proposed that the Secretary of HHS could publish a
list of specific measures that an institution or investigator could use
to meet the security requirements. The list would be evaluated and
amended, as appropriate, after consultation with other Common Rule
departments and agencies. The proposed list would be published in the
Federal Register, and public comment on the proposed list would be
sought before the list was finalized.
    The specific safeguards that would be identified by the Secretary
would be designed so that they could be readily implemented by the
individual investigator, and could build on existing safeguards already
in place to protect research data. These standards would include
security safeguards to assure that access to physical biospecimens or
data is limited only to those who need access for research purposes.
The standards would also assure that access to electronic information
is authorized only for appropriate use. Finally, the safeguards,
collectively referred to as ``privacy safeguards,'' would assure that
information and biospecimens posing informational risks to subjects
would be protected according to appropriate standards.
    Second, the NPRM proposed that if an institution or investigator is
currently required to comply with the HIPAA rules, then the safeguards
required by the Common Rule would be satisfied. No additional
requirements were proposed to protect information subject to the HIPAA
Rules. The NPRM also proposed to clarify that the proposed provisions
would not amend or repeal the requirements of 45 CFR parts 160 and 164
for the institutions or investigators to which these regulations apply
pursuant to 45 CFR 160.102. Institutions or investigators that are not
required to follow HIPAA could voluntarily implement the HIPAA Rules
and be considered as satisfying the proposed requirements. The NPRM
also proposed that for federal departments and agencies that conduct
research activities that are or will be maintained on information
technology that is subject to and in compliance with section 208(b) of
the E-Government Act of 2002, 44 U.S.C. 3501 note, if all of the
information collected, used, or generated as part of the activity will
be maintained in systems of records subject to the Privacy Act of 1974,
5 U.S.C. 552a, and the research will involve a collection of
information subject to the Paperwork Reduction Act of 1995, 44 U.S.C.
3501 et seq., the requirements would be satisfied.
    For purposes of informing the development of the proposed privacy
safeguards, the NPRM sought comment on the types of safeguards that
would be appropriate for the Secretary's list. The NPRM also noted that
additional statutes or acts mandate the protection of privacy and
confidentiality of identifiable private information. It might be
reasonable to include these as additional standards that would meet the
proposed requirement if they were met in research that is subject to
those standards or for which an investigator or institution has
voluntarily elected to comply. Public comment was sought on whether any
of these existing statutes or acts would serve the goals of proposed
privacy safeguards.
    The NPRM also included conditions for use and disclosure of
research information to other entities. It required that protections be
in place when a biospecimen or identifiable private information is
shared for appropriate research or other purposes. Unless required by
law, the NPRM proposed to limit the re-disclosure of identifiable
private information or release of biospecimens obtained for research.
    The NPRM asked for feedback on whether limiting re-disclosure to
four specific circumstances unless such a disclosure was ``required by
law'' would be too restrictive, or whether more permissive standards
would better facilitate the NPRM goal of fostering the secondary
research use of information. The NPRM also whether the proposed
limitations on re-disclosure were more or less restrictive than
necessary and whether there should be additional purposes for which
release of biospecimens or re-disclosure of identifiable private
information would be permitted should be allowed.
    The NPRM justified this change by arguing that its benefit would be
that IRBs would not be required to review the individual plans for
safeguarding information and biospecimens for each research study.
Although the NPRM presumed that the proposed privacy safeguards would
be sufficient, an IRB could determine that a particular activity would
require more than what was proposed. Once IRBs became familiar with
standard institutional and investigator-adopted protections, the NPRM
anticipated that they would become more comfortable with the fact that
they need not review every protocol for privacy safeguards. In
addition, it was expected that if the proposed privacy safeguards were
adopted, overall reduction in regulatory burden would occur because
IRBs would not

have to review security provisions on a case-by-case basis.
    Finally, as discussed in Section V, the NPRM contained proposed
exemptions that would have permitted a larger number of protocols to
proceed without IRB review if specific conditions were met, conditioned
on investigators and institutions also meeting the proposed privacy and
security requirements. Note that there was no requirement for an IRB to
determine whether investigators were adhering to the privacy safeguards
for such exempt research.

C. Public Comments

    Approximately 130 comments addressed the privacy safeguards, with a
majority generally supporting the proposal. Both those who supported
the proposal and those who opposed it indicated that it was difficult
to comment on the adequacy of privacy standards that had yet to be
developed.
    Those who supported the proposal stated that having standardized,
minimum safeguards would create more consistency across IRBs in how
biospecimens and identifiable private information are protected. Those
who were opposed to the proposal stated that patient information is
already covered by HIPAA security standards and student records are
already covered by FERPA, arguing that these plus an array of other
standards cover financial and various other types of sensitive
information, making inclusion in the Common Rule redundant.
    However, several comments asserted that the HIPAA standards, while
appropriate for health information, would not be appropriate for other
types of research data. Others noted that the wide range and nature of
research makes it too challenging to develop a blanket standard. With
regard to applying the standards to exempt research, one large
association of research universities, medical centers, and independent
research institutes argued that research covered by the proposed exempt
or excluded categories should be low risk and therefore third party
evaluation of privacy safeguards was not needed. Several academic
research institutions urged that if the security and privacy
requirements were included in the final rule, then the measures should
be as simple as possible. For example, they suggested developing a
single set of standards for all identifiable data rather than
calibrating the safeguards to the sensitivity of the information to be
collected.
    A few comments addressed the proposed re-disclosure criteria. Of
these, a majority indicated concerns with the NPRM redisclosure
provision. Most of the opposition was specifically aimed at imposing
the sharing criteria for nonidentified biospecimens. These commenters
indicated that for sharing nonidentified biospecimens, imposing HIPAA-
like privacy safeguards was unnecessary and would be extremely
burdensome. Several comments suggested that the Common Rule adopt the
same permissible uses and disclosures of information without
authorization that exists under HIPAA.
    One scientific professional organization and more than 60
institutions endorsing its comments noted that specific redisclosure
considerations should exist for identifiable biospecimens, stating that
redisclosure of the identity of the source of a biospecimen is
appropriate in rare situations in which a confirmed research finding
may have a significant impact on the health of the donor of the
specimen. A large, private higher education institution noted that the
limitations on use, release, and disclosure as proposed seemed at odds
with the permissible uses and disclosures allowed under HIPAA.
    Others suggested that the language stating that biospecimens or
identifiable private information could be released for any lawful
purpose with the consent of the subject was too open-ended and
permissive. One data privacy and security advocacy group also noted
that the introductory language to the proposed safeguards could be read
as requiring an investigator to release research biospecimens or
disclose identifiable private information upon receipt of a valid
request, as opposed to simply permitting an institution to do so. One
academic research organization suggested an alternative approach--that
the Federal Government clarify that institutions and networks may
designate specialized privacy and security boards to review safeguards.

D. Response to Comments and Explanation of the Final Rule: Privacy and
Security Protections

    The final rule does not adopt the privacy and security protections
proposed in the NPRM, but rather retains and acknowledges the IRB's
role in ensuring that privacy safeguards are appropriate for the
research studies that require IRB review. To better ensure that
appropriate privacy protections are required by IRBs, the final rule
includes a new provision in the IRB review and approval criteria at
Sec.  __.111(a)(7)(i) that requires the Secretary of HHS in
consultation with OMB and the Common Rule departments and agencies to
issue guidance o assist IRBs in assessing what provisions are adequate
to protect the privacy of subjects and to maintain the confidentiality
of data. This requirement is discussed in more detail in Section XI.
    Although we continue to believe that appropriately protecting the
privacy of human subjects who provide identifiable private information
and identifiable biospecimens as well as preventing security breaches
is critically important, we agree with the public's concerns about
requiring adherence to privacy and security standards when the
safeguards to be issued by the Secretary of HHS have yet to be
developed. The federal privacy and security laws would apply only to
certain federally conducted research. Rather than promulgate a
regulation that lacked sufficient specificity, we determined it would
be preferable to maintain the requirement that IRBs review research
studies to ensure that appropriate privacy and security safeguards are
in place to protect research subjects, but include a commitment that
the Secretary of HHS will issue guidance to assist IRBs in
appropriately protecting subjects' privacy and confidentiality. This
guidance would take into consideration, among other things, the level
of identifiability and sensitivity of the information being collected.
Although IRBs were not specifically designed to evaluate risk to
privacy and confidentiality and the adequacy of safeguards to protect
against those risks, IRBs have been responsible for evaluating such
risks under the pre-2018 rule. We believe that guidance in this complex
and evolving area will assist IRBs to identify appropriate protections,
and may be better able than standardized protections, to address the
variety of privacy and confidentiality concerns that arise in the broad
range of research studies that are being carried out now and those that
will be conducted in the years to come.
    As discussed in Section V, certain NPRM exemption proposals
required the application of the NPRM's proposed safeguards in whole or
in part. To accommodate the fact that the final rule does not include
the privacy safeguards, exemption categories in the final rule that are
predicated on the need for some type of privacy safeguards will instead
require that an IRB conduct a limited review to ensure that adequate
provisions are in place to protect the privacy of subjects and to
maintain the confidentiality of data.
    The final rule exemptions subject to this limited IRB review
requirement are:
     The exemption for research that includes only interactions
involving

educational tests, survey procedures, interview procedures, or
observations of public behavior regardless of the identifiability or
sensitivity of the information collected/recorded (Sec.
__.104(d)(2)(iii));
     The exemption for research involving benign behavioral
interventions in conjunction with the collection of information from an
adult subject through verbal or written responses or video recording
(regardless of the identifiability or sensitivity of the information
collected/recorded (Sec.  __.104(d)(3)(i)(C));
     The exemption for the storage or maintenance of
identifiable private information or identifiable biospecimens for which
broad consent is required, when there is a change specific to the
research activity in how the identifiable private information or
identifiable biospecimens are stored and maintained (Sec.
__.104(d)(7)); and
     The exemption for the secondary research use of
identifiable private information or identified biospecimens for which
broad consent is required (Sec.  __.104(d)(8))

VII. IRB Membership and Modification to References to Vulnerability
(Sec. Sec.  __.107(a), __.111(a)(3), and __.111(b))

A. Background and Pre-2018 Requirements

    The pre-2018 rule stipulated a condition of IRB membership at Sec.
__.107(a) stating that IRBs should aim for membership that does not
consist entirely of individuals of one gender, race, or cultural
background. It referred again to the characteristics of IRB members at
Sec.  __.107(b), stating that efforts should be made to ensure that no
IRB consists entirely of members of one gender or one profession.
    The pre-2018 rule also referred to the concept of vulnerability and
consideration of vulnerable populations in three provisions, one of
which pertained to IRB membership (Sec.  __.107(a)), one with regard to
selection of subjects (Sec.  __.111(a)(3)), and one with regard to
additional protections needed for subjects vulnerable to coercion or
undue influence (at Sec.  __.111(b)). Under the pre-2018 rule, only
Sec.  __.111(b) of the three provisions specifically referred to
vulnerability to coercion or undue influence as the type of
vulnerability that should be considered. In addition, of these same
three provisions in the pre-2018 rule, only Sec.  __.107(a) identified
``handicapped'' individuals as a vulnerable category of subjects.

