
[Federal Register Volume 82, Number 12 (Thursday, January 19, 2017)]
[Rules and Regulations]
[Pages 7149-7274]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2017-01058]



[[Page 7147]]

Vol. 82

Thursday,

No. 12

January 19, 2017

Part IX





Department of Homeland Security





-----------------------------------------------------------------------





6 CFR Part 46





Department of Agriculture





-----------------------------------------------------------------------

7 CFR Part 1c





Department of Energy





-----------------------------------------------------------------------

10 CFR Part 745





National Aeronautics and Space Administration





-----------------------------------------------------------------------

14 CFR Part 1230





Department of Commerce





-----------------------------------------------------------------------

15 CFR Part 27





Social Security Administration





-----------------------------------------------------------------------

20 CFR Part 431





Agency for International Development





-----------------------------------------------------------------------

22 CFR Part 225

[[Page 7148]]

Department of Housing and Urban Development





-----------------------------------------------------------------------

24 CFR Part 60





Department of Labor





-----------------------------------------------------------------------

29 CFR Part 21





Department of Defense





-----------------------------------------------------------------------

32 CFR Part 219





Department of Education





-----------------------------------------------------------------------

34 CFR Part 97





Department of Veterans Affairs





-----------------------------------------------------------------------

38 CFR Part 16





Environmental Protection Agency





-----------------------------------------------------------------------

40 CFR Part 26





Department of Health and Human Services





-----------------------------------------------------------------------

45 CFR Part 46





National Science Foundation





-----------------------------------------------------------------------

45 CFR Part 690





Department of Transportation





-----------------------------------------------------------------------

49 CFR Part 11





-----------------------------------------------------------------------





Federal Policy for the Protection of Human Subjects; Final Rule

  Federal Register / Vol. 82 , No. 12 / Thursday, January 19, 2017 / 
Rules and Regulations  

[[Page 7149]]


-----------------------------------------------------------------------

DEPARTMENT OF HOMELAND SECURITY

6 CFR Part 46

DEPARTMENT OF AGRICULTURE

7 CFR Part 1c

DEPARTMENT OF ENERGY

10 CFR Part 745

NATIONAL AERONAUTICS AND SPACE ADMINISTRATION

14 CFR Part 1230

DEPARTMENT OF COMMERCE

15 CFR Part 27

SOCIAL SECURITY ADMINISTRATION

20 CFR Part 431

AGENCY FOR INTERNATIONAL DEVELOPMENT

22 CFR Part 225

DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT

24 CFR Part 60

DEPARTMENT OF LABOR

29 CFR Part 21

DEPARTMENT OF DEFENSE

32 CFR Part 219

DEPARTMENT OF EDUCATION

34 CFR Part 97

DEPARTMENT OF VETERANS AFFAIRS

38 CFR Part 16

ENVIRONMENTAL PROTECTION AGENCY

40 CFR Part 26

DEPARTMENT OF HEALTH AND HUMAN SERVICES

45 CFR Part 46

RIN 0937-AA02

NATIONAL SCIENCE FOUNDATION

45 CFR Part 690

DEPARTMENT OF TRANSPORTATION

49 CFR Part 11


Federal Policy for the Protection of Human Subjects

AGENCY: Department of Homeland Security; Department of Agriculture; 
Department of Energy; National Aeronautics and Space Administration; 
Department of Commerce; Social Security Administration; Agency for 
International Development; Department of Housing and Urban Development; 
Department of Labor; Department of Defense; Department of Education; 
Department of Veterans Affairs; Environmental Protection Agency; 
Department of Health and Human Services; National Science Foundation; 
and Department of Transportation.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The departments and agencies listed in this document announce 
revisions to modernize, strengthen, and make more effective the Federal 
Policy for the Protection of Human Subjects that was originally 
promulgated as a Common Rule in 1991. This final rule is intended to 
better protect human subjects involved in research, while facilitating 
valuable research and reducing burden, delay, and ambiguity for 
investigators. These revisions are an effort to modernize, simplify, 
and enhance the current system of oversight.

DATES: This rule is effective on January 19, 2018. The compliance date 
for this rule, except for Sec.  __.114(b) (cooperative research), is 
January 19, 2018. The compliance date for Sec.  __.114(b) (cooperative 
research) is January 20, 2020.

ADDRESSES: Jerry Menikoff, M.D., J.D., OHRP, 1101 Wootton Parkway, 
Suite 200, Rockville, MD 20852.

FOR FURTHER INFORMATION CONTACT: Jerry Menikoff, M.D., J.D., Office for 
Human Research Protections (OHRP), Department of Health and Human 
Services, 1101 Wootton Parkway, Suite 200, Rockville, MD 20852; 
telephone: 240-453-6900 or 1-866-447-4777; facsimile: 301-402-2071; 
email: jerry.menikoff@hhs.gov.

SUPPLEMENTARY INFORMATION: 

Preamble

Executive Summary
I. The Rationale for Modernizing the Common Rule
II. To What Does This Policy Apply? Scope and Applicability of the 
Regulations
III. Definitions for Purposes of this Policy (Sec.  __.102)
IV. Ensuring Compliance with this Policy (Sec.  __.103)
V. Exempt Research (Sec.  __.104)
VI. Protection of Identifiable Private Information and Identifiable 
Biospecimens
VII. IRB Membership and Modification to References to Vulnerability 
(Sec. Sec.  __.107(a), __.111(a)(3), and __.111(b))
VIII. IRB Functions and Operations (Sec.  __.108)
IX. IRB Review of Research (Sec.  __.109)
X. Expedited Review Procedures (Sec.  __.110)
XI. Criteria for IRB Approval of Research (Sec.  __.111)
XII. Cooperative Research (Sec.  __.114)
XIII. IRB Records (Sec.  __.115)
XIV. General Requirements for Informed Consent (Sec.  __.116)
XV. Documentation of Informed Consent (Sec.  __.117)
XVI. Applications and Proposals Lacking Definite Plans for 
Involvement of Human Subjects (Sec.  __.118)
XVII. Research Undertaken Without the Intention of Involving Human 
Subjects (Sec.  __.119)
XVIII. Conditions (Sec.  __.124)
XIX. Regulatory Impact Analyses
XX. Environmental Impact
XXI. Paperwork Reduction Analysis
XXII. Tribal Consultation Statement
Final Regulatory Text

Executive Summary

Purpose of the Regulatory Action

    Individuals who are the subjects of research may be asked to 
contribute their time and assume risk to advance the research 
enterprise, which benefits society at large. U.S. federal regulations 
governing the protection of human subjects in research have been in 
existence for more than three decades. The Department of Health, 
Education, and Welfare first published regulations for the protection 
of human subjects in 1974, and the Department of Health and Human 
Services (HHS) revised them in the early 1980s. During the 1980s, HHS 
began a process that eventually led to the adoption of a revised 
version of the regulations by 15 U.S. federal departments and agencies 
in 1991. The purpose of this effort was to promote uniformity, 
understanding, and compliance with human subject protections as well as 
to create a uniform body of regulations across federal departments and 
agencies (subpart A of 45 Code of Federal Regulations [CFR] part 46), 
often referred to as the ``Common Rule'' or ``Protection of Human 
Subjects Regulations.'' Those regulations were last amended in 2005, 
and have remained unchanged until the issuance of this final rule.

[[Page 7150]]

    Since the Common Rule was promulgated, the volume and landscape of 
research involving human subjects have changed considerably. Research 
with human subjects has grown in scale and become more diverse. 
Examples of developments include: an expansion in the number and types 
of clinical trials, as well as observational studies and cohort 
studies; a diversification of the types of social and behavioral 
research being used in human subjects research; increased use of 
sophisticated analytic techniques to study human biospecimens; and the 
growing use of electronic health data and other digital records to 
enable very large datasets to be rapidly analyzed and combined in novel 
ways. Yet these developments have not been accompanied by major change 
in the human subjects research oversight system, which has remained 
largely unaltered over the past two decades.
    On July 26, 2011, the Office of the Secretary of HHS, in 
coordination with the Executive Office of the President's Office of 
Science and Technology Policy (OSTP), published an advance notice of 
proposed rulemaking (ANPRM) to request comment on how current 
regulations for protecting those who participate in research might be 
modernized and revised to be more effective.\1\
---------------------------------------------------------------------------

    \1\ HHS. Human Subjects Research Protections: Enhancing 
Protections for Research Subjects and Reducing Burden, Delay, and 
Ambiguity for Investigators. 76 FR 44512 (Jul. 26, 2011). Retrieved 
from https://www.gpo.gov/fdsys/pkg/FR-2011-07-26/pdf/2011-18792.pdf
---------------------------------------------------------------------------

    On September 8, 2015, HHS and 15 other federal departments and 
agencies published a Notice of Proposed Rulemaking (NPRM) proposing 
revisions to the regulations for protection of human subjects in 
research.\2\ Like the ANPRM, the NPRM sought comment on how to better 
protect research subjects while facilitating valuable research and 
reducing burden, delay, and ambiguity for investigators. Public 
comments on both the ANPRM and the NPRM have informed the final rule 
that is now being promulgated.
---------------------------------------------------------------------------

    \2\ HHS. Federal Policy for the Protection of Human Subjects. 80 
FR 53931 (Sept. 8, 2015). Retrieved from https://www.federalregister.gov/documents/2015/09/08/2015-21756/federal-policy-for-the-protection-of-human-subjects
---------------------------------------------------------------------------

    The final rule is designed to more thoroughly address the broader 
types of research conducted or otherwise supported by all of the Common 
Rule departments and agencies such as behavioral and social science 
research. It also benefits from continuing efforts to harmonize human 
subjects policies across federal departments and agencies.

Summary of the Major Changes in the Final Rule

    The final rule differs in important ways from the NPRM. Most 
significantly, several proposals are not being adopted:
     The final rule does not adopt the proposal to require that 
research involving nonidentified biospecimens be subject to the Common 
Rule, and that consent would need to be obtained in order to conduct 
such research.
     To the extent some of the NPRM proposals relied on 
standards that had not yet been proposed, the final rule either does 
not adopt those proposals or includes revisions to eliminate such 
reliance.
     The final rule does not expand the policy to cover 
clinical trials that are not federally funded.
     The final rule does not adopt the proposed new concept of 
``excluded'' activities. Generally, activities proposed to be excluded 
are now either described as not satisfying the definition of what 
constitutes research under the regulations or are classified as exempt.
     The proposed revisions to the exemption categories have 
been modified to better align with the long-standing ordering in the 
final rule. The final rule does not include the proposed requirement 
that exemption determinations need to be made in specified ways.
     The final rule does not include the proposed standardized 
privacy safeguards for identifiable private information and 
identifiable biospecimens. Aspects of proposals that relied on those 
safeguards have been modified or are not being adopted.
     The final rule does not adopt the most restrictive 
proposed criteria for obtaining a waiver of the consent requirements 
relating to research with identifiable biospecimens.

    The final rule makes the following significant changes to the 
Common Rule:
     Establishes new requirements regarding the information 
that must be given to prospective research subjects as part of the 
informed consent process.
     Allows the use of broad consent (i.e., seeking prospective 
consent to unspecified future research) from a subject for storage, 
maintenance, and secondary research use of identifiable private 
information and identifiable biospecimens. Broad consent will be an 
optional alternative that an investigator may choose instead of, for 
example, conducting the research on nonidentified information and 
nonidentified biospecimens, having an institutional review board (IRB) 
waive the requirement for informed consent, or obtaining consent for a 
specific study.
     Establishes new exempt categories of research based on 
their risk profile. Under some of the new categories, exempt research 
would be required to undergo limited IRB review to ensure that there 
are adequate privacy safeguards for identifiable private information 
and identifiable biospecimens.
     Creates a requirement for U.S.-based institutions engaged 
in cooperative research to use a single IRB for that portion of the 
research that takes place within the United States, with certain 
exceptions. This requirement becomes effective 3 years after 
publication of the final rule.
     Removes the requirement to conduct continuing review of 
ongoing research for studies that undergo expedited review and for 
studies that have completed study interventions and are merely 
analyzing study data or involve only observational follow up in 
conjunction with standard clinical care.

    Other minor changes have been to improve the rule and for purposes 
of clarity and accuracy.

Estimated Costs and Benefits

    Table 1 summarizes the quantified and nonquantified benefits and 
costs of all changes to the Common Rule. Over the 2017-2026 period, 
present value benefits of $1,904 million and annualized benefits of 
$223 million are estimated using a 3 percent discount rate; present 
value benefits of $1,494 million and annualized benefits of $213 
million are estimated using a 7 percent discount rate. Present value 
costs of $528 million and annualized costs of $62.0 million are 
estimated using a 3 percent discount rate; present value costs of $474 
million and annualized costs of $67.0 million are estimated using a 7 
percent discount rate. Nonquantified benefits include improved human 
subjects protections in research; enhanced oversight of research 
reviewed by IRBs not operated by a Federalwide Assurance (FWA)-holding 
institution; and increased uniformity in regulatory requirements among 
Common Rule departments and agencies. Nonquantified costs include the 
time needed for consultation among

[[Page 7151]]

Common Rule agencies before federal guidance is issued.

                         Table 1--Accounting Table of Benefits and Costs of All Changes
----------------------------------------------------------------------------------------------------------------
                                                   Present value of 10 years by   Annualized value over 10 years
                                                    discount rate  (millions of   by discount rate  (millions of
                                                           2015 dollars)                   2015 dollars)
                                                 ---------------------------------------------------------------
                                                     3 percent       7 percent       3 percent       7 percent
----------------------------------------------------------------------------------------------------------------
Benefits:
    Quantified Benefits.........................           1,904           1,493             223             213
rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr---------------------------------------------------------------
Nonquantified Benefits:
    Improved human subjects protections in research; enhanced oversight in research reviewed by IRBs not
     operated by an FWA-holding institution; and increased uniformity in regulatory requirements among Common
     Rule departments and agencies..............................................................................
----------------------------------------------------------------------------------------------------------------
Costs:
    Quantified Costs............................             528             474            62.0            67.0
----------------------------------------------------------------------------------------------------------------
Nonquantified Benefits:
    Time for consultation among Common Rule agencies before federal guidance is issued..........................
----------------------------------------------------------------------------------------------------------------

I. The Rationale for Modernizing the Common Rule

A. The Changing Nature of Research

    This final rule recognizes that in the past two decades a paradigm 
shift has occurred in how research is conducted. Evolving 
technologies--including imaging, mobile technologies, and the growth in 
computing power--have changed the scale and nature of information 
collected in many disciplines. Computer scientists, engineers, and 
social scientists are developing techniques to integrate different 
types of data so they can be combined, mined, analyzed, and shared. The 
advent of sophisticated computer software programs, the Internet, and 
mobile technology has created new areas of research activity, 
particularly within the social and behavioral sciences. In biomedical 
science, the Human Genome Project laid the foundation for precision 
medicine and promoted an environment of data sharing and innovation in 
analytics and technology, and drew attention to the need for policies 
that support a changing research landscape. New technologies, including 
genomic sequencing, have quickly led to exponential growth in the data 
to which investigators have access. The sheer volume of data that can 
be generated in research, the ease with which it can be shared, and the 
ways in which it can be used to identify individuals were simply not 
possible, or even imaginable, when the Common Rule was first adopted.
    Research settings are also shifting. Although much biomedical 
research continues to be conducted in academic medical centers, more 
research is being conducted in clinical care settings, thus combining 
research and medical data. Biospecimen repositories and large databases 
have made it easier to do research on existing (stored) biospecimens 
and data. Clinical research networks connected through electronic 
health records have developed methods for extracting clinical data for 
research purposes and are working toward integration of research data 
into electronic health records in a meaningful way. The scientific 
community recognizes the value of data sharing and open-source 
resources and understands that pooling intellectual resources and 
capitalizing on efficient uses of data and technology represent the 
best ways to advance knowledge.
    At the same time, the level of public engagement in the research 
enterprise has changed. More people want to play an active role in 
research, particularly related to health.
    As technology evolves, so does the nature of the risks and benefits 
of participating in certain types of research. Many studies do not 
involve interaction with research subjects, but instead involve 
secondary analysis of data or biospecimens. Risks related to these 
types of research studies are largely informational, not physical; that 
is, harms could result primarily from the inappropriate disclosure of 
information and not from the research interventions themselves. 
Nonetheless, those harms can be significant.
    Because of these shifts in science, technology, and public 
engagement and expectations, a wide range of stakeholders have raised 
concerns about the limitations of the existing regulatory framework, 
arguing for a re-evaluation of how the fundamental principles of the 
1979 Belmont Report \3\ that underlie the Common Rule--respect for 
persons, beneficence, and justice--are applied in practice to the 
myriad new contexts in which U.S. research is conducted in the 21st 
century. The changes that are being implemented in the final rule 
continue to be shaped by those principles (a detailed background 
discussion of which was provided in the NPRM).
---------------------------------------------------------------------------

    \3\ National Commission for the Protection of Human Subjects of 
Biomedical and Behavioral Research. Belmont Report. Washington, DC: 
U.S. Department of Health and Human Services. 1979. Retrieved from 
http://www.hhs.gov/ohrp/humansubjects/guidance/belmont.html.
---------------------------------------------------------------------------

    Finally, it is important to note that, to the extent appropriate, 
the intent is to eventually amend the other subparts of the HHS human 
subjects protection regulations in 45 CFR part 46 (subparts B, C, D, 
and E), and consider the need for updates to FDA regulations and other 
relevant federal departmental or agency regulations with overlapping 
scope.

