Ending five and a half years of rulemaking and speculation, the US Department of Health and Human Services (HHS) and 15 other Federal Agencies released a final revision of the Federal Policy for the Protection of Human Subjects, or “Common Rule,” on January 19, 2017. These are the first revisions to the Common Rule since it was promulgated in 1991.

The version published in the Federal Register includes a lengthy preamble which provides, for each section of the Rule, a summary of what was in the existing Common Rule, an explanation of what the 2015 Notice of Proposed Rulemaking (NPRM) included, a summary of the public comments received on that issue, and a description of what was included in final Rule, and the rationale. The document also includes sections providing a regulatory impact analysis, an environmental impact analysis, and a paperwork reduction analysis. The text of the actual new Common Rule is, as before, relatively short, and can be found on pages 7259-7269 of the version linked above.

I won’t summarize all the changes from the original Common Rule or from the NPRM. PRIM&R and some of our sister organizations have complied such summaries; those can be found on our Common Rule resource page. I encourage you to review these resources for the details about what, specifically, has changed. For a brief overview, see our quick reference guide to the new Rule.

Instead, I want to share some of my overall reflections and reactions to the shape and scope of the final Rule, touching on some of the most significant changes along the way.

Even a quick reading of the preamble material suggests that the agencies promulgating the Rule listened to the more than 2100 comments they received on the NPRM. In response, they have made significant efforts to remove or refine proposed provisions that were either overly complex, unjustifiably rigid, or unsupported by evidence that they would improve subject protections. In many ways, the final Rule is much more modest in scope than the proposed Rule, and, to my mind, that is a good thing.

For example, the concept of exclusions introduced in the NPRM has been removed; the 11 categories of activities that fell within the scope of exclusions have either been folded into an expanded list of exemptions, dropped altogether, or are now explicitly mentioned as not within the scope of the definition of “research.”

And, in what will probably be the most welcome news of all, the NPRM proposal to count all research with non-identified biospecimens as human subjects research, and therefore subject to the Common Rule—a provision that many agreed would add tremendous burden, halt important research, and was of questionable value to subjects—does not appear in the final version of the Rule. In other words, for now, things remain unchanged with respect to non-identified biospecimens. It should be noted, however, that the Rule includes a provision noting that what counts as “identifiable,” and what technologies generate identifiable information, will be reviewed and updated every few years. This raises the question of whether the gap between identifiable and non-identified biospecimens might close over time.

Something else that struck me immediately upon reading the Rule is its emphasis on enhanced flexibility, a point that was in fact reinforced by the Office of Human Research Protections (OHRP) leadership in this New England Journal of Medicine perspective piece. Whereas the NPRM had proposed a number of rigid “solutions” to issues such as determining exemptions, cooperative review for multi-site research, “strengthened’ informed consent, broad consent for research with biospecimens, and standardized privacy and security protections, the final Rule instead offers—in most of these areas—an expanded range of options to choose from to meet regulatory requirements. For example, rather than requiring the use of an exemption determination tool or a set of standardized privacy safeguards (neither of which were provided for review in the NPRM), the final Rule leaves exemption determinations and decisions about appropriate privacy and security protections to IRBs. In addition, rather than specifying that consent forms include only required elements and relegating additional information to appendices, the final Rule allows discretion about what key information is presented in the “beginning” section of a consent form (as long as that information meets certain new general consent requirements; more on this below).

It should be noted that the requirement to use a single IRB for multi-site research remains in the final Rule, but even here, some modest flexibility has been added with respect to how institutions set up and document their cooperative review arrangements, and for exceptions to the mandate.

The goal of the revised Rule is to decrease administrative burden while enhancing subject protections where they are needed most, all in an effort to update and modernize the Rule. The final Rule seems to be premised on the assumption that this can be accomplished by providing IRBs, institutions, and investigators with more options to meet their regulatory responsibilities within any particular context. This increased flexibility will no doubt be welcomed by the research and oversight community. But with flexibility may also come uncertainty, and so, should the Rule stay with us, additional guidance about how best to take advantage of such flexibility will be important.

In response to the NPRM, PRIM&R and others expressed deep concern that the proposed revisions seemed to diffuse responsibility for human subjects protection, shifting it away from the entities most experienced and best equipped to ensure the ethical conduct of research. In many cases—such as exclusion and exemption determinations—these responsibilities were shifted to investigators, but without any corresponding assurance that investigators would be properly equipped, educated, or held accountable for overcoming their often conflicting interests and meeting these responsibilities. Most of the provisions that led to this concern do not appear in the final version of the Rule. In other words, it appears that shifts in responsibility which were designed to streamline and eliminate burden have been replaced with added flexibility that is designed to do the same thing.

I think it’s worth noting that the most significantly changed section of the final Rule is the one concerned with the general requirements for informed consent at §__.116. I can’t claim to have mastered it all yet, but this section has been significantly reworked to emphasize that information must be presented in a manner that facilitates a prospective subjects’ understanding of the reasons why one might choose—or not—to participate in research. More specifically, the information provided should be information any “reasonable person” would want to have, and should be organized in a way that makes it useful—not just presented as “an isolated list of facts.” The Rule considers useful to further mean “sufficient detail” with key information presented in a “concise and focused” way in the beginning section of the consent form.

There are also a few changes to the basic and additional elements of consent, and the consent section also now includes broad consent as an option for storage and secondary research use of identifiable private information and identifiable biospecimens. I’d encourage everyone to spend some time digesting this section. I think these are exciting changes, but it seems likely to be an area where further guidance will be needed and welcome.

I think it’s worth noting some additional changes to the Rule that seem designed to update it for today’s research populations. The first is the long-overdue removal of pregnant women and the “handicapped” from the list of populations who are vulnerable to coercion and undue influence. Second is the fact that the new Rule adds “or their legally authorized representative” whenever it mentions subjects in the context of their decision-making and consent capabilities (“legally authorized representative” has also been redefined). And finally, across a number of provisions, the revised Rule refers explicitly to American Indian/Alaska Native (AI/AN) tribes having the authority to develop their own laws, standards, and protections that may depart from those in the Rule, and requires that federally-funded researchers conducting research involving tribal populations abide by those rules.

There is a lot more to unpack about the new Rule, but I’ll turn now to the question on everyone’s mind: what next? The compliance date for most of the Rule’s provisions is one year from the date of publication, January 19, 2018. For the requirement to use a single IRB for multi-site research, the effective date is January 20, 2020. However, as we noted in a blog post last week, fate of the Rule is uncertain, given the change in presidential administration and potential steps Congress can take with recently approved measures such as this. It may, then, be premature to begin implementing any of these provisions at this time.
    
That is only one of the reasons why PRIM&R is committed to keeping you updated on all developments, and to providing you with the resources you need to understand and (if the rule remains in place) implement the changes accordingly. Visit our Common Rule webpage often for the latest news, information and resources from us and our colleagues in the field; sign up for our webinar, and read our blog series. If the revised Rule remains in place, we’ll have a webinar series along with additional resources to help you with implementation.