B. NPRM Proposal

    The NPRM proposed eliminating the pre-2018 rule stipulation that
IRBs should aim for membership that does not consist entirely of
individuals of one gender or profession because the requirement that
IRB membership reflect members of varying backgrounds and diversity,
including gender, accomplishes the same goal.
    Further, the NPRM proposed that the criterion at Sec.  __.111(a)(3)
be revised to align with the language of Sec.  __.111(b) to reflect
that the vulnerability of the populations in these research studies
should be considered to be a function of the possibility of coercion or
undue influence, and that this vulnerability alone should be the IRB
focus of concern with respect to this criterion. The proposed change
was intended to provide greater consistency and clarity in IRB
consideration of vulnerability of subject populations in research
activities and appropriate protections. A comparable change was also
proposed at Sec.  __.107(a), pertaining to IRB membership.
    In addition, the NPRM proposed that the term ``handicapped'' be
changed to ``physically disabled'' individuals. Therefore, to enhance
consistency and clarity among these three provisions, it was proposed
that the term ``physically disabled'' be inserted at Sec.  __.111(a)(3)
and (b). This would mean that physically disabled persons would be
among the individuals that the IRB may consider in determining that the
selection of subjects is equitable (Sec.  __.111(a)(3)), and that the
IRB may consider to be vulnerable to coercion or undue influence (Sec.
__.111(b)). Public comment was sought on whether pregnant women and
those with physical disabilities should be characterized as vulnerable
to coercion or undue influence. Whether or not these subpopulations are
considered vulnerable to coercion or undue influence would not affect
the applicability of subpart B.
    Finally, the NPRM proposed a change in Sec.  __.107(a), involving
the insertion of ``economically or educationally disadvantaged
persons'' as an example of a vulnerable population, and requiring an
IRB to give consideration to membership expertise in this area. This
language was already included in the pre-2018 rule at Sec.
__.111(a)(3) and Sec.  __.111(b). Adding this category of individuals
to those who may be considered vulnerable to coercion or undue
influence at Sec.  __.107(a) was intended to create greater consistency
among these three provisions.

C. Public Comments

    Between 40 and 50 NPRM comments discussed the language describing
vulnerable populations found in Sec. Sec.  __.107(a), __.111(a)(3), and
(b). A majority of these comments only discussed the inclusion of
pregnant women as an example of a population that might be vulnerable.
Typically, comments addressed only one of the three questions posed in
the NPRM about these provisions. The questions asked whether the Sec.
__.111(a)(3) and (b) focus on issues related to coercion or undue
influence in research with vulnerable populations, and no other
considerations related to vulnerability, was appropriate; whether
pregnant women and those with physical disabilities should be included
in the category of subpopulations that may be vulnerable to coercion or
undue influence; and, whether populations should be considered
vulnerable for reasons other than vulnerability to coercion or undue
influence.
    A majority of the comments stated that the inclusion of pregnant
women as an example of a group that might be vulnerable to coercion or
undue influence was inappropriate. These commenters noted that to
suggest that noncognitive limitations make individuals inherently
vulnerable is insulting to those populations. Of those comments that
addressed these proposals, a minority discussed whether individuals
with physical disabilities should be included as an example of a group
that might be vulnerable to coercion and undue influence. As with
pregnant women, these commenters stated that the insinuation that
groups with physical disabilities might be inherently vulnerable to
coercion and undue influence was insulting. One commenter noted that a
physical condition might make one vulnerable to coercion or undue
influence in the research context, but typically only when the research
activity targets that vulnerability (as opposed to those populations
always being vulnerable).
    In terms of whether other types of vulnerabilities should be
considered by IRBs, public comment was mixed. Some commenters indicated
that in the research context, the specific concerns with respect to
vulnerable populations are limited to vulnerability to coercion and
undue influence, while others noted that the regulations do not
preclude an IRB from considering other types of vulnerability and that
because of this flexibility, additional regulatory text was not
necessarily needed. Groups specifically concerned with issues related
to research involving Native

American populations noted that there are issues broader than
vulnerability to coercion and undue influence that should be
considered, such as vulnerability to group harms; one commenter
recommended that populations be considered vulnerable as a result of
being historically marginalized, such as native/tribal communities;
lesbian, gay, bisexual, and transgender (LGBT) individuals; and racial
and ethnic groups.
    Commenters who disagreed with this change generally felt that a
history of societal marginalization, such as that experienced by LGBT
groups or AI/AN tribes, should be a basis for determining
vulnerability, and that a focus on only coercion or undue influence may
be insufficient for IRB consideration.
    Several comments discussed the fact that using the term mentally
disabled is potentially patronizing. One commenter suggested that
instead of listing mentally disabled individuals as a group that might
be vulnerable to coercion and undue influence, the regulations should
use the term ``populations with impaired decision making ability.''
This suggestion echoes a recommendation made by SACHRP in 2009 as
well.\36\
---------------------------------------------------------------------------

    \36\ HHS. SACHRP. Attachment: Recommendations Regarding Research
Involving Individuals with Impaired Decision-making (2008, 2009).
Retrieved from http://www.hhs.gov/ohrp/sachrp-committee/recommendations/2009-july-15-letter-attachment/#.
---------------------------------------------------------------------------

    Another commenter stated that vulnerability status should be based
on situational context, not on membership in a population, which
potentially promotes stigmatization. Rather, focus should be more on
the risk of the research and the situation of each subject when asked
to participate in research. Finally, it was suggested that terminally
ill patients who have exhausted all standard therapies, and possibly
other research interventions, should be considered vulnerable.

D. Response to Comments and Explanation of the Final Rule: References
to Vulnerability

    A majority of comments agreed that the focus on issues related to
coercion or undue influence, and no other considerations related to
vulnerability, was appropriate. We agree with this assessment, and have
retained this language in the final rule. We believe this change will
help guide IRBs when assessing the type of vulnerability that should be
the focus of review. We note that the Sec.  __.111(a)(3) approval
criterion retains the reference to the purposes of the research and the
setting in which it is conducted because these considerations are also
relevant to the assessment of the equitable selection of subjects, and
may include factors such as societal marginalization or discrimination.
    The language at the three provisions (Sec.  __.107(a), Sec.
__.111(a)(3), and Sec.  __.111(b)) has been made identical in referring
to vulnerability as meaning vulnerability to coercion and undue
influence, in recognition that coercion or undue influence refers to
the ability to make an informed decision about participating in
research.
    We agree with comments that said that the list of example
vulnerable populations listed in the pre-2018 rule is out of date.
    In agreement with the majority of comments, the final rule no
longer includes pregnant women or ``handicapped'' or physically
disabled individuals as examples of populations that are potentially
vulnerable to coercion or undue influence. Adopting a suggestion from
public comment and SACHRP, the final rule uses the term ``individuals
with impaired decision-making ability'' to replace the term ``mentally
disabled persons.''

VIII. IRB Functions and Operations (Sec.  __.108)

A. Background and Pre-2018 Requirements

    The pre-2018 rule outlined IRB functions and operations at
Sec. Sec.  __.103 and __.108.

B. NPRM Proposals

    The NPRM contained several proposals for changes in IRB functions
and operations. Of relevance here, the requirements for recordkeeping
by IRBs would no longer appear in Sec.  __.103 of the rule but in Sec.
__.108. Much of the discussion related to these changes appears in
Section IV regarding the assurance process. The issues are summarized
here.
    The NPRM proposed that the requirement that a written assurance
include a list of IRB members for each IRB designated under the
assurance process be replaced. In its place, the NPRM proposed that the
assurance include a statement for each designated IRB, prepared and
maintained by the institution, or when appropriate the IRB, with a
current detailed list of the IRB members including information
sufficient to describe each member's chief anticipated contributions to
IRB deliberation; and any employment or other relationship between each
member and the institution. The regulatory requirement at Sec.
__.103(b)(3) that changes in IRB membership be reported to the
department or agency head, or to OHRP when the existence of an HHS-
approved assurance is accepted, would be deleted, eliminating the
requirement. Instead, an institution would be required under proposed
Sec.  __.108(a)(2) to maintain a current IRB roster, but such a roster
would not need to be submitted to OHRP or other agency managing the
assurance of compliance process.
    The NPRM also proposed to eliminate the requirement in Sec.
__.103(b)(2) that an institution designate one or more IRBs on its FWA
established in accordance with the Common Rule. The requirement in the
pre-2018 Common Rule at Sec.  __.103(b)(2) that IRBs have sufficient
meeting space and staff to support IRB reviews and record keeping
requirements was moved in the NPRM to Sec.  __.108(a)(1). Note that
under this proposal federal departments or agencies would retain the
ability to ask for information about which IRBs review research
conducted at an institution as part of the assurance process.

C. Public Comments

    Approximately 10 comments were received on these proposals. Of
those, all supported the NPRM proposal that changes in IRB membership
no longer needed to be reported to the funding department or agency.
All commenters supported the proposal that IRBs would simply need to
prepare and maintain a current list of IRB members. Commenters agreed
that the proposed changes to the IRB roster requirement would reduce
administrative burden without having any significant impact on the
protection of human subjects. Those who commented on the proposed
deletion of the requirement to designate one or more IRBs on an
institution's FWA generally supported the proposal.
    No comments were received on the proposed movement of IRB policy
and recordkeeping requirements from Sec.  __.103 to Sec.  __.108.

D. Explanation of the Final Rule: IRB Functions and Operations

    The final rule adopts the NPRM proposals to move the IRB
recordkeeping requirements from Sec.  __.103(b)(3), (4), and (5) to
Sec.  __.108(a)(2), (3), and (4). (See Section IV regarding changes to
Sec.  __.103 as well.) The final rule also adopts the NPRM proposal
that IRBs must maintain an accurate list of IRB members but are not
required to submit changes to that roster to the funding department or
agency. The final rule also adopts the NPRM proposal to delete the
requirement in the pre-2018 rule

that institutions designate one or more IRBs on that institution's FWA.