B. Public Comments, Expert Advice, Stakeholder Dialogue

    The revisions to the Common Rule are based on a variety of sources 
of public, stakeholder, and expert comments and advice, including 
comments received on the 2011 ANPRM and the 2015 NPRM. They also 
benefit from guidance provided by a 2014 National Research Council 
consensus report, Proposed Revisions to the Common Rule for the 
Protection of Human Subjects in the Behavioral and Social Sciences,\4\ 
and

[[Page 7152]]

the National Academies of Science, Engineering, and Medicine 2016 
report Optimizing the Nation's Investment in Academic Research: A New 
Regulatory Framework for the 21st Century.\5\
---------------------------------------------------------------------------

    \4\ National Research Council of the National Academies. 
Proposed Revisions to the Common Rule for the Protection of Human 
Subjects in the Behavioral and Social Sciences. Washington, DC: The 
National Academies Press; 2014. 13-168. Retrieved from http://www.nap.edu/catalog/18614/proposed-revisions-to-the-common-rule-for-the-protection-of-human-subjects-in-the-behavioral-and-social-sciences.
    \5\ National Academies of Sciences, Engineering, and Medicine. 
Optimizing the Nation's Investment in Academic Research: A New 
Regulatory Framework for the 21st Century. Washington, DC: The 
National Academies Press; 2016. Retrieved from https://www.nap.edu/read/21824/chapter/1.
---------------------------------------------------------------------------

    Since the publication of the 2011 ANPRM, HHS has continued to 
solicit public comment on a variety of policy issues related to human 
subjects protections, including consent, the use of a single IRB for 
multi-institutional studies, and sharing of genomic data. Although 
these policies were more specific than the issues raised in the ANPRM, 
the responses received from public comments provide insight for 
refining the proposals initially put forward in the ANPRM. Of 
particular relevance are the National Institutes of Health's (NIH's) 
recently issued policy on the use of a single IRB for multi-
institutional research,\6\ the Office for Human Research Protection's 
(OHRP's) draft guidance on the required content of consent language for 
research conducted within the standard of care,\7\ and NIH's policy to 
promote sharing of large-scale human genomic data generated from 
studies funded or conducted by NIH.\8\
---------------------------------------------------------------------------

    \6\ National Institutes of Health. Final NIH Policy on the Use 
of a Single Institutional Review Board for Multi-Site Research. June 
21, 2016. Notice Number: NOT-OD-16-094. Retrieved from https://grants.nih.gov/grants/guide/notice-files/NOT-OD-16-094.html.
    \7\ HHS. Draft Guidance on Disclosing Reasonably Foreseeable 
Risks in Research Evaluating Standards of Care. 79 FR 63630 (Oct. 
24, 2014). Retrieved from https://www.gpo.gov/fdsys/pkg/FR-2014-10-24/pdf/2014-25318.pdf.
    \8\ Information about the NIH Genomic Data Sharing policy is 
available at https://gds.nih.gov/03policy2.html.
---------------------------------------------------------------------------

    Other developments include the enactment of the Newborn Screening 
Saves Lives Reauthorization Act of 2014 (Pub. L. 113-240) in December 
2014. The law made a number of changes relevant to the HHS regulations 
for protecting research subjects, including asserting that research 
with newborn dried blood spots (DBS) that is federally funded pursuant 
to the Public Health Service Act is to be considered research with 
human subjects, and that the provisions allowing IRBs to waive consent 
would not apply. By statute, the changes made by this law applied only 
until changes to the Common Rule are promulgated. Thus, the changes 
made by this statute will no longer apply after the effective date of 
this rule, January 19, 2018. In addition, in April 2015, the Medicare 
Access and Children's Health Insurance Program Reauthorization Act of 
2015 (Pub. L. 114-10) was passed. That law requires HHS to issue a 
clarification or modification of the Common Rule with regard to how the 
regulatory requirements should be applied to activities involving 
clinical data registries. In addition, in December 2016 the 21st 
Century Cures Act (Pub. L. 114-255) was enacted.
    Finally, as a result of conducting a variety of public discussions 
associated with the President's Precision Medicine Initiative,\9\ \10\ 
\11\ many perspectives were heard, with much alignment around the 
central tenet that participants should be active partners in such 
research and not merely passive subjects of research studies.
---------------------------------------------------------------------------

    \9\ The White House, Office of the Press Secretary. Fact Sheets: 
President Obama's Precision Medicine Initiative. January 30, 2015. 
Retrieved from https://www.whitehouse.gov/the-press-office/2015/01/30/fact-sheet-president-obama-s-precision-medicine-initiative.
    \10\ Collins FS, Varmus H. A New Initiative on Precision 
Medicine. The New England Journal of Medicine 2015 Feb; 372:793-795.
    \11\ For more information on the Precision Medicine Initiative 
Cohort Program see https://www.nih.gov/sites/default/files/research-training/initiatives/pmi/pmi-working-group-report-20150917-2.pdf.
---------------------------------------------------------------------------

1. Summary of Public Comments on Structural, Conceptual, and Policy 
Implications of the Proposed Rule
    The NPRM received more than 2,100 public comments, the majority of 
which were from people writing in their individual capacity. The 
remaining comments were submitted by institutions, professional 
organizations and societies, and membership organizations. The 
proposals receiving the most comments were those related to 
biospecimens (expanded definition of human subject, broad consent, and 
tightened criteria for waiver of consent). Here we summarize comments 
on the overall structural, conceptual, and policy implications of the 
proposed rule. Comments regarding the specific provisions of the rule 
appear throughout this preamble.
    The NPRM asked for public comment on whether the proposed changes 
will achieve the objectives of: (1) decreasing administrative burden, 
delay, and ambiguity for investigators, institutions, and institutional 
review boards (IRBs); and (2) strengthening, modernizing, and making 
the regulations more effective in protecting research subjects. In 
response, many public commenters expressed concern about the overall 
complexity and length of the NPRM, the unavailability of key 
deliverables, proposals being internally inconsistent, and proposals 
giving investigators too much leeway to determine if their research is 
exempt or falls outside the scope of the rule.
    Several commenters expressed concerns that they were unable to 
adequately or meaningfully comment on particular provisions proposed in 
the NPRM because an underlying document, tool, or list had not been 
developed or shared with the public at the time the NPRM was published, 
specifically: (1) the proposed broad consent templates; (2) the 
proposed standards for privacy protection; (3) the proposed list of 
eligible expedited procedures; and (4) the proposed exemption decision 
tool. Several commenters suggested that these items should be removed 
from the final rule and developed independently, urging government 
personnel to work collaboratively with representatives from the 
research community and funding agencies in the development of such 
documents, tools, and lists.
    Some commenters suggested issuing a new NPRM that would be more 
complete and would include details on the privacy protection standards, 
exemption decision tool, and broad consent templates. Another commenter 
recommended that only the fully developed, less controversial 
provisions of the NPRM should be adopted into a final rule. Another 
commenter urged the Common Rule departments and agencies to reissue the 
NPRM to solicit comment on several of these documents, tools, and 
lists, arguing that it would be unlawful for a final rule to be issued 
until such an action were taken. This commenter noted that for members 
of the public to reasonably participate in rulemaking, agencies must 
provide enough factual detail and rationale to allow interested parties 
to comment meaningfully on the rule. This commenter also argued that 
the NPRM did not satisfy the requirement set forth in the 
Administrative Procedure Act that the notice provided to the public in 
rulemaking include either the terms or substance of the proposed rule 
or a description of the subjects and issues involved. In sum, the 
commenter argued that the NPRM sought comments on numerous provisions 
without providing the ``terms or substance'' of the specific proposals.
    Some commenters encouraged dropping the proposal to require consent 
for research use of nonidentified biospecimens and instead exploring a 
system of public notification and opportunity to opt out of such 
research through issuance of a new NPRM following widespread 
consultation. A few commenters

[[Page 7153]]

suggested that Common Rule departments and agencies fund pilot studies 
to better understand how such a system might work. Additional 
commenters focused on the importance of public education about the 
research enterprise regardless of the policy choices pursued in a final 
rule.
    Commenters, including state health departments and other health 
entities involved in newborn screening activities, raised concerns that 
several of the NPRM proposals represented unfunded mandates, 
specifically the expansion of the definition of human subject to 
include all biospecimens regardless of identifiability, expansion of 
the policy to apply to all clinical trials that meet certain 
conditions, and mandatory single IRB review of cooperative research. 
Several institutions and disease advocacy groups noted that statewide 
newborn screening programs are often modestly funded, and the NPRM 
proposals would impose processes that could cost millions of dollars 
each year.
    In addition, commenters raised concerns that HHS and other Common 
Rule departments and agencies are not authorized under 42 U.S.C. 289 to 
regulate humanities and social science research.
    Public comments also discussed several ideas for consideration in a 
final rule that were not otherwise proposed in the NPRM, including:
     Develop or strengthen sanctions and penalties for 
investigators or institutions that re-identify subjects without proper 
authorization or review, rather than focusing solely on obtaining 
consent as the way to protect subjects. To this end, several commenters 
suggested that a separate section be added to the Common Rule focused 
on investigator responsibilities.
     Develop an IRB efficiency rating system.
     Deem research about IRB operations as an excluded, exempt, 
or expeditable activity to foster research into IRB operations.
     Include provisions about compensation for research-related 
injuries.
     More fully review and address how the rule should or 
should not apply to prisoners, children, and pregnant women and 
fetuses.
     Include provisions about U.S.-funded studies in developing 
countries with regard to defining standards of care and addressing 
post-trial access to proven therapies.
2. Response to Public Comments on Structural, Conceptual, and Policy 
Implications of the Proposed Rule
    The final rule differs in numerous, major ways from what was 
proposed in the NPRM. Most significantly, the provisions relating to 
making nonidentified biospecimens subject to the Common Rule are not 
being implemented. That change alone addresses many of the public 
comments on the NPRM. Eliminating that proposal is intended to address 
concerns about the complexity of and lack of justification for the 
proposed changes in the rule, as well as concerns about embarking on 
significant changes without evidence that they would improve the 
system. Responses to public comments on specific provisions appear 
throughout this preamble. Below we summarize our responses to comments 
that addressed major structural or organizational issues or perceived 
insufficiencies in the NPRM proposals and their presentation.
    Concerns about the overall complexity of the proposed changes have 
been addressed in several ways. For example, concerns about creating a 
new category of ``excluded'' activities have been addressed by not 
adopting that concept in the final rule. Instead, the goal of 
clarifying what is covered by the rule has been accomplished by 
modifying the definition of what constitutes research, and by adding or 
modifying exemptions that were already in the pre-2018 rule.\12\ And, 
even where existing concepts are modified, we have attempted to make 
those modifications in ways that minimize the extent of the change 
(such as largely preserving much of the core structure of the previous 
exemption categories).
---------------------------------------------------------------------------

    \12\ For purposes of this preamble, the terms ``pre-2018 
requirements'' or ``pre-2018 rule'' refer to the Common Rule as 
published in the 2016 edition of the Code of Federal Regulations 
(i.e., the Federal Policy for the Protection of Human Subjects, 
originally published on June 18, 1991 and subsequently amended on 
June 23, 2005). In addition, the term ``this rule'' or ``final 
rule'' refers to the 2018 requirements as presented in this 
issuance.
---------------------------------------------------------------------------

    To reduce public concerns about the aspects of the proposal that 
were not yet developed, we chose not to implement most of those 
provisions. For example, given the changes made to the proposals 
regarding broad consent, the final rule does not reference or include 
the concept of broad consent templates. The requirement that the 
Secretary of HHS develop a list of proposed privacy safeguards has been 
eliminated, as has the proposed exemption decision tool. In addition, 
we have dropped the regulatory requirement for the Secretary of HHS to 
publish a list of activities that are minimal risk (as was proposed in 
the NPRM in the definition of minimal risk). The final rule retains the 
requirement at Sec.  __.110(a) that the Secretary of HHS will establish 
and publish for public comment a list of categories of research that 
may be reviewed by an IRB through the expedited review procedure, 
consistent with the pre-2018 rule.
    Some of the ``new ideas'' for altering the system for protecting 
research subjects that were presented by commenters--for example, 
addressing compensation for research-related injuries or the meaning of 
equivalent protections when research is conducted in foreign 
countries--were either very innovative or not yet widely discussed. 
This made it difficult to adopt them at this point without further 
study and additional notice and opportunity for public comment. 
Therefore, the fact that one or another of these ideas was not 
incorporated into the final rule should not be viewed as a rejection of 
their possible merits, or an indication that they might not be explored 
in some future revision of the Common Rule or in guidance.
a. Process Issues
    We carefully considered concerns voiced by commenters about the 
process that led to this final rule, and other legal concerns about the 
adequacy of that process. We concluded that the approach proposed in 
the NPRM and the approach adopted in this final rule are consistent 
with the Federal Government's obligations under the Administrative 
Procedure Act.
    Regarding the concerns expressed that the Common Rule departments 
and agencies are not authorized to regulate humanities and social 
science research, this challenge had been asserted previously against 
the 1981 HHS protection of human subjects regulations,\13\ as well as 
the 1991 Common Rule,\14\ and in each case the regulatory agencies 
concluded that the regulation of humanities and social science research 
is justified. We continue to assert the authority to regulate 
humanities and social science research that falls within the scope of 
the final rule.
---------------------------------------------------------------------------

    \13\ Federal Regulations Amending Basic HHS Policy for the 
Protection of Human Research Subjects; Final Rule, 46 FR8366 
(January 26, 1981). Retrieved from https://wayback.archive-it.org/all/20160202182914/http://archive.hhs.gov/ohrp/documents/19810126.pdf.
    \14\ Federal Policy for the Protection of Human Subjects; 
Notices and Rules. 56 FR 28002. (June 18, 1981). Retrieved from 
https://www.hhs.gov/ohrp/sites/default/files/ohrp/policy/frcomrul.pdf.

