The rationale for this excluded category is that these activities
are designed only to improve the implementation of a practice that is
already accepted, not to evaluate the effectiveness and value of the
accepted practice itself, and thus would generally be expected to pose
little if any risks to the recipients of those practices, and are
directly aimed at improving the practical use of those practices. This
does not include quality improvement activities designed with a
research purpose relating to the safety and efficacy of the accepted
practice. It is accordingly important to note that activities that do
involve such research--for example, assigning patients to different
versions of treatments that are within the standard of care in order to
evaluate the differences between those treatments in terms of
effectiveness or risks--would not come within this exclusion. In the
educational context, for example, activities where students are
assigned to experimental and control groups to determine the
effectiveness of experimental teaching methodologies would also not
come within this exclusion. Furthermore, that type of activity would
also not meet a separate requirement of this exclusion--that the
activity be related to the delivery of (i.e., implementing) an accepted
form of care, and not an attempt to evaluate the efficacy or risks of
that form of care.
v. Public Health Surveillance (NPRM at Sec.  __.101(b)(1)(v))
(1) NPRM Proposal
    The fifth category of excluded activities involves public health
surveillance activities, including the collection and testing of
biospecimens, conducted, supported, requested, ordered, required, or
authorized by a public health authority and limited to those necessary
to allow the public health authority to identify, monitor, assess, or
investigate potential public health signals or the onset of a disease
outbreak, including trends, or signals, and patterns in diseases, or
sudden increase in injuries from using a consumer product, or
conditions of public health importance, from data, and including those
associated with providing timely situational awareness and priority
setting during the course of an event or crisis that threatens public
health, including natural or man-made disasters. A majority of
commenters to the 2011 ANPRM supported excluding public health
activities from the scope of the Common Rule.
    The rationale for excluding some public health surveillance
activities is that when a public health authority conducts public
health surveillance activities to fulfill its legal mandate to protect
and maintain the health and welfare of the populations it oversees, the
regulatory protections of the Common Rule should not impede its ability
to accomplish its mandated mission of promoting this recognized public
good, in keeping with the principle of beneficence. Other protections
independent of the Common Rule exist that serve to protect the rights
and welfare of individuals participating in such activities, including
privacy, confidentiality and security safeguards for the information
collected.
    Public health surveillance refers to the collection, analysis, and
use of data to target public health prevention. It is the foundation of
public health practice. Surveillance uses data from a variety of
sources, including mandatory reporting of certain conditions, routine
monitoring, vital records, medical billing records, and public health
investigations in response to reports of potential outbreaks. The line
between public health surveillance and epidemiological research can be
difficult to draw, as the same techniques may be used in both.
Generally, the difference between the activities is the purpose or
context in which the investigation is being conducted and the role of
the public health authority.
    The following are examples of activities that meet the public
health surveillance exclusion:
     Safety and injury surveillance activities designed to
enable a public health authority to identify, monitor, assess, and
investigate potential safety signals for a specific product or class of
products (for example, the surveillance activities of the FDA's Adverse
Event Reporting System (AERS), the Vaccine Adverse Event Reporting
System (VAERS), Manufacturer and User Facility Device Experience
(MAUDE) database, the Medical Product Safety Network (MedSun), and the
Sentinel Initiative);
     Surveillance activities designed to enable a public health
authority to identify unexpected changes in the

incidence or prevalence of a certain disease in a defined geographic
region where specific public health concerns have been raised (e.g.,
the U.S. influenza surveillance system, which allows CDC to find out
when and where influenza activity is occurring, track influenza-related
illness, determine what influenza viruses are circulating, detect
changes in influenza viruses, and measure the impact influenza is
having on hospitalizations and deaths in the United States);
     Surveillance activities designed to enable a public health
authority to identify the prevalence of known risk factors associated
with a health problem in the context of a domestic or international
public health emergency;
     Surveillance activities designed to enable a public health
authority to locate the range and source of a disease outbreak or to
identify cases of a disease outbreak;
     Surveillance activities designed to enable a public health
authority to detect the onset of disease outbreaks or provide timely
situational awareness during the course of an event or crisis that
threatens the public health, such as a natural or man-made disaster.
    On the other hand, subsequent research using information collected
during a public health surveillance activity, for instance genetic
analysis of biospecimens, would not fall under this exclusion, but
would likely be covered under one or more of the other exclusions for
low-risk research or exemptions.
    Additional examples of activities that would not fall under the
exclusion include: Exploratory studies designed to better understand
risk factors, including genetic predisposition, for chronic diseases;
exploratory studies designed elucidate the relationships between
biomarkers of exposure and biomarkers of disease; exploratory studies
of potential relationships between behavioral factors (e.g., diet) and
indicators of environmental exposures. These types of activities would
be considered research, and thus subject to the Common Rule, even if
conducted by a Federal agency with a public health mandate. To clarify
this proposed exclusion the NPRM also proposes a new regulatory
definition of public health authority proposed in Sec.  __.102(k).
(2) Question for Public Comment
    8. Public comment is requested on whether the parameters of the
exclusions are sufficiently clear to provide the necessary operational
guidance, or whether any additional criteria or parameters should be
applied to clarify or narrow any of these exclusions.
vi. Intelligence Surveillance Activities (NPRM at Sec.
__.101(b)(1)(vi))
(1) NPRM Proposal
    The sixth category of excluded activities that will not be
considered research involves surveys, interviews, surveillance
activities and related analyses, or the collection and use of
biospecimens where these activities are conducted by a defense,
national security, or homeland security authority solely for authorized
intelligence, homeland security, defense, or other national security
purposes.
    The rationale for excluding the defense or national security-
related activities is similar to that described above regarding public
health surveillance activities. The lawful conduct of the departments'
and agencies' mandated missions for actively protecting national
security, homeland security, and homeland defense are fundamentally not
research. These activities may incorporate the collection and analysis
of identifiable information, but they are not designed to develop or
contribute to generalizable knowledge; rather, they are solely
conducted to fulfill a department or agency's legal mandate to ensure
the safety and protection of the United States, its people, and its
national security interests. This exclusion codifies the current
interpretation of the Common Rule. Research conducted or sponsored by
Federal departments and agencies using this exclusion will continue to
be subject to this regulation.
b. Exclusion of Activities That Are Low-Risk and Already Subject to
Independent Controls (NPRM at Sec.  __.101(b)(2))
i. NPRM Goals
    The NPRM proposes to exclude four categories of research activities
that do not entail physical risk and are non-intrusive, either in
themselves or because they are subject to policies that provide
oversight independent of the Common Rule. Although the activities are
research, they will not be required to receive any form of
determination or IRB approval--including expedited review.
Additionally, statements of purpose, benefit, and voluntariness as well
as consent are not required unless the entity conducting the research,
collecting data, or providing data is also subject to separate statutes
and regulations requiring such statements. Some of the activities
proposed for exclusion are categories that appear as exemptions in the
current Rule. It is proposed that the marginal protections provided by
the Common Rule are not consistent with the amount of researcher time
and institutional resources that they currently draw.
    By reclassifying certain research activities from being exempt to
being excluded, the proposed rule would eliminate the need for any
administrative or IRB review. All investigators performing excluded
studies are expected to act in a way that is consistent with the
principles outlined in the Belmont Report, even if the Common Rule does
not impose requirements on excluded work. For instance, consistent with
the spirit of respect for persons, investigators should tell
prospective subjects the purpose of the information collection and,
where appropriate, that they can choose to participate or not in these
activities, although investigators are not explicitly required to do
so.
    Designating certain research fully outside of the bounds of the
Common Rule means that investigators are self-determining whether their
own research is covered by the law. As such, the proposal to add these
categories is based on the assumption that all investigators will be
accurately determining whether their proposed activity is outside the
scope of the Common Rule. There is no current proposal outlining how
decisions will be made for determining whether a research activity is
eligible for exclusion and by whom or how differences among
collaborators would be handled. As readers review each of the exclusion
categories below, please consider whether the benefits associated with
reducing the delay for researchers are countervailed by potential
increases in risk of harm.
    Throughout this NPRM, the term ``low-risk'' is used to denote
research activities that do not entail physical risk, and where both
the probability and magnitude of other risks, once required protections
are applied, are hypothesized to be low. Public comment is sought on
whether there are instances in the regulatory text where the term
``low-risk'' is used, but these conditions do not apply, and whether
there is a better way to characterize this category of risk.
ii. ANPRM Discussion
    The ANPRM discussed criticisms of the current rule that it does not
adequately calibrate the review process to the level of risk of the
research, particularly in social and behavioral research. It also
discussed whether answering questions should be sufficient indication
of willingness to participate in survey or interview

research. It distinguished between informational or psychological risks
and physical risks, and raised questions about how effectively IRB
review provides protections from informational or psychological risks.
iii. Educational Tests, Survey Procedures, Interview Procedures, or
Observation of Public Behaviors (NPRM at Sec.  __.101(b)(2)(i))
(1) NPRM Proposal
    The exclusion at Sec.  __.101(b)(2)(i) is for research, not
including interventions, that involves the use of educational tests
(cognitive, diagnostic, aptitude, achievement), survey procedures,
interview procedures, or observation of public behavior (including
visual or auditory recording) uninfluenced by the investigators, if at
least one of the following is met:
     The information is recorded by the investigator in such a
manner that human subjects cannot be identified, directly or through
identifiers linked to the subjects; or
     Any disclosure of the human subjects' responses outside
the research would not reasonably place the subjects at risk of
criminal or civil liability or be damaging to the subjects' financial
standing, employability, educational advancement, or reputation; or
     The research will involve a collection of information
subject to the Paperwork Reduction Act of 1995, 44 U.S.C. 3501 et seq.,
research information will be maintained on information technology that
is subject to and in compliance with section 208(b) of the E-Government
Act of 2002, 44 U.S.C. 3501 note, and all of the information collected,
used, or generated as part of the research will be maintained in a
system or systems of records subject to the Privacy Act of 1974, 5
U.S.C. 552a.
    The exclusion does not include research activities in which any
sort of intervention is used, in addition to the specified methods of
information collection. Also, the term ``survey'' as used here refers
to information collected about individuals via questionnaire or similar
procedures (e.g., the Current Population Survey conducted by the
Census). ``Human subjects'' do not include organizations or businesses.
``Survey,'' as used here, does not include the collection of
biospecimens or other types of information collection that might
involve invasive procedures. Thus, a survey that included information
collections in addition to verbal or written responses, including the
collection of a biospecimen or the use of some other physically
invasive procedures (e.g., a diagnostic test and blood spot or buccal
swab) could not use this exclusion.
    This exclusion includes the research activities in current
exemption category 2 in the (current Common Rule at Sec.
__.101(b)(2)), and some additional government information collection
research activities using the same methods. As in the current exemption
category 2, this proposed exclusion includes research studies whose
methods consist of the use of educational tests, survey procedures or
interview procedures, or observation of public behavior uninfluenced by
the investigators, if the data are recorded anonymously, or the
information is recorded with identifiers, but is not sensitive such
that its disclosure could result in harm to the subjects. The exclusion
provides a list of the specific harms that must be considered, which is
the same as in the current exemption category, with the addition of the
specific harm of being damaging to the subjects' educational
advancement. This potential harm has been added because of the obvious
relevance to the effects of the disclosure of responses in research
involving educational tests.
    This proposed exclusion does not include the first element in the
current exemption category at Sec.  __.101(b)(3)(i), which is the
element pertaining to research involving the use of educational tests,
survey procedures, interview procedures, or observation of public
behavior if the human subjects are elected or appointed public
officials or candidates for public office. The rationale for this
change in the proposed NPRM is that it does not seem appropriate to
single out this category of subjects for different treatment in this
way.
    The third element of this proposed exclusion covers research
activities using the same methods identified above even when the data
are recorded with identifiers and the information recorded may be
personally sensitive or private but not explicitly damaging to an
individual, if the research is subject to specified federal statutes
and regulations that require data security and subject privacy
protections. Under this proposal, the preponderance of research
conducted by Federal employees and contractors that collects
information exclusively through educational tests, questionnaires, or
observations of behavior would no longer be subject to the Common Rule
because most such collections would be subject to the Paperwork
Reduction Act of 1995, would be maintained on information technology
that is subject to and in compliance with section 208(b) of the E-
Government Act of 2002, and all of the information collected, used, or
generated as part of the research would be maintained in a system or
systems of records subject to the Privacy Act of 1974. Furthermore,
consistent with these laws, OMB's Standard 2.2 in its ``Standards and
Guidelines for Statistical Surveys'' \46\ identifies the required
notifications to potential survey respondents.
---------------------------------------------------------------------------