IX. IRB Review of Research (Sec.  __.109)

A. Background and Pre-2018 Requirements

    The pre-2018 rule listed four areas of responsibility for IRBs in
the review process concerning their authority to approve, request
modification, or disapprove research activities; ensure informed
consent requirements are met (including documentation or waiver, as
relevant); notify investigators of their determinations; and conduct
continuing review of research. The rule at Sec.  __.109(a) stated that
IRBs have the authority to carry out these responsibilities for all
research activities covered by the policy.
    In particular, the pre-2018 rule at Sec.  __.109(e) required that
IRBs conduct continuing review of research covered by this policy at
intervals appropriate to the degree of risk, but not less than once per
year. Except when an expedited review procedure was used, continuing
review of research was to occur at convened meetings at which a
majority of the IRB members are present, including at least one member
whose primary concerns are in nonscientific areas.
    An IRB could use an expedited review procedure to conduct
continuing review of research for some or all of the research appearing
on the list of research eligible for expedited review \37\ and found by
the reviewer(s) to involve no more than minimal risk. The Common Rule
departments and agencies could restrict, suspend, terminate, or choose
not to authorize an IRB's use of the expedited review procedure (Sec.
__.110(d)).
---------------------------------------------------------------------------

    \37\ Office for Human Research Protections. Categories of
Research That May Be Reviewed by the Institutional Review Board
(IRB) through an Expedited Review Procedure. November 9, 1998.
Retrieved from http://www.hhs.gov/ohrp/policy/expedited98.html.
---------------------------------------------------------------------------

B. NPRM Proposals

    The NPRM proposed clarifying that the Common Rule does not give
IRBs the authority to review or approve, require modification in or
disapprove research that qualifies for the exemptions proposed in the
NPRM.
    The NPRM also proposed to eliminate continuing review for many
minimal risk studies (namely those that qualify for expedited review),
unless the reviewer documents why continuing review should take place,
which would be required according to the NPRM. Moreover, for studies
initially reviewed by a convened IRB, continuing review would not be
required, unless specifically mandated by the IRB, after the study
reaches the stage where it involves only one or both of the following:
(1) Analyzing data (even if it is identifiable private information); or
(2) accessing follow-up clinical data from procedures that subjects
would undergo as part of standard care for their medical condition or
disease.
    In addition, the NPRM proposed that continuing review would not be
required for research involving certain secondary research using
information and biospecimens that requires limited IRB review in order
to qualify for an exemption proposed in the NPRM.
    Further, the NPRM proposed that an IRB must receive annual
confirmation that research is ongoing and that no changes have been
made that would require the IRB to conduct continuing review (that is,
the study still qualifies for expedited review because it still meets
the criteria listed above and still involves no greater than minimal
risk).
    The NPRM also proposed a new requirement for IRBs to maintain
records of continuing reviews. Because the NPRM proposed a new
provision that eliminates the need for continuing review under specific
circumstances, it also proposed that IRBs need to justify the need for
continuing review in cases where it was not required. If an IRB chooses
to conduct continuing review even when these conditions are met, the
NPRM stated that the rationale for doing so must be documented.

C. Public Comments

    Approximately four comments addressed the clarification proposed in
the NPRM that IRBs were not authorized by this policy to review exempt
research. All who commented opposed the proposed modification. Those
who commented were concerned that IRBs and institutions would interpret
the modifications to mean that IRBs were precluded from ever reviewing
such research and pointed to the possibility, although rare, that there
might be a need to do so, particularly if the initial exemption
determination was flawed.
    With regard to continuing review, approximately 120 comments
discussed this proposal. A strong majority of comments (approximately
95) supported this proposal and approximately 15 opposed it. Other
comments were mixed. Those who supported the proposal said that it
would indeed alleviate IRB administrative burden without diminishing
the protections afforded to human subjects. Those who did not support
this proposal believed the continuing review process served an
important role in allowing an institution to periodically re-evaluate
the benefits, risks, methods, and procedures used in research
activities, and whether the research had been modified without
approval. Some commenters who supported the proposal were opposed to
the requirement for annual confirmation to the IRB that such research
is ongoing and that no changes have been made that would require the
IRB to conduct continuing review. They stated that the burden
alleviated by eliminating the need for continuing review was offset by
the requirement to submit an annual confirmation.

D. Response to Comments and Explanation of the Final Rule: Review of
Research

    The final rule at Sec.  __.109(a) modifies the language of the pre-
2018 rule to state that IRBs review and have the authority to approve,
require modifications in, or disapprove all research activities covered
by this policy, including exempt research activities under Sec.  __.104
for which limited IRB review is a condition of exemption (Sec.
__.104(d)(2)(iii), Sec.  __.104(d)(3)(i)(C), Sec.  __.104(d)(7), and
Sec.  __.104(d)(8)). Since the final rule requires limited IRB review
for certain categories of exempt research, the provision at Sec.
__.109(a) has been modified to clarify that IRBs have the authority
needed to conduct limited IRB review.
    As proposed in the NPRM, and as generally supported in public
comments, continuing review is eliminated for all studies that undergo
expedited review, unless the reviewer explicitly justifies why
continuing review would enhance protection of research subjects (Sec.
__.109(f)(1)(i) and Sec.  __.115(a)(3)). For studies initially reviewed
by a convened IRB, once certain specified procedures are all that
remain for the study, continuing review would not be required, unless
specifically mandated by the IRB. These activities include: (1)
Research eligible for expedited review in accordance with Sec.  __.110;
or (2) Research that has progressed to the point that it involves only
one or both of the following, which are part of the IRB-approved study:
(a) Data analysis, including analysis of identifiable private
information or identifiable biospecimens, or (b) Accessing follow-up
clinical data from procedures that subjects would undergo as part of
clinical care (at Sec.  __.109(f)). In addition, the final rule states
at Sec.  __.109(f)(1)(ii) that continuing review is not required for
research reviewed in accordance with the limited IRB review procedure
described in Sec.  __.104(d)(2)(iii),

Sec.  __.104(d)(3)(i)(C), Sec.  __.104(d)(7), or Sec.  __.104(d)(8).
    The final rule does not require investigators to provide annual
confirmation to the IRB that such research is ongoing and that no
changes have been made that would require the IRB to conduct continuing
review. Institutions that choose to require some accounting of ongoing
research not subject to continuing review have significant flexibility
in how they implement their own requirements. Note that under the final
rule, investigators would still have the current obligations to report
various developments (such as unanticipated problems or proposed
changes to the study) to the IRB.

X. Expedited Review Procedures (Sec.  __.110)

A. Background and Pre-2018 Requirements

    Under the pre-2018 rule, a research study could receive expedited
review if the research activities to be conducted appear on the list of
activities published by the Secretary of HHS that are eligible for such
review,\38\ and was found by the reviewer(s) to involve no more than
minimal risk. Under an expedited review procedure, the review could be
carried out by the IRB chairperson or by one or more experienced
reviewers designated by the chairperson from among the members of the
IRB. Research that was eligible for expedited review required
continuing review at least annually.
---------------------------------------------------------------------------

    \38\ HHS. OHRP. Categories of Research That May Be Reviewed by
the Institutional Review Board (IRB) through an Expedited Review
Procedure. November 9, 1998. Retrieved from http://www.hhs.gov/ohrp/policy/expedited98.html.
---------------------------------------------------------------------------

B. NPRM Proposals

    The NPRM proposed changes regarding expedited review, to allow
expedited review to occur for studies on the Secretary's list unless
the reviewer(s) determine(s) that the study involves more than minimal
risk. This was in contrast to the pre-2018 regulations, which required
that an IRB use the expedited review procedure only if the reviewer
determines (and documents) that the research involves no more than
minimal risk. In addition, OHRP has indicated that the activities on
the current list should not be deemed to be of minimal risk simply
because they are included on the list. In a related change, the NPRM
contained a requirement that IRBs document the rationale for an
expedited reviewer's determination that research appearing on the
expedited review list is more than minimal risk (i.e., an override of
the presumption that studies on the Secretary's list are minimal risk).
    The NPRM proposed that IRBs reviewing the consent process (and,
when required, the privacy safeguards) for studies eligible for the
proposed exemption at Sec.  __.104(f)(1) could use the expedited review
procedure.
    As discussed in Section III of this preamble, the NPRM did not
propose to modify the definition of minimal risk, but rather proposed
adding to the definition a requirement that the Secretary of HHS create
and publish a list of activities that qualify as ``minimal risk''. This
Secretary's list would be re-evaluated periodically, but at least every
8 years, based on recommendations from federal departments and agencies
and the public. Note that this would not be an exhaustive list of all
activities that would be considered minimal risk under the Common Rule,
but would allow IRBs to rely on the determination of minimal risk for
activities appearing on the list. IRBs would still need to make minimal
risk determinations about activities that do not appear on this list.
    In addition, the NPRM proposed to eliminate the parenthetical
phrase ``of one year or less'' when referring to the IRB approval
period, since annual continuing review of research eligible for
expedited review would no longer be required.
    The NPRM also proposed that the regulations be revised to require
evaluation of the list of expedited review categories every 8 years,
followed by publication in the Federal Register and solicitation of
public comment. A revised list would be prepared for public comment
outside the scope of the NPRM.

C. Public Comments

    Approximately 50 comments were received regarding the proposal to
update the Secretary's list of expedited review categories every 8
years. A strong majority supported this proposal although some
recommended that the mandatory period of review occur more frequently
than every 8 years.
    Approximately 10 comments discussed the NPRM proposal that an IRB
may use the expedited review procedure to satisfy limited IRB review of
the consent process as required under the proposed NPRM exemption. A
strong majority of these comments supported this proposal.

D. Response to Comments and Explanation of the Final Rule: Expedited
Review Procedures

    Under the final rule, a study is deemed to be minimal risk and thus
eligible for expedited review if the study only involves activities on
the Secretary's list, unless the reviewer determines and documents that
the study involves more than minimal risk (Sec.  __.110(a) and (b)(1)).
Thus, we anticipate that more studies that involve no more than minimal
risk will undergo expedited review, rather than full review, which will
relieve burden on IRBs.
    Further, IRBs will be required to document their rationale when
they override the presumption that studies on the Secretary's expedited
review list involve greater than minimal risk (at Sec.  __.115(a)(8)).
Although public comments argued that this documentation represented an
unjustified burden on IRBs, we believe that such documentation could
provide a basis for the Secretary's future determinations about the
appropriateness of the list, and allow for greater consistency across
institutions, and thus make the Common Rule more just.
    At Sec.  __.110(b)(1)(iii) the final rule adopts the NPRM proposal
that an IRB may use the expedited review process when conducting
limited IRB review as required by the exemptions at Sec.
__.104(d)(2)(iii), Sec.  __.104(d)(3)(i)(C), Sec.  __.104(d)(7), and
Sec.  __.104(d)(8).
    Finally, as proposed in the NRPM, evaluation of the list of
expedited review categories will occur every 8 years, followed by
publication in the Federal Register and solicitation of public comment.

XI. Criteria for IRB Approval of Research (Sec.  __.111)

A. Background and the Pre-2018 Requirements

    The determinations that an IRB must make before it can approve a
study were spelled out in the pre-2018 rule at Sec.  __.111. These
relate, among other things, to minimizing risks to subjects,
determining that an appropriate relationship exists between risks and
benefits, and ensuring the equitable selection of subjects. The
regulations generally required all of these determinations to be made
for any study that must undergo IRB review.