---------------------------------------------------------------------------

[[Page 7154]]

C. Signatories to the Common Rule

    This section provides information about where each Common Rule 
department or agency's statutory authority for enacting and revising 
human subjects research protection regulation lies, and provides 
additional information about new signatories to the Common Rule.
    The regulations are codified in each department or agency's title 
or chapter of the CFR. The Common Rule was based on HHS's regulations, 
45 CFR part 46, subpart A, and includes identical language in the 
separate regulations of each department and agency.
    Although they did not previously issue the Common Rule in 
regulations, four departments and agencies have historically complied 
with all subparts of the HHS protection of human subjects regulations 
at 45 CFR part 46. These are the Central Intelligence Agency (CIA), the 
Office of the Director of National Intelligence (ODNI), the Department 
of Homeland Security (DHS), and the Social Security Administration 
(SSA).
    Pursuant to Executive Order 12333 of December 4, 1981, as amended, 
elements of the Intelligence Community must comply with the guidelines 
issued by HHS regarding research on human subjects found in 45 CFR part 
46. This final rule does not supersede the Executive Order. The CIA 
will continue to adhere to the HHS regulations at 45 CFR part 46, 
pursuant to the Executive Order.
    Through this rulemaking, DHS is codifying the final rule into its 
own agency regulations. DHS, which was created after issuance of the 
pre-2018 rule, has been required by statute (Pub. L. 108-458, title 
VIII, section 8306) to comply with 45 CFR part 46, or with equivalent 
regulations promulgated by the Secretary of Homeland Security or his 
designee. Through this rulemaking, DHS is issuing equivalent 
regulations, consistent with statute, and will comply with the DHS 
regulations as the requirements will be equivalent to compliance with 
HHS regulations at 45 CFR part 46, subpart A.
    Through this rulemaking, SSA is codifying the final rule into its 
own agency regulations. SSA was separated from HHS in 1995 and, 
pursuant to the transition rules provided in Section 106 of title 1 of 
Pub. L. 103-296, has been required to apply regulations that applied to 
SSA before the separation, absent action by the Commissioner. With this 
rulemaking, SSA will follow the SSA regulations (adopting the 
provisions of this final rule) instead of HHS regulations at 45 CFR 
part 46, subpart A. (See Pub. L. 103-296 Sec. 106(b), 108 Stat. 1464, 
1476.)
    The Department of Labor (DOL), which was not a signatory to the 
pre-2018 rule, is now a signatory to this rulemaking and is codifying 
the final rule in DOL regulations for human subjects research that DOL 
conducts or supports.
    The Consumer Product Safety Commission (CPSC), subject to 
Commission vote, intends to adopt this rule through a separate 
rulemaking.
    The legal authority for the departments and agencies that are 
signatories to this action is as follows:
    Department of Homeland Security, 5 U.S.C. 301; Pub. L. 107-296, 
sec. 102, 306(c); Pub. L. 108-458, sec. 8306. Department of 
Agriculture, 5 U.S.C. 301; 42 U.S.C. 300v-1(b). Department of Energy, 5 
U.S.C. 301; 42 U.S.C. 7254; 42 U.S.C. 300v-1(b). National Aeronautics 
and Space Administration, 5 U.S.C. 301; 42 U.S.C. 300v-1(b). Department 
of Commerce, 5 U.S.C. 301; 42 U.S.C. 300v-1(b). Social Security 
Administration, 5 U.S.C. 301; 42 U.S.C. 289(a). Agency for 
International Development, 5 U.S.C. 301; 42 U.S.C. 300v-1(b), unless 
otherwise noted. Department of Housing and Urban Development, 5 U.S.C. 
301; 42 U.S.C. 300v-1(b) and 3535(d). Department of Labor, 5 U.S.C. 
301; 29 U.S.C. 551. Department of Defense, 5 U.S.C. 301. Department of 
Education, 5 U.S.C. 301; 20 U.S.C. 1221e-3, 3474; 42 U.S.C. 300v-1(b). 
Department of Veterans Affairs, 5 U.S.C. 301; 38 U.S.C. 501, 7331, 
7334; 42 U.S.C. 300v-1(b). Environmental Protection Agency, 5 U.S.C. 
301; 7 U.S.C. 136a(a) and 136w(a)(1); 21 U.S.C. 346a(e)(1)(C); sec. 
201, Pub. L. 109-54, 119 Stat. 531; and 42 U.S.C. 300v-1(b). Department 
of Health and Human Services, 5 U.S.C. 301; 42 U.S.C. 289(a); 42 U.S.C. 
300v-1(b). National Science Foundation, 5 U.S.C. 301; 42 U.S.C. 300v-
1(b). Department of Transportation, 5 U.S.C. 301; 42 U.S.C. 300v-1(b).

II. To what does this policy apply?

Scope and Applicability of the Regulations

    This section of the preamble describes changes made in the final 
rule with regard to its scope and applicability. Specifically, it 
addresses which entities are subject to the rule; coverage of clinical 
trials; department and agency discretion in applying the rule; the 
relevance of state and local laws; coverage of research conducted in 
foreign countries; the goal of harmonizing guidance across the federal 
entities; effective and compliance dates; and severability.

A. IRBs Not Operated by an Institution Holding a Federalwide Assurance 
(Sec.  __.101(a)(1))

1. Background and Pre-2018 Requirements
    Before this final rule, IRBs not operated by an institution holding 
an FWA were not directly subject to oversight for compliance with the 
Common Rule. In situations in which an institution relied on an IRB not 
operated by the institution, OHRP's practice was to hold the 
institution engaged in human subjects research accountable for 
compliance violations, even in circumstances in which the regulatory 
violation was directly related to the responsibilities of the IRB.
    An institution might rely on an IRB not operated by that 
institution to review cooperative research, that is, research conducted 
at more than one institution. However, for some, such reliance has been 
considered problematic due to lack of direct regulatory accountability 
for these IRBs. Previously, the choice to have cooperative research 
reviewed by a single IRB was voluntary and, for federally funded 
research, most institutions have been reluctant to replace review by 
their own IRB with review by a single IRB not operated by that 
institution.
2. NPRM Proposal To Cover IRBs not Operated by an Institution Holding 
an FWA
    For the reasons outlined above, and based on comments to OHRP's 
2011 ANPRM, the NPRM proposed adding a new provision at Sec.  __.101(a) 
that would explicitly give Common Rule departments and agencies the 
authority to enforce compliance directly against IRBs that are not 
operated by an FWA-holding institution (sometimes referred to as 
``independent IRBs''). Under the pre-2018 rule, even if an institution 
engaged in research relied on an IRB operated by another FWA-holding 
institution, OHRP's practice has been to enforce compliance through the 
engaged institution and not the reviewing IRB.
    Relatedly, another NPRM proposal would require single IRB review of 
multi-institution studies (see Section XII of this preamble). This 
proposal would place responsibility for meeting the relevant regulatory 
requirements on the IRB of record in a multi-institutional study, 
rather than on the institution engaged in the research.

[[Page 7155]]

3. Public Comments
    Approximately 50 comments addressed this proposal, largely in 
support, because it would encourage institutions to rely on IRBs not 
operated by an FWA-holding institution when necessary and would place 
responsibility on the IRB and its decisions rather than on the 
institution relying on the IRB's determination. Commenters stated that 
this change could increase IRB accountability and protect institutions 
relying on IRBs that they do not operate. However, a few commenters 
supported the proposal only if the mandate for a single IRB of record 
in multi-institutional research was not implemented. That is, they 
supported the concept of holding IRBs not operated by the institution 
engaged in research accountable for compliance, but did not support it 
if it was intended solely to facilitate mandatory single IRB review for 
cooperative research, because they opposed that mandate. One 
organization that advocates for human subjects protections opposed the 
proposal because it did not believe that any research should be 
reviewed by an independent IRB, and feared this practice would become 
more frequent with this change. Several academic institutions opposed 
the proposal, as did a large trade organization, stating that this 
extension of the rule was not necessary.
4. Response to Comments and Explanation of the Final Rule: Authority To 
Enforce Compliance Directly Against IRBs Not Operated by an FWA-Holding 
Institution
    New language at Sec.  __.101(a) is adopted that gives Common Rule 
departments and agencies the authority to enforce compliance directly 
against IRBs that are not operated by an assured institution. This 
authority will allow Common Rule departments and agencies to avoid 
involving other engaged institutions in enforcement activities related 
to the responsibilities of the designated IRB. It is anticipated that 
this change will reassure institutions using an IRB that they do not 
operate because compliance actions could be taken directly against the 
IRB responsible for the regulatory noncompliance, rather than against 
the institutions that relied on that review.

B. Coverage of Clinical Trials

1. Background and Pre-2018 Requirements
    The Common Rule has historically applied to human subjects research 
that is conducted or supported by a Common Rule department or agency. 
Research that is not federally conducted or supported has not been 
subject to the Common Rule's requirements unless the U.S. institution 
receiving federal funding for research voluntarily extended the Common 
Rule to all research conducted at that institution, regardless of 
funding source.
    The Institute of Medicine,\15\ the National Bioethics Advisory 
Commission,\16\ and others have stated that human subjects would be 
best protected by applying consistent ethical standards and a uniform 
system of regulatory oversight to all human subjects research conducted 
in the United States. Common Rule departments and agencies do not have 
statutory authority to directly apply the Common Rule to all human 
subjects research conducted in the United States. However, departments 
and agencies can require U.S. institutions that receive some federal 
funding from a Common Rule department or agency for research with human 
subjects to extend regulatory protections to all research studies 
conducted at the institution as a condition of funding. The 2011 ANPRM 
sought comment on this approach.
---------------------------------------------------------------------------

    \15\ Federman DD, Hanna KE, Rodriguez LL, eds. Responsible 
Research: A Systems Approach to Protecting Research Participants. 
Washington, DC: National Academies Press; 2002.
    \16\ National Bioethics Advisory Commission. Ethical and Policy 
Issues in Research Involving Human Participants. Bethesda, MD; 2001.
---------------------------------------------------------------------------

2. NPRM Proposal
    The NPRM proposed changes in the regulatory language to extend the 
rule to all clinical trials, irrespective of funding source, that met 
three conditions: (1) The clinical trials are conducted at an 
institution that receives support from a federal department or agency 
for human subjects research that was not proposed to be excluded under 
the NPRM and was not exempt; (2) the clinical trials are not subject to 
FDA regulation; and (3) the clinical trials are conducted at an 
institution located within the United States.
    The purpose of the proposed clinical trials extension was to ensure 
that clinical trials involving significant risks that would otherwise 
not be covered be subject to federal oversight. It was for that reason 
that the proposed extension excluded clinical trials subject to FDA 
oversight. The proposed extension also was based on whether an 
institution received funding specifically for other human subjects 
research that had to comply with the substantive requirements of the 
Common Rule. The Common Rule departments and agencies have a more 
substantial relationship with institutions that receive federal support 
to conduct research subject to the regulatory requirements than they do 
with institutions that receive such support for only exempt human 
subjects research.
    The NPRM proposed that a clinical trial be defined as a research 
study in which one or more human subjects are prospectively assigned to 
one or more interventions (which may include placebo or other control) 
to evaluate the effects of the interventions on biomedical or 
behavioral health-related outcomes. By the term ``behavioral health-
related outcomes,'' the NPRM recognized that clinical trials may occur 
outside of the biomedical context, and further stated that the studies 
addressed in the proposed definition of clinical trial are more likely 
to present more than minimal risk to subjects, and, therefore, require 
the highest level of oversight.
3. Public Comments
    Approximately 70 comments discussed the proposal to extend the 
Common Rule to cover certain clinical trials. Opinion was mixed, with a 
slim majority opposing the proposed change. Universities and medical 
centers providing comments largely opposed the proposed measure, while 
professional associations and advocacy groups largely supported the 
proposal. We note that some of those who opposed the clinical trial 
extension did so because they felt that the proposal did not go far 
enough to include additional types of research.
    Those supporting the proposed change indicated that it had the 
potential to ensure greater consistency of rules and protections for 
research subjects, thereby aiding efficiency and speeding the review 
process of study protocols. However, even those commenters who 
supported the proposal indicated that such an extension must fulfill 
the intent of a risk-based, streamlined approach to human subject 
protection, considering the effects of this extension on certain 
minimal risk research activities, such as student research, and social, 
behavioral, and educational research.
    Those expressing opposition to this expansion of coverage noted 
concerns that: (1) Because the research institutions likely to engage 
in clinical trials already require IRB review of such research, the 
expansion would only increase administrative burdens (such as federal 
reporting requirements) for this type of research without a meaningful 
increase in protections to human subjects; (2) the regulatory extension 
to nonfederally funded

[[Page 7156]]

clinical trials would encompass many minimal-risk social and behavioral 
research activities and currently unregulated institutional activities 
that involve randomization (such as nonfederally funded quality 
improvement or quality assurance activities); and (3) because an 
institution's funding status may change, implementation of this 
proposal would be complicated. Several commenters expressed concern 
about the lack of detail in the NPRM regarding the planned 
implementation of the proposed requirement.
    Several commenters also expressed concern that the unfunded 
clinical trials encompassed by this proposal would be subject to the 
single IRB mandate without a corresponding provision of federal funds 
to implement that requirement.
    Some commenters suggested that the proposed change in the NPRM will 
not address the real gap in human subjects protections--facilities that 
receive no federal funding--and that if broad concern exists that some 
subjects are not being adequately protected in research that is not 
federally funded, then Congress would be the appropriate body to 
address any such deficiency through legislation. Further, some 
commenters expressed concern that extending the Common Rule to 
nonfederally funded clinical trials might have an overall effect of 
decreasing human subject protections by discouraging some smaller 
organizations from accepting any federal funding, thus removing federal 
oversight of their work.
    One research institution noted that, if finalized, the proposed 
clinical trials extension would be implemented at the same time the 
ability of institutions to formally extend the application of the rule 
to all research conducted at the institution is being eliminated. Some 
states, such as Virginia, have state human subjects regulations that 
must be applied to research when federal regulations are not required. 
The commenter noted that removing the option to voluntarily extend the 
FWA would have the effect of reducing uniform application of the 
federal standards, as nonfederally funded research that does not meet 
the proposed definition of a clinical trial would by default be subject 
to state law.
    A few commenters challenged whether the legal authority provided by 
the Public Health Service Act was sufficient to extend the Common Rule 
to nonfederally funded clinical trials. Commenters also suggested that 
this proposal is an unfunded mandate from the Federal Government with 
no benefit accruing to subjects or the research enterprise.
4. Response to Comments and Explanation of the Final Rule: Coverage of 
Certain Clinical Trials
    The final rule does not adopt the NPRM proposal. Although we 
continue to maintain the position that increased harmonization of 
appropriate standards for ethical oversight of human subjects research 
is an important and desirable endpoint, we agree with the concerns 
expressed by commenters suggesting that our proposal for extending the 
Common Rule to currently unregulated clinical trials would benefit from 
further deliberation. Some commenters asserted that, in our attempt to 
close the perceived ``gap'' in oversight, the NPRM created a structure 
that would be both confusing and complicated for institutions to 
implement. We received multiple comments objecting to the 
administrative complexity involved in applying a regulatory extension 
triggered by the receipt of Common Rule department or agency funding 
for other nonexempt research, and asserting that the administrative 
burden is not offset by a corresponding increase in the meaningful 
protection of human subjects. Additionally, it is apparent from the 
public comments received that our intention to apply the Common Rule to 
cover the most risky types of research--clinical trials--was not 
accomplished through the NPRM proposal, given the definition of 
``clinical trial'' included in the NPRM, as that definition encompassed 
research that would pose no more than minimal risk to subjects. 
Commenters were further concerned that an unintended consequence might 
be that the proposed extension would apply to low-risk student research 
and social, behavioral, or educational research, and would cause 
currently unregulated institutional activities, such as certain quality 
improvement or quality assurance activities, to fall within regulatory 
oversight. Upon reflection on the perspectives expressed by these 
commenters, we are persuaded that the proposed extension of the Common 
Rule is not appropriate to include in a final rule at this time. We 
will continue to carefully consider the related issues.
    As an alternative, we contemplated explicitly limiting the 
extension of this policy to clinical trials that present greater than 
minimal risk to subjects in order to better align with the intent of 
this extension, as described in the preamble to the NPRM. However, such 
an alteration of the rule would itself introduce a variety of 
complexities, including the question of how a determination would be 
made that a particular activity involves more than minimal risk. Thus, 
there would be a very real possibility that such a rule would lead to 
an administrative burden on substantially more activities than the rule 
itself would be targeting (such as many minimal risk quality 
improvement activities).
    We also considered the alternative of maintaining the pre-2018 
standard of allowing institutions to voluntarily extend their FWAs to 
nonfederally funded research. We concluded that this alternative would 
not further the expressed goal of increasing the application of 
consistent protections to clinical trials, regardless of the source of 
support, because the extension of the FWA would be optional. We 
therefore plan to implement the proposed nonregulatory change to the 
assurance mechanism to eliminate the voluntary extension of the FWA to 
nonfederally funded research.
    We note the concern expressed by commenters that a gap in federal 
oversight will remain for nonfederally funded research, and the comment 
that Congress would be the appropriate body to address any such 
deficiency through legislation. We recognize that institutions may 
choose to establish an institutional policy that would require IRB 
review of research that is not funded by a Common Rule department or 
agency (and indeed, as commenters noted, almost all institutions 
already do this), and nothing in this final rule precludes institutions 
from providing protections to human subjects in this way. As a result, 
the final rule continues to allow institutions the same wide degree of 
flexibility that they currently have with regard to making other 
similar determinations regarding ethical oversight of research not 
regulated by the Common Rule.
    Although we are not implementing the proposed extension of the 
Common Rule to ``clinical trials'' (as defined by this policy), the 
proposed definition of ``clinical trial'' is still relevant to the 
final rule provision requiring posting of one IRB-approved consent form 
used to enroll subjects for a clinical trial conducted or supported by 
a federal department or agency, at Sec.  __.116(h). The definition of 
clinical trial is unaltered from the NPRM proposal and appears at Sec.  
__.102(b).