    \46\ Executive Office of the President, OMB. (Sept. 2006).
Standards and Guidelines for Statistical Surveys. Retrieved from The
White House: https://www.whitehouse.gov/sites/default/files/omb/inforeg/statpolicy/standards_stat_surveys.pdf.
---------------------------------------------------------------------------

    Specifically, Standard 2.2 states that Federal agencies must ensure
that each information collection instrument clearly states the reasons
the information is planned to be collected; the way such information is
planned to be used to further the proper performance of the functions
of the agency; whether responses to the collection of information are
voluntary or mandatory (citing authority); the nature and extent of
confidentiality to be provided, if any (citing authority); an estimate
of the average respondent burden together with a request that the
public direct to the agency any comments concerning the accuracy of
this burden estimate and any suggestions for reducing this burden; the
OMB control number; and a statement that an agency may not conduct and
a person is not required to respond to an information collection
request unless it displays a currently valid OMB control number. These
policies are rooted in the Fair Information Practice Principles that
cover the following concepts: Individual participation, transparency,
authority, purpose specification and use limitation, minimization,
access and amendment, redress, quality and integrity, security,
training, integration, and accountability. It is proposed that the
information risk protections afforded by these laws and their
implementing regulations are generally stronger than the privacy
protections that result from IRB review, and would result in affording
more uniform protections to participants.
    The rationale for excluding these research activities from the
Common Rule, even when the research is not otherwise subject to
additional federal controls, is that consent is inherent to
participation and that the risks most likely to be experienced by
subjects are related to disclosure of anonymous, non-sensitive
information and are thus categorized as ``low.'' Said another way, all
individuals, including vulnerable populations, would understand that
actively providing response to

educational tests, surveys, or interview procedures constitutes consent
to participate and that the risk associated with such participation
would be related to disclosure of the information they provided. The
exclusion of this type of activity rests in large part on the idea that
all individuals, regardless of the setting or context in which the
activity will take place, are generally familiar with common forms of
educational tests, survey and interview procedures which they
experience in their daily lives, and do not need additional measures to
protect themselves and their privacy from investigators who seek their
involvement in research activities involving these procedures.
    This exclusion is based on the assumption that the activities
covered by this category are largely informational, and thus the most
important role that an IRB might play with respect to reducing
potential harms is to ensure data security and privacy protections.
Under this assumption, the proposed exclusion is consistent with the
principle of respect for persons and the preservation of autonomy. In
the case of observation of public behavior, even if the subject does
not know that an investigator is watching his or her actions, the
subject's behavior is public and could be observed by others and thus
the research observation is not inappropriately intrusive. However,
there are situations in which this assumption would not always hold.
For instance, administration of a questionnaire or participation in a
focus group on a sensitive topic may induce significant stress in some
individuals, or individuals approached about taking a survey may feel
compelled to participate. Whether and how the exclusion should be
bounded so that the final rule achieves a balance among the principles
of beneficence, autonomy, and justice is the subject of the request for
comment on this proposed exclusion.
    In addition, this exclusion is in keeping with one of the goals of
this NPRM, namely to reduce burden on research that includes sufficient
protections to research subjects. By proposing that this exclusion
could be satisfied if the information to be collected is subject to the
Paperwork Reduction Act of 1995, would be maintained on information
technology that is subject to and in compliance with section 208(b) of
the E-Government Act of 2002, and all of the information collected,
used, or generated as part of the research would be maintained in a
system or systems of records subject to the Privacy Act of 1974, the
NPRM notes that the privacy protections afforded by these laws are
generally comparable, if not stronger, than the privacy protections
that result from IRB review.
(2) Questions for Public Comment
    9. Public comment is requested on the extent to which covering any
of these activities under the Common Rule would substantially add to
the protections provided to human research subjects.
    10. Public comment is sought on whether this exclusion should only
apply to research activities in which notice is given to prospective
subjects or their legally authorized representatives as a regulatory
requirement. If so, please comment on what kind of information should
be included in the notice such as the research purpose, privacy
safeguards, contact information, ability to opt-out, etc. Would
requiring notice as a condition of this exempt research strike a good
balance between autonomy and beneficence?
    11. Public comment is sought regarding whether it is reasonable to
rely on investigators to make self-determinations for the types of
research activities covered in this particular exclusion category. If
so, should documentation of any kind be generated and retained?
    12. Public comment is sought regarding whether some or all of these
activities should be exemptions rather than exclusions.
    13. Public comment is sought regarding whether these exclusions
should be narrowed such that studies with the potential for
psychological risk are not included. Are there certain topic areas of
sensitive information that should not be covered by this exclusion? If
so, please provide exemplary language to characterize such topic areas
in a manner that would provide clarity for implementing the Rule.
    14. For activities captured under the third element of this
exclusion, do the statutory, regulatory, and other policy requirements
cited provide enough oversight and protection that being subject to
expedited review under the Common Rule would produce minimal additional
subject protections? If so, should the exclusion be broadened to also
cover secondary analysis of information collected pursuant to such
activities?
    15. Public comment is requested on the extent to which excluding
any of these research activities from the Common Rule could result an
actual or perceived reduction or alteration of existing rights or
protections provided to human research subjects. Are there any risks to
scientific integrity or public trust that may result from excluding
these research activities from the Common Rule?
iv. Research Involving the Collection or Study of Information that has
been or will be Collected (NPRM at Sec.  __.101(b)(2)(ii))
(1) Current Rule
    This exclusion appears in the current Common Rule as exemption
category 4 (current Rule at Sec.  __.101(b)(4)). This exemption
currently applies to research involving the use of existing data,
documents, records, and pathological or diagnostic specimens, but only
if the sources are publicly available or if the information is recorded
by investigators in such a manner that subjects cannot be identified,
directly or through identifiers linked to them.
(2) ANPRM Discussion
    The ANPRM proposed retaining this exemption as an exemption (not an
exclusion). The ANPRM asked questions about whether the current
limitations specified in exempt category 4 (research involving the use
of existing information or biospecimens, Sec.  __.101(b)(4) in the
current Rule) should be eliminated. Specifically, the ANPRM suggested
that the category would be revised to eliminate the word ``existing.''
With this elimination, the exemption would be broadened to cover the
use of information or biospecimens that were or will be collected for
purposes other than the suggested research, rather than requiring that
all of the information or biospecimens already exist at the time the
study is suggested for exemption.
(3) NPRM Proposal
    The second category of low-risk research activities excluded from
the proposed rule is a revised version of the current Rule's exemption
category 4 (current Rule at Sec.  __.101(b)(4)). The NPRM proposal is
that the excluded category at Sec.  __.101(b)(2)(ii) includes research
involving the collection or study of information that has been or will
be acquired solely for non-research activities or was acquired for
research studies other than the proposed research study when the
sources are publicly available, or the information is recorded by the
investigator in such a manner that human subjects cannot be identified,
directly or through identifiers linked to the subjects, the
investigator does not contact the subjects, and the investigator will
not re-identify subjects or otherwise conduct an analysis that could
lead to

creating individually identifiable private information.
    In light of the proposed expansion of the rule to cover certain
biospecimens regardless of identifiability, this category has been
modified such that it does not include secondary research use of
biospecimens. Many of the comments supported the discussion in the
ANPRM of eliminating the requirement that the information be
``existing'' at the time the study was suggested for exemption. Thus,
in addition to changing this category of activities from being exempted
to being excluded, the proposed exclusion does not require that the
data exist as of the time that the study commences, but rather is
expanded to include the secondary research use of data collected in the
future for research or non-research purposes. The underlying logic
behind the exclusion in proposed Sec.  __.101(b)(2)(ii) is that such
research involves no direct interaction or intervention with human
subjects, and any research use of the information does not impose any
additional personal or informational risk to the subjects, because (1)
the information is already available to the public, and so any risk it
may include exists already, or (2) the information recorded by the
investigator cannot be identified, and no connection to or involvement
of the subjects is contemplated. Any requirements of the Common Rule
would not provide additional protections to subjects, and could add
substantial administrative burden on IRBs, institutions, and
investigators. Creating this excluded category avoids that problem.
(4) Questions for Public Comment
    16. Public comment is sought regarding whether it is reasonable to
rely on investigators to make self-determinations for the types of
research activities covered in this particular exclusion category. If
so, should documentation of any kind be generated and retained?
    17. Public comment is requested on the extent to which covering any
of these activities under the Common Rule would substantially add to
the protections provided to human research subjects. Is there a way in
which this exclusion should be narrowed? Public comment is also sought
regarding whether activities described here should appear as an
exclusion or as an exemption.
v. Research Conducted by a Government Agency using Government-Generated
or Government-Collected Data (NPRM at Sec.  __.101(b)(2)(iii))
(1) NPRM Proposal
    The third category of low-risk research activities excluded from
the proposed rule at Sec.  __.101(b)(2)(iii) is research conducted by a
federal department or agency using government-generated or government-
collected information obtained for non-research purposes (including
criminal history data), if the information originally involved a
collection of information subject to the Paperwork Reduction Act of
1995, 44 U.S.C. 3501 et seq., the information is maintained on
information technology that is subject to and in compliance with
section 208(b) of the E-Government Act of 2002, 44 U.S.C. 3501 note,
and all of the information collected, used, or generated as part of the
research is maintained in a system or systems of records subject to the
Privacy Act of 1974, 5 U.S.C. 552a. This proposed exclusion is
consistent with the Federal Government's emphasis on minimizing the
burden on the public and maximizing the value of the information
collected by the Federal Government, while protecting participant
privacy and data security.\47\ This exclusion is proposed for
situations in which both the original data collection and the
subsequent (secondary) analysis are subject to data security,
participant privacy, and notice requirements associated with the named
federal statutes and regulations. As such, it does not seem that the
delay imposed by obtaining a determination as ``exempt'' or
``expedited'' is likely to increase the protections provided to those
who have already provided the government with information for other
purposes. Public comment is requested on the extent to which covering
any these activities under the Common Rule would substantially add to
the protections provided to human research subjects.
---------------------------------------------------------------------------

    \47\ United States Office of Management and Budget, February 14,
2014, Memorandum to Heads of Executive Departments and Agencies;
Guidance for Providing and Using Administrative Data for Statistical
Purposes https://www.whitehouse.gov/sites/default/files/omb/memoranda/2014/m-14-06.pdf. This guidance builds on three previously
issued OMB memoranda designed to increase the value of existing
data: Sharing Data While Protecting Privacy (M-11-02 of November 3,
2010), Open Data Policy-Managing Information as an Asset (M-13-13 of
May 9, 2013), and Next Steps in the Evidence and Innovation Agenda
(M-13-17 of July 26, 2013).
---------------------------------------------------------------------------