B. NPRM Proposals

    The NPRM proposed a number of changes regarding the criteria for
IRB approval of research, including (1) creating a new form of IRB
review for activities relating to storing or maintaining data and
biospecimens for later secondary use; (2) revising two of the existing
criteria for approval of

research that have special considerations related to the involvement of
vulnerable populations and for privacy and confidentiality of data
provisions; and (3) adding a provision about plans to review the return
of individual results to participants.
    The first set of changes concerned updating the IRB review criteria
for research activities relating to storing or maintaining information
and biospecimens, and to the secondary use of such information and
biospecimens. Paragraph (a)(9)(i) of proposed Sec.  __.111 would have
applied to a proposed exemption at Sec.  __.104(f)(1) for storing or
maintaining biospecimens or identifiable private information for use in
secondary research. This provision would have eliminated the need for
an IRB to make the usual determinations about such an activity.
Instead, the IRB would have been required to determine that the
procedures for obtaining broad consent to storing or maintaining the
biospecimens or information were appropriate, and met the standards
included in the introductory paragraph of Sec.  __.116. In addition, if
these storage and maintenance activities involved a change for research
purposes from the way the biospecimens or information had been stored
or maintained, then the IRB would have needed to determine that the
proposed biospecimen and privacy safeguards at Sec.  __.105 were
satisfied for the creation of any related storage database or
repository.
    The second proposed change was related to the NPRM privacy
safeguard proposal and clarified that it would not be an IRB
responsibility to review the security plans for biospecimens and
identifiable private information for every protocol (i.e., on a case-
by-case basis). Also, as discussed in Section VII, the NPRM proposed
changing how vulnerable populations are referred to in the regulatory
language at Sec.  __.111(a)(3).
    The third proposed change was the addition of section (a)(8) to
Sec.  __.111 clarifying that if an investigator submits as part of the
protocol a plan for returning clinically relevant research results to
subjects, the IRB would have to evaluate the appropriateness of the
plan. This criterion was proposed in response to public discussions,
including SACHRP, recommending that IRBs consider returning individual
results to subjects.\39\
---------------------------------------------------------------------------

    \39\ http://www.hhs.gov/ohrp/sachrp-committee/recommendations/attachment-b-return-individual-research-results/index.html.
---------------------------------------------------------------------------

C. Public Comments

    Approximately 20 comments discussed the proposed modifications in
Sec.  __.111 related to the criteria for IRB approval of research. Of
these comments, a majority discussed the proposal that an IRB be
required to review the adequacy of plans to return research results,
should a proposed study include such a plan. Comments on this proposal
were mixed, with both those opposing and supporting the proposal
indicating that HHS and other Common Rule departments and agencies
would need to issue detailed guidance addressing what is considered an
adequate plan in this context. Several commenters suggested deleting
this provision due to the lack of clarity surrounding the IRB's role in
such a review.

D. Response to Comments and Explanation of the Final Rule: Criteria for
IRB Approval of Research

    The final rule does not adopt all of the NPRM proposals. It does
not include the NPRM proposal regarding IRB review of plans to review
the return of clinically relevant results to subjects. This proposal
was deleted due to concern over the criteria that would be required for
an IRB to appropriately consider this area, the need for particular IRB
expertise to appropriately assess the return of results, and ambiguity
over the meaning of ``clinically relevant.''
    The final rule does, however, revise two of the existing criteria
for approval of research: (1) Special considerations related to the
involvement of vulnerable populations, and (2) privacy and
confidentiality of data provisions.
    As discussed in more detail in Section VII, the language regarding
vulnerable populations at Sec.  __.111(a)(3) and (b) has been revised
to reflect the current understanding of which populations should
receive special consideration due to potential vulnerabilities specific
to the purposes and context of human subjects studies and to parallel
other references to vulnerable populations found at Sec.  __.107(a).
    Section __.111(a)(7) in the final rule retains the pre-2018
language, but also adds an additional requirement, thereby serving a
dual function as both the primary regulatory provision requiring IRB
review of the adequacy of protections for the privacy of subjects and
confidentiality of identifiable private information (including that
obtained from the analysis of biospecimens), and as the primary limited
IRB review requirement needed to satisfy certain exemption
determinations in Sec.  __.104(d).
    In Sec.  __.111(a)(7)(i) the Secretary of HHS commits to issuing
guidance to assist IRBs in assessing what provisions are adequate to
protect the privacy of subjects and to maintain the confidentiality of
information, after consultation with OMB's privacy office and other
federal departments and agencies that have adopted this policy. This
modification is intended to serve a similar function as the privacy
safeguards proposed in the NPRM (but not adopted in the final rule).
The guidance might address the following considerations such as:
     The extent to which identifiable private information is or
has been de-identified and the risk that such de-identified information
can be re-identified;
     The use of the information;
     The extent to which the information will be shared or
transferred to a third party or otherwise disclosed or released;
     The likely retention period or life of the information;
     The security controls that are in place to protect the
confidentiality and integrity of the information; and
     The potential risk of harm to individuals should the
information be lost, stolen, compromised, or otherwise used in a way
contrary to the contours of the research under the exemption.

    The final rule at Sec.  __.111(a)(8) modifies the NPRM proposal on
the limited IRB review required by Sec.  __.104(d)(7). Section
__.111(a)(8) specifies that for the purposes of conducting the limited
IRB review required by Sec.  __.104(d)(7), the IRB must determine that
broad consent for storage, maintenance, and secondary research use of
identifiable biospecimens or identifiable private information is
obtained in accordance with the requirements of Sec.  __.116(a)(1)-(4),
(a)(6), and (d). As part of its review of these requirements for broad
consent, the IRB would review the appropriateness of the process
proposed for obtaining broad consent, and ensure that the required
elements of broad consent were appropriately included in the broad
consent form (or process, if broad consent is to be obtained orally).
Additionally, the IRB must determine that consent is appropriately
documented, or that a waiver of documentation is appropriate, in
accordance with Sec.  __.117. Finally, if a change is made for research
purposes in the way identifiable private information or identifiable
biospecimens are stored or maintained, the IRB must determine that
adequate provisions are in place to protect the privacy of subjects and
to maintain the

confidentiality of data. It is expected that the guidance to be
developed by the Secretary of HHS about protecting the privacy of
subjects and maintaining the confidentiality of data will also be
applicable to the privacy and confidentiality considerations included
in this limited IRB review requirement.

XII. Cooperative Research (Sec.  __.114)

A. Background and Pre-2018 Requirements

    The pre-2018 rule required that each institution engaged in a
cooperative research study obtain IRB approval of the study, although
it did not require that a separate local IRB at each institution
conduct such review. In many cases, however, a local IRB for each
institution would independently review the research protocol, and
informed consent forms and other materials, often resulting in multiple
reviews for one study. When any one of these IRBs would require changes
to the research protocol that are adopted for the entire study,
investigators would have to re-submit the revised protocol to all of
the reviewing IRBs. This process could take many months and
significantly delay the initiation of research projects and recruitment
of subjects into studies. More importantly, little evidence has
suggested that the time and effort put into these activities by
investigators (in providing materials to IRBs) and IRBs have
significantly increased the well-being of research subjects.

B. NPRM Proposals

    Taking into consideration the history of public debate on this
topic and various sources of public comments, the NPRM proposed a
requirement mandating that all institutions located in the United
States engaged in cooperative research rely on a single IRB as their
reviewing IRB for that study. Under this proposal, this requirement
would not apply to: (1) Cooperative research for which more than single
IRB review is required by law; or (2) research for which the federal
department or agency supporting or conducting the research determines
and documents that the use of a single IRB is not appropriate for the
particular study. Public comment was sought on whether it would be
useful for this requirement to include criteria that federal
departments or agencies would need to apply in determining whether to
make exceptions to the use of a single IRB requirement and what those
criteria might be. Further the public was asked whether the exceptions
proposed were appropriate and sufficient, or whether this mandate
should have additional exceptions for single IRB review than those
proposed in the NPRM.
    The change proposed by the NPRM would apply only to U.S.-conducted
portions of studies because the flexibility to make use of local IRB
reviews at international sites should be maintained. It might be
difficult for an IRB in the United States to adequately evaluate local
conditions in a foreign country that could play an important role in
the ethical evaluation of the study.
    This policy would apply regardless of whether the study underwent
convened review or expedited review. Under the NPRM, the IRB of record
would be expected to be selected either by the funding agency or, if
there is no funding agency, by the lead institution conducting the
study. An agency may, but is not required, to solicit input regarding
which IRB would be most appropriate to designate as the IRB of record.
Public comment was sought on how this would work in practice.
    This policy would not relieve any site of its other obligations
under the regulations to protect human subjects. Nor would it prohibit
institutions from choosing, for their own purposes, to conduct
additional IRB or other administrative reviews, though such reviews
would no longer have any regulatory status in terms of compliance with
the Common Rule.
    Some concerns about a mandated single IRB review for cooperative
research point to implementation logistics, and the time necessary to
establish new policies, procedures, and agreements. Recognizing this
concern, the proposed compliance date was 3 years from the publication
of the final rule. Public comment was sought on whether this was a
realistic timeframe.
    The public was asked to comment on whether mandated single IRB
review for all cooperative research was a realistic option, and what
the likely costs and benefits to institutions might be. Further, the
public was asked to comment on whether additional resources would be
necessary to meet this requirement in the short term and whether
savings might be anticipated in the long run. Finally, public comment
was sought regarding in what areas guidance would be needed for
institutions to comply with this requirement and whether the Common
Rule departments and agencies could take actions to address concerns
about institutional liability, such as developing model written
agreements.

C. Public Comments

    This proposal was one of the most commented on in the NPRM,
receiving more than 300 comments. Public comment was divided on whether
a final rule should implement the proposal to mandate one IRB of record
in domestic cooperative research studies. Of those who commented on
this proposal, approximately 130 supported the proposal, and
approximately 140 opposed it. Others had mixed views.
    Research institutions tended to oppose this proposal, while
individuals (i.e., those who were not providing comment in an official
institutional capacity) and scientific organizations tended to support
the proposal. A strong majority of those who opposed the proposal
indicated that the final rule should encourage, rather than mandate, a
single IRB of record in cooperative research studies. Arguments against
the proposal cited the need for local review and potential loss of
accountability, as well as operational issues such as the increased
administrative capacity and technological systems required for a site
to function effectively as a single IRB. One comment stated that
mandated single IRB review would not eliminate the challenges
associated with multi-institutional trials. The commenter argued that
it would shift the burden from sponsors to investigators and at the
institutional level, centralized systems would have to be developed and
sustained in order to manage single IRB reviews.
    Some who supported the proposal stated that it would decrease
administrative burdens and inefficiencies for investigators and
institutions. Conversely, some commenters stated that the proposal
should not be implemented because it would ultimately increase burdens
and inefficiencies for investigators and institutions.
    In addition to the broad themes for and against this proposal, some
commenters such as SACHRP noted that the proposed requirement seems
premature at this time and suggested that more data are needed before
such a provision could be implemented. Others said the scope of the
proposal seemed overly broad. Many cited the alternative, narrower
approach discussed in SACHRP's public comment as a reasonable
option.\40\ Further commenters stated that the lead institution likely
would experience

increased costs if this proposal were implemented because of the
obligations it would have to assume. In addition, some commenters said
that the proposal does not address risk of liability to institutions
and IRBs that are not considered the lead.
---------------------------------------------------------------------------

    \40\ SACHRP's public comment to the NPRM is available here:
https://www.hhs.gov/ohrp/sachrp-committee/recommendations/2016-january-5-recommendation-nprm-attachment-a/index.html.
---------------------------------------------------------------------------

    Commenters also noted that long review times for prospective
research studies are not solely related to the IRB review and approval
itself. Rather, commenters noted that long review times are caused by
the sum total of the many different types of reviews either mandated by
other regulations or by institutional policy (e.g., radiation safety
board review, privacy board review, departmental scientific review)
that must be completed. These other reviews would likely not be
affected by the NPRM proposal.
    Several commenters expressed concern that according to the NPRM
proposal, the supporting federal department or agency would select the
IRB of record as required by the provision. These commenters were
concerned that the provisions did not seem to allow for grantee or
awardee input on what IRB should be the IRB of record nor did they seem
to suggest that funding departments or agencies should consult with the
institutions receiving funding about the IRB of record. Several public
comments also expressed concern about the burden this provision would
place on nonfederally supported studies subject to the rule solely
based on the clinical trials expansion proposed in the NPRM.
    Representatives of AI/AN tribes also provided comments emphasizing
the sovereign status of their governments, and stating that nonlocal
review would be inappropriate for their communities.