C. Activities Deemed Not To Be Research Appear at Sec.  __.102(l) and 
Research Exempt From This Policy Appears at Sec.  __.104

    In response to the public comments, the NPRM's general approach of 
designating various categories of

[[Page 7157]]

activities as excluded is not included in the final rule. The final 
rule reverts to the general structure of the pre-2018 rule and 
integrates some of the categories proposed for exclusion in the NPRM 
into that structure. Some changes to the categories are also included 
in the final rule.
    In the final rule, some of the proposed exclusions from the 
requirements of the Common Rule are addressed in the definition of 
research, which includes a provision identifying ``activities that are 
deemed not to be research'' (see Section III). In addition, some of the 
proposed exclusions are included as exemptions in the final rule. Under 
Sec.  __.101(b) of the pre-2018 rule, six categories of research were 
considered exempt from this policy unless otherwise required by 
department or agency heads. In the final rule, exempt research is now 
described at Sec.  __.104 and eight categories are included (see 
Section V).

D. Department or Agency Discretion in Applying the Policy (Sec.  
__.101(c), (d), (i))

1. Background and Pre-2018 Requirements
    The pre-2018 requirements included provisions at Sec.  __.101 that 
allowed federal department or agency heads to determine which specific 
activities or classes of activities are covered by the rule and whether 
certain requirements could be waived. This flexibility was allowed in 
recognition of the varying missions of the federal departments and 
agencies, the possibility that there may be superseding or alternative 
statutes or regulations governing their activities, and the possibility 
that a given situation requires either more stringent oversight (e.g., 
``sensitive research'') or reduced requirements (e.g., a public health 
emergency).
2. NPRM Proposals
    The NPRM proposed to retain the Common Rule's pre-2018 requirement 
that federal department or agency heads retain final judgment about the 
coverage of particular research activities under the Common Rule (Sec.  
__.101(c)) and proposed an additional requirement that federal 
department or agency heads exercise their authority consistent with the 
principles of the Belmont Report.
    The NPRM also proposed at Sec.  __.101(d) that a department or 
agency may require additional protections for specific types of 
research it supports or conducts, or that is otherwise subject to 
regulation by the federal department or agency but not otherwise 
covered by the Common Rule. However, advance public notice would be 
required when those additional requirements apply to entities outside 
of the federal department or agency itself. This latter requirement was 
intended to promote harmonization among federal agencies or 
departments, to the extent possible, and to ensure transparency between 
funding entities and the regulated community.
    Finally, at Sec.  __.101(i) the NPRM proposed to amend the criteria 
for a department or agency waiving the applicability of some or all of 
the provisions of the policy, by stating that the alternative 
procedures to be followed must be consistent with the principles of the 
Belmont Report. The addition of this provision was to make explicit the 
ethical basis underpinning how waiver decisions have and must be 
considered. The NPRM also proposed that such waivers be posted on a 
publicly accessible federal Web site.
3. Public Comments
    Approximately 25 comments related to the NPRM proposals at Sec.  
__.101(c) and (i) and none on Sec.  __.101(d). Comments received on 
these proposals generally expressed opposition to ever granting the 
authority to department or agency heads to retain final judgment as to 
whether a particular activity is covered by this policy, or to waive 
certain requirements, even though these provisions existed in the pre-
2018 rule. These commenters were concerned about the potential for 
Common Rule departments and agencies to exclude certain activities for 
political purposes or for expediency, such as certain activities that 
might involve surveillance or criminal investigative aims. With regard 
to Sec.  __.101(i), some commenters stated that reference to the 
ethical principles of the Belmont Report was too narrow. That is, one 
might rely on additional ethical considerations to evaluate the 
applicability of the regulations.
4. Response to Public Comments and Explanation of the Final Rule: 
Department or Agency Discretion About Applicability of the Policy
    The final rule adopts the NPRM proposals in Sec.  __.101(c). Thus, 
under Sec.  __.101(c), department or agency heads retain final judgment 
as to whether a particular activity is covered by the Common Rule, and 
this judgment should be exercised consistent with the ethical 
principles of the Belmont Report. We note that under the pre-2018 
requirements Common Rule departments and agencies retained final 
authority as to whether a particular human subjects research study 
conducted or supported by that department or agency is covered by the 
Common Rule (Sec.  __.101(c)) and that authority continues under the 
final regulations, but with the new limitation that this judgment must 
be consistent with the ethical principles of the Belmont Report. This 
discretion provides important flexibility given the varying missions 
and policies of the many departments and agencies.
    Although some commenters were opposed to ever granting departments 
or agencies the authority permitted by Sec.  __.101(c), we believe 
requiring that these decisions be consistent with the principles of the 
Belmont Report is an approach that promotes accountability while still 
giving federal departments and agencies the necessary flexibility to 
achieve their respective missions.
    The final rule in Sec.  __.101(d) does not adopt the NPRM 
proposals, and instead retains the pre-2018 language. The NPRM proposed 
to modify Sec.  __.101(d) to say that department or agency heads could 
require additional protections to research activities conducted or 
supported by federal departments or agencies, but that were not 
otherwise covered by the Common Rule. This language was intended as a 
clarification to the pre-2018 language. However, we determined that the 
term ``additional protections'' could potentially be confusing in that 
the activities at issue in this provision are those for which no Common 
Rule protections are required; thus the protections imposed by 
department or agency heads might be the only protections to which these 
activities are subject. We also note that departments or agencies 
conducting or supporting an activity subject to the Common Rule may 
require additional protections for human subjects.
    The final rule also does not incorporate the NPRM proposal in Sec.  
__.101(d) that advance public notice must be provided when a department 
or agency head requires that the Common Rule, or part of it, be applied 
to research activities not otherwise subject to the rule. Upon further 
assessment, we decided that such a requirement could hinder the ability 
of a department or agency to move quickly in cases where the department 
or agency determined that additional protections are warranted.
    Section __.101(i) of the final rule adopts a majority of the NPRM 
proposals. As proposed in the NPRM, Sec.  __.101(i) is modified to 
require that any alternative procedures adopted by departments or 
agency heads are consistent with the principles of the Belmont Report. 
Also as proposed in the NPRM, Sec.  __.101(i) is modified to state

[[Page 7158]]

that, unless otherwise required by statute or executive order, notice 
of these alternative procedures must be forwarded to OHRP (or any 
successor office), or to the equivalent office within the appropriate 
federal department or agency. The pre-2018 rule only listed OHRP (or 
any successor office) as the office to which notices must be sent. This 
final rule modification is intended to ensure that if a non-HHS 
department or agency allows for alternative procedures, the appropriate 
office within that same department or agency receives notification. The 
final rule retains the pre-2018 requirement for the notice to also be 
published in the Federal Register or in such other manner provided for 
in department or agency procedures.
    The final rule also adopts in Sec.  __.101(i) the NPRM proposal to 
require that the waiver notice include a statement that identifies the 
conditions under which the waiver will be applied and a justification 
as to why the waiver is appropriate for the research, including how the 
decision is consistent with the principles in the Belmont Report.
    Section __.101(i) of the final rule does not include the NPRM 
proposal that would have required each federal department or agency 
conducting or supporting the research to establish on a publicly 
accessible federal Web site a list of the research for which a waiver 
has been issued. We decided that the rule's requirement to publish the 
waiver notice in the Federal Register, or in such other manner as 
provided in department or agency procedures, adequately ensures that 
the waiver notice will be available to the public without also 
requiring that such notices be listed on a federal Web site. We note 
that some departments, such as HHS, currently post such notices on 
their Web sites.
    The final rule thus formally codifies in Sec.  __.101(c) and (i) 
the general practice that the ethical standards articulated in the 
Belmont Report are the ethical standards that Common Rule departments 
or agencies will use in determining whether an activity is covered 
under this policy or whether to grant a waiver of the applicability of 
some or all of the provisions (unless otherwise required by law). The 
addition of the reference to the Belmont Report makes explicit the 
ethical basis underpinning how waiver decisions have and must be 
considered.

E. State and Local Laws That Provide Additional Protections for Human 
Subjects (Sec.  __.101(f))

1. Background and Pre-2018 Requirements
    The pre-2018 rule specified that the policy does not affect any 
state or local laws or regulations that may otherwise be applicable and 
that provide additional protections for human subjects. The NPRM did 
not propose any changes to this statement. However, questions raised by 
public comments, as described below, led to some clarifications to the 
final rule.
1. Public Comments
    Several public comments raised questions and concerns about the 
ability of tribal nations to require additional protections that might 
be needed for research involving American Indian/Alaska Native (AI/AN) 
populations.
    One tribal government noted the documented mistrust of research by 
AI/AN people and communities, and advocated for specific provisions 
acknowledging the authority and role of tribal nations in overseeing 
research that happens on their lands and with their citizens. 
Additionally, this entity noted that tribal nations do not always have 
their own regulatory bodies for human subject research protections, 
expressing concern about external groups deciding what constitute risks 
and benefits for the community.
Other AI/AN Population concerns of commenters included:
     Tribal (i.e., group) and individual consent for secondary 
research with biospecimens: Commenters noted that group consent can 
occur and should inform the proposed changes in the rule. They also 
noted that broad consent for future, unspecified research use of 
biospecimens presents a challenge to the ongoing ability of both tribes 
and individuals to choose to remove their data from research, or to 
understand how their information is being used to benefit, or put at 
risk, themselves or others.
     Tribal and individual consent for research with 
biospecimens or other data from people who are no longer alive: AI/AN 
groups noted the need to address protections for biospecimens initially 
collected from living humans after those humans pass away.
     Research oversight by tribal IRBs and other tribal 
regulatory bodies: AI/AN groups raised concerns about the use of a 
single IRB in cooperative and multi-institutional research, which does 
not foster community-based governance and oversight of research that 
has the potential to improve outcomes for tribal and minority 
populations.
     Research oversight for categories of research and 
activities important in tribal contexts: Commenters noted concerns 
about the proposed changes related to the exclusion of certain 
categories of activities (e.g., oral history, biography), addition of 
exempt categories of research (e.g., educational tests, surveys, 
interviews), and elimination of continuing review requirements for some 
studies because tribal research review often extends the scope of 
examination beyond individual-level protections to enact community-
level protections important for maintaining the integrity of culturally 
significant information and practices. Changes to excluded and exempt 
categories of research and eliminating some continuing review 
requirements, especially where no clear mechanism for additional tribal 
oversight and input has been established, are a cause for concern for 
the AI/AN community.
2. Response to Public Comments and Explanation of the Final Rule: State 
and Local Laws That Provide Additional Protections
    Consistent with the pre-2018 rule, this final rule retains the 
language in Sec.  __.101(f)) providing that the Common Rule does not 
affect any state or local laws or regulations that may otherwise be 
applicable and that provide additional protections for human subjects. 
However, the final rule adds clarifying language providing that the 
referenced state or local laws or regulations include tribal laws 
passed by the official governing body of an AI/AN tribe. Thus, if the 
official governing body of a tribe passes a tribal law that provides 
additional protections for human subjects, the Common Rule does not 
affect or alter the applicability of such tribal law. (Note that a 
similar change was also made to Sec.  __.116(i) and (j) to provide the 
same clarification.) In addition, for purposes of the exception to the 
single IRB review requirement for cooperative research, relating to 
circumstances where review by more than a single IRB is required by 
law, Sec.  __.114(b)(2)(i) specifies that tribal law is to be 
considered in assessing whether more than single IRB review is required 
by law.

[[Page 7159]]

F. Research Covered by This Policy Conducted in Foreign Countries 
(Sec.  __.101(h))
1. Background and Pre-2018 Requirements
    The pre-2018 requirements at Sec.  __.101(h) stated that when 
research covered by this policy takes place in foreign countries, 
procedures normally followed in those countries to protect human 
subjects may differ from those set forth in this policy. The previous 
rule cited the Declaration of Helsinki, as amended in 1989, as an 
example of internationally recognized ethical standards that a foreign 
country might use as its ethical standard. The rule provided that if a 
department or agency head determined that procedures prescribed by the 
institution in the foreign country afforded protections that are at 
least equivalent to those provided in this policy, the department or 
agency head may approve the substitution of the foreign procedures in 
lieu of the procedural requirements provided in this policy.
2. NPRM Proposal
    The NPRM proposed to remove the specific reference to the 
Declaration of Helsinki in this provision. A concern with providing a 
specific example of an internationally recognized ethical document is 
that such a document is subject to change independent of Common Rule 
departments and agencies, and therefore could be modified to contain 
provisions that are inconsistent with future U.S. laws and regulations.
3. Public Comments
    A few comments addressed the removal of the reference to the 
Declaration of Helsinki. These comments were equally divided between 
those opposed and those supportive or generally supportive. Those 
opposed feared that the removal of the reference would suggest that the 
Declaration of Helsinki does not apply and that it was cited in the 
pre-2018 requirements as an example, not as an equivalent replacement 
for the Common Rule. These commenters also noted that the United States 
had refused to sign on to some recent revisions to the Declaration. One 
organization commented that it would have been useful for the NPRM to 
address the issue of equivalent protections for U.S.-funded research 
conducted in foreign countries, as that might have addressed ongoing 
concerns about the use of alternative systems of protections when 
research is conducted outside the United States. Those supportive of 
removing the reference to the Declaration of Helsinki agreed with the 
arguments laid out in the NPRM and felt that it was judicious to not 
align U.S. regulations with other standards because those standards are 
likely to change, perhaps in ways inconsistent with U.S. policy.
4. Response to Public Comments and Explanation of Final Rule: Removing 
the Reference to the Declaration of Helsinki
    The final rule adopts the NPRM proposal. Although the pre-2018 
requirements cited the Declaration of Helsinki as an example of 
internationally recognized ethical standards that a foreign country 
might use as its ethical base, we note that providing a specific 
example of an internationally recognized ethical document is concerning 
because such a document is subject to change independent of Common Rule 
department or agency policies, and therefore might be modified in ways 
that create standards that are inconsistent with U.S. laws and 
regulations.

G. Harmonization of Department and Agency Guidance (Sec.  __.101(j))

1. Background and Pre-2018 Requirements
    Each Common Rule department and agency and the Food and Drug 
Administration (FDA) are authorized to issue its own guidance with 
regard to interpreting and implementing the regulations protecting 
human subjects. That guidance may differ substantially across entities. 
Currently, multiple efforts are underway to address variation in 
guidance across the Federal Government, but no regulatory requirement 
exists for departments and agencies to consult with other departments 
before issuing a policy, to the extent appropriate. As a result, 
interdepartmental communication has been at times uneven, leading to 
potentially avoidable inconsistencies. The Common Rule departments and 
agencies have procedures for sharing proposed guidance before it is 
adopted, and these procedures have generally been successful. 
Additionally, FDA and OHRP have worked closely to ensure harmonization 
of guidance to the extent possible, given the differing statutory 
authorities and regulatory missions. Also, as mentioned earlier in 
section I.B., the 21st Century Cures Act was enacted in December 2016. 
Among other things, it requires that the Secretary of HHS, to the 
extent practicable and consistent with other statutory provisions, 
harmonize the differences between 45 CFR part 46, subpart A, and FDA's 
human subject regulations.
2. NPRM Proposal
    Responses to questions in the 2011 ANPRM about the need for 
harmonization of guidance across Common Rule departments and agencies 
reflected widespread support for such efforts. Several commenters 
acknowledged the difficulty of getting all Common Rule departments and 
agencies to agree on all issues, as each has a different mission and 
research portfolio. However, they encouraged seeking harmonized 
guidance whenever possible. Thus the NPRM proposed that the regulations 
contain language requiring consultation among the Common Rule 
departments and agencies for the purpose of harmonization of guidance, 
to the extent appropriate, before guidance on the Common Rule is 
issued, unless such consultation is not feasible. The NPRM requested 
public comment on whether the proposed language would be effective in 
achieving greater harmonization of department and agency guidance, and 
if not, how it should be modified.
3. Public Comments
    Approximately 60 comments were received regarding this proposal, 
and they were almost equally divided for and against it, although some 
of those opposed thought it did not go far enough to achieve the 
intended goal. Those who supported the proposal, either fully or 
partially, cited concerns they have as institutions, investigators, or 
IRBs in navigating different sets of regulations and different 
department or agency guidance documents. As noted above, among those 
who opposed the proposal, some expressed concern that the proposed 
language about harmonization did not go far enough. That is, they 
thought the language should mandate harmonization in guidance across 
Common Rule departments and agencies. These commenters felt that 
without a requirement to harmonize, federal departments and agencies 
will continue with business as usual and policy and guidance will 
continue to differ, creating complexity in the research environment. 
For example, one large research university emphasized the importance of 
harmonization across federal departments and agencies regarding 
guidance on the protections of human subjects for investigators, IRB 
administrators, and human subjects, and felt that the proposed language 
in the Common Rule NPRM might be ineffective in harmonizing agency

[[Page 7160]]

guidance. Several commenters emphasized the need, in particular, for 
greater harmonization between the Common Rule and FDA requirements, and 
between the Common Rule and the requirements of the Health Insurance 
Portability and Accountability Act of 1996 (HIPAA; Pub. L. 104-191).
    Others were concerned that this provision would, in effect, mean 
that Common Rule departments and agencies issue fewer guidance 
documents because of lengthy internal government review and approval 
processes.
4. Response to Public Comments and Explanation of the Final Rule: 
Harmonization of Guidance
    We believe there is a compelling case for as much consistency as is 
possible regarding guidance on the protections of human subjects. As 
such, the final rule implements the NPRM proposal at Sec.  __.101(j). 
The final rule creates a requirement that guidance should be issued 
only after consultation among the Common Rule departments and agencies, 
while also permitting guidance to be issued without such consultation 
when it is not feasible. The proposal recognizes that harmonization 
will not always be possible or desirable given the varied missions of 
the departments and agencies that oversee the protection of human 
subjects and differences in their statutory authorities.
    We note that some public comments expressed concern about the 
acceptable degree of variability among departments and agencies and 
encouraged attention to these concerns when diverging on guidance. The 
departments and agencies that oversee the protection of human subjects 
have a variety of missions and functions, including regulatory agencies 
and agencies that conduct and support research. In addition, in some 
cases, statutory differences among the departments and agencies have 
resulted in different regulatory requirements and guidance. They also 
oversee very different types and phases of research and thus may have 
reasonable justifications for differences in guidance. However, we 
agree that efforts should be made to issue collective guidance when 
possible and feasible and in a timely manner. We do not believe that 
this provision will result in the issuance of less guidance, because it 
largely codifies what has been the working practice among Common Rule 
departments and agencies up to this point.