(2) Questions for Public Comment
    18. Public comment is sought on whether this or a separate
exclusion should also include research involving information collected
for non-research purposes by non-federal entities where there are
comparable privacy safeguards established by state laws and
regulations, or whether such non-federally conducted research would be
covered by the proposed exemption at Sec.  __.104(e)(2).
    19. Public comment is requested on the extent to which covering any
of these activities under the Common Rule would substantially add to
the protections provided to human research subjects.
    20. Public comment is sought regarding whether it is reasonable to
rely on investigators to make self-determinations for the types of
research activities covered in this particular exclusion category. If
so, should documentation of any kind be generated and retained?
    21. Public comment is sought regarding whether some or all of these
activities should be exemptions rather than exclusions.
vi. Certain Activities Covered by HIPAA (NPRM at Sec.
__.101(b)(2)(iv))
(1) ANPRM Discussion
    The public was asked to comment on whether it might be useful to
adopt the distinction made by the HIPAA Privacy Rule, which
distinguishes between ``health care operations'' and ``research''
activities, defining ``health care operations'' to include, among other
activities, ``conducting quality assessment and improvement activities,
including outcomes evaluation and development of clinical guidelines,
provided that the obtaining of generalizable knowledge is not the
primary purpose of any studies resulting from such activities.'' The
public was asked to comment about this specifically in the context of
quality improvement activities.
(2) NPRM Proposal
    The fourth category of low-risk research activities excluded from
the proposed rule, found at Sec.  __.101(b)(2)(iv), covers activities
that are regulated under the HIPAA Privacy Rule (i.e., covered
entities). These are activities whose risks relate only to privacy and
confidentiality, and are already subject to independent controls
provided by HIPAA. Specifically, it is proposed that research, as it is
defined in this proposed rule, that involves the use of protected
health information by a HIPAA covered entity for ``health care
operations,'' ``public health activities,'' or ``research,'' as those
three terms are defined under the HIPAA Rules, would

be excluded from the Common Rule. This proposed exclusion would not
apply if the investigator that receives and uses individually
identifiable health information for a research study was not covered by
the HIPAA Rules, even if the entity disclosing the individually
identifiable health information to the investigator was covered by the
HIPAA Rules. The exclusion is limited in this way to ensure that it
only applies to research studies and information that are already
subject to independent privacy, confidentiality, and security
protections.
    A majority of comments on the 2011 ANPRM favored distinguishing
between research and health care operations, as such terms are defined
in the HIPAA Privacy Rule and the Health Information Technology for
Economic and Clinical Health (HITECH) Act, and excluding the latter
from the policy. Some commenters noted that people involved in these
various activities are protected in other ways, and alluded to the
sorts of measures that provide protection. Others suggested that any
exclusions should be limited to data collection and analysis
activities, or to activities below a certain threshold of risk (i.e.,
minimal risk). A minority of comments objected to these exclusions,
arguing that these activities represent encroachments on their
individual rights and privacy, and that oversight in accordance with
the Common Rule requirements would be more protective. The proposed
exclusion excludes only certain activities that involve data collection
and analysis, where privacy safeguards are in place.
(3) Questions for Public Comment
    22. Public comment is requested on whether the protections provided
by the HIPAA Rules for identifiable health information used for health
care operations, public health activities, and research activities are
sufficient to protect human subjects involved in such activities, and
whether the current process of seeking IRB approval meaningfully adds
to the protection of human subjects involved in such research studies.
    23. Public comment is sought regarding to what extent the HIPAA
Rules and HITECH adequately address the beneficence, autonomy, and
justice aspects for the collection of new information (versus
information collected or generated in the course of clinical practice,
e.g., examination, treatment, and prevention). Should this exclusion be
limited to data collected or generated in the course of clinical
practice? If additional data collection is allowable, should it be
limited to what is on the proposed Secretary's list of minimal risk
activities (discussed in more detail below in II.F.2 of this preamble)?
    24. Public comment is requested on whether additional or fewer
activities regulated under the HIPAA Privacy Rule should be included in
this exclusion.
c. Applicability of Exclusions to the Subparts
i. Current Rule
    The current Common Rule does not contain exclusion categories,
though as discussed above, some of the proposed exclusions are similar
to activities that are exempt under the current regulations, which
therefore might provide a basis for comparison.
    All of the current exemption categories can be applied to research
that is subject to subpart B. None of the current exemption categories
can be applied to research that is subject to subpart C.
    The exemptions in the current Rule generally apply to subpart D.
However, the exemption at Sec.  __.101(b)(2), for research involving
educational tests, survey or interview procedures, or observation of
public behavior does not apply to subpart D except for research
involving educational tests or observations of public behavior when the
investigators do not participate in the activities being observed.
ii. NPRM Proposals
    Language specifying the application of the exclusions to the
subparts can be found in the NPRM at Sec.  __.101(b)(2) and (3).
    It is proposed that all of the exclusion categories in Sec.
__.101(b)(2) and (3) apply to research that is subject to subpart B,
and therefore the requirements imposed by subpart B would not need to
be met.
    It is similarly proposed that all of the exclusion categories in
Sec.  __.101(b)(2) and (3) apply to research involving prisoners,
therefore the requirements of subpart C would not need to be met. This
would narrow the scope of research currently requiring subpart C review
and certification to OHRP. Considerations in favor of this conclusion
include the preponderance of low-risk socio-behavioral research
designed to improve prisoner welfare, including studies that focus on
substance abuse treatment, community reintegration, and services
utilization; the occurrence of prisoner-subjects in research not
targeting prisoner populations; the occurrence of prisoner-subjects in
databases or registries; and the broad regulatory interpretation of the
subpart C ``prisoner'' definition. Public comment is requested on
whether the application of these exclusions to research involving
prisoners is appropriate and acceptable.
    It is proposed that all of the exclusion categories in Sec.
__.101(b)(2) apply to research subject to subpart D, with the exception
that the exclusion proposed under Sec.  __.101(b)(2)(i) would only
apply to research involving educational tests or observations of public
behavior when the investigator does not participate in the activities
being observed. This limitation would maintain the protection currently
provided by the similar application of the current exemption Sec.
__.101(b)(2) to research involving children, and would continue to
require IRB review under the Common Rule and additional IRB review
under subpart D of 45 CFR part 46 when the research involves surveys or
interview procedures with children or observation of public behavior
when the investigator participates in the activities being observed.
iii. Questions for Public Comment
    25. Should research involving prisoners be allowed to use any or
all of the exclusions found at Sec.  __.101(b)(2) and (3), as currently
proposed?
    26. Are there certain provisions within the broader categories
proposed at Sec.  __.101(b)(2) and (3) to which the subparts should or
should not apply?
3. Proposed Exemptions (NPRM at Sec.  __.104)
    The Common Rule has been criticized for inadequately calibrating
the review process to the risk of research. Some have argued that,
particularly given the paucity of information suggesting significant
risks to subjects in certain types of survey and interview-based
research, the current system overregulates such research. Further, many
critics see little evidence that most IRB review of social and
behavioral research effectively protects subjects from psychological or
informational risks. Overregulating social and behavioral research in
general may serve to distract attention from identification of social
and behavioral research studies that do pose ethical challenges and
thus merit significant oversight.
    The proposed exemption categories and attendant policies and
procedures related to exemptions appear in the NPRM at Sec.  __.104,
and are guided by the following policy goals:

     To create procedural efficiencies for IRBs, administrators
and investigators in making and receiving exemption determinations,
thereby reducing the overall IRB workload and the wait time for
investigators to begin their work.
     To ensure that reasonable safeguards are in place for
certain lower risk research activities not fully excluded under the
current Common Rule by requiring that research in certain exemption
categories follow elements of the proposed rule, but not be required to
undergo full IRB review according to the full set of criteria at Sec.
__.111(a)(1)-(8) and other regulatory requirements of the Common Rule .
    Note that all of the exemption categories in the current Rule have
been carried over to the proposed Rule in one or another form. In
particular, some of the current Rule's exemptions have now become
exclusions under the NPRM (and thus subject to no administrative or IRB
review), while some remain in the NPRM's exempt categories section.
    Under the current Common Rule, research may qualify for exemption
from the regulatory policy if it falls into one of the six current
categories at Sec.  __.101(b)(1)-(6). Such studies are fully exempt
from the regulations. The current regulations do not specify who at an
institution may determine that research is exempt under Sec.
__.101(b). However, in the past OHRP has recommended that because of
the potential for conflict of interest, investigators not be given the
authority to make an independent determination that human subjects
research is exempt. OHRP has recommended that institutions should
implement exemption policies that most effectively address the local
setting and programs of research. OHRP has recognized that this may
result in a variety of configurations of exemption authority, any of
which are acceptable assuming compliance with applicable regulations.
    The NPRM proposes to retain the term ``exempt,'' (rather than
``excused,'' as suggested in the ANPRM) but require that exempt
research comply with certain provisions of the proposed rule such as
proposed privacy safeguards at Sec.  __.105 (discussed below). This
policy retains and, in important respects (through a new safe harbor
provision), expands the current flexibility of institutions to develop
a system in which someone at the institution--including the
investigator, unless prohibited by law--uses an exemption decision tool
to make the exemption determination.
    It is important to recognize that while in some cases there are new
requirements that have been imposed on the exemption categories that do
not exist in the current version of the exemption categories, this
usually does not actually represent a tightening of the rules for those
exemptions. To the contrary, these changes are generally being made to
allow the exemption in question to be expanded to cover activities that
are not currently exempt. For example, adherence to new privacy
standards is a new requirement in order for certain surveys to be
exempt, but these are surveys that under the current Common Rule would
require IRB review.
    The proposed eight exemptions are divided into three groupings
according to the kind of risk characteristically involved and what
protections are called for: (1) Low-risk interventions that do not
require application of standards for information and biospecimen
protection; (2) research that may involve sensitive information that
requires application of standards for information and biospecimen
protection described in proposed Sec.  __.105; and (3) secondary
research involving biospecimens and identifiable private information
that requires application of privacy safeguards discussed at proposed
Sec.  __.105, broad consent as discussed in proposed Sec.  __.116(c),
and limited IRB review as discussed in proposed Sec.  __.111(a)(9).
a. Making Exempt Research Determinations (NPRM at Sec.  __.104(c))
i. NPRM Goal
    The goal of this NPRM proposal is to create procedures for
appropriate exemption determinations in a manner that does not waste
time and effort.
ii. Current Rule
    In developing policies and procedures addressing the exemptions,
OHRP currently recommends that when an exemption determination is made,
the specific exemption category or categories should be included in the
record of the material supplied to the IRB and this information should
be available for oversight purposes. In addition, OHRP guidance has
said that institutional policies and procedures should identify clearly
who is responsible for making exemption decisions. OHRP notes that
under current policy a Common Rule Department or Agency retains final
authority as to whether a particular human subjects research study
conducted or supported by that Department or Agency is exempt from the
Common Rule (Sec.  __.101(c)) and that authority continues under the
proposed regulations.
iii. ANPRM Discussion
    The ANPRM discussed a mechanism to (1) register exempt research,
and (2) audit a small but appropriate portion of such research, which
would still be subject to other regulatory protections such as the
suggested data security and information protection standards and
certain consent requirements.
    The ANPRM discussed a tracking mechanism to enable institutions to
assure that such research meets the criteria for inclusion in the
suggested ``excused'' categories. The original recommendations would
require investigators to register their study with an institutional
office by completing a brief form, thus eliminating the current
practice of not allowing investigators to begin conducting such studies
until a reviewer had determined it meets the criteria for excused
research. This would make the institution aware of key information
about the research (such as the purpose of the research and the name of
the study's principal investigator), without also requiring that the
activity undergo a review that, if not done in a timely manner, could
slow the research without adding any significant protection to
subjects. In addition, the institution could choose to review some of
the submissions at the time they are filed and, if deemed appropriate,
require that the study be sent for expedited review or, in rare cases,
convened IRB review. It would be made clear that the regulations would
not require, and in fact, would discourage, having each of these
registration forms undergo a comprehensive administrative or IRB review
prior to commencing the study or even afterward.
    The auditing requirement was intended to encourage institutions to
use the regulatory flexibility suggested for the exempt categories of
research. The auditing requirement would have provided institutions
with information needed to assess their compliance with the new
``excused'' categories without unnecessarily subjecting all such
research to either prospective review, or even routine review sometime
after the study is begun. Note that currently, OHRP recommends that
there be some type of review by someone other than the investigator to
confirm that a study qualifies as exempt, and many institutions do
impose such a requirement even though such a requirement is extra-
regulatory.\48\
---------------------------------------------------------------------------

    \48\ Office for Human Research Protections. (2011, January 20).
Exempt Research Determination FAQs. Retrieved from Frequently Asked
Questions About Human Research: http://www.hhs.gov/ohrp/policy/faq/index.html.