D. Response to Public Comments and Explanation of the Final Rule:
Cooperative Research

    The final rule adopts the NPRM proposal with modifications that are
responsive to public comment. We agree with commenters who speculated
that mandated single IRB review would ultimately decrease
administrative burdens and inefficiencies for investigators and
institutions, while acknowledging that the transition to this model
would require significant time and an adjustment to institutional
structures and policies. We concur that, rather than offering
additional protections, in many cases multiple IRB approvals increase
burden and frequently delay the implementation of studies, increasing
the costs of clinical trials and potentially stalling access to new
therapies. We note comments that expressed frustration with the
frequent occurrence of central IRB participating sites insisting on
separate institutional reviews. One comment noted that these additional
IRB reviews generally reach the same conclusions, or conclusions with
minor changes, that are then imposed solely on that site. When working
optimally, we expect the central IRB model will work more efficiently
and require less personnel time and fewer resources for tracking and
implementing IRB changes and approvals, thereby eliminating the
potential for unnecessarily duplicative reviews.
    Although a large number of comments believed that single IRB review
should be encouraged rather than mandated, we feel that this
incentivized approach would ultimately fail to yield substantive
positive change in the system. Rather, systematic efficiencies have the
best chance of occurring if single IRB review is required for all
review in domestic research involving more than one institution. We
acknowledge that further guidance for this requirement will need to be
developed and that initial cost projections may have been low. However,
we feel this change supports the best interests of the research
infrastructure through increasing efficiency. Note that the final rule
permits appropriate flexibilities that will assist in implementation.
Institutions may still choose to conduct additional internal IRB
reviews for their own purposes, though such reviews would no longer
have any regulatory status in terms of compliance with the Common Rule.
    We agree with comments recommending that a greater role should be
provided for grantee input on choosing the IRB of record, and have
modified the language accordingly. The language at Sec.  __.114(b)(1)
now states that the reviewing IRB (i.e., the IRB of record) will be
identified by the federal department or agency supporting or conducting
the research, yet allows lead institutions to propose the reviewing
IRB, subject to the acceptance of the federal department or agency
supporting the research. This provision is consistent with the NIH
single IRB policy, which was published on June 21, 2016.
    This final rule adopts (in Sec.  __.114(b)(2)(i)) the NPRM's
proposal that cooperative research for which more than single IRB
review is required by law is not subject to the requirements of Sec.
__.114. The rule also adds clarifying language providing that this
provision extends to tribal laws passed by the official governing body
of an AI/AN tribe. Thus, if the official governing body of an AI/AN
tribe passes a tribal law that requires more than single IRB review for
certain cooperative research, the requirement for single IRB review
does not apply to such cooperative research. In addition, we highlight
that Sec.  __.114(b)(2)(ii) allows a federal department or agency the
flexibility to determine that the use of a single IRB is not
appropriate for certain contexts, thereby permitting additional IRB
review and consideration of local and regional variations in some
circumstances.
    Finally, the final rule adopts the NPRM proposal for this provision
to have a delayed compliance date of 3-years from the date the final
rule is published in the Federal Register. This transition period is
intended to allow the regulated community appropriate time and
flexibility in adjusting to this new model.

XIII. IRB Records (Sec.  __.115)

A. Background and Pre-2018 Requirements

    The pre-2018 rule at Sec.  __.115 outlined requirements for IRBs in
preparing and documenting its activities and for maintaining records.

B. NPRM Proposals

    As discussed in Section IV, the NPRM proposed to revise the pre-
2018 requirement that an up-to-date list of the IRB members and their
qualifications be included in an institution's assurance. Instead, the
NPRM proposed the requirement that an IRB or the institution prepare
and maintain a current list of IRB members.
    As discussed in Section IX, the NPRM proposed a new requirement for
IRBs to maintain, as part of their records of continuing reviews, the
rationale for conducting continuing review of research that was deemed
eligible for elimination of continuing review per proposed changes at
Sec.  __.109(f)(1)(ii). Specifically, this would apply to research that
had progressed to the point that it involves only one or both of the
following, which are part of the IRB-approved study: (1) Conducting
data analysis, including analysis of identifiable private information,
or (2) accessing follow-up clinical data from procedures that subjects
would undergo as part of standard care for their medical condition.
    Also, as discussed in Section IX, the NPRM proposed eliminating
continuing review for many minimal risk studies (namely those that
qualify for expedited review), unless the reviewer finds and documents
why continuing review should take place for the study. Finally,

the NPRM contained a requirement that IRBs document the rationale for
an expedited reviewer's determination that research appearing on the
expedited review list is more than minimal risk (i.e., overturning the
presumption that studies on the Secretary's list are minimal risk).
    New in the NPRM was a proposal to require that an IRB maintain
records of exemption determinations. Additionally, the NPRM proposed
that the use of the proposed exemption determination tool would satisfy
the proposed documentation requirement.
    In addition, a new provision was proposed to require that the
institution or IRB that retains IRB records should safeguard, if
relevant, individually identifiable private information contained in
those records in compliance with the proposed privacy safeguards.
    Finally, the NPRM proposed a modification of the pre-2018 rule
clarifying that IRB records may be maintained in print or electronic
form.

C. Public Comment

    The proposed modifications to Sec.  __.115 received approximately
25 comments. A majority focused on three proposed revisions. The NPRM
proposed to require that reviewers document why an IRB required
continuing review when continuing review was not required as proposed
in the NPRM. The majority of commenters opposed this requirement
stating that it merely shifted administrative burden from one activity
to another with no increase in protections.
    The NPRM also proposed to require that a reviewer document why a
research activity appearing on the expedited review list is more than
minimal risk, and thus should be subject to full IRB review. This was
opposed by the majority of commenters who indicated that this proposal
was an unjustified administrative burden.
    One commenter stated that the proposed documentation requirements
would be punitive to IRBs. Several others suggested that this
requirement served as a disincentive to institutions who wanted to
implement additional protections than those required by the Common
Rule. These commenters noted that this seemed in contrast to the
longstanding policy articulation that the Common Rule served as a
``floor'' for protections and that institutions could require
additional protections for research conducted at their institutions.

D. Response to Comments and Explanation of the Final Rule: IRB Records

    A majority of the changes proposed in the NPRM in Sec.  __.115 have
been retained in the final rule without alteration. However, the final
rule differs from the NPRM in a few ways. First, the NPRM included two
provisions requiring documentation of continuing review activities;
these have been merged into one provision in the final rule at Sec.
__.115(a)(3). Second, the NPRM required that the IRB keep records of
the IRB reliance agreements between an institution and the IRBs not
operated by that institution that review said institution's nonexempt
research activities. Instead, the final rule includes language at Sec.
__.115(a)(9) that requires each institution to maintain adequate
documentation of the responsibilities that each entity will undertake
to ensure compliance with this policy. This provision differs from the
NPRM proposal to correspond to the more flexible provision included at
Sec.  __.103(e), which does not require the creation of a written
agreement between an institution and a reviewing IRB that said
institution does not operate.
    Because the final rule does not include an exemption determination
requirement, the exemption documentation requirement proposed in the
NPRM is not included in the final rule. Additionally, because the final
rule does not include specified privacy safeguards, the NPRM proposal
for an IRB to safeguard records as required by the proposed privacy
safeguards is not included.
    The final rule includes the NPRM proposal that IRBs document
decisions to require continuing review or full board review even in
circumstances when such review is not required because we believe it is
important to document why an IRB is making a determination that differs
from the regulatory baseline. This also helps to promote the principle
of justice (as applied to IRB operations). Note that nothing in these
regulations prevents an institution from authorizing an IRB to apply
standards that exceed those in the regulations, if indeed the
institution has chosen to do so.
    In addition, while the NPRM proposed to require that IRB records
that contain identifiable private information be safeguarded through
compliance with the proposed privacy safeguards, the final rule does
not require such safeguards. Although no public comments were received
on this provision, in deciding not to include the NPRM's proposed
privacy safeguard requirements in the final rule, we determined that it
was unnecessary for the Common Rule to impose additional privacy
requirements on IRB records as we are unaware of instances in which IRB
records were breached. In addition, IRB records are not the regulatory
equivalent of research records, which should be adequately secured or
safeguarded against inappropriate uses or disclosures of identifiable
private information. IRB records will generally be secured for a
variety of reasons. These include not only protecting identifiable
private information, but also, for example, protecting discrete
information and intellectual property that might be included in a
protocol. There are other means for ensuring institutions and IRBs
protect their records beyond what is required by the Common Rule.

XIV. General Requirements for Informed Consent (Sec.  __.116)

    The final rule contains several major revisions to the requirements
for informed consent, specifically with respect to: (1) New
requirements relating to the content, organization, and presentation of
information included in the consent form and process to facilitate a
prospective subject's decision about whether to participate in
research; (2) the basic and additional elements of consent; (3) the
elements of broad consent for the storage, maintenance, or secondary
research use of identifiable private information and identifiable
biospecimens; (4) attendant changes in the waiver or alteration
criteria for consent; (5) a new provision that allows IRBs to approve a
research proposal for which investigators obtain information or
biospecimens without individuals' informed consent for the purpose of
screening, recruiting, or determining the eligibility of prospective
human subjects of research, provided certain conditions are met; and,
(6) a new requirement to post to a federal Web site a copy of an IRB-
approved version of the consent form that was used for enrollment
purposes for each clinical trial conducted or supported by a federal
department or agency. Each of the final rule provisions are discussed
separately below.