H. Compliance Dates and Transition Provisions of the Final Rule (Sec.  
__.101(l))

1. NPRM Proposal
    In the NPRM, we shared the expectation that both the effective date 
of the final rule (meaning the date that the regulatory text is 
published in the Code of Federal Regulations) and the general 
compliance date of the final rule (meaning the date after which, as a 
general matter, regulated entities must comply with this rule) would be 
1 year after publication of the final rule in the Federal Register. The 
NPRM also proposed two exceptions that would provide different 
compliance dates for two provisions. The first proposed exception 
pertained to the NPRM's proposal that the Common Rule be extended to 
cover all biospecimens regardless of identifiability. The second 
proposed exception pertained to the NPRM's proposal that a single IRB 
would be responsible for certain multi-institutional clinical trials, 
also described as cooperative research. The NPRM proposed that both of 
these provisions would have compliance dates of 3 years after 
publication of the final rule in the Federal Register. The intent 
behind this proposed delay was to enable institutions to develop 
institutional policies and procedures necessary to implement these new 
requirements. The NPRM sought public comments about the advisability of 
this proposed approach as well as possible alternatives.
    The preamble to the NPRM also discussed the option for institutions 
or investigators to implement provisions of the final rule anticipated 
to provide additional regulatory flexibilities voluntarily 90 days 
after publication of the final rule in the Federal Register. This 
proposed approach was intended to enable institutions or investigators 
to gain the benefit of revisions to the Common Rule as soon as 
possible. The NPRM proposed a 90-day timeframe for this flexibility to 
enable the Common Rule departments and agencies time to develop the 
documents and tools needed to assist institutions in implementing the 
rule's regulatory flexibilities (e.g., the Secretary's broad consent 
templates) and the Secretary's list of privacy safeguards.
    The NPRM also explained that the proposed extension of the Common 
Rule to clinical trials that are not directly funded by a Common Rule 
department or agency, but that are conducted at an institution that 
receives funding from a Common Rule department or agency for other 
human subjects research, would not apply to an institution until the 
institution had received federal funding for nonexempt research in an 
award made after the effective date of the final rule.
    The NPRM also proposed that ongoing human subjects research 
initiated before the effective date of the final rule would not need to 
comply with particular regulatory requirements.
    In addition, the NPRM proposed a grandfather clause for research 
involving the use of biospecimens collected before the compliance date. 
This clause applied to the provision that would extend the Common Rule 
to cover all biospecimens, regardless of identifiability. Specifically, 
the NPRM proposed that such research would not need to comply with the 
final rule if any research uses of the biospecimens occurred only after 
removal of any individually identifiable information.
2. Public Comments
    A majority of comments received on the effective dates opposed the 
NPRM's proposal that only nonidentified biospecimens would be 
grandfathered. Others commented on the proposed 3-year compliance date 
for the proposed expansion of the definition of human subjects to all 
biospecimens, regardless of their identifiability. In Section III, we 
discuss the determination not to finalize the biospecimen provisions, 
which addresses these comments. Some commenters expressed support for 
the general compliance date, as well as the delayed compliance date for 
the cooperative research provision.
    Many commenters expressed the viewpoint that regulated entities 
would need to invest significant time and resources before they would 
be able to comply with the changes to the Common Rule proposed in the 
NPRM. Some commenters (including an academic institution and a hospital 
association) noted that such investments would have implications not 
only for research operations, but also for clinical care. Some 
commenters also noted their concern that 1 year was not enough time for 
institutions to comply with the large number of new and different 
regulatory requirements proposed in the NPRM and that such changes 
would necessitate significant modifications to their research and 
clinical enterprises and might impose hardships on IRBs, IRB staff, 
institutional leadership, and the regulated research community. Several 
commenters explained that the proposed 1-year general compliance period 
would not provide enough time to update written IRB procedures (which 
are required under the Common Rule), disseminate such procedures, 
update related documents (e.g., forms),

[[Page 7161]]

and develop appropriate training materials. One of these commenters 
explained that accredited institutions will need time for accrediting 
bodies to align their accreditation standards with the revised 
regulatory standards or risk conflicts between meeting proposed 
regulatory standards and losing accreditations.
    Other commenters recommended 2-year or 3-year general compliance 
dates (including some that recommended permitting institutions to 
comply earlier), noting that compliance would be particularly 
challenging for institutions with smaller research programs. At least 
one commenter argued that the 3-year compliance date for the proposed 
cooperative research provision was inadequate given the significant 
costs and time that would be associated with establishing reliance 
agreements between collaborating research sites, maintaining required 
documents at the reviewing IRB, and ensuring that applicable laws were 
followed. At least one commenter argued that the proposed effective and 
compliance provisions left institutions with the discretion to remove 
studies from the oversight of the Common Rule without establishing any 
protective standards for doing so.
    One group representing multiple professional societies stated that 
the efficiencies achieved by eliminating protracted negotiations 
concerning consent forms and institutional responsibilities will far 
outweigh any upfront costs incurred through implementation of this 
policy, and advocated for a faster timeframe for compliance than the 
proposed 3 years from the time of final publication: 1 year for 
clinical trials and 2 years for research studies. Another commenter 
echoed these views.
    We did not receive many comments concerning the proposal to allow 
institutions to implement provisions offering regulatory flexibilities 
before the compliance date.
3. Response to Comments and Explanation of the Final Rule: Compliance 
Dates and Transition Provisions
    The effective date and compliance dates included in this final rule 
are intended to meet the same general objectives as those described in 
the NPRM. Nonetheless, the approach adopted in the final rule is 
different in certain respects from the approach proposed in the NPRM.
    As a general matter, none of the proposed dates in the NPRM related 
to research with biospecimens will be implemented because the proposal 
included to extend the Common Rule to research with all biospecimens, 
regardless of identifiability, is not being implemented.
    The final rule adopts an effective date and a general compliance 
date of 1 year from publication of this final rule in the Federal 
Register. During this 1-year timeframe, institutions will be able to 
revise forms, documents, and practices for consistency with the 
revisions reflected in this regulation. Although we recognize the work 
associated with compliance, we concluded that 1 year is a reasonable 
and adequate timeframe. We note that ongoing research studies that were 
initially approved by an IRB, waived pursuant to Sec.  __.101(i), or 
determined to be exempt before January 19, 2018 will not be required to 
comply with the changes reflected in this final rule.
    Section 101(l) describes the regulatory requirements that will 
apply to specific categories of research once the final rule goes into 
effect. For clarity, Sec.  __.101(l) begins by defining two sets of 
requirements. First, as set forth in Sec.  __.101(l)(1), the pre-2018 
rule is described as the ``pre-2018 Requirements'', which refers to the 
Common Rule as published in the 2016 edition of the Code of Federal 
Regulations. As described below, certain ongoing research may be 
subject to these requirements.
    Section 101(l)(3)-(4) describes the different regulatory 
requirements that apply to different categories of research. For 
clarity and in order to have an easy-to-implement standard, these 
categories are generally based upon the date the research was initially 
approved by an IRB, waived pursuant to Sec.  __.101(i), or determined 
to be exempt.
    The first category of research, described in Sec.  __.101(l)(3), 
applies to research initially approved by an IRB, waived pursuant to 
Sec.  __.101(i), or determined to be exempt before January 19, 2018. We 
believe that such research (e.g., research for which an initial 
determination was made before the effective date of this final rule) 
should, as a general rule, be able to follow the same set of standards 
throughout the entire course of the research. The intent is to minimize 
burdens associated with research conducted over a period of time and to 
avoid a requirement that such research be subject to two sets of rules 
during the lifetime of the research. For that reason, this regulation 
adopts as a default rule, set forth in Sec.  __.101(l)(3), that 
research initially approved by an IRB, waived pursuant to Sec.  
__.101(i), or determined to be exempted before January 19, 2018 (the 
effective date of this final rule) will not be subject to this final 
rule but will continue to be subject to the requirements of the Common 
Rule in place before January 19, 2018.
    However, we also recognize that institutions may prefer, for a 
particular study initiated before to January 19, 2018, to comply with 
this final rule given the benefits that it offers and for 
administrative simplicity such as common regulatory requirements across 
an institution. Thus, Sec.  __.101(l)(3) permits institutions engaged 
in ongoing research that was initially approved by an IRB, waived 
pursuant to Sec.  __.101(i), or determined to be exempted before 
January 19, 2018, to choose, on a study-by-study basis, whether such 
research will be subject to the pre-2018 requirements (the rule in 
place before January 19, 2018, or the final rule. This is an exception 
and is offered as an additional flexibility to regulated entities. If 
an institution engaged in such research determines that it prefers to 
comply with the final rule for a particular research study, such 
research will be subject to the final rule if the institution formally 
makes a determination that the final rule will apply to such research 
and an IRB documents the decision made by the institution. If these 
requirements are not met or if the institution makes no decision, the 
pre-2018 requirements will apply to such research.
    The second category of research, described in Sec.  __.101(l)(4), 
applies to research initially approved by an IRB, waived pursuant to 
Sec.  __.101(i), or determined to be exempted on or after January 19, 
2018. Because such research does not begin and is not conducted until 
after the general compliance date of this final rule, this category of 
research is subject to the final rule throughout its lifetime.
    A single IRB requirement for cooperative research has been adopted 
in Sec.  __.114(b) of this final rule. As set forth in Sec.  
__.101(l)(2), this final rule adopts the proposed 3-year compliance 
date for this requirement to afford affected institutions sufficient 
time to prepare for and implement this requirement (e.g., developing 
institutional policies and procedures).
    Although we understand the concerns expressed concerning the 
complexities that will be involved in establishing reliance agreements 
to satisfy the cooperative research provision adopted in this final 
rule, this final rule reflects the conclusion that a 3-year compliance 
date is adequate for this provision, based on our belief that this 
provision will offer significant benefits to institutions, particularly 
as the regulated community becomes

[[Page 7162]]

accustomed to this requirement. In addition, we believe it is likely 
that the institutional policies, procedures, and standard documents 
needed to implement this regulatory provision will, over time, become 
increasingly standardized, which will significantly minimize the burden 
on institutions associated with this requirement. So long as all other 
regulatory requirements are satisfied, institutions may use a single 
IRB to oversee cooperative research even before this compliance date 
occurs with respect to any research that institutions believe may 
benefit from this approach.
    This final rule does not adopt the proposal mentioned in the 
preamble to the NPRM to permit institutions and investigators to 
voluntarily implement provisions in the final rule that allow 
additional flexibilities 90 days after publication of the final rule. 
We determined that the approach adopted at Sec.  __.101(l)(3), and 
described above, offers institutions and investigators similar 
advantages with respect to the conduct of ongoing research, while 
providing greater clarity and more simplicity concerning which set of 
regulatory requirements apply to particular studies.
    We disagree with the comment that the proposed timelines enable 
institutions to remove their studies from the oversight of the Common 
Rule without establishing appropriate standards for doing so. The final 
rule does not enable institutions to opt out of compliance with the 
Common Rule. The effective dates do afford institutions the discretion 
to choose, on a study-specific basis whether existing research should 
comply with the Common Rule in place when the research was initiated 
(the pre-2018 requirements) or this final rule (the 2018 requirements). 
This flexibility is offered only for certain ongoing research studies 
that were initially approved, determined to be exempt, or subject to a 
Sec.  __.101(i) waiver before the effective date of this final rule.
    To explain the approach adopted in this final rule, the following 
chart describes the standards that apply to different categories of 
research:

------------------------------------------------------------------------
   Research Study Initiation Date                 Standards
------------------------------------------------------------------------
Research initially approved by an    These studies are by default
 IRB, waived pursuant to Sec.         subject to the pre-2018 rule (the
 __.101(i), or determined to be       Common Rule as published in the
 exempt before January 19, 2018.      2016 edition of the Code of
                                      Federal Regulations).
                                     However, an institution engaged in
                                      such research may choose to comply
                                      with the final rule (2018
                                      requirements) for such a study if
                                      the institution makes a
                                      determination to apply the final
                                      rule to the study and an IRB
                                      documents this determination.
Research initially approved by an    These studies are subject to the
 IRB, waived pursuant to Sec.         final rule (2018 requirements).
 __.101(i), or determined to be
 exempt on or after January 19,
 2018.
------------------------------------------------------------------------

I. Severability (Sec.  __.101(m))

    A severability clause has been added as Sec.  __.101(m), providing 
that if any provision of this final rule is held to be unenforceable in 
one set of circumstances, it should be construed to give maximum effect 
to the provision as applied to other persons or circumstances. 
Similarly, if a provision is held to be invalid or unenforceable, that 
provision should be severable from, and have no impact on the 
application of, the remainder of the rule. This provision reflects our 
intention regarding the way that this final rule, and the pre-2018 
rule, should be construed and interpreted and is meant as a 
clarification.

III. Definitions for Purposes of this Policy (Sec.  __.102)

    The final rule revises and adds new definitions of key terms for 
the purposes of this policy, as summarized below. Some of the changes 
are made to clarify new provisions that appear elsewhere in the final 
rule. In addition, the definitions have been placed in alphabetical 
order to facilitate searching by the reader. The definitions of 
institution, IRB, and IRB approval are unchanged but appear in a 
different place in the regulatory language.

A. Certification (Sec.  __.102(a))

    Although ``certification'' was defined in the pre-2018 
requirements, as was proposed in the NPRM, the final rule clarifies 
that notification by the institution that a proposed research study has 
been reviewed and approved is made to the supporting ``federal'' 
department or agency and that it might be a component of the agency or 
department that is notified rather than the entity as a whole. This 
clarification relates to the change included in the final rule at Sec.  
__.102(d) regarding the definition of ``federal department or agency'' 
that clarifies that this phrase refers to the department or agency 
itself, not its bureaus, offices, or divisions. There were no public 
comments on this clarification.