---------------------------------------------------------------------------

    The ANPRM also asked whether it was acceptable for investigators to
independently determine whether their research was exempt, whether
review of all registrations should be required, and whether there
should be a time limitation or waiting period before excused research
could begin.
    The ANPRM also asked whether it was appropriate to require
institutions holding a Federalwide assurance (FWA) to conduct
retrospective audits of a percentage of the excused studies to make
sure they qualify for inclusion in an excused category, and if so, how
such audits should be conducted.
iv. NPRM Proposal
    The NPRM proposes to adopt an exemption determination documentation
requirement which is somewhat different from the registration system
suggested in the 2011 ANPRM. To assist investigators and institutions
in making a timely and accurate determination of exemption status the
NPRM at Sec.  __.104(c) states that federal departments or agencies
will develop one or more exemption determination tools. Federal
departments or agencies may create their own tool, or rely on a tool
created by another department or agency (including the web-based tool
created by HHS). The tool, which has not yet been developed, will be
designed in such a way that if the person using the tool inputs
accurate information about the study, the tool will produce an outcome
which is the determination as to whether the study is exempt or not.
Institutions may rely on use of the federally developed tool by
investigators as a ``safe harbor'' for this determination: So long as
the information that was provided to the tool was accurate, result of
the application of the tool will be presumed by the federal departments
or agencies to be an appropriate determination of exempt status. Use of
the tool will be voluntary; each institution and agency would determine
whether to rely on the decision tool for their determinations, and if
so, who would be allowed to operate it. Institutions, if they so
choose, could continue to have such determinations made by an
individual who is knowledgeable about the exemption categories and who
has access to sufficient information to make an informed and reasonable
determination. In general, it is expected that investigators would not
be allowed to make exemption determinations for themselves without the
use of the decision tool, due to considerations of a conflict of
interest. It should also be noted that for FDA-regulated device studies
IRB review is required by statute.
    The NPRM also proposes that the institution or IRB be required to
maintain records of exemption determinations, which records must
include, at a minimum, the name of the research study, the name of the
investigator, and the exemption category applied to the research study.
Maintenance of the output of the completed decision tool would fulfill
this recordkeeping requirement.
    In general, commenters to the 2011 ANPRM were not necessarily
opposed to the concept of registration but sought further information
on what this process would entail. Public commenters also expressed
concerns about allowing an investigator to independently make the
determination that his or her research is exempt. Other commenters
suggested that this practice would be acceptable for some
investigators, whose research is well known to IRB members, and is
clearly within an exempt category. The ANPRM noted concerns that some
exempt research was unnecessarily delayed by requirements of some
institutions to review the research to make an exemption decision.
    Several institutions reported that they already as a matter of
policy require investigators to submit exempt studies to the IRB, not
necessarily for full board review, but to ensure that the exempt
determination is valid. These decisions typically are made by the IRB
administrator and never involve full review unless there is concern
about the exemption status. Thus, they felt the registration
requirement was unnecessary and would add new administrative burdens
for research already considered low-risk.
    Other commenters, such as investigators conducting research
currently considered exempt, were strongly opposed to a registration
requirement because it would add a new burden to conducting less than
minimal risk and exempt research. In addition, commenters raised
concerns about the administrative burden and need for a retrospective
audit system of registered research.
    This NPRM proposal is anticipated to provide more flexibility than
the registration requirement originally proposed, while helping to
ensure that correct determinations of exempt status are made. The
existence of a ``safe harbor'' mechanism will hopefully encourage
institutions to create policies that allow investigators to use the
tool, and thus to be able to more quickly commence their research
without needing additional administrative or IRB reviews for these
types of studies. Other people at the institution who have access to
accurate information about a proposed study may also utilize the tool,
which will also allow research to go forward unimpeded.
    In addition, it is proposed that a change to Sec.  __.109(a) be
made to clarify that the Common Rule does not give IRBs the authority
to review or approve, require modification in or disapprove research
that qualifies for exemption under Sec.  __.104(d), (e), or (f)(2).
    There is no auditing requirement in this NPRM proposal.
Consequently, it does not address concerns raised at the ANPRM stage
regarding potential conflict of interest if the investigator is
providing the information to operate the decision tool. Public comment
is sought on this idea regarding the operational details for further
development of this proposal. Depending upon the comments received on
this proposal, additional operational details regarding the proposed
federally sponsored decision tool would be developed and subject to
public comment. It should also be noted that the lack of an auditing
requirement would not prohibit an institution from performing post-
approval monitoring of exemption determinations according to the
institution's standard operating procedure.
v. Questions for Public Comment
    27. Public comment is sought regarding how likely it would be that
institutions would allow an investigator to independently make an
exempt determination for his or her own research without additional
review by an individual who is not involved in the research and
immersed in human research protection e.g., a member of the IRB Staff.
    28. Public comment is sought regarding whether an investigator
would be able to contrive his or her responses to the automated
exemption decision tool in order to receive a desired result i.e., an
exempt determination, even if it does not accurately reflect the
research activities.
    29. Public comment is sought on whether it would be more
appropriate for some of the exempt categories than others to rely on
the exemption determination produced by the decision tool where
investigators themselves input the data into the tool, or whether there
should be further administrative review in such circumstances.
    30. Public comment is sought regarding whether relying on the
exemption determination produced by the decision tool where
investigators themselves input the data into the tool

as proposed would reduce public trust in research.
    31. Public comment is sought regarding how likely it would be that
institutions would rely on such a decision tool to provide a safe
harbor for an investigator making a determination that the proposed
research qualifies for an exemption, or whether developing such a tool
would not be worthwhile, and whether institutions would be able to
adequately manage exemption determinations without the use of the
decision tool.
    32. Public comment is sought regarding what additional information
should be required to be kept as a record other than the information
submitted into the decision tool, for example, a study abstract, the
privacy safeguards to be employed, or any notice or consent document
that will be provided.
    33. Public comment is sought regarding the value of adding an
auditing requirement.
b. Exemptions Subject to the Documentation Requirements of Sec.
__.104(c) and No Other Section of the Proposed Rule
    Four exemptions are proposed that will not be subject to any
additional requirements apart from the need to keep a record of the
determination that the study was exempt. Three of these four exemptions
in proposed Sec.  __.104(d) are versions of exemptions found in the
current rule. A revised version of exemption category 1 in the current
Common Rule (research conducted in established or commonly accepted
educational settings) is found at proposed Sec.  __.104(d)(1) in the
NPRM. A revised version of the current exemption category 5 (research
and demonstration projects) is found at proposed Sec.  __.104(d)(2).
Exemption category 6 in the current Common Rule (taste and food quality
evaluations) is found in the NPRM at Sec.  __.104(d)(4), and is
unchanged.
i. Research Conducted in Established or Commonly Accepted Educational
Settings (NPRM at Sec.  __.104(d)(1); Current Rule at Sec.
__.101(b)(1))
(1) NPRM Goal
    The goal is to retain an exemption for a considerable portion of
education research, but to provide for review if the research might
adversely affect students' opportunity to learn required educational
content, or the assessment of educators.
(2) Current Rule
    The current exemption category 1 (Sec.  __.101(b)(1) in the current
Rule) is for research conducted in established or commonly accepted
educational settings, involving normal educational practices, such as
(i) research on regular and special education instructional strategies,
or (ii) research on the effectiveness of or the comparison among
instructional techniques, curricula, or classroom management methods.
(3) NPRM Proposal
    The first exemption category is for research conducted in
established or commonly accepted educational settings when it
specifically involves normal educational practices. This includes most
research on regular and special education instructional strategies, and
research on the effectiveness of, or the comparison among,
instructional techniques, curricula, or classroom management methods,
so long as the research is not likely to adversely impact students'
opportunity to learn required educational content in that educational
setting or the assessment of educators who provide instruction.
    This exemption category is a revised version of the first exemption
category in the current Common Rule. The rationale for the revision is
that there are concerns about whether the conduct of some research
projects of this type might draw sufficient time and attention away
from the delivery of the regular educational curriculum, and thereby
have a detrimental effect on student achievement. The current education
system places a strong emphasis on student performance on tests in core
curriculum areas such as reading, science, and mathematics, which have
a significant effect on such things as grade promotion and student
assignment to different courses, and cumulatively influence student
attainment and achievement. It could also have a negative effect on
teachers being evaluated on the basis of student performance. The
exemption category is designed to not include such research projects.
Otherwise, the exemption is retained in order to allow for the conduct
of education research that may contribute to the important public good
of improving education, consistent with the principle of beneficence.
(4) Questions for Public Comment
    34. Public comment is sought on whether this exemption category
should only apply to research activities in which notice that the
information collected will be used for research purposes is given to
prospective subjects or their legally authorized representatives as a
regulatory requirement, when not already required under the Privacy Act
of 1974. If so, comment is sought on what kind of information should be
included in the notice, such as the research purpose, privacy
safeguards, contact information, etc. Comment is also sought on how
such a notice should be delivered, e.g., publication in a newspaper or
posting in a public place such as the school where the research is
taking place, or by individual email or postal delivery. Note that
other requirements, such as those of the Family Educational Rights and
Privacy Act (FERPA) or the Protection of Pupil Rights Amendment, may
also apply. Would requiring notice as a condition of this exempt
research strike a good balance between autonomy and beneficence?
    35. Public comment is sought on whether the privacy safeguards of
Sec.  __.105 should apply to the research included in Sec.
__.104(d)(1), given that such research may involve risk of disclosure
of identifiable private information.
ii. Research and Demonstration Projects Conducted or Supported by a
Federal Department or Agency (NPRM at Sec.  __.104(d)(2); Current Rule
at Sec.  __.101(b)(5))
(1) NPRM Goal
    The NPRM exemption proposed at Sec.  __.104(d)(2) is for research
and demonstration projects involving public benefit or service
programs, and is a slightly revised version of exemption 5 in the
current Common Rule.
    The proposed regulatory revision and change in interpretation of
the exemption is designed to clarify the scope of the exemption so that
more research studies would be exempt. It is believed that these
changes would make the exemptions easier to apply. It is also designed
to allow the Federal Government to carry out important evaluations of
its public benefit and service programs to ensure that those programs
are cost effective and deliver social goods, consistent with the
principle of beneficence.
(2) Current Rule
    The current version of this exemption category was originally
created based on the recognition that alternative processes are in
place in which ethical issues raised by research in public benefit or
service programs are be addressed by the officials who are familiar
with the programs and responsible for their successful operation under
state and federal laws. These alternative processes implicitly consider
risk, but there is not a predefined scope for the likelihood or

magnitude of risk in these research activities. In fact, the Secretary
of HHS noted in 1983 that these demonstration and service projects are
already subject to procedures which provide for extensive review by
high level officials in various program administration offices. The
Secretary further noted that review by an IRB would be duplicative and
burdensome to state and local agencies and to other entities
participating in demonstration projects. It was thought that removal of
this unnecessary layer of review would not only reduce the cost of the
projects but also help avoid unnecessary delays in project
implementation.\49\
---------------------------------------------------------------------------