A. General Requirements for Informed Consent (Sec.  __.116(a))

1. Background and Pre-2018 Requirements
    Under the pre-2018 rule, many fundamental requirements applicable
to all informed consents were set forth in

an introductory (and unnumbered) paragraph at the beginning of Sec.
__.116.
    In considering changes to the general requirements set forth in
Sec.  __.116(a), we considered arguments put forth by some that consent
forms have evolved to protect institutions rather than to provide
potential research subjects with the most important pieces of
information that a person would need in order to make an informed
decision about whether to enroll in a research study.\41\ Instead of
presenting the information in a way that is most helpful to prospective
subjects--such as explaining why someone might want to choose not to
enroll--these individuals argued the forms may function more as sales
documents or as a means to protect against institutional liability.\42\
We also considered a growing body of literature that suggests informed
consent forms have grown too lengthy and complex, adversely affecting
their ability to effectively convey the information needed for
prospective participants to make an informed decision about
participating in research.\43\
---------------------------------------------------------------------------

    \41\ Levine RJ. Informed consent: Some challenges to the
universal validity of the western model. J Law Med Ethics 1991;19(3-
4):207-213.
    \42\ Menikoff J., Richards E. What the Doctor Didn't Say: The
Hidden Truth about Medical Research. New York, NY: Oxford University
Press; 2006:113-123.
    \43\ Beardsley E. et al. Longer Consent Forms for Clinical
Trials Compromise Patient Understanding: So Why Are They
Lengthening? Journal of Clinical Oncology. 2007 Mar 20;25(9):e13-4.
---------------------------------------------------------------------------

2. NPRM Proposals
    The NPRM proposed adding new language to the introductory text of
Sec.  __.116 to emphasize the need to first provide essential
information that a reasonable person would want to know in order to
make an informed decision about whether to participate in research, and
to provide an opportunity to discuss that information. Furthermore, in
recognition of complaints that consent forms are too often complicated
documents primarily used to protect sponsors from legal liability, the
NPRM proposed requiring that the information in these forms be
organized and presented in a way that does not merely provide lists of
isolated facts, but rather facilitated the prospective subject's or
representative's understanding of the reasons why one might or might
not want to participate in the research.
    The NPRM also proposed that an investigator seeking to obtain
informed consent be required to present first the information required
by Sec.  __.116, which has been recognized by the Common Rule
departments and agencies as the most fundamental and required content
of informed consent, before providing other information, if any, to the
subject. As proposed under the NPRM, the main portion of a consent
document could include only the elements of informed consent that were
required by the Common Rule, with any other information included in an
appendix. This change was intended to lead to substantially shorter
``core'' sections of consent forms, with prospective subjects receiving
the most important information in the body of these relatively short
forms, instead of that key information being buried in long and overly
complex documents. As proposed, additional information could be set
forth in appendices to consent forms.
    Given the consensus that informed consent forms should be written
in appropriate language, this proposal reinforced the need to include
information using language understandable to the subject. This goal was
consistent with Federal Plain Language guidelines and the Federal Plain
Writing Act of 2010. The NPRM proposed that the Secretary publish
guidance at a later time to explain how consent forms could be written
to comply with this regulatory requirement. Public comments were sought
on what topics should be addressed in future guidance on improving the
understandability of informed consents. As explained in the NPRM, it
was not envisioned that the revised Common Rule would require a formal
assessment to evaluate an individual's competency, but we acknowledged
that such a practice might be appropriate for certain populations or
studies.
    In addition, the NPRM proposed to clarify in the introductory
language at Sec.  __.116 that if a HIPAA authorization is combined with
a consent form, the authorization elements required by 45 CFR 164.508
(part of the HIPAA Privacy regulations) must be included in the consent
document and not the appendices. In other words, when informed consent
for research under the Common Rule is combined with a HIPAA
authorization, the NPRM proposed that the authorization elements would
be considered to constitute one of the required elements of informed
consent.
3. Public Comments
    Approximately 200 comments discussed the proposal to include
information required by the Common Rule in the consent form and place
other information in appendices. A majority of those (approximately
140) supported the proposal and approximately 35 commenters opposed
this proposal. Those who expressed support for this proposal generally
noted agreement with the NPRM's rationale for the proposed revisions.
Even those who supported the proposal stated that guidance would be
needed for the proposal to be implemented and for the proposal to have
the desired effect. Among those who opposed this proposal, all
indicated support for the intention behind it. Reasons for opposing
this proposal included:
     Concern that having a ``dual document'' system (with a
primary consent form and appendices) would not actually improve
subjects' understanding specifically and the informed consent process
generally.
     Concerns that in some circumstances, the information that
one might require to make an informed decision about research
participation may not always be information required under the Common
Rule when seeking and obtaining informed consent.
     Concern that the proposed language for the Sec.  __.116
introductory paragraph should not be promulgated as regulatory text
(and would be more appropriate as guidance).
     Concern that because the proposed language does not
include specific standards and specific criteria, the provision would
ultimately be impossible to implement and enforce.
     Concern that the language as proposed would not reduce the
complexity and length of consent forms because much of the information
generally contained in an informed consent document is required by
various regulatory agencies. To this end, several commenters noted that
the NPRM proposed an additional four required elements of consent,
which would add to the quantity of information that is required to be
discussed in an informed consent document.
    Some comments noted that although they liked the general idea of
the proposal for the introductory paragraph of Sec.  __.116, they felt
that the proposal should not focus on the length of a consent form, but
rather on clarity and understandability. One comment expressed a need
for guidance on how to implement the proposed language in the
introductory paragraph of Sec.  __.116 and the requirement at Sec.
__.109(b) of the pre-2018 rule.\44\ The NPRM did not

propose changing the latter item, which mandated that IRBs require that
information given to subjects as part of informed consent conform with
the requirement. However, the NPRM also permitted IRBs to require
additional information if it would meaningfully add to the protection
of the rights and welfare of subjects. This comment was made in light
of the NPRM's proposal that information not required as an element of
consent at Sec.  __.116 must be provided after providing the required
elements of consent.
---------------------------------------------------------------------------

    \44\ Section __.109(b) of the pre-2018 rule states that an IRB
shall require that information given to subjects as part of informed
consent is in accordance with Sec.  __.116. The IRB may require that
information, in addition to that specifically mentioned in Sec.
__.116, be given to the subjects when in the IRB's judgment the
information would meaningfully add to the protection of the rights
and welfare of subjects.
---------------------------------------------------------------------------

    The NPRM asked about what topics should be addressed in future
guidance on improving the understandability of informed consent.
Approximately 35 commenters answered this question, a majority of which
were universities and research institutions. Several commenters
questioned whether the proposals in the introductory paragraph of Sec.
__.116 would be enforceable, and how Common Rule departments and
agencies would assess and enforce compliance.
    Several commenters indicated that mandating the order in which the
content of consent forms should be presented may not always facilitate
increased understanding by potential subjects because the best way to
facilitate understanding is likely to be study specific. In other
words, the order of importance of issues could be dependent on unique
aspects of a given study. Others noted that most information in consent
forms is there because the regulations require it to be included. Thus,
the proposal to include the information required by the regulations up
front, with all other information included as an appendix, is not a
requirement that will inherently improve consent forms. Some commenters
suggested that more research was needed on the informed consent process
before prescribing specific approaches.
    Many commenters asked that future guidance be developed to assist
in drafting consent forms that addresses language level, literacy, risk
communication, and best practices in use of alternative media in the
informed consent process (e.g., interactive presentation on a tablet,
comic strips for pediatric populations). In this regard, some comments
objected to the singular focus on a ``form'' in the proposed language,
stating that this sends the message that alternative and innovative
approaches to improving the informed consent process would be
discouraged. Others noted that future guidance should include topics of
interest to tribal groups, such as acknowledgement of community-level
implications of research and clarification about the handling of
biospecimens in a study.
    Several commenters noted that guidance should focus on how to
foster understanding rather than focusing on mandatory length
limitations on consent forms. However, a few comments endorsed a
recommended page length maximum, citing it as perhaps the only way to
force investigators and institutions to be brief and concise in the
presentation of relevant information.
4. Response to Comments and Explanation of the Final Rule: General
Requirements for Informed Consent
    Before addressing how the general requirements for informed consent
proposed in the NPRM have been adopted and altered in the final rule,
it is important to note that the structure for this regulatory text has
been altered. In the pre-2018 rule, the general requirements were
included in an unnumbered introductory paragraph. The NPRM proposed the
same approach. To emphasize the fact that this paragraph includes
multiple independent and important regulatory requirements, and to
enable stakeholders and Common Rule departments and agencies to more
easily reference particular requirements, these general requirements
have been redesignated into a new Sec.  __.116(a). In addition, the
general requirement for consent in the final rule at Sec.  __.116(a)(6)
removes the reference to oral or written consent that was in the pre-
2018 rule. This is the provision that addresses the prohibition on
including exculpatory language through which the subject or the legally
authorized representative is made to waive or appear to waive any of
the subject's legal rights, or releases or appears to release the
investigator, the sponsor, the institution, or its agents from
liability for negligence. The reference to oral or written consent was
removed from this provision in the final rule. In its place, a similar
reference was included in to Sec.  __.116(a) to clarify that all the
requirements set forth in Sec.  __.116(a) apply to written and oral
consent.
    Another change made in the final rule, as compared with the pre-
2018 rule and the language proposed in the NPRM, is that Sec.
__.116(a) contains introductory language summarizing each paragraph of
Sec.  __.116 and the relationship between those paragraphs. Given that
the framework for informed consent has been altered and reorganized
through this regulation, this introductory language is intended to
explain the overall approach set forth in revised Sec.  __.116, as well
as the significance of each paragraph. This introductory language is
also intended to explain the role of broad consent under revised Sec.
__.116. The introductory paragraph explains that the general
requirements for informed consent are now set forth in Sec.  __.116(a)
and that these general requirements apply with respect to informed
consent obtained pursuant to Sec.  __.116(b), (c), and (d) (except, as
described later, Sec.  __.116(a)(5) does not apply to broad consent
obtained under Sec.  __.116(d)). This introductory language also
explains that the basic elements of informed consent (which were
described in Sec.  __.116(a) of the pre-2018 rule) are included in
Sec.  __.116(b) of this final rule and that additional elements of
informed consent that pertain only to certain studies (which were
described in Sec.  __.116(b) of the pre-2018 rule) are included in
Sec.  __.116(c) of this final rule.
    In addition, this introductory language explains that the
requirements for broad consent (a concept not specifically addressed in
the pre-2018 rule) are described in Sec.  __.116(d) of this final rule.
As discussed below, broad consent under this final rule differs from
the broad consent approach proposed for Sec.  __.116(c) in the NPRM.
The introductory language of Sec.  __.116(a) explains that broad
consent may be obtained in lieu of informed consent obtained under
Sec.  __.116(b) and Sec.  __.116(c) (which describe basic elements of
informed consent as a general matter and additional elements of
informed consent that apply only to certain studies, respectively) for
certain purposes. Specifically, in lieu of obtaining study-specific
informed consent in accordance with Sec.  __.116(b) and (c), broad
consent may be obtained under Sec.  __.116(d) for the use of
identifiable private information or identifiable biospecimens collected
for either research studies other than the proposed research or
nonresearch purposes for: (1) storage and maintenance for secondary
research use; and (2) secondary research. For those purposes (and no
others), broad consent under Sec.  __.116(d) may be obtained instead of
specific consent under Sec.  __.116(b) and (c).
    New introductory language at Sec.  __.116(a) also summarizes the
provisions describing circumstances in which waiver or alteration of
the requirements of informed consent are permitted. These circumstances
pertain to research involving public benefit and service programs
conducted by or