B. Clinical Trial (Sec.  __.102(b))

1. Background and Pre-2018 Requirements
    The pre-2018 rule did not include a definition of ``clinical 
trial.''
2. NPRM Proposal
    The NPRM proposed defining ``clinical trial,'' for purposes of this 
policy, as a research study in which one or more human subjects are 
prospectively assigned to one or more interventions (which may include 
placebo or other control) to evaluate the effects of the interventions 
on biomedical or behavioral health-related outcomes. In addition, the 
NPRM requested public comment on whether the proposed definition should 
include additional explanation of what is encompassed by the term 
behavioral health-related outcomes.
3. Public Comments
    Approximately 20 comments explicitly addressed the definition of 
``clinical trial'' included in the NPRM. All expressed concern that the 
proposed definition encompassed more activities than intended, given 
the NPRM discussion that the definition was intended to cover the 
riskiest research. Commenters who responded asked for some type of 
clarification, either in guidance or in the regulatory language itself 
about the term ``behavioral health-related outcomes.'' One commenter 
noted that clinical trials involving activities such as behavioral 
interventions, psychotherapy, or skills training, for example, should 
be included in the proposed regulations of clinical trials in a risk-
based manner, as for nonbehavioral studies. That is, greater oversight 
would be required for trials with a higher potential degree of risk, 
regardless of what type of trial. The commenter noted that certain 
populations for whom behavioral health research is conducted are high 
risk by

[[Page 7163]]

nature, such as chronically suicidal individuals. Another commenter 
asked that the regulatory language include additional explanation of 
what is encompassed by the term ``behavioral health-related outcomes'' 
because practitioners and researchers conceptualize the term 
differently.
4. Response to Comments and Explanation of the Final Rule Definition of 
Clinical Trial
    The final rule at Sec.  __.102(b) adopts the NPRM definition of 
``clinical trial,'' which is a research study in which one or more 
human subjects are prospectively assigned to one or more interventions 
(which may include placebo or other control) to evaluate the effects of 
the interventions on biomedical or behavioral health-related outcomes. 
We generally expect that this definition will be applied harmoniously 
with the definition of clinical trial recently promulgated in the 
ClinicalTrials.gov final rule.\17\
---------------------------------------------------------------------------

    \17\ HHS. Clinical Trials Registration and Results Information 
Submission. 81 FR 64981. (Sept. 21, 2016). Retrieved from https://www.federalregister.gov/documents/2016/09/21/2016-22129/clinical-trials-registration-and-results-information-submission
---------------------------------------------------------------------------

    In response to public concerns about an overly expansive definition 
of ``clinical trial'' given the importance of that definition to the 
proposed extension of the rule to clinical trials previously not 
covered by the rule, we have eliminated that proposed expansion of 
coverage in this final rule. As such, the definition that appears in 
the final rule will only be relevant to the requirement for posting of 
consent forms for clinical trials conducted or supported by Federal 
departments or agencies (Sec.  __.116(h)). It should be appropriate for 
that relatively narrow regulatory purpose.

C. Department or Agency Head and Federal Department or Agency/
Institutions (Sec.  __.102(c) (d) and (f))

1. Background and Pre-2018 Requirements
    The pre-2018 rule provided a definition of ``department or agency 
head.'' The phrase appeared repeatedly throughout the regulations.
2. NPRM Proposals
    New definitions of ``department or agency head'' and ``federal 
department or agency'' were proposed in the NPRM to clarify 
requirements related to federal department and agency discretion in 
applying the policy to their funded or conducted research.
3. Public Comments
    There were no comments directly related to these proposed 
revisions.
4. Explanation of the Final Rule: Definition of Department or Agency 
Head, Federal Department or Agency, and Institution
    The final rule adopts the NPRM proposals to provide new definitions 
of ``department or agency head'' and ``federal department or agency,'' 
which appear at Sec.  __.102(c) and (d). ``Department or agency head'' 
at Sec.  __.102(c) refers to the head of any federal department or 
agency, for example, the Secretary of HHS, and any other officer or 
employee of any federal department or agency to whom authority has been 
delegated. To add clarity to the definition found in the pre-2018 
regulations, the example of the Secretary of HHS was inserted.
    The final rule provides at Sec.  __.102(d) a definition of 
``federal department or agency'' in order to avoid confusion as to 
whether this phrase encompasses federal departments and agencies that 
do not follow the Common Rule. The definition also clarifies that this 
phrase refers to the department or agency itself, not its bureaus, 
offices, or divisions. This is consistent with the historical 
interpretation of the Common Rule. Related to this, the definition of 
``institution'' was changed at Sec.  __.102(f) in the final rule to 
clarify that departments can be considered institutions for the 
purposes of this policy. The final rule provides examples of what is 
intended by this definition: HHS, the Department of Defense, and the 
Central Intelligence Agency.

D. Human Subject (Sec.  __.102(e))

1. Background and Pre-2018 Requirements
    The pre-2018 rule defined ``human subject'' as a living individual 
about whom an investigator (whether professional or student) conducting 
research obtains (1) data through intervention or interaction with the 
individual, or (2) identifiable private information. Further, the pre-
2018 rule asserted that ``private information'' was considered 
individually identifiable if the identity of the subject is or may 
readily be ascertained by the investigator or is associated with the 
information.
    Thus, in cases where no intervention or interaction with an 
individual occurred, determining the meaning of ``identifiable'' and 
``readily ascertainable'' was central to determining whether human 
subjects were involved in a research activity covered by the pre-2018 
rule. Under the pre-2018 rule, provided the data were collected for 
purposes other than the currently proposed research, it was permissible 
for investigators to conduct research on biospecimens and data that had 
been stripped of all identifiers or coded without obtaining consent 
because the nonidentified biospecimens and data did not meet the 
regulatory definition of a human subject.
    Moreover, ``private information'' was not considered to be 
identifiable under the pre-2018 rule if the identity of the subject is 
not or may not be ``readily ascertained'' by the investigator from the 
information or associated with the information.
    If the definition of ``human subject'' was met, together with the 
other significant requirements, the pre-2018 rule required IRB review 
and approval unless the study was exempt. IRB waiver of informed 
consent was allowable under the Common Rule, if the research study 
satisfied the criteria for waiver of informed consent.
2. NPRM Proposal
    The NPRM proposed to revise the definition of ``human subject'' to 
include research in which an investigator obtains, uses, studies, or 
analyzes biospecimens, regardless of identifiability. Thus, the focus 
of this proposal was to require informed consent for research involving 
biospecimens in all but a limited number of circumstances. In addition, 
the NPRM proposal would have still permitted IRBs to waive the 
requirement for informed consent for research use of biospecimens, but 
the requirements for approval of such waivers would have been very 
strict, and such waivers would have occurred only in rare circumstances 
(see Section XIV on waiver of informed consent). This expansion of the 
definition of ``human subject'' would also have triggered other 
provisions of the NPRM relating to the use of biospecimens, including 
security measures. Thus, it was a complex and far-reaching proposal.
    The NPRM also offered two alternative proposals to altering the 
definition of ``human subject,'' both of which maintained 
``identifiability'' as a major aspect of determining applicability of 
the Common Rule to biospecimens. The public was asked to comment on 
which of the three proposals achieved the most reasonable tradeoff 
between the principles of autonomy and beneficence.
    Alternative Proposal A would have expanded the definition of 
``human subject'' to include whole genome sequencing (WGS). Under this

[[Page 7164]]

alternative, WGS would have been considered to be the sequencing of a 
human germline or somatic biospecimen with the intent to generate the 
genome or exome sequence of that biospecimen.
    Alternative Proposal B would have expanded the definition of 
``human subject'' to include the research use of information that was 
produced using a technology applied to a biospecimen that generated 
information unique to an individual. In such a case, it was foreseeable 
that, when used in combination with publicly available information, the 
individual could have been identified. Information that met this 
standard would have been referred to as ``bio-unique information.''
    The NPRM also asked the public to comment on whether the rule 
should include a definition of ``biospecimen'' and whether the rule 
should be clearer and more direct about the definition of 
``identifiable private information.''
    The NPRM also proposed some minor changes to the wording of the 
definition of ``human subject'' merely to clarify how the word 
``obtains'' has been interpreted.
    The NPRM did not propose any major substantive modifications to the 
descriptions of ``private information'' and ``identifiable private 
information'' found in the pre-2018 rule. However, the NPRM proposed 
clarifying language with regard to ``private information'' and 
``identifiable private information.'' The pre-2018 rule used the 
example of a medical record as constituting private information. The 
NPRM added the example of a biospecimen in keeping with the proposal to 
expand the definition of ``human subject'' to include all biospecimens. 
In addition, the NPRM proposed adding the words ``shared or'' to the 
description of what constitutes ``private information,'' for the 
purpose of expanding the scope of the information that would be 
described by that term.
    In addition, the NPRM asked for public comment about whether a 
different identifiability standard would be appropriate. One 
alternative discussed was to adopt the term ``identifiable private 
information'' with the term used across the Federal Government: 
``personally identifiable information'' (PII). PII refers to 
information that can be used to distinguish or trace an individual's 
identity (such as name, social security number, biometric records) 
alone, or when combined with other personal or identifying information 
that is linked or linkable to a specific individual, such as date and 
place of birth, or mother's maiden name. It acknowledged that replacing 
``identifiable private information'' with ``PII'' would increase the 
scope of what is subject to the Common Rule. Subsequent to the release 
of the NPRM, the Office of Management and Budget (OMB) updated 
government-wide guidance for managing personally identifiable 
information.\18\
---------------------------------------------------------------------------

    \18\ CIRCULAR NO. A-130 Memorandum to: The Heads of Executive 
Departments and Agencies Subject: ``Managing Information as a 
Strategic Resource''. July 7, 2016. See especially, Appendix II: 
Responsibilities for Managing Personally Identifiable Information. 
Retrieved from https://www.federalregister.gov/documents/2016/07/28/2016-17872/revision-of-omb-circular-no-a-130-managing-information-as-a-strategic-resource
---------------------------------------------------------------------------

    Related to this issue, the NPRM noted new legislative developments, 
specifically the Newborn Screening Saves Lives Reauthorization Act of 
2014 (Pub. L. 113-240), signed into law in December 2014. The law 
required consent for federally funded research with newborn dried blood 
spots and prohibits IRBs from waiving consent. These changes were to be 
effective until updates to the Common Rule were promulgated, and 
applied whether or not the newborn dried blood spots would be 
considered ``identifiable private information'' under the regulatory 
definition.
3. Public Comments
a. Public Comments on the Primary NPRM Proposal
    The proposal regarding revising the definition of ``human subject'' 
to include biospecimens regardless of identifiability was commented on 
by almost 50 percent of the commenters. Others commented on the effects 
such an expansion would have on consent requirements, the ability to 
waive consent, and the applicability of exemptions and exclusions. The 
vast majority of commenters who addressed this expansion (80 percent) 
were opposed to it for a variety of reasons, particularly because of 
the implications of this change for requiring consent for most research 
uses of biospecimens that were collected as part of clinical care.
    A majority of these commenters responded as members of the general 
public (that is, not explicitly affiliated with a specific organization 
or institution) or as patients (including family members of patients). 
Patients tended to oppose these proposals, focusing on the additional 
and more stringent criteria for waiver of informed consent because they 
believed the effects of the proposals would be that many people would 
not provide consent, thus restricting access by investigators to 
biospecimens, which would in turn slow research. Investigators also 
expressed concerns about the negative impact on research. Organizations 
and institutions with some affiliation with the research enterprise 
expressed opposition to this suite of proposals as well, but for 
different reasons, as discussed further below.
    Most support for the expansion of the definition of ``human 
subject'' to encompass all biospecimens and its implications for 
consent, waiver of consent, and exempt research came from members of 
the public who argued that they wanted to always be consulted before 
their biospecimens were used in research, without exception. Within 
this group, a strong majority opposed the comprehensive biospecimen-
related proposals because they were uncomfortable with the concept of 
broad consent (as discussed in Section IIV of this preamble) to any 
future research use of those biospecimens and the existence of any type 
of over-ride by an IRB of the requirement to obtain informed consent.
    Many of the commenters supporting the expansion stated that it 
would respect autonomy by requiring that nearly all research with 
biospecimens be subject to IRB review and informed consent 
requirements. Others expressed distrust of the medical and scientific 
enterprises. One member of the public felt that consent should be 
required for government research seeking to use an individual's 
biospecimens, and that researchers should be required to inform the 
individual of the ``who, what, how, and why'' of the desired research.
    Many of those who expressed support for this proposal also 
indicated that they felt it important for their biospecimens to be 
anonymized in research activities. For example, a member of the public 
with experience in biobanking expressed a willingness to consent to the 
use of his biospecimens to advance science, but called for a mechanism 
to inform the public about such research use even if some individuals 
might decline to participate. The commenter stressed the importance of 
respecting the individual's right to know and refuse, citing privacy 
concerns and stressing the importance of anonymity of biospecimens to 
protect individuals from potential negative consequences.
    Still others supported the expansion of the definition of ``human 
subject'' to include all biospecimens because of a desire to receive 
research results or to financially profit from discoveries, implying 
that retaining identifying information with biospecimens would enable 
both of these possibilities. Some who felt there is an entitlement to

[[Page 7165]]

financially profit from discoveries described biospecimens as personal 
property. For example, one commenter compared the use of an 
individual's biospecimens without consent to one party illegally taking 
another's property such as land, a house, or an arm.
    Several commenters noted that medical services should not be 
allowed to be contingent upon a person's consent to use of their 
leftover biospecimens for research despite the fact that this was not 
proposed in the NPRM. In fact, the pre-2018 rule states that informed 
consent must include a statement that ``refusal to participate will 
involve no penalty or loss of benefits to which the subject is 
otherwise entitled'' and that element appears in the final rule as 
well.
    For example, one commenter indicated that patients should be 
informed and be given the opportunity to consent to the use of their 
body tissues, and if one declines consent, the individual should not be 
denied treatment or receive diminished care. In other words, they felt 
that consent should never be a condition of treatment.
    The reasons for opposing the expansion of the definition of ``human 
subject'' to include all biospecimens were numerous, including: the 
feasibility of obtaining broad consent in a clinical setting; the costs 
of obtaining, tagging, and tracking consents given the low risk nature 
of the research in question; allowing autonomy to trump beneficence and 
justice; insufficient evidence of risk or public concern about the 
issue; the fact that it would result in fewer specimens collected from 
fewer sources, with adverse implications for rare diseases and for 
justice; the idea that requiring all biospecimens to remain identified 
poses greater privacy and confidentiality risks than the current 
system; and overall negative impacts on research.
    Many expressed concern about the number of biospecimens that might 
no longer be available for research, not out of concern that 
individuals would decline to have their leftover tissue used in 
research, but rather because many hospitals and medical providers might 
decline to enact the expensive consent and tracking system that the 
NPRM envisioned. Some commenters were concerned that this would then 
limit the heterogeneity of biospecimens obtained and stored, as 
community hospitals and clinics might opt out of participating in such 
collections.
    Several comments suggested that for academic medical centers where 
a large amount of research is conducted, research activities often do 
not result in profits, and that the proposed policies would come at 
great costs to institutions already struggling to financially sustain a 
healthy research enterprise. For example, one commenter noted that the 
NPRM proposal would require additional resources to obtain consent, 
which would hinder smaller institutions with fewer staff or resources 
available in their ability to contribute to scientific and medical 
research, and limit the opportunities for patients at these facilities 
to participate in research. The commenter also pointed out that 
academic institutions rarely receive significant financial gain from 
their research, and institutions sometimes share biospecimens, which 
can be valuable in research, especially in the case of uncommon and 
poorly understood diseases. Thus, this commenter expressed concern that 
biospecimens might not be available for research given the requirements 
of the proposed policy.
    Many members of the public with rare diseases commented on how 
research into their specific diseases might be affected should the NPRM 
proposal be finalized. For example, several commenters expressed 
interest in the proposed rule because they or a family member had been 
diagnosed with a desmoid tumor, which are often limb threatening and 
sometimes life threatening. Research using tissue blocks is critical to 
determine how to treat these tumors, which are rare and can vary among 
patients. The commenter felt that the proposed rule would make desmoid 
tumor research virtually impossible by reducing access to the already 
low number of tissue blocks available for research.
    More than one academic medical center asserted that there was a 
lack of evidence that patients value their autonomy over the potential 
for innovative diagnostics, treatments, cures, or preventative 
interventions that could result from research with leftover 
biospecimens, and called for empirical research on whether patients, 
patient advocacy groups, and the general public value autonomy (in the 
form of written consent for research use of nonidentified biospecimens) 
above other values when explained in light of potential impact on 
medical advances.
    Some public commenters pointed out the illogic of treating 
biospecimens differently from information for the purposes of defining 
what constitutes a human subject. For instance, one professional 
organization composed of investigative pathologists and dozens of 
individual pathologists around the country noted that there are several 
areas in which the NPRM proposes treating biospecimens differently from 
identifiable information unjustifiably since both create the potential 
for identification of the donor and a potential negative impact on the 
individual and their family, such as employment or insurance 
discrimination, embarrassment, or stigmatization. That organization 
noted that no empirical evidence has been provided to indicate either 
that biospecimens pose a risk greater than that posed for identifiable 
information or that the public is more concerned about the use of 
biospecimens compared to the use of identifiable private information.
    One member of the public asserted that the research use of leftover 
biospecimens in medical research poses less of a privacy risk to 
individuals than market research that analyzes one's attitudes, words, 
and behaviors and is used to generate commercial profit.
    Several commenters noted that the proposed expansion of the 
definition of ``human subject'' creates a cascade of consequences 
throughout the rule that are overly complex and unnecessary given the 
minimal risk of such research.
    Other commenters suggested that the NPRM proposals would have 
negative impacts on the advancement of precision medicine. For example, 
a research university felt that mandating consent for de-identified 
biospecimens would impair the ability to achieve precision medicine for 
all. The commenter asserted that to offer care tailored to the needs of 
each individual based on understanding how each person is affected by 
disease requires understanding differences in the origins and 
manifestations of disease in individual patients who differ in genetics 
and environmental exposures. The commenter felt that restricting access 
to nonidentified biospecimens would violate the principles of justice 
and beneficence because many health care facilities serving under-
represented minorities and economically-disadvantaged individuals, 
particularly those in rural settings, might not have the financial 
resources to obtain and track consent. As a result, medical research 
therefore might represent a skewed population of individuals receiving 
care at large, research intensive referral centers. In addition, the 
commenter felt that compliance would impose an onerous and expensive 
bureaucratic burden that would result in many institutions no longer 
collecting and using these critically important specimens with the net 
effect of thwarting efforts to provide precision medicine for all 
citizens.