    \49\ 48 FR 9266 (Mar. 4, 1983).
---------------------------------------------------------------------------

    OHRP has interpreted the current exemption category 5 (Sec.
__.101(b)(5) in the current Common Rule) to apply only to those
research and demonstration projects designed to study a ``public
benefit or service program'' that a Common Rule department or agency
itself administers, and for which the public benefit or service program
exists independent of any research initiative. As an example, OHRP has
in the past said that a research study to evaluate a Centers for
Medicare & Medicaid Services (CMS)-administered demonstration project
comparing two different mechanisms for reimbursing providers under
Medicare or Medicaid would meet this exemption. However, this exemption
would not apply to some types of research, for example, the evaluation
of clinical trials (e.g., a National of Institutes of Health-funded
clinical trial comparing two treatment regimens for heart disease),
even if such studies would inform Medicare reimbursement policies.
(3) ANPRM Discussion
    The ANPRM asked several questions about the interpretation and
applicability of current exemption category 5 (current Common Rule at
Sec.  __.101(b)(5)), including the scope of the current interpretation
of the category 5 exemption. The ANPRM also asked if the current
category 5 guidance entitled, ``OPRR Guidance on 45 CFR 46.101(b)(5),''
\50\ should be revised, or if additional guidance on the interpretation
of exemption category 5 is needed.
---------------------------------------------------------------------------

    \50\ See 48 FR 9266-9270 (Mar 4, 1983). (OPRR Guidance on 45 CFR
46.101(b)(5), Exemption for Research and Demonstration Projects on
Public Benefit and Service Programs, http://www.hhs.gov/ohrp/policy/exmpt-pb.html).
---------------------------------------------------------------------------

    More specifically, the ANPRM asked whether this exemption should be
revised to assure that it is not misinterpreted or misapplied, whether
broadening it would result in inappropriately increasing risks to
subjects, how such risks might be mitigated, and whether OHRP guidance
should be revised.
(4) NPRM Proposal
    The second proposed exemption category (NPRM at Sec.  __.104(d)(2))
is for research and demonstration projects that are conducted or
supported by a Federal department or agency, or otherwise subject to
the approval of department or agency heads, and that are designed to
study, evaluate, or otherwise examine public benefit or service
programs, including procedures for obtaining benefits or services under
those programs, possible changes in or alternatives to those programs
or procedures, or possible changes in methods or levels of payment for
benefits or services under those programs.
    It is proposed that each federal department or agency conducting or
supporting the research and demonstration projects would be required to
establish, on a publicly accessible federal Web site or in such other
manner as the department or agency head may prescribe, a list of the
research and demonstration projects that the Federal department or
agency conducts or supports under this provision. The research or
demonstration project would be required to be published on this list
prior to or upon commencement of the research. Agencies and departments
would be able to create or use their own Web sites for this purpose, or
use a Web site created by OHRP. Note that for studies exempted pursuant
to Sec.  __.104(d)(2), the recordkeeping requirement at proposed Sec.
__.104(c) would be deemed to be satisfied by the published list
required under proposed Sec.  __.104(d)(2)(i).
    There were few responses to the questions posed on this exemption
in the 2011 ANPRM. However, those that did comment noted that this
category is often misunderstood by IRBs and, at best, would benefit
from clearer guidance. Commenters said that examples would help
investigators and IRBs understand when research activities included in
demonstration projects constitute human subjects research subject to
the Common Rule. Commenters noted that many activities in demonstration
projects do not contribute to generalizable knowledge as they produce
results that are relevant only to the program being assessed; as such,
many of these activities do not meet the Common Rule's regulatory
definition of ``research'' and thus fall outside of the rule. Other
commenters said that some activities in this category are mandated or
required by law or regulation and should not be considered to be under
the purview of the Common Rule. It was noted that the critical issue in
these studies should be protecting privacy and as long as measures are
in place to do so, additional protections are not required.
    The revision of the language in this exemption clarifies the
original language to say that a federally conducted project examining
any aspect of a public benefit or service program would qualify for the
exemption. The clauses concerning procedures for obtaining benefits,
other changes in programs and procedures, and changes in methods or
levels of payment are merely examples of such projects, and are not
considered to be all-inclusive.
    In addition, OHRP proposes to clarify its interpretation of public
benefit and service programs which are being evaluated as part of the
research to include public benefit or service programs that a Common
Rule department or agency does not itself administer through its own
employees or agents, but rather funds (i.e., supports) through a grant
or contract program. Therefore, the exemption would be clarified to
apply to research and demonstration projects supported through federal
grants or cooperative agreements, for example. These activities include
appropriate privacy, confidentiality and security safeguards for any
biospecimen and information used in this research. For example,
information collected in some demonstration projects are subject to the
protections of the HIPAA rules, and Federal agencies include conditions
in grants or cooperative agreements which require the recipient to
protect the confidentiality of all project-related information that
includes personally identifying information.
    It is believed that these changes would make the exemptions easier
to apply. It is also designed to allow the Federal Government to carry
out important evaluations of its public benefit and service programs to
ensure that those programs are cost effective and deliver social goods.
The proposed changes to this exemption would require OHRP to revise its
existing guidance document on this exemption accordingly.
    These changes would bring the language into conformance with other
provisions of the rule that refer to research ``conducted or
supported'' by Federal agencies. Both current practice and the edited
language cover such

research, whether it is conducted directly by federal staff or through
a contract, cooperative agreement, or grant. These methods of
administration are, of course, always subject to department or agency
head approval, directly or by delegation. In addition, some of these
research and demonstration projects are conducted through waivers,
interagency agreements, or other methods that also require agency head
approval. Accordingly, both the previous and the revised language allow
for the full panoply of methods by which research and demonstration
projects on public benefit or service programs can be carried out.
    Although research such as that described above is exempt, an
additional requirement is proposed. In the interest of transparency,
each Federal department or agency conducting or supporting the research
and demonstration projects must establish, on a publicly accessible
federal Web site or in such other manner as the Secretary may
prescribe, a list of the research and demonstration projects which the
federal department or agency conducts or supports under this provision.
The research or demonstration project must be published on this list
prior to or upon commencement of the research. The agency determines
what will be included on this list and maintains its oversight.
Agencies that already publish research and demonstration projects on a
publicly accessible Web site could satisfy this proposed requirement if
the existing Web site were to include a statement indicating which of
the studies were determined to meet this exemption. The goal of this
proposed requirement is to promote transparency of federally conducted
or supported activities affecting the public that are not subject to
oversight under the Common Rule. It should not create any delay to the
research. HHS will develop a resource that all Common Rule agencies may
use to satisfy the requirement at proposed Sec.  __.104(d)(2)(i).
Alternatively, an agency can make its own Web site.
    Currently, there is no such comprehensive listing of studies that
have been determined to have met this exemption, so this requirement
would also enable Common Rule departments and agencies to better assess
the types of projects that use this exemption, and consider whether any
changes to its scope would be appropriate.
(5) Questions for Public Comment
    36. Public comment is sought on whether this exemption category
should only apply to research activities in which notice is given to
prospective subjects or their legally authorized representatives as a
regulatory requirement. If so, comment is sought on what kind of
information should be included in the notice, e.g., the research
purpose, privacy safeguards, or contact information. Also comment on
how such a notice should be delivered; e.g., publication in a newspaper
or posting in a public place, or by individual email or postal
delivery. Would requiring notice as a condition of this exempt research
strike a good balance between autonomy and beneficence? In many cases,
it may be that individual notice or consent to all potentially affected
persons before the research or demonstration commences is ordinarily
impossible in the conduct of such studies. For example, if a research
or demonstration project will affect all inhabitants of a large
geographic area (e.g., a housing, a police patrol, a traffic control,
or emergency response experiment), or all clients or employees of a
particular program or organization or setting will be subject to a new
procedure being tested (e.g. a new approach to improving student
performance, a new anti-smoking or anti-obesity program, a new method
for evaluating employee performance), would it be possible to make
participation voluntary for all affected individuals, or even to
identify and inform all affected individuals in advance?
    37. Public comment is sought on whether this exemption category is
appropriate based on the recognition that alternative processes are in
place in which ethical issues raised by research in public benefit or
service programs would be addressed by the officials who are familiar
with the programs and responsible for their successful operation under
state and federal laws, rather than meeting specific risk-based
criteria, or whether risk limitations should be included, and if so,
what those limitations should be. Though long-standing, this exemption
has never identified specific risk-based criteria, or risk limitations
to bound the type of projects that may be covered. When originally
promulgated, the exemption did stipulate that following the review of
such projects, if the Secretary determines that the research or
demonstration project presents a danger to the physical, mental, or
emotional well-being of a participant or subject, then written informed
consent would be required. Public comment is sought on whether to limit
the risk that can be imposed on subjects while using this exemption,
and if so, how to characterize those limits in a clear fashion. If more
than minimal risk interventions are included, public comment is sought
on whether, for transparency, this should be made clear in the
regulatory text.
    With regard to the issue of risks encountered by participants in
such research or demonstration projects, comments are also sought
regarding the argument that any and every demonstration project
involving changes in public benefit or service programs (e.g., water or
sewage treatment programs or pollution control programs, programs
involving educational procedures, or programs involving emergency
procedures related to extreme weather events, etc.) exposes those
affected to possible risks of some kind. In this regard, those risks
are ordinarily and perhaps always no different in kind or magnitude
than those involved in simply making the change in procedures without
using research tools to evaluate them. For example, health care
providers could be required to perform certain sanitation reforms to
prevent patient infections whether or not such reforms were first
tested in practice through a research or demonstration project. It is
common for all Federal departments and agencies that regulate private
or public organizations to impose conditions of participation in public
programs providing for safety, program integrity, financial reporting,
etc. Public comment is sought regarding whether there should be
conditions (e.g., an individual notice or consent requirement) imposed
on such research or demonstration projects involving public benefit or
service programs which might lead to significant impediments or
limitations on testing and evaluation before or after being imposed
program-wide. Would the effect of imposing expensive or impracticable
conditions on public benefits or services evaluations be to reduce the
number of such evaluations and consequently to expose program
participants to increased risk through exposure to untested reforms?
    38. Public comment is sought on whether the existing privacy
safeguards for such activities, including the Privacy Act, HIPAA rules,
and other federal or state privacy safeguards provide sufficient
independent controls, or whether other safeguards such as the privacy
safeguards of Sec.  __.105 should be applied.