subject to the approval of state or local officials at Sec.  __.116(e),
and to research more generally at Sec.  __.116(f) (see below).
    Another change reflected in the final rule is that specific
requirements for informed consent have been included in subparagraphs
for clarity and emphasis. For example, the requirement that information
that is given to the subject or the legally authorized representative
shall be in language understandable to such subject or representative
is no longer included as part of a general introductory paragraph and
is instead included as Sec.  __.116(a)(3). Except as noted here, these
requirements remain the same as they were under the pre-2018 rule.
    The final rule adopts, almost verbatim, all of the proposals made
in the NPRM to improve and clarify the general requirements for
informed consent. For example, the final rule adopts the proposed
requirement specifying that the information provided in an informed
consent form must be presented in sufficient detail relating to the
research, and must be organized and presented in a way that does not
merely provide lists of isolated facts, but rather facilitates the
prospective subject's or legally authorized representative's
understanding of the reasons why one might or might not want to
participate. The final rule also adopts new language clarifying that
this requirement applies to the informed consent as a whole. In
addition, the final rule adopts the NPRM's proposal that prospective
subjects or legally authorized representative must be provided with key
information that is most likely to assist a prospective subject or
legally authorized representative in making a decision about
participating in research, and to provide an opportunity to discuss
that information. Moreover, the final rule adopts an approach,
consistent with many public comments, emphasizing efforts to foster
understanding overall rather than imposing specific length limitations
on the entire consent forms.
    The final rule also includes language slightly different from that
proposed in the NPRM for clarity or for conformance with other language
in the final rule. For example, the final rule replaces references to a
subject's representative with references to a subject's legally
authorized representative (a term defined in Sec.  __.102) for clarity.
    As discussed above, a significant proposal in the NPRM was that in
obtaining informed consent, investigators would first have to present
the information required by Sec.  __.116, before presenting any other
information, if any. In addition, the NPRM proposed mandating that
consent forms must include only the required information under Sec.
__.116 and that any other information be included in appendices. The
final rule does not adopt a requirement that certain information be
included only in appendices. This approach is responsive to public
comments expressing concerns that such a mandate might sometimes
undermine the informed consent process. The final rule adopts a slight
variation of that approach in response to public comments about
perceived lack of flexibility in the proposed language. Whereas the
NPRM referred to the ``body'' of the consent form as opposed to
appendices to the consent form, the final rule replaces those concepts
with references to material that must be at the beginning of the
consent form, versus material that can appear after that beginning
section. The final rule does not limit the information that can be
provided in the beginning of a consent form to only the Sec.  __.116
requirements, but instead offers a more flexible and meaningful
approach in response to public concerns that the NPRM proposal was too
prescriptive. Moreover, the approach recognizes public comments that
expressed concerns about creating a ``dual document'' system. As such,
the final rule does not address appendices to the informed consent.
However, the NPRM's references to the appendices of the consent form
have in general been conceptually replaced by references to the
material in a consent form that follows the ``beginning'' section.
    In particular, the final rule imposes a new requirement (set forth
in Sec.  __.116(a)(5)(i)) that the informed consent begin with a
concise and focused presentation of the key information that is most
likely to assist a prospective subject or legally authorized
representative in understanding the reasons why one might or might not
want to participate in the research. This provision further requires
that this beginning portion of the informed consent must be organized
and presented in a way that facilitates comprehension. This requirement
applies to all informed consents, except for broad consents obtained
pursuant to Sec.  __.116(d), which may warrant a different
presentation.
    This new requirement included at Sec.  __.116(a)(5)(i) is somewhat
similar to the proposal advanced in the NPRM insofar as both emphasize
the importance of presenting the information that would be most
important to a subject (or a legally authorized representative) before
presenting other information. However, the requirement included in
Sec.  __.116(a)(5)(i) is more specific, detailed, and flexible. First,
this provision requires that key information be included in the
beginning of the informed consent in a concise and focused
presentation. We recognize that how this requirement applies will
depend on the nature of the specific research study and the information
presented in the informed consent and believe that this requirement
strikes an appropriate balance between facilitating the comprehension
of subjects of key issues and allowing study-specific flexibilities. In
general, our expectation is that this initial presentation of the key
pieces of information will be relatively short. This section of the
consent could, in appropriate circumstances, include a summary of
relevant pieces of information that are explained in greater detail
later in the consent form.
    The requirement that key information be presented in a concise and
focused way will require an assessment that is specific to a study and
its informed consent. For example, for most complicated clinical trials
involving cancer patients with long (e.g., 20- to 25-page) consent
documents, our expectation would be that the concise and focused
presentation referred to in Sec.  __.116(a)(5)(i) would be no more than
a few pages, and would provide the key pieces of information about the
trial in such a manner that facilitates a person's comprehension of why
they might or might not want to participate in the research.
    In such cases, for example, we would not consider a 10-page
description of elements such as potential risks, accompanied by lengthy
and complex charts and graphs, to satisfy the ``concise and focused''
requirement of Sec.  __.116(a)(5)(i). With regard to risks in the type
of cancer trial mentioned above, for example, instead of needing to
mention every reasonably foreseeable risk, which would be required by
Sec.  __.116(b)(2), this beginning section of the consent form should
identify the most important risks, similar to the information that a
doctor might deliver in the clinical context in telling a patient how
sick the chemotherapy drugs will make them, but with a particular
emphasis on how those risks are changed by participating in the study.
    We recognize the advantages of allowing institutions to design
informed consents, consistent with Sec.  __.116(a)(5)(i), that are
tailored to particular research studies to assist prospective subjects
in understanding the most fundamental aspects of the

informed consent. For this reason, the final rule does not strictly
specify the types of information that should or should not be included
to satisfy Sec.  __.116(a)(5)(i), or the length of such concise and
focused presentations. This flexibility is responsive to public
comments recommending against a rigid approach to enable institutions
and individuals to tailor informed consents to the circumstances of
particular studies. A discussion of the key information to be included
in the beginning section of the consent form, and how it will operate
in practice, may be further clarified in future guidance.
    We also recognize that for some relatively simple research studies
with limited risks or benefits, the entire informed consent document
may be relatively brief and still satisfy Sec.  __.116. In such
circumstances, an institution may determine that virtually all of the
information required by Sec.  __.116 would also satisfy Sec.
__.116(a)(5)(i). In such cases, the informed consent document could
include the concise and focused presentation of Sec.  __.116(a)(5)(i)
at the beginning of the informed consent document, followed by limited
additional information required to satisfy Sec.  __.116.
    In all circumstances (those involving lengthy and complex informed
consents as well as short and relatively simple informed consents), if
information included at the beginning of the informed consent satisfies
both Sec.  __.116(a)(5)(i) and the elements of informed consent under
Sec.  __.116(b) and Sec.  __.116(c) more generally, the information
included at the beginning need not be repeated later in the body of the
informed consent. Thus, with respect to the example provided above
concerning a clinical trial with cancer patients, the most important
reasonably foreseeable risks to subjects would be summarized at the
beginning of the informed consent as part of Sec.  __.116(a)(5)(i)'s
concise and focused presentation, but that a more comprehensive and
detailed description of reasonably foreseeable risks to subjects would
be included later in the body of the informed consent. In contrast,
with respect to a relatively simple research study with limited risks,
we would expect that all of the information provided to potential
subjects concerning such risks might satisfy both Sec.  __.116(a)(5)(i)
(as part of a concise and focused presentation of key information) and
Sec.  __.116(b)(2) (a description of any reasonably foreseeable risks
or discomforts to the subject). In such circumstances, the information
provided at the beginning of the informed consent would not need to be
repeated or further detailed in the informed consent and the entire
informed consent could be relatively short.
    In general, we would expect that to satisfy Sec.  __.116(a)(5)(i),
the beginning of an informed consent would include a concise
explanation of the following: (1) the fact that consent is being sought
for research and that participation is voluntary; (2) the purposes of
the research, the expected duration of the prospective subject's
participation, and the procedures to be followed in the research; (3)
the reasonably foreseeable risks or discomforts to the prospective
subject; (4) the benefits to the prospective subject or to others that
may reasonably be expected from the research; and (5) appropriate
alternative procedures or courses of treatment, if any, that might be
advantageous to the prospective subject. As a general matter, a brief
description of these five factors would encompass the key information
most likely to assist a reasonable person (or legally authorized
representative) in understanding the reasons why one might or might not
want to participate in research, as required by Sec.  __.116(a)(5)(i)
and Sec.  __.116(a)(4). However, we recognize that this determination
is necessarily fact-specific and that IRBs and institutions may require
that somewhat different (or additional) information be presented at the
beginning of an informed consent to satisfy Sec.  __.116(a)(5)(i).
    The NPRM also proposed adding a new requirement to the general
introductory paragraph of Sec.  __.116, which would provide that if an
authorization required by 45 CFR parts 160 and 164 (parts of the HIPAA
Privacy Rule) is combined with a consent form, the authorization
elements required by 45 CFR 164.508 must be included in the consent
form (and not the appendices). Because this final rule does not
incorporate the distinction proposed in the NPRM between the informed
consent and appendices, the final rule does not incorporate this
language.
    We are satisfied that the approach adopted in this final rule will
enable regulated entities and individuals to pursue different and
innovative approaches to obtaining informed consent, as recommended in
some public comments, while ensuring that the important aspects of
informed consent are clearly communicated to prospective subjects and
subjects.

B. Basic Elements of Informed Consent (Sec.  __.116(b))

1. Background and Pre-2018 Requirements
    Under the pre-2018 rule, investigators were generally required to
obtain the subjects' informed consent to participate in research.\45\
The regulations required that the consent form include at least eight
specific items of information, including: (1) an explanation of the
purposes of the research, its duration, and procedures involved, and
identification of any procedures which are experimental; (2) a
description of the reasonably foreseeable risks; (3) a description of
any potential benefits; (4) a disclosure of appropriate alternative
procedures or courses of treatment, as relevant; (5) information about
confidentiality of records, compensation, and treatments if injury
occurs; (6) for research involving more than minimal risk, an
explanation as to whether any compensation or medical treatments are
available if injury occurs; (7) contact information; and (8) a
statement that participation is voluntary, and that refusal to
participate or decision to withdraw will involve no penalty or loss of
benefits to which the subject is otherwise entitled.
---------------------------------------------------------------------------

    \45\ For general requirements for informed consent see Sec.
__.116 in the pre-2018 Rule, and 21 CFR 50.20, .25 in FDA's
comparable requirements. There are provisions under the Common Rule,
that allow for the waiver of some or all of the elements of informed
consent (see Sec.  __.116(e) and (f)). The Federal Food, Drug, and
Cosmetic Act limits the circumstances under which informed consent
can be waived. See, e.g., section 520(g) (21 U.S.C. 360j(g)).
Currently, FDA regulations contain only two exceptions from informed
consent in certain life-threatening and emergency situations under
21 CFR 50.23-24. However, the 21st Century Cures Act recently
amended the Federal Food, Drug and Cosmetic Act to allow waiver of
informed consent for certain FDA-regulated minimal risk
investigations.
---------------------------------------------------------------------------