[[Page 7166]]

    Many commenters expressed the opinion that the existing regulatory 
framework is adequate and that current practices should be maintained, 
stressing that the research use of nonidentified data or biospecimens 
involves minimal or low risk to the research subject. Furthermore, 
several commenters noted that, although it is theoretically plausible 
to identify a person based on their biospecimen, the likelihood remains 
remote enough to argue against the presumption that the sources of all 
biospecimens are identifiable and cited a study showing that the risk 
of re-identification from a system intrusion of databases was only 0.22 
percent.\19\ Other commenters noted that the existing definition of 
human subject is sufficient because once a biospecimen becomes 
identifiable in research, such research is considered to involve human 
subjects and therefore IRB review and consent or waiver of consent 
would be required. They argued that the current policy works and there 
has been no evidence provided that it needs to be fixed.
---------------------------------------------------------------------------

    \19\ Kwok P, et al. Harder Than You Think: A Case Study of Re-
Identification Risk of HIPAA-Compliant Records. NORC at The 
University of Chicago and Office of the National Coordinator for 
Health Information Technology. 2011. Retrieved from http://www.amstat.org/meetings/jsm/2011/onlineprogram/AbstractDetails.cfm?abstractid=302255.
---------------------------------------------------------------------------

    The NPRM specifically asked whether the final rule should include a 
definition of ``biospecimen'' to assist the regulated community in 
understanding what types of activities might fall under the rule. 
Approximately 100 comments answered this question. A majority of these 
comments did not provide a suggestion for how biospecimen should be 
defined, but suggested that the Federal Government convene panels and 
solicit input from governmental and nongovernmental experts.
    One university emergency medical department suggested including in 
this definition biological samples from human subjects which contain 
DNA and are being obtained for the purpose of medical analysis and 
provided examples of biospecimens which would fall under this 
definition, including excised tissue (fresh, fixed, or paraffin 
embedded), whole blood, urine (when hematuria is known to exist), and 
saliva among others. The commenter also provided examples of 
biospecimens which would not fit in this definition, including serum or 
plasma, urine (when no hematuria is known to exist), and processed 
tissues where the DNA has been removed as a part of the processing.
    Others indicated that the definition of biospecimen used by the 
National Cancer Institute \20\ seemed appropriate and workable for this 
rule.
---------------------------------------------------------------------------

    \20\ NCI defines ``biospecimen'' as, ``A quantity of tissue, 
blood, urine, or other human-derived material. A single biopsy may 
generate several biospecimens, including multiple paraffin blocks or 
frozen biospecimens. A biospecimen can comprise subcellular 
structures, cells, tissue (e.g., bone, muscle, connective tissue, 
and skin), organs (e.g., liver, bladder, heart, and kidney), blood, 
gametes (sperm and ova), embryos, fetal tissue, and waste (urine, 
feces, sweat, hair and nail clippings, shed epithelial cells, and 
placenta). Portions or aliquots of a biospecimen are referred to as 
samples (NCI Best Practices working definition).'' Retrieved from 
http://biospecimens.cancer.gov/bestpractices/got/#B. Last modified 
March 16, 2016.
---------------------------------------------------------------------------

    A majority of comments on the definition of ``biospecimen'' asked 
for explicit clarification on how certain biospecimens would be treated 
under the rule. Several comments asked whether microbiology 
biospecimens would be considered covered under the NPRM proposal. One 
research university requested specification that biologic material of 
organisms that use human biospecimens merely as a host (e.g., bacteria, 
viruses, fungi) not be considered to involve human subjects.
    The NPRM also asked whether covering only biospecimens that include 
nucleic acids would be a reasonable definition. A majority of those who 
responded to this said it would not be a good line to draw. One 
commenter specifically noted that the presence of nucleic acids does 
not guarantee re-identification.
b. Public Comments on Alternative NPRM Proposals A and B
    Some of the alternative NPRM proposals were partly based on the 
premise that biospecimens could at some point become readily 
identifiable as a result of increasingly sophisticated technology. Many 
public commenters stated that a better approach to protecting privacy 
than requiring consent is to impose sanctions against investigators who 
aim to or do re-identify biospecimens without authorization by an IRB 
or other body. Such an approach, they said, would be less onerous for 
the entire enterprise, and if accompanied by clear guidance from 
funding agencies, would do more to protect privacy and guard against 
potential harms to subject rights and welfare.
    Few commenters, approximately 20, explicitly supported Alternative 
A or B over the NPRM proposal or the pre-2018 rule.
    The Presidential Commission for the Study of Bioethical Issues 
explicitly supported Alternative B, noting that it is the most forward-
looking of all three proposals, using ``bio-unique'' data as human 
subjects research with a focus on the technology and its ability to 
identify donors using small amounts of data, as opposed to tying the 
definition of human subjects research to a particular kind of data.\21\ 
Another commenter identified alternative B as the best proposal to keep 
pace with advances in technology (including technologies driving 
personalized medicine), protect research participants, respect 
autonomy, increase trust, and close the gap in protection in the 
current regulations.
---------------------------------------------------------------------------

    \21\ The Commission had previously addressed related issues in 
its October 2012 report, Privacy and Progress in Whole Genome 
Sequencing. Washington, DC: Presidential Advisory Commission for the 
Study of Bioethical Issues. Retrieved from http://bioethics.gov/sites/default/files/PrivacyProgress508_1.pdf.
---------------------------------------------------------------------------

    Those who supported the primary NPRM proposal--to expand the 
definition of ``human subject'' to include all biospecimens--indicated 
that Alternatives A and B would not give individuals who wanted to 
control the use of their biospecimens the opportunity to do so.
    Approximately 250 commenters (about 12 percent of the total 
comments received) said that they endorsed the pre-2018 policy, but 
that if the Federal Government must do something other than maintain 
the current definition of human subject, Alternative A would be 
preferable to the NPRM proposal or to Alternative B. These comments 
argued that Alternative A would be the least disruptive to the research 
enterprise, but that the pre-2018 policy would be better.
    However, the majority of those commenters addressing the 
alternative proposals indicated that neither struck an appropriate 
balance among the Belmont Report principles. A research university 
concluded that both alternatives lack balance, emphasizing respect for 
persons with little regard for the principles of beneficence and 
justice.
    Additional concerns about Alternative A included the fact that 
while limiting the expansion of the scope of activities covered by the 
rule to whole genome sequencing may be a reasonable line for inclusion 
today, that line might not be inclusive enough in the future.
    Additional concerns about Alternative B included that by requiring 
continual re-review of technologies and databases by the federal 
government, there would be an ``inevitable lag'' between when a 
technology might be identified and when it would be added to the list. 
Thus, these commenters argued that the list might end up being useless.

[[Page 7167]]

c. Alternative Proposals Offered by Public Commenters
    Many commenters proposed or endorsed alternatives to the NPRM 
proposals. Generally, these alternatives involved maintaining the 
existing schema, developing a system of notice and opt out, engaging in 
a public education campaign about how the research enterprise works, 
and developing penalties and sanctions for re-identification of 
biospecimens and information. A policy that requires notice, opt out, 
and public education were generally endorsed or discussed together.
    The Secretary's Advisory Committee on Human Research Protections 
(SACHRP) offered one of the most detailed alternative proposals. SACHRP 
indicated that existing practices of research with biospecimens and 
data that have been collected for nonresearch uses (most often in the 
course of clinical care) should be revised to better protect subjects 
through greater transparency, public education about research with 
biospecimens, more exacting standards for protecting against dignity 
harms, allowing individuals to opt out, requiring IRB or institutional 
review and approval of specific research uses of identified 
biospecimens and identified data, and through strict legal consequences 
for re-identification of de-identified biospecimens and data that have 
been shared for research purposes.
    SACHRP also proposed that data security protections be developed to 
safeguard biospecimen-associated data and identified data against 
unauthorized release or access, and focused review of the storage, 
maintenance, or secondary research use of identified biospecimens and 
identified data to determine whether the proposed activity is likely to 
be objectionable.
    A professional organization of investigative pathologists urged 
consideration of opt-out broad consent models for nonidentified 
biospecimens collected in research and nonresearch settings, and 
suggested that this model would bring consent for the broad use of 
nonidentified biospecimens in line with HIPAA privacy practices, 
preserving the ability for an individual to decide not to participate 
in research efforts. This organization asserted that this option would 
be less burdensome and an inclusive, respectful, and functional way to 
promote ethically conducted biomedical research on biospecimens.
d. Public Comments on Identifiability
    Approximately 40 comments were received in response to the request 
to comment on the definition of identifiable private information. 
Comments were mixed. The largest proportion of those comments 
(approximately 13) supported the definition in the pre-2018 rule. 
Others felt that the pre-2018 definition of identifiable private 
information was sufficient, but that additional guidance would be 
needed to implement it. Another group of commenters supported adopting 
a different identifiability standard in the final rule (such as the 
federal government's personally identifiable information standard, or 
the HIPAA identifiability standard).
    Several public comments claimed that the meaning of 
``identifiable'' with regard to information and biospecimens will 
change as technology advances. They indicated that the technique of 
whole genome sequencing altered the conversations about the 
identifiability of biospecimens and future technological advances using 
advanced computing and large databases could provide methods for easily 
aggregating disparate data for the purposes of identifying an 
individual.
    Public comments received from a large professional association 
related to the definition of identifiable private information noted 
that the modifier ``may be readily ascertained'' that was included in 
the definition of identifiable private information within the 
definition of human subject allows for changes in scientific technology 
and data sharing over time since what was readily ascertainable 10 
years ago has changed and will be different 10 years from now. The 
commenter noted that this allows IRBs and investigators to assess 
identifiability based on current technology, data sharing and computing 
capabilities, rather than comparing it to an enumerated list of 
identifiers or scientific technologies.
    Some commenters expressed a desire for guidance to be issued on 
these definitions or for the definitions to be better clarified and 
explained in the regulatory text. Several comments specifically 
suggested a need for a definition of or guidance on the term ``readily 
ascertainable.''
    Approximately 10 comments endorsed replacing the Common Rule's 
identifiability standard with either the Federal Government's concept 
of personally identifiable information (PII) or HIPAA's concept of 
protected health information (PHI).
    One academic medical center felt that the concept of PII would 
unnecessarily broaden the scope of the Common Rule and create a larger 
administrative burden due to the vagueness of the PII definition 
without providing substantial added protection to human subjects, and 
suggested replacing the term ``identifiable private information'' with 
the definition of ``protected health information,'' which can be found 
at 45 CFR 160.103.
    Those who supported the use of the PII concept noted that it would 
harmonize other definitions of identifiability used in other Federal 
Government regulations. One state department of health and human 
services noted that adopting PII would be consistent with other 
confidentiality laws, policies, and industry standards that require 
organizations to protect the privacy and security of PII, achieving 
consistency across standards and helping organizations comply with the 
various privacy and security requirements. The commenter felt that 
replacing the identifiable private information standard with the 
concept of PII should not be overly burdensome on the research 
community since exemptions and waivers of informed consent would likely 
apply in many contexts.
    A few commenters also noted that regardless of how identifiability 
might be defined, some concerns about group harms still were not 
addressed in the NPRM.
    Several other commenters noted that a change to the definition of 
PII would not increase public trust or understanding of the system, nor 
would it likely clarify for investigators whether biospecimens or 
private information are identifiable.
    A majority of the commenters noted that whatever direction the 
final rule takes; additional guidance will be necessary to reduce 
ambiguity within the regulated community.
e. Public Comments on Newborn Dried Blood Spots
    Approximately 50 comments discussed how issues related to research 
use of residual newborn dried blood spots (DBS) were addressed by the 
proposal to expand the definition of human subject. Of those comments, 
35 supported the idea of parental consent for research with DBS. 
Thirty-two comments stated that specific consent should be required for 
all research uses, in other words, that the exemptions and exclusion 
categories should not apply to research involving DBS. Those who felt 
that parental consent should always be required for the research use of 
DBS expressed the need to respect autonomy and parents' rights, and 
frequently conveyed a distrust of medicine and scientists. These 
individuals generally supported the spirit of the main NPRM

[[Page 7168]]

proposal, but objected to any exemptions, exclusions, and waivers of 
informed consent.
    Fifteen comments expressed concerns that the biospecimen proposals 
in the NPRM would impede research involving DBS, which could negatively 
affect the expansion and improvement of newborn screening programs due 
to, among other things, a possible lack of resources for obtaining 
consent. In this regard, an employee of a California state health 
department described the health department's experience of seeking and 
obtaining consent for the research use of DBS. This individual noted 
that 52 percent of new parents were offered the opportunity to consent. 
Of those offered the opportunity, 90 percent said yes. This employee 
was thus concerned that due to staffing constraints, the majority of 
new parents simply would not be asked to provide consent to future 
research uses of DBS.
    Others indicated that some kind of notice and opt-out process would 
be acceptable, but that as a general matter the research community 
would benefit from guidance on the extent to which the exemptions and 
exclusions apply to this type of work.
4. Response to Comments and Explanation of the Final Rule: Definition 
of Human Subject
    The final rule does not implement the proposed expansion of the 
definition of ``human subject'' to include all biospecimens regardless 
of identifiability. It is clear from the comments received that the 
public has significant and appropriate concern about both the need for 
obtaining consent before using such biospecimens for research, and the 
potential negative impacts of implementing that proposal on the ability 
to conduct research. And, while it does not substantially change the 
definition of ``identifiable private information,'' the final rule 
includes a new process by which Common Rule departments and agencies 
can regularly assess the scientific and technological landscape to 
determine whether new developments merit reconsideration of how 
identifiability of either information or biospecimens is interpreted in 
the context of research. Because the final rule does not implement the 
NPRM's proposed expansion to the definition of ``human subject,'' it 
also does not implement the NPRM proposal to exclude certain research 
activities involving nonidentified biospecimens.
    With regard to changing the definition of ``human subject'' to 
include all biospecimens, the majority of commenters who addressed this 
expansion opposed it for a variety of reasons, as described above. As 
explained in the NPRM, one of the core reasons for proposing that the 
rule be broadened to cover all biospecimens, regardless of 
identifiability, was based on the premise that continuing to allow 
secondary research with biospecimens collected without consent for 
research places the publicly funded research enterprise in an 
increasingly untenable position because it is not consistent with the 
majority of the public's wishes, which reflect legitimate autonomy 
interests. However, the public comments on this proposal raise 
sufficient questions about this premise such that we have determined 
that the proposal should not be adopted in this final rule.
    Further, the current regulatory policy appears to sufficiently 
protect against the unauthorized research use of identifiable 
biospecimens. Under the pre-2018 rule, if an investigator funded by a 
Common Rule department or agency uses nonidentified biospecimens and 
manages to re-identify them, that investigator would then be conducting 
human subjects research without IRB approval, in violation of the 
rules. It should also be noted that the position adopted in the final 
rule does not eliminate any authority, separate and apart from the 
Common Rule, that Common Rule departments and agencies have to 
establish policies with additional requirements related to consent for 
research involving nonidentifiable biospecimens or nonidentifiable 
private information, or preclude them from exercising such authority.
    Nonetheless, we acknowledge the need to also appropriately respect 
and promote autonomy interests. Any future proposals aimed at promoting 
autonomy should jointly evaluate the importance of the autonomy 
interests at issue, as well as explicitly quantify the potential 
negative impacts the proposal might have on the ability to conduct 
research, including such consequences on the representativeness of 
biospecimens available for research.
    In the final rule, we have added requirements to the informed 
consent process to increase transparency so that potential subjects 
will have more information about how their biospecimens or private 
information might be used. Specifically, prospective subjects will be 
told that identifiers might be removed from their biospecimens or 
private information and used for future research, if this might be a 
possibility. Finally, as some public comments addressed the desire to 
share in any profits that might accrue as a result of research use of 
their biospecimens, an additional element of consent will require, as 
appropriate, a statement that the subject's biospecimens may be used 
for commercial profit and whether the subject will or will not share in 
this commercial profit. We believe that this increased attention to 
transparency in the consent process will allow individuals to make 
informed choices about whether they want to consent to current or 
future research uses of their biospecimens. A few clarifying changes 
are made in the final rule pertaining to the definition of ``human 
subject'' and the components within that definition, particularly 
referring to both information and biospecimens as key determinants of 
whether a human subject is involved in research.
    With respect to the definition of ``identifiable private 
information,'' although the pre-2018 definition of ``identifiable'' did 
not incorporate a specific process for considering the growing volume 
of information being generated and shared in research (including from 
biospecimens), or consider how evolving technology can ease and speed 
the ability to re-identify information or biospecimens previously 
considered nonidentifiable, we appreciate that a change in that 
definition could have collateral implications with respect to imposing 
unwarranted consent requirements on activities that were not subject to 
the regulations. We appreciate the commenter requests for more guidance 
on how they should interpret the definition of identifiable private 
information. Thus, although the final rule only makes minor changes to 
the existing definition of ``identifiable private information,'' it 
sets in place a process (Sec.  __.102(e)(7), discussed below) that will 
help facilitate any necessary future updates to the understanding of 
that term.
    In the final rule the language at Sec.  __.102(e)(1)(i) relating to 
information obtained through intervention or interaction with an 
individual was adopted and modified by replacing the reference to data, 
as proposed in the NPRM, with a reference to information or 
biospecimens, and by adding the NPRM-proposed language relating to 
using, studying, or analyzing the information or biospecimens. The 
explicit reference to biospecimens in this context is intended as a 
mere clarification of the previous understanding of how the pre-2018 
rule operated.
    Likewise, the final rule adopts the NPRM-proposed language at Sec.  
__.102(e)(1)(ii) relating to obtaining identifiable private 
information, but