iii. Research involving benign interventions in conjunction with the
collection of data from an adult subject (NPRM at Sec.  __.104(d)(3))
(1) NPRM Goal
    The goal of this proposed new exemption for studies that involve
benign interventions is to eliminate IRB review of these low-risk
studies to reduce time and effort, allow IRBs to focus more attention
on research with higher risks or presenting other ethical challenges,
and to enable this research to go forward.
(2) Current Rule
    Currently, research studies in the social and behavioral sciences
that do not qualify for exemption category 2 (current Common Rule at
Sec.  __.101(b)(2)), but that involve certain types of well-understood
interactions with subjects (e.g., asking someone to watch a video and
then conducting word association tests), require either convened board
or expedited IRB review.
(3) ANPRM Discussion
    The ANPRM considered whether to include on the list of exempt
studies certain types of social and behavioral research conducted with
competent adults that would involve specified types of benign
interventions commonly used in social and behavioral research, that are
known to involve virtually no risk to subjects, and for which prior
review does little to increase protections to subjects. These would be
methodologies that are familiar to people in everyday life and in which
verbal or similar responses would constitute the research data being
collected. The ANPRM asked whether this category should include
research in which there is deception.
(4) NPRM Proposal
    The proposed exemption at Sec.  __.104(d)(3) is new and includes
research involving benign interventions in conjunction with the
collection of data from an adult subject through verbal or written
responses (including data entry) or video recording if the subject
prospectively agrees to the intervention and data collection and at
least one of the following is met:
     The information obtained is recorded in such a manner that
human subjects cannot be identified directly or through identifiers
linked to the subjects; or
     Any disclosure of the human subjects' responses outside
the research would not reasonably place the subjects at risk of
criminal or civil liability or be damaging to the subjects' financial
standing, employability, educational advancement, or reputation.
    For the purpose of this proposed provision, benign interventions
would be brief in duration, harmless, painless, not physically
invasive, not likely to have a significant adverse lasting impact on
the subjects, and it would be required that the investigator has no
reason to think the subjects will find the interventions offensive or
embarrassing. If these criteria were met, such benign interventions
might include research activities in which a subject is asked to read
materials, review pictures or videos, play online games, solve puzzles,
or perform cognitive tasks. If the research involves deceiving the
subjects regarding the nature or purposes of the research, this
exemption would not be applicable unless the subject authorizes the
deception. For the purpose of this proposed provision, authorized
deception would be prospective agreement by the subject to participate
in research where the subject is informed that he or she will be
unaware of or misled regarding the nature or purposes of the research.
    Many commenters to the 2011 ANPRM supported adding another
exemption category of research for certain types of social and
behavioral activities, conducted with competent adults, that would
involve specified types of benign interventions beyond educational
tests, surveys, focus groups, interviews, and similar procedures that
are commonly used in social and behavioral research, that are known to
involve virtually no risk to subjects, and for which IRB review does
little to increase protections for subjects. However, many commenters
were opposed to the requirement that subjects be ``competent adults''
in order for the expanded exemption to apply, asking whether tests of
competency would be required for such research to proceed.
    This new exemption category addresses research involving benign
interventions, in which information is collected through verbal or
written responses and recorded in a manner such that human subjects
cannot be identified, or where the disclosure of responses would not
place the subjects at risk of criminal or civil liability or be
damaging to the subjects' financial standing, employability,
educational advancement, or reputation. Here, a ``benign intervention''
is categorized as one that is temporary and painless, producing no
lasting negative impacts. Examples of benign interventions might
include research activities in which a subject is asked to read
materials, review pictures or videos, play online games, solve puzzles,
or perform cognitive tasks, so long as the interventions meet the
requirements for this category.
    The NPRM proposes to allow this type of research to occur without
the requirements of informed consent or data security protections
because neither the intervention nor the identifiability of the
information is likely to result in harm to the subject, and the subject
must prospectively agree to the intervention and the data collection.
This exemption would include some research using authorized deception,
where there is a prospective agreement by the research subject to
participate in the activity after being informed that he or she will be
unaware or misled regarding the nature of the research (Sec.
__.104(d)(3)(iii)-(iv)). Subjects must be adults, but the provision
does not specify that they must be competent, and so tests of
competency are not necessary; however, the presumption is that in
keeping with the principle of respect for persons, these subjects will
not be taken advantage of. This new exemption category is being added
because respect for persons is accomplished through the prospective
subject's prospective agreement or authorization, the research
activities pose little risk to subjects, and the use of this exemption
for many social or behavioral studies will enable IRBs to devote more
time and attention to research studies involving greater risks or
ethical challenges.
(5) Questions for Public Comment
    39. Public comment is sought on whether this exemption category
should only apply to research activities in which notice is given to
prospective subjects or their legally authorized representatives as a
regulatory requirement. If so, comment is sought on what kind of
information should be included in the notice, such as the research
purpose (if authorized deception is not utilized), privacy safeguards,
contact information, etc. Would requiring notice as a condition of this
exempt research strike a good balance between autonomy and beneficence?
    40. Public comment is sought regarding what improvements could be
made to the language describing the type of interventions in this
exemption category so as to make clear what interventions would or
would not satisfy this exemption category.
    41. Public comment is sought on whether it is reasonable, for
purposes of this exemption, to rely on the exemption determination
produced by the decision tool where investigators

themselves input the data into the tool, or whether there should be
further administrative review in such circumstances.
iv. Taste and Food Quality Evaluation and Consumer Acceptance Studies
(NPRM at Sec.  __.104(d)(4); current Rule at Sec.  __.101(b)(6))
    The exemption proposed in Sec.  __.104(d)(4) is found in the
current Common Rule at Sec.  __.101(b)(6). This exemption is for taste
and food quality evaluation and consumer acceptance studies if
wholesome foods without additives are consumed, or if a food is
consumed that contains a food ingredient at or below the level and for
a use found to be safe, or agricultural chemical or environmental
contaminant at or below the level found to be safe, by FDA or approved
by the EPA or the Food Safety and Inspection Service of the U.S.
Department of Agriculture.
    This exemption is retained unchanged from the current Common Rule.
The research activities included under this intervention are relatively
benign, no sensitive information is collected, and presumably subjects
are made aware of the nature of the activity before they participate,
and may exercise their autonomy in choosing whether or not to
participate. However, since the research activities involve physical
interventions with the subject, the rules relating to exemption
determinations and the record-keeping requirement for exempt activities
are appropriate.
(1) Question for Public Comment
    42. Public comment is sought on whether this exemption category
should be narrowed to apply only to research activities in which notice
is given to prospective subjects or their legally authorized
representatives as a regulatory requirement. If so, comment is sought
on what kind of information should be included in the notice such as
the research purpose, privacy safeguards, contact information, etc.
Would requiring notice as a condition of this exempt research strike a
good balance between autonomy and beneficence? Should prospective
subjects be given the explicit opportunity to opt out of such research?
c. Exemptions Subject to the Documentation Requirements of Sec.
__.104(c) and the Privacy Safeguards Described in Sec.  __.105
    Two exemption categories are proposed which will be subject to the
documentation requirement and the new privacy safeguards. The first
exemption category is for certain research involving educational tests,
surveys, interviews, or observation of public behavior. The second
category is for secondary research use of identifiable private
information originally collected for non-research purposes where notice
was given.
    One of the functions of IRB review when a study presents only
informational risks is to ensure the sufficiency of the investigator's
plan for protecting any identifiable private information that will be
collected, created, or used as part of the study. In keeping with one
of the goals of this NPRM and as discussed in section II.A.3 of this
preamble, to reduce burden associated with research that includes
sufficient protections to research subjects, this NPRM proposes to
eliminate the need for IRB review for studies involving the collection
of identifiable private information when collected through educational
tests (cognitive, diagnostic, aptitude, achievement), survey
procedures, interview procedures, or observation of public behavior
(including visual or auditory recording), or in studies involving only
the secondary analysis of identifiable private information originally
collected for non-research purposes when the proposed privacy
safeguards at Sec.  __.105 are met. The newly proposed Sec.  __.105
offers three avenues to meeting the data security and privacy
protection requirements, all three of which are posited to be at least
as protective as those usually that result from IRB review.
     The investigator is required by law to comply with, or
voluntarily complies with, the HIPAA Rules;
     The activity is conducted by federal departments and
agencies, and the activity is or will be maintained on information
technology that is subject to and in compliance with section 208(b) of
the E-Government Act of 2002, 44 U.S.C. 3501 note, if all of the
information collected, used, or generated as part of the activity will
be maintained in systems of records subject to the Privacy Act of 1974,
5 U.S.C. 552a, and the research will involve a collection of
information subject to the Paperwork Reduction Act of 1995, 44 U.S.C.
3501 et seq.; or
     The investigator complies with the privacy safeguards
promulgated by the Secretary of HHS (which standards will be designed
so that they could be readily implemented by an individual
investigator, and would involve minimal cost and effort to implement).
    It is believed that the protections afforded by the Paperwork
Reduction Act, section 208 of the E-Government Act, and the Privacy Act
in combination with each other are generally equivalent to the privacy
protections that result from IRB review. It is similarly believed that
the privacy protections afforded by HIPAA in the context of the studies
exempted under Sec.  __.104(e) justify eliminating IRB review.
    The proposed section 105 also includes limitations on the use,
release, and disclosure of the identifiable private information
collected or maintained for research subject to this Rule.
    Although most if not all of these requirements are already in
effect for federal entities and HIPAA covered entities, they will
likely be new to some institutions and their investigators. The intent
is that Secretary would develop a list of ``reasonable and appropriate
safeguards'' that would be easily implemented by investigators. As
such, it is envisioned that the Secretary's privacy safeguards
described in proposed Sec.  __.105 would be designed as a checklist
that could be easily monitored by investigators and IRB members alike.
In the case where IRB members have additional expertise, they may
choose to deviate from the Secretary's list. Acknowledging that it is
difficult for the public to fully comment on the implications of such a
checklist before it has been developed; the Rule includes a requirement
that the Secretary solicit public comment on the proposed minimum
safeguards.
i. Questions for Public Comment
    43. Public comment is sought on the concept of requiring such
minimum safeguards and limitations on disclosure, as well as whether
the requirements of the proposed Sec.  __.105 would constitute a
broadening of IRB responsibilities rather than a streamlining of the
implementation of responsibilities that many IRBs already adopted. If
an institution does view this as an inordinate broadening of
responsibilities, does the institution currently have in place
alternative mechanisms for ensuring data security and participant
privacy in a research context? Suggestions for alternative approaches
to meeting public expectation that federally sponsored research
safeguard their data and protect privacy are sought during this public
comment period.
    44. Public comment is sought regarding whether the proposed Rule's
information security requirements for biological specimens and
identifiable private information are highly technical and require a
level of expertise not currently available to most IRBs. Do these
security requirements unrealistically expand IRB responsibilities
beyond current competencies?