2. NPRM Proposals
    In the NPRM it was proposed that research with nonidentified data
continue to be considered not to involve ``human subjects.'' However,
to better ensure that subjects are informed of the possibility that
identifiers collected as part of a research study could be removed from
the data and then be used for secondary research studies without the
protections provided by this policy, it was proposed that a new element
of informed consent be required. The new basic element of consent
proposed in the NPRM at Sec.  __.116(a)(9) would apply to all research
collecting identifiable private information. Based on the
investigator's plans, the informed consent form and process would need
to inform subjects either that: (1)

identifiers might be removed from the data and that the nonidentified
data could be used for future research studies or distributed to
another investigator for future research studies without additional
informed consent from the subject or the representative, if this might
be a possibility; or (2) the subject's data collected as part of the
research, from which identifiers are removed, would not be used or
distributed for future research studies.
3. Public Comments
    Approximately 40 public comments were received on the proposed new
required element of informed consent found in the NPRM at proposed
Sec.  __.116(a)(9). A large majority favored this proposal. Those who
supported this proposal indicated that it provided useful information
to prospective subjects about how private information obtained from a
study might be used in the future. They also commented that it enhanced
transparency in research, providing potential subjects with the
information they need to decide whether to participate. Those who
opposed this proposal suggested that it would increase the length of
consent forms without appreciably improving potential subjects'
understanding of a specific research activity.
4. Response to Comments and Explanation of the Final Rule: Basic
Elements of Informed Consent
    The final rule, at Sec.  __.116(b)(9), adopts the NPRM proposal to
inform potential subjects about the possible use of their identifiable
private information with two clarifying changes. First, because the
final rule at Sec.  __.102(e)(1) now states that the definition of
human subject, in part, includes research in which an investigator
obtains, uses, studies, analyzes, or generates identifiable
biospecimens or identifiable private information, this new element of
informed consent has been clarified to specifically apply to any
research that involves the collection of identifiable biospecimens,
rather than all biospecimens, in addition to research that involves the
collection of identifiable private information. In addition, a change
to what was proposed in the NPRM has been made to the new element of
consent in the final rule at Sec.  __.116(b)(9)(ii), to clarify that it
is intended to inform subjects that their information or biospecimens
collected as part of the research will not be used or distributed for
future research, even if identifiers are removed.
    We agree with the public comments that indicated this new element
of consent will provide useful information to prospective subjects
about whether their identifiable private information or identifiable
biospecimens might be stripped of identifiers and used for future
research studies or distributed to another investigator for future
research studies without additional informed consent from the subject
or the legally authorized representative.
    We expect that this information can usually be provided in a brief
statement, and disagree with the commenters that suggested that this
new basic element of consent would increase the length of consent forms
without appreciably improving potential subjects' understanding of a
specific research activity. This new requirement is intended to give
the potential subject a right to know that identifiers might be removed
from information or biospecimens and be used for future research
without additional consent, when such a possibility exists, so he or
she can make a fully informed decision about whether to participate in
the research. If subjects' identifiable private information or
identifiable biospecimens will not be used for future research studies,
even if identifiers are removed, this new element of consent requires
that subjects be informed of this as well. Finally, if a specific
technology or technique determined to be capable of generating
identifiable private information or identifiable biospecimens through
the consultative process described at Sec.  __.102(e)(7) will be used,
that information should be included in the description of the research
at Sec.  __.116(b)(1).

C. Additional Elements of Informed Consent (Sec.  __.116(c))

1. Background and Pre-2018 Requirements
    The pre-2018 rule contained six additional elements of consent
required when appropriate: (1) A statement that the particular
treatment or procedure may involve risks to the subject (or to the
embryo or fetus, if the subject is or may become pregnant) which are
currently unforeseeable; (2) anticipated circumstances under which the
subject's participation may be terminated by the investigator without
regard to the subject's consent; (3) any additional costs to the
subject that may result from participation in the research; (4) the
consequences of a subject's decision to withdraw from the research and
procedures for orderly termination of participation by the subject; (5)
a statement that significant new findings developed during the course
of the research which may relate to the subject's willingness to
continue participation will be provided to the subject; and (6) the
approximate number of subjects involved in the study.
2. NPRM Proposals
    The NPRM proposed adding three additional elements of consent that,
when appropriate, would be required to be included in the informed
consent form and process. These proposed additional elements of consent
pertain to issues that have become more relevant in recent years as
science has advanced and the nature of research has changed. One
proposed new element would require that prospective subjects be
informed that their biospecimens may be used for commercial profit and
whether the subject will or will not share in this commercial profit. A
second proposed element would require that prospective subjects be
informed of whether clinically relevant research results, including
individual research results, will be disclosed to subjects, and if so,
under what conditions. A third proposed new element would provide
subjects or their legally authorized representatives with an option to
consent, or refuse to consent, to investigators re-contacting the
research subject to obtain additional information or biospecimens, or
for future research.
3. Public Comments
    Each of the proposed additional elements of informed consent found
in the NPRM at Sec.  __.116(b)(7)-(9) received approximately 50
comments. All three proposals were generally favored by the public.
With respect to the proposed element of consent at Sec.  __.116(b)(7),
requiring that prospective subjects be informed that their biospecimens
may be used for commercial profit and whether the subject will or will
not share in this commercial profit, comments, especially from
individual members of the public not identified with any institution or
organization, indicated that the extent to which an investigator might
profit from information or biospecimens collected or used during a
study was an important decision point as to whether a prospective
subject would want to participate in a study. In response to proposed
element Sec.  __.116(b)(8)--requiring that prospective subjects be
informed of whether clinically relevant research results, including
individual research results, will be disclosed to subjects, and if so,
under what conditions--several public comments stated that knowing
whether or not

research results would be returned to them was an important piece of
information for them to know and understand in deciding whether to
participate in a study.
    Finally, comments discussing Sec.  __.116(b)(9) regarding the
potential to be contacted for future studies noted that allowing an
individual to indicate whether or not he or she might be contacted for
future research studies respected subject autonomy. Those who opposed
the provision noted that while the intent of the provision was
laudable, the ensuing tracking system that would need to be developed
by institutions to track who had said ``yes'' or ``no'' to being re-
contacted, and in what circumstances, would be difficult to develop and
maintain, and would also represent significant costs to institutions
without a corresponding tangible increase in the protections afforded
to human subjects.
4. Response to Comments and Explanation of the Final Rule: Additional
Elements of Consent
    The final rule contains two of the three proposed additional
elements of consent. The final rule does not include the additional
element proposed in the NPRM relating to providing subjects or their
legally authorized representatives the option to consent or refuse to
consent to being re-contacted to obtain additional information or
biospecimens, or for future research.
    New additional elements included in the final rule are: (1) A
statement that the subject's biospecimens (even if identifiers are
removed) may be used for commercial profit and whether the subject will
or will not share in this commercial profit (Sec.  __.116(c)(7)); and
(2) a statement regarding whether clinically relevant research results,
including individual research results, will be disclosed to subjects,
and if so, under what conditions (Sec.  __.116(c)(8)). Because many
public comments addressed a desire to share in the profits of
successful products developed using their biospecimens, we believe that
investigators, when appropriate, should inform prospective subjects
about whether they might or might not benefit commercially from future
products resulting from the research, should that possibility be
important in their decision making process. Also, several comments
received from individuals who reported participation in research
studies described disappointment that research results were not
returned to them. We believe that potential subjects should be aware of
the possibility that they might not receive research results, as well
as the possibility that they might, so that they can factor that
information into their decision about whether to consent to research.
This provision is intended to pertain to all clinically relevant
research results, including general or aggregate research findings and
individual research results.
    We are also including in the final rule an additional element that
when appropriate for research involving biospecimens, subjects be
informed of whether the research will (if known) or might include whole
genome sequencing (WGS) (Sec.  __.116(c)(9)). This provision of the
final rule describes WGS as the sequencing of a human germline or
somatic specimen with the intent to generate the genome or exome
sequence of that specimen. WGS generates an extremely large amount of
information about people, including factors that will contribute to
their future medical conditions. As was recognized in the NPRM's
Alternative Proposal A to expand the definition of ``human subject'' to
include WGS (discussed in Section III), data obtained through WGS can
provide important insights into the health of individuals as well as
their biological family. It is also possible that WGS data gathered for
one purpose may reveal important information, perhaps unanticipated and
unplanned for, years later. Given the unique implications of the
information that can be developed through WGS, if it is either known
that a specific research study will include this technique, or might
include it, we believe that this aspect of the research must be
disclosed to prospective subjects as part of the informed consent
process. It is recognized that under the pre-2018 rule, if a research
study were to involve WGS, this research procedure would have almost
always been included in the description of the research. However, to
remove any ambiguity about whether such information would need to be
included in the informed consent, the final rule makes this requirement
explicit through this new element of consent.
    The information that would have to be disclosed under these
additional elements of consent is often relevant to an individual's
decision of whether to participate in a research study. Such
information may have been included in informed consent forms under the
pre-2018 rule. However, the final rule now requires inclusion of these
additional elements, when appropriate.
    The additional element of consent proposed in the NPRM that was not
included in the final rule would have required providing subjects or
their legally authorized representatives with an option to consent, or
refuse to consent, to investigators re-contacting the subject to seek
additional information or biospecimens or to discuss participation in
another research study. Although for some research studies, it will be
desirable to inform prospective subjects about investigators' plan to
re-contact subjects for certain purposes, and give them the option to
agree or disagree to such re-contact, we agree with the public comments
that questioned the importance of requiring that such information be
included in the consent form. Although the final rule does not include
this additional element of consent, this information can be included in
the consent form.

D. Elements of Broad Consent for the Storage, Maintenance, and
Secondary Research Use of Identifiable Private Information or
Identifiable Biospecimens (Sec.  __.116(d))

1. Background and Pre-2018 Requirements
    Under the pre-2018 rule, if identifiers are removed from
information and biospecimens such that the identity of the subject
could not be readily ascertained by an investigator or associated with
the information or biospecimens, then such information and biospecimens
that have been collected for purposes other than the proposed research
could be used without any requirement for informed consent. Similarly,
under the HIPAA Privacy Rule, if data are de-identified or HIPAA
identifiers do not accompany biospecimens, then the Privacy Rule does
not apply. When identifiers have not been removed, under the pre-2018
rule investigators were allowed in certain situations to obtain a
consent that is broader than for a specific research study, such as for
creating a research repository that involves obtaining biospecimens
from living individuals for use in future research studies. In these
cases, an IRB could determine that the original consent for the
creation of the research repository satisfied the requirements of the
Common Rule for the conduct of the future research, provided that the
elements of consent continue to be satisfied for the future research.
Despite this flexibility in the Common Rule, stakeholders and the
Common Rule departments and agencies believe that the elements of
consent required under Sec.  __.116 of the pre-2018 rule often were not
satisfied in the case of broad consent for future unspecified research
use of identifiable private information or identifiable biospecimens.

    With respect to HIPAA, HHS's pre-2013 interpretation of the HIPAA
Privacy Rule was that authorizations for research needed to be study-
specific, and thus, that such authorizations could not authorize
certain future unspecified research. However, in January 2013, the
Office for Civil Rights modified its prior interpretation.\46\ Under
the new interpretation, an authorization now may be obtained from an
individual for uses and disclosures of protected health information for
future research purposes, so long as the authorization adequately
describes the future research such that it would be reasonable for the
individual to expect that his or her protected health information could
be used or disclosed for the future research purposes.
---------------------------------------------------------------------------

    \46\ HHS. Modifications to the HIPAA Privacy, Security,
Enforcement, and Breach Notification Rules Under the Health
Information Technology for Economic and Clinical Health Act and the
Genetic Information Nondiscrimination Act; Other Modifications to
the HIPAA Rules. 78 FR 5611 (Jan. 25, 2013). Retrieved from https://www.gpo.gov//fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf.
---------------------------------------------------------------------------

    Because biospecimens and information that have been collected for
clinical use or purposes other than for the proposed research are often
an important source of information and material for investigators, and