ii. Research Involving Educational Tests, Surveys, Interviews, or
Observation of Public Behavior if the Information is Recorded with
Identifiers and even if the Information is Sensitive (NPRM at Sec.
__.104(e)(1))
(1) NPRM Goals
    The goal of the proposed exemption at Sec.  __.104(e)(1) is to
eliminate the need for IRB review of certain low-risk studies that
involve collecting information by means of educational tests, surveys,
interviews, or observation of public behavior. The intent is that this
change would reduce IRB and investigator time and effort in reviewing
and submitting protocols, and would allow IRBs to focus more attention
on research with higher risks or presenting other ethical challenges,
would respect autonomy, and would enable this research to go forward.
(2) Current Rule
    The current Common Rule only allows these activities, involving the
recording of identifiable information about research subjects, to be
exempt if the disclosure of the identifiable information outside the
research could not reasonably place the subjects at risk of criminal or
civil liability or be damaging to the subjects' financial standing,
employability, or reputation.
(3) ANPRM Discussion
    The ANPRM discussed criticisms of the current Common Rule that it
does not adequately calibrate the review process to the level of risk
of the research, particularly in social and behavioral research. It
also discussed whether answering questions should be sufficient
indication of willingness to participate in survey or interview
research. It distinguished between informational or psychological risks
and physical risks, and raised questions about how effectively IRB
review provides protections from informational or psychological risks.
    Specifically, the ANPRM discussed expanding the current exemption
category 2 (current Rule at Sec.  __.101(b)(2)) to include all studies
involving educational tests, surveys, interviews, and similar
procedures, so long as the subjects are competent adults, without any
further qualifications (but subject to the data security and
information protection standards).
(4) NPRM Proposal
    The exemption proposed in Sec.  __.104(e)(1) covers research, not
including interventions, involving the use of educational tests
(cognitive, diagnostic, aptitude, achievement), survey procedures,
interview procedures or observation of public behavior (including
visual or auditory recording), if the information obtained is recorded
in such a manner that human subjects can be identified directly or
through identifiers linked to the subjects. The research in this
category is exempt from most requirements of the NPRM, but
investigators must adhere to the privacy safeguards outlined in
proposed Sec.  __.105. Note that the language used in this exemption is
very similar to that used in the current exemption 2, proposed
exclusion Sec.  __.101(b)(2)(i), and the proposed exemption at Sec.
__.104(d)(3); unlike the language in those three places, however, the
proposed exemption at Sec.  __.104(e)(1) would allow for research to be
exempt where sensitive identifiable private information is collected
the release of which could pose some measure of risk. However, the
exemption is subject to adherence to the proposed Sec.  __.105 privacy
safeguards, which are designed to limit the chances that the release of
that information would lead to harm. This exemption category includes
research involving test development, and use of tests that have not
already been shown to be valid or reliable, inasmuch as such research
activity is desirable in order to determine the their validity and
reliability, and the exemption category provides safeguards to ensure
that results will not be used to evaluate student achievement. Note
that the activities that are currently exempted under exemption
category 2 (involving similar ways to collect information, but only
where either the identity of the subject is not recorded or disclosure
of the information would not have any adverse consequences to the
subject) would be moved under the NPRM to the proposed exclusion at
Sec.  __.101(b)(2)(i), rather than being under an exemption. That
proposed exclusion is discussed in section II.A.2 of this preamble.
Note also that this proposed exemption would cover the research
activities under the exemption in the current Rule at Sec.
__.101(b)(3)(ii), such as the research activities funded subject to the
Department of Justice statute related to certificates of
confidentiality (42 U.S.C. 3789g) and the information collections
subject to the confidentiality provisions of the Education Sciences
Reform Act (20 U.S.C. 9573) of the Department of Education. Presumably
the safeguards provided by these statutes satisfy the privacy
safeguards of the proposed Sec.  __.105.
    Consistent with the spirit of the principle of respect for persons,
investigators should provide prospective subjects with sufficient
information to make an informed decision about participation. Public
comment is sought regarding whether some kind of notice must be given
as a regulatory requirement for this exemption, and if so, what kind of
information must be included in that notice.
    The rationale for characterizing these activities as low-risk is
that prospective subjects can decline to participate or answer specific
questions in procedures they are already familiar with from the
experiences of daily life, and, importantly, that the information will
be protected through the new privacy safeguards of Sec.  __.105. The
availability of this exemption is designed to reduce the volume of
information collection that IRBs process, thereby enabling them to
devote more time and attention to research studies which pose greater
risks or involve ethical challenges.
    The underlying assumptions and rationale for this exemption mirror
the rationale for the exclusion proposed in Sec.  __.101(b)(2)(i)(C).
Here again it is presumed that the subjects are sufficiently familiar
with survey and interview procedures and educational tests to be able
to knowingly and willingly provide the information, or decline to
participate. The rationale for this exemption category is that
prospective subjects can decline to participate or answer specific
questions in procedures they are already familiar with from the
experiences of daily life, and that the information collected will be
protected through the privacy safeguards of Sec.  __.105.
    However, there are situations in which these assumptions would not
always hold. For instance, administration of a questionnaire or
participation in a focus group on a sensitive topic may induce
significant stress in some individuals, or individuals approached about
taking a survey may feel compelled to participate. Whether and how this
exemption should be bounded so that the final rule archives a balance
among the principles of beneficence, autonomy, and justice is the
subject of a request for public comment on this proposed exemption. The
use of this exemption is designed to enable IRBs to devote more time
and attention to research studies which pose greater risks or involve
more challenging ethical concerns.

(5) Questions for Public Comment
    45. Public comment is sought on whether the proposed exemption
regarding the use of educational tests, survey procedures, interview
procedures, or observation of public behavior (Sec.  __.104(e)(1))
should be applied to research involving the use of educational tests
with children and whether it should also be applied to research
involving the use of survey or interview procedures with children. If
so, for research involving children, should the permissible survey or
interview topics be limited in some way?
    46. Public comment is sought on whether this exemption category
should only apply to research activities in which notice is given to
prospective subjects or their legally authorized representatives as a
regulatory requirement. If so, comment is sought on what kind of
information should be included in the notice such as the research
purpose, privacy safeguards, contact information, etc. Would requiring
notice as a condition of this exempt research strike a good balance
between autonomy and beneficence? Should prospective subjects be given
the explicit opportunity to opt out of such research?
    47. Public comment is sought on whether it is reasonable, for
purposes of this exemption, to rely on the exemption determinations
produced by the decision tool where investigators themselves input the
data into the tool, or whether there should be further administrative
review in such circumstances?
    48. Public comment is sought on whether this exemption category
should be narrowed such that studies with the potential for
psychological risk are not included. Are there certain topic areas of
sensitive information that should not be covered by this exemption? If
so, please provide exemplary language to characterize such topic areas
in a manner that would provide clarity for implementing the Rule.
iii. Secondary Research Use of Identifiable Private Information (NPRM
at Sec.  __.104(e)(2))
(1) NPRM Goal
    The goal of the proposed new exemption category at Sec.
__.104(e)(2) is to facilitate secondary research using identifiable
private information that has been or will be collected or generated for
non-research purposes, when prior notice has been given and privacy
safeguards and prohibitions on re-use of the information are in place.
Technological developments and the creation of large databases have
significantly increased the potential benefits of secondary research
analyses. The proposed exemption category would eliminate the need for
IRB review of certain low-risk studies that only involve secondary use
of identifiable private information that was collected for non-research
purposes. The information would be protected under the privacy
safeguards of Sec.  __.105, and respect for persons would be
demonstrated through a requirement for notice. The proposed exemption
is limited to the research use of the identifiable private information
for the purposes of the specific research for which the investigator or
recipient entity requested access to the information, not for any
further secondary research use. This proposed exemption is intended to
reduce IRB and investigator time and effort, and allow IRBs to focus
more attention on research with higher risks or presenting other
ethical challenges. The exemption would enable beneficial secondary
research to occur without being impeded by administrative or IRB
review, but with privacy safeguards to avoid harm and a notice
requirement to show respect for persons. Public comment is sought
regarding this proposal, including what limits in scope it should have,
what controls and protections should be attached above and beyond the
privacy safeguards of Sec.  __.105, and how best to respect the
autonomy or other interests of the individuals who are the subjects of
the information.
(2) Current Rule
    Under the current Common Rule, secondary research studies using
identifiable private information undergo IRB review and approval, often
using the expedited review procedure. If the activity satisfies the
relevant criteria, the IRB may waive the requirement for informed
consent, which IRBs typically do.
(3) ANPRM Discussion
    The ANPRM proposed that with regard to an investigator's use of
pre-existing data (i.e., data that were previously collected for
purposes other than the currently proposed research study) originally
collected for non-research purposes, then, as is currently the rule,
written consent or waiver of consent would only be required if the
investigator obtains information that identifies the subjects. Under
the ANPRM, there would accordingly have been no change in the current
ability of investigators to conduct such research using de-identified
data or a limited data set, as such terms are used in the HIPAA Rules,
without obtaining consent.
    Second, the ANPRM proposed that if the data were originally
collected for research purposes, then consent would be required
regardless of whether the investigator obtains identifiers. This would
have been a change with regard to the current interpretation of the
Common Rule in the case where the investigator does not obtain any
identifiers. That is, the allowable current practice of telling the
subjects, during the initial research consent, that the information
they are providing will be used for one purpose, and then after
stripping identifiers, allowing it to be used for a new purpose to
which the subjects never consented, would not have been allowed.
(4) NPRM Proposal
    The NPRM proposal here is for a new exemption covering the
secondary research use of identifiable private information that has
been or will be acquired for non-research purposes, if the following
are met:
     Prior notice has been given to the individuals to whom the
identifiable private information pertains that such information may be
used in research;
     The privacy safeguards of Sec.  __.105 are required; and
     The identifiable private information is used only for
purposes of the specific research for which the investigator or
recipient entity requested access to the information.
    Under the current system, IRBs frequently waive consent for
research involving the secondary use of identifiable private
information, particularly when the data sets are large or drawn from
multiple institutions. In such circumstances, IRBs often impose privacy
and data security protection requirements. However, since this proposed
exemption category requires that the privacy safeguards at Sec.  __.105
are in place, requiring these studies to undergo IRB review will
provide little or no additional protections to subjects, while
continuing to generate potentially substantial burdens on investigators
and IRBs and diverting IRB resources away from research that may
involve more serious ethical challenges.
    Under this proposed exemption there will be greater protections for
these research subjects than is currently the case. The new privacy
safeguards of Sec.  __.105 would be applied to this research, and would
be the same safeguards that would be used for many other types of
research under the NPRM. In addition, the scope of the exemption is
limited to the specific research for

which the investigator or recipient entity requested access to the
information, so the otherwise permissible uses, releases and
disclosures under Sec.  __.105(c) would not apply to research covered
by this exemption. Respect for persons would be given more weight
insofar as the subjects would now receive notice that research might
take place, which is currently not required.
    Further, in many cases, other laws such as HIPAA also provide
protections in the research context for the information that would be
subject to this proposed exemption (e.g., clinical records), such that
additional Common Rule requirements for consent may not be necessary in
those contexts. Under HIPAA, these protections include, where
appropriate, requirements to obtain the individual's authorization for
future, secondary research uses of protected health information, or
waiver of that authorization by an IRB or HIPAA Privacy Board. This
proposal does not disturb those laws.
    The NPRM proposal limits the use of this exemption to cases in
which individuals have been informed that the information may be used
in research with the goal of ensuring that research under this
exemption exhibits respect for persons. In particular, by ensuring that
subjects are notified that their information may be used for research,
this notice requirement may enhance subject autonomy.
    Alternative scopes for this provision are also proposed for
consideration. A narrower scope could be envisioned that would limit
the exemption to data generated by the Federal Government for which a
privacy impact assessment has been conducted pursuant to section 208(b)
of the E-Government Act of 2002, 44 U.S.C. 3601 et seq., that fully
describes the ways that the information will be accessed, used,
maintained, disseminated, and protected, and there is a formal written
agreement between the investigator and the federal agency that requires
the investigator to apply the same practices and safeguards as those
addressed in the privacy impact assessment. Such a narrower
interpretation might be easier to implement, and the line between Sec.
__.104(e)(2) and (f)(2) would be clearer.
    Alternatively, it could be broadened to allow additional research
uses of the information beyond the specific research for which the
investigator or recipient entity obtained the information.
    The proposed exemption category could also be revised to change the
manner in which respect for persons would be demonstrated by requiring
that individuals have been given the opportunity to opt out of any
secondary research with their identifiable private information. This
would mean that subjects could exercise their autonomy to choose not to
allow their information to be used, although this would not meet the
even higher standard of fully informed active consent. Under this
alternative, which would give prospective subjects the opportunity to
opt out, it could be argued that the balance would be struck even more
in favor of respect for persons by limiting the exemption to research
where more than prior notice was required. This would restrict the
exemption to research where an even greater measure of respect for
persons had occurred, that is, that the individuals had been given the
right to decline to participate in research, rather than simply being
notified that such research was going to take place. Public comment is
sought regarding this alternative approach as well.
    Finally, it also should be noted that section 511 of the Medicare
Access and CHIP Reauthorization Act of 2015 requires the Secretary to
issue a clarification or modification with respect to the application
of these regulations to certain activities involving clinical data
registries. This exemption category might allow certain research
activities of these clinical data registries not otherwise covered by
the proposed HIPAA-related exclusion at Sec.  __.101(b)(2)(iv) (i.e.,
when the clinical data registries are not part of a HIPAA covered
entity or acting as a business associate), such as when a clinical data
registry may receive information from a health care entity for research
purposes.
(5) Questions for Public Comment
    49. Public comment is sought on the types of research that should
fall under the proposed exemption. Should the proposed exemption be
available to all types of research using identifiable data collected
for non-research purposes or should the exemption be available only to
a more limited subset of research? For example, should the proposed
exemption apply only for research using records and information already
subject to comprehensive privacy and other protections in other Federal
laws (e.g., records held by the Federal Government subject to the
Federal Privacy Act, or records governed by HIPAA or FERPA)?
    Depending upon the scope of the exemption, the relationship between
this exemption and the exemption proposed at Sec.  __.104(f)(2) would
need to be clarified. Since a major justification for including this
exemption is to reduce burden on IRBs, should the proposed exemption
apply only to research for which IRBs typically waive informed consent,
that is, where the research could not practicably be carried out
without a waiver of informed consent, and the rights and welfare of
subjects will not be adversely affected by the waiver? Finally, is
there a sufficient need for this exemption at all given the other
proposed exclusions and exemptions?
    50. Public comment is sought regarding whether the proposed
exemption should be limited to research in which individuals had been
informed of the potential future research use of their information, and
given the opportunity to opt out of having their identifiable private
information used for research. If the proposed exemption should be
limited in this way, what information should be included in the
opportunity to opt out? If the opportunity to opt out is made a
condition of the exemption category how should it be structured (e.g.,
how long and under what circumstances should it remain in effect) and
what, if any, impact should the opt out have on other provisions of the
rule, such as the ability of an IRB to waive informed consent for a
subsequent research study using the individual's information? Are there
other or alternative mechanisms that should be required to respect
individuals' autonomy and other interests?
    51. Public comment is sought regarding what should constitute
notice for purposes of this exemption category. Given the many
different types of data that would be covered by this provision (e.g.,
data from private entities used for social or behavioral science
research, government records for which laws already establish standards
for notice, and data publicly available for harvesting from the
internet), would it be possible to develop a uniform ``notice''
requirement? What type of notice, in terms of its dissemination and
scope, should be considered to meet this requirement of the proposed
exemption? With regard to the dissemination of the notice, should the
notice requirement be permitted to be fulfilled through a general
public notice, not specifically directed to individuals who are
potential research subjects, such as the notice allowable under the
Privacy Act? Would a prominent notice posted in all clinics or other
relevant public places where information will be collected be
acceptable? Should each individual whose data could be used receive
their own notice, such as is required of direct treatment providers
covered by the

HIPAA Privacy Rule? With regard to the content of the notice required
by this proposed exemption, what kind of information should be included
in the notice, such as the types of research that might be conducted,
privacy safeguards, contact information, etc.?
    52. Public comment is sought on whether, on the other hand, prior
notice is necessary. Is the notice requirement proposed for this
exemption a meaningful and important measure to respect individual
autonomy, particularly if the notice requirement could be fulfilled
through a general public posting? Current practices suggest that IRBs
will frequently waive informed consent for studies involving the
secondary use of identifiable private information collected for non-
research purposes. If the exemption were to exclude the notice
requirement, but continue to require application of the data security
and privacy safeguards of Sec.  __.105 and restrict the use of
identifiable private information to only purposes of the specific
research for which the investigator obtained the information, would the
exemption better strike a reasonable balance between respect for
persons and beneficence, while eliminating the current requirement for
IRB review?
    53. Public comment is sought as to whether this exemption would
provide appropriate protections for research conducted by clinical data
registries, while enabling these research activities to proceed without
delay, and what should be included in guidance regarding such
activities. Public comment is sought regarding the extent to which
other exclusions or exemption categories would apply to research
conducted by clinical data registries, such that the conditions of this
exemption category would not apply.
d. Exemptions Subject to the Documentation Requirements of Sec.
__.104(c), the Privacy Safeguards Described in Sec.  __.105, Limited
IRB Review as Described in Sec.  __.111(a)(9), and Broad Consent in
Accordance With Sec.  __.116(c)
i. NPRM Goals
    The goal of this proposed rule is to enable the conduct of research
in the rapidly growing area of research involving biospecimens,
especially genetic analyses, while recognizing the autonomy interests
of people to decide whether or not to participate in this area of
research. Some people have a particular interest in whether research
will be carried out with their biospecimens, and want to exercise some
control over their biospecimens. At the same time, biospecimen
repositories are being created to enable innumerable research studies
in the future, and the pace of technology development is such that the
specific research studies to be carried out with those biospecimens is
unknown at the time the biospecimens are collected.
ii. Current Rule
    The current Rule requires IRB review and approval of research
involving identifiable private information, including individually
identifiable biospecimens. IRB waiver of informed consent is allowable
under the Common Rule, if the research study satisfies the criteria for
waiver of informed consent. The current Rule also allows for research
without consent when a biospecimen is used for research under
conditions where the investigator does not possess information that
would allow him or her to identify the person whose biospecimen is
being studied.
iii. ANPRM Discussion
    The ANPRM considered requiring written general consent for
secondary research use of biospecimens originally collected in research
or non-research settings regardless of whether they include
identifiers. The ANPRM proposed an excused or exempt category for
research involving the secondary use of biospecimens originally
collected for either research or non-research purposes if there was
written broad consent for the research use of the biospecimens,
typically obtained at the time of the original collection. The ANPRM
also considered whether the broad consent should include check-off
boxes allowing subjects to consent or decline consent for types of
research raising unique concerns.
iv. NPRM Proposals
    The NPRM includes two exemptions proposed in Sec.  __.104(f) to
facilitate storage, maintenance, and secondary research use of
biospecimens and identifiable private information. Generally the
exemption at Sec.  __.104(f)(1) will first be employed to allow the
storage or maintenance for secondary research use of biospecimens or
identifiable private information, by means of broad consent being
obtained. Following that, the secondary research that will be conducted
using such biospecimens or identifiable private information could often
be exempted under Sec.  __.104(f)(2).
    A majority of commenters opposed the suggestion that there be
consent requirements for the research use of non-identifiable
biospecimens collected for purposes other than the current research
study. Some commenters also favored requiring IRB review and approval
for specific studies involving the use of identifiable private
information and identifiable biospecimens, rather than permitting the
use of a broad consent for future use to satisfy the regulatory
requirement for consent. These commenters indicated that IRB review of
specific research studies, and the IRB's consideration of whether a
study-specific informed consent should be required or whether informed
consent could be waived, was more protective of human subjects than the
ANPRM recommendation permitting use of a broad consent for future use.
    Commenters to the 2011 ANPRM were mostly concerned with the cost
and burden that would be imposed by the requirement to obtain consent
for future research use of all biospecimens, regardless of
identifiability. Commenters anticipated these costs to include
obtaining consent from participants and the administrative efforts
required to keep track of the consent status of biospecimens. Most
commenters did not provide detailed cost estimates with their comments;
data are specifically requested in response to this NPRM. In addition,
estimates of the type and number of studies that could not be pursued
using existing samples and data because of the absence of sufficient
consent are requested. Comment is also sought on the value to the
public and research participants of being asked their permission for
research use of their data and biospecimens.
    While consideration was given to the opposition expressed by ANPRM
commenters of a consent requirement for secondary research use of non-
identified biospecimens, the NPRM proposes to require that consent be
obtained for the research use of non-identified biospecimens, but to
allow for that consent to be broad. Thus, while consent would be
required for the research use of non-identified biospecimens, one would
not have to obtain study-specific consent for the research use of those
biospecimens, drastically reducing the burden imposed by this new
requirement.
    The NPRM proposal includes several protections for secondary
research use of biospecimens in addition to the broad consent. Research
activities falling under the exemption at Sec.  __.104(f) are subject
to the requirements under proposed Sec.  __.104(c). This would require
that exemption determinations be made by someone knowledgeable of the
regulations, or by the to-be-created exemption determination tool (when
utilized by an investigator or other

individual). Additionally, the documentation requirement would allow
institutions to better know the scope and volume of secondary research
studies conducted at an institution. Also note that Sec.  __.104(f)(1)
requires that an IRB review the consent process through which broad
consent would be obtained in the non-research context, to further allay
ethical concerns about obtaining broad consent in clinical and other
non-research contexts.
(1) Exemption for the Storage or Maintenance of Biospecimens or
Identifiable Private Information for Secondary Research Use (NPRM at
Sec.  __.104(f)(1))
    The first exemption in this group, at proposed Sec.  __.104(f)(1),
is for storage or maintenance for secondary research use of
biospecimens or identifiable private information that have been or will
be acquired for research studies other than for the proposed research
study, or for non-research purposes, if the following criteria are met:
     Written consent for the storage, maintenance, and
secondary research use of the information or biospecimens is obtained
using the broad consent template that the Secretary of HHS will
develop. Oral consent, if obtained during the original data collection
and in accordance with the elements of broad consent outlined in Sec.
__.116(c) and (d)(3), would be satisfactory for the research use of
identifiable private information initially acquired in accordance with
activities excluded under Sec.  __.101(b)(2)(i) or exempt in accordance
with Sec.  __.104(d)(3) or (4), or Sec.  __.104(e)(1); and
     The reviewing IRB conducts a limited IRB review of the
process through which broad consent will be sought, and, in some cases,
of the adequacy of the privacy safeguards described in Sec.  __.105.
    This exemption category only allows for the storage or maintenance
for secondary research use of biospecimens or identifiable private
information. Note that this exemption does not exempt the creation of
any data or the actual new collection of any biospecimens from a person
through a research interaction or intervention. (For example, if the
proposed research activities involved creating a research repository of
DNA samples that would be obtained from people through cheek swabs, the
collection of the cheek swabs would mean that the creation of the
research repository would require IRB review, and would not be exempt.)
This exempt category is for secondary research use of biospecimens and
identifiable private information and applies to biospecimens and
identifiable private information that were initially collected for
purposes other than the proposed research activity. The term `other
than the proposed activity' here means that the information or
biospecimens were or will be collected for a different research study
or for a non-research purpose.
    In the case of a research study involving the actual new collection
of biospecimens such as a clinical trial, the informed consent process
could include obtaining informed consent for the original study (which
study would not be exempt and would require IRB review and the usual
type of consent document as required under Sec.  __.116(a) and (b)),
and for secondary research use of the biospecimens. The informed
consent form for the latter step (the secondary research use) could
make use of the Secretary's template, in which case the biospecimen
would be eligible for maintenance or storage under Sec.  __.104(f)(1)
with limited IRB review or for a secondary research study under Sec.
__.104(f)(2). If the Secretary's template for broad consent is not
used, the storage or maintenance for secondary research use would not
meet this exemption and the consent form would need to be reviewed and
approved by an IRB, either along with the IRB review of the original
study, if the maintenance and storage for secondary research is known
and described, or later, if it is not. Note also that if the
Secretary's template is not used, the Sec.  __.104(f)(2) exemption, as
discussed below, would not apply to exempt any actual secondary
research studies conducted using the stored biospecimens. IRB review
would be needed for each of those studies, unless the research met one
of the proposed exclusions at Sec.  __.101(b)(1) or (b)(3), or the
exemption found in proposed Sec.  __.104(d)(2).
    This exemption requires written informed consent using the
Secretary's template for broad consent for secondary research, or oral