[[Page 7169]]

modifies it by adding an explicit reference to ``identifiable 
biospecimens.'' This is also intended as a mere clarification of the 
previous understanding of how the pre-2018 rule operated as applied to 
biospecimens. Similarly, the definition of intervention has been 
modified to clarify that information or biospecimens might be gathered, 
replacing the former reference only to data. This, too, is merely a 
clarification of the existing understanding of that concept.
    A definition of ``identifiable biospecimen'' has been added at 
Sec.  __.102(e)(6). This new definition was not added as a result of 
any substantive change, but rather to enable greater clarity in other 
provisions of these regulations in explaining when a particular 
provision relates to either identifiable private information alone (not 
including biospecimens), or identifiable biospecimens alone, or both. 
The pre-2018 rule's concept of ``identifiable private information'' had 
encompassed the concept of an identifiable biospecimen, whereas under 
the final rule that concept has been ``cleaved off'' from that 
definition and given its own definition. Note that a biospecimen is 
deemed to include private information (consistent with the 
understanding of this concept under the pre-2018 rule), so there is no 
need to add the adjective ``private'' in the definition of an 
``identifiable biospecimen.'' In effect, once a biospecimen becomes 
identifiable (for example, by being tagged with the name or other 
information that indicates the person from whom the biospecimen was 
obtained), then an investigator using that biospecimen is already using 
something to which Sec.  __.102(e)(1)(ii) would apply. There is no need 
to make any additional determination about the ``private'' aspects of 
what is taking place.
    In addition, the minor clarifying change in the language for the 
concept of ``private information'' that was proposed in the NPRM, 
namely adding the phrase ``shared or,'' was not adopted. It was decided 
that because any information that should not be shared would always 
meet the standard of being information that should not be made public, 
this change would not actually expand the amount of information that is 
considered private information.
    Although the description of when private information is 
identifiable was not significantly changed, a new provision has been 
added at Sec.  __.102(e)(7) requiring federal departments and agencies 
that implement the Common Rule to regularly, upon consultation with 
appropriate experts, reexamine the meaning of the terms ``identifiable 
private information,'' as defined in Sec.  __.102(e)(5), and 
``identifiable biospecimen,'' as defined in Sec.  __.102(e)(6). Such 
reexamination shall take place at least every 4 years. This new 
provision specifically requires that the federal departments and 
agencies implementing this policy collaborate on this process to avoid 
a duplication of efforts and in order to have a consistent 
interpretation of these terms.
    This new process responds to the growing volume of information 
being generated and shared in research (including from biospecimens), 
and evolving technology that can ease and speed the ability to re-
identify information or biospecimens previously considered 
nonidentifiable. With an increase in the number of exemptions included 
in this final rule, it will be important to reconsider the potential 
identifiability of information and biospecimens and facilitate uniform 
interpretation to ensure adequate privacy and security measures are in 
place.
    Section 102(e)(7) also provides that, after conducting this 
process, if it is determined to be appropriate and permitted by law, 
Common Rule departments and agencies could alter the interpretation of 
identifiable private information or identifiable biospecimens, 
including through the use of guidance.
    In addition, there will occur, also at least every 4 years and as a 
collaborative process among those federal departments and agencies, 
upon consultation with appropriate experts, an assessment as to whether 
there are analytic technologies and techniques that should be 
considered by investigators to generate identifiable private 
information or identifiable biospecimens. The ultimate goal is to 
implement the Common Rule in a way that is aligned with the evolving 
understanding of the concept of identifiability while protecting 
subjects and encouraging and facilitating valuable research.
    To the extent that this process leads to a determination that 
particular analytic technologies or techniques, when applied to 
information or biospecimens that are not identified, do lead to the 
generation of identifiable private information or identifiable 
biospecimens, those technologies or techniques will be placed on a list 
of technologies and techniques satisfying that determination, and 
recommendations might accordingly be made with regard to relevant 
issues relating to consent and privacy and data security protections. 
The result may be that such technologies and techniques could therefore 
only be used in instances where the person has provided their consent 
(broad or study-specific) which meets the requirements of the Common 
Rule, or where an IRB has waived the requirement for consent.
    Notice and the opportunity for public comment would take place 
before a technology or technique could be placed on this list. The 
expectation is that whole genome sequencing will be one of the first 
technologies to be evaluated to determine whether it should be placed 
on this list.
    It is important to note that an investigator who possesses 
information or biospecimens to which such a technology or technique 
might be applied is not to be considered in possession of identifiable 
private information or identifiable biospecimens merely as a result of 
such a circumstance: that would only be true were the investigator to 
actually apply the technology or technique to generate identifiable 
private information or identifiable biospecimens.
    This new provision is not being added as a result of any pre-
conceived determination that there is indeed a need to change, whether 
by guidance or otherwise, the interpretation of ``individually 
identifiable'' as that concept is currently interpreted. Consistent 
with a core theme underpinning the process that led to this final rule, 
it would be inappropriate to expand the scope of coverage of the Common 
Rule with regard to activities that usually involve very little risk 
absent good reason to think that there is a problem that the added 
administrative burden will be correcting. The public comments on both 
the ANPRM and the NPRM do not identify a specific problem, but 
clarification from the regulatory agencies might be useful. Thus, apart 
from the consequences of placing technologies and techniques on the new 
list, the most significant effect of Sec.  __.102(e)(7) may be the 
issuance of guidance from time to time that facilitates understanding 
of and compliance with existing interpretations.
    Finally, with regard to the use of newborn DBS, retaining the pre-
2018 approach toward nonidentified biospecimens resolves many of the 
concerns expressed by commenters who felt that important research 
involving newborn screening would be halted or inhibited under the 
NPRM. The Newborn Screening Saves Lives Reauthorization Act of 2014 
(Pub. L.

[[Page 7170]]

113-240) will no longer be effective following the effective date of 
this final rule, given that its changes applied only until changes to 
the Common Rule were promulgated. As a result, under the final rule, 
secondary research with nonidentified newborn DBS would be treated in 
the same way as secondary research with any other type of nonidentified 
biospecimen. Such research would not be considered research with human 
subjects under the final rule, and thus would not be subject to the 
rule.

E. Legally Authorized Representative (Sec.  __.102(i))

1. Background and Pre-2018 Requirements
    The Common Rule contains a definition of legally authorized 
representative to clarify who can consent on behalf of a prospective 
subject who is unable to consent to research participation on his or 
her own behalf. Under the pre-2018 rule, a legally authorized 
representative was defined as an individual or judicial or other body 
authorized under applicable law to consent on behalf of a prospective 
subject to the subject's participation in the procedure(s) involved in 
the research.
    As there is no federal legal standard as to who, or what entity, is 
authorized to serve as a legally authorized representative to provide 
consent to a subject's research participation, the issue of who can 
serve as a legally authorized representative has been determined by the 
laws of the jurisdiction in which the research will be conducted. 
Within the United States, this generally means state or local law. 
``Applicable law'' could be a state statute or regulation, case law on 
point, an opinion of a State Attorney General, or a combination of 
these.
    Some states and jurisdictions have statutes, regulations, or common 
law that specifically address consent by someone other than the subject 
for participation in research. Most states and jurisdictions have no 
law specifically addressing the issue of consent in the research 
context. In these states and jurisdictions, law that addresses who is 
authorized to give consent on behalf of another person to specific 
medical procedures or generally to clinical care may be relevant if 
those types of procedures are the procedures involved in the research. 
The long-standing interpretation by OHRP has been that such laws 
relating to surrogate consent in the clinical context can be used for 
purposes of the Common Rule.
    In every state, a legally authorized representative can be 
authorized through an advance directive or by a court through 
guardianship proceedings. However some states have no law specifically 
addressing the issue of consent by a surrogate in the research setting, 
and some states have no applicable statutes, regulations, or common law 
specifying when an individual can provide consent for another to 
medical treatment. In the absence of such law, it is usually the case 
that community or other standards (such as institutional policies) 
define hierarchies or identify individuals who are allowed to provide 
consent, for medical treatment purposes, on behalf of others who cannot 
consent for themselves.
    SACHRP and the Presidential Commission for the Study of Bioethical 
Issues have raised concerns that the definition of legally authorized 
representative may be inappropriately hindering the conduct of research 
with subjects who lack capacity to consent. In the second part of its 
report on neuroscience and ethics, Gray Matters: Topics at the 
Intersection of Neuroscience, Ethics, and Society (Volume 2), the 
Commission recommended that federal regulatory agencies establish clear 
requirements to identify who can serve as legally authorized 
representatives for individuals with impaired decision-making capacity 
to support their responsible inclusion in research.\22\
---------------------------------------------------------------------------

    \22\ Presidential Commission for the Study of Bioethical Issues. 
Gray Matters: Topics at the Intersection of Neuroscience, Ethics, 
and Society (Volume 2). Washington, DC: Presidential Commission for 
the Study of Bioethical Issues, 2015. Retrieved from http://bioethics.gov/sites/default/files/GrayMatter_V2_508.pdf
---------------------------------------------------------------------------

2. NPRM Proposal
    Although the NPRM did not propose regulatory text that would change 
the definition of ``legally authorized representative,'' it requested 
public comment on whether we should modify the definition in light of 
the definition's reference to persons or entities ``authorized under 
applicable law.''
    The NPRM sought comment on whether expansion of the current 
definition to permit a legally authorized representative to be defined 
by an accepted common practice standard within a state or jurisdiction 
that lacks applicable state law for determining who can legally consent 
to clinical care would be consistent with the ethical principles 
underlying the Common Rule. The NPRM proposed to allow use of this 
alternative standard only in jurisdictions in which there is also no 
applicable law affirmatively authorizing a legally authorized 
representative to provide consent to the subject's research 
participation.
3. Public Comments
    Approximately 60 commenters discussed the Common Rule's definition 
of ``legally authorized representative.'' A clear majority supported 
the goal of addressing the barrier that the regulatory definition of 
``legally authorized representative'' poses in jurisdictions that have 
no applicable law affirmatively authorizing an individual to provide 
consent for another. Commenters also favored the suggested approach and 
responded that including the allowance of an accepted common practice 
standard would still appropriately protect subjects. About one-third of 
the commenters responding to this question, including disability rights 
organizations, advocacy organizations, and academic institutions, did 
not agree with the direction of the contemplated modification or 
whether this issue should be addressed through regulatory change.
    Those supporting a modified definition generally agreed that 
broadening the definition to cover anyone considered acceptable to 
provide consent for another individual in the clinical setting would be 
appropriate, would represent an alignment with accepted common 
practice, and would bring consistency to the consent process for the 
jurisdictions that are silent on both who may provide consent for 
clinical care and who may provide consent for research. A number of 
commenters who supported the proposal for modification noted that state 
law authorizing individuals to provide consent would continue to apply.
    Among the commenters who opposed the modification, several said 
state law provides sufficient guidance regarding the hierarchy of those 
who can consent for an adult incapable of consenting on his or her own 
behalf, and reduces the institution's liability in the event that an 
inappropriate person consents for the subject. A research institution 
recommended that we reassess this proposal and include more specific 
requirements and details as to the role and authority of the legally 
authorized representative. A disability rights organization, while 
recognizing that the pre-2018 standard is not acceptable, commented 
that the problem is not solved by incorporating broad discretion among 
different jurisdictions. The organization also opined that a common 
practice standard does not provide

[[Page 7171]]

sufficient guidance to assess and balance reasonable risk, considering 
that a legally authorized representative's consent is not equivalent to 
an autonomous decision by the subject. A research subject advocacy 
organization expressed concern that such a change would not provide 
sufficient oversight of investigators, who might use this standard in a 
way that would violate local law. Another commenter stated that certain 
individuals may be considered able to give consent for participation in 
clinical procedures for individuals unable to do so for themselves, but 
may not have the best interests of the individual in mind.
    Commenters responded specifically to the solicitation of comment on 
the proposed standard of ``accepted common practice'' and indicated 
that practices for surrogate consent should be those used in clinical 
settings. Several commenters provided ideas for a more specific 
approach to interpreting the terms ``accepted'' and ``common.'' A 
researchers' association commented that interpretation of these terms 
should include standards that define hierarchies or identify 
individuals who may provide legally acceptable consent, for clinical 
purposes, on behalf of others who cannot consent for themselves. One 
commenter supporting the modification suggested that the terms could be 
defined to refer to the historically used form of governing and 
familial decision making within the group of subjects. A research 
institution commented that an IRB's careful review and documentation of 
who may serve as a legally authorized representative would be 
preferable to an accepted common practice standard, as that standard is 
vague. A research institution commenting in support of broadening the 
definition to those who are allowed to consent to clinical procedures 
advised that this would reduce confusion between physicians and 
researchers as to who can consent for whom in research situations, and 
suggested that the terms ``accepted'' and ``common'' should refer to 
the conducting institution's own policies on who can provide consent to 
clinical procedures.
4. Responses to Comments and Explanation of the Final Rule: Definition 
of Legally Authorized Representative
    The definition of legally authorized representative in the final 
rule at Sec.  __.102(i) has been modified to address jurisdictions in 
which no applicable law authorizes a legally authorized representative 
to provide consent on behalf of a prospective research subject. In 
these jurisdictions, an individual recognized by institutional policy 
as acceptable for providing consent in the nonresearch context to the 
subject's participation in the procedures involved in the research, 
will now be considered a legally authorized representative for purposes 
of this rule.
    The change made from the NPRM discussion that ``accepted common 
practice'' could be used to identify a legally authorized 
representative is in response to objections to the vagueness of these 
terms and the potential for confusion in implementation, which was 
expressed by the majority of commenters opposed to the proposal. We 
agree with the commenters' suggestion that an institution's own 
policies as to surrogate consent may be a better touchstone than 
``accepted common practice,'' as a standard referencing institutional 
policy will provide additional clarity as to who may serve as a legally 
authorized representative at that particular institution.
    The final rule also differs from the NPRM discussion in that it 
allows institutional policies applicable to surrogate consent in either 
the clinical context, or other nonresearch contexts, to authorize a 
legally authorized representative. We expect that implementation of 
this aspect of the final rule definition will in large part rely on 
institutional policies for determining surrogates for clinical decision 
making. In those instances, there is relatively little risk that this 
rule will have inappropriate consequences, as far more significant 
considerations, not related to the Common Rule, play a role in shaping 
and constraining an institution's policies relating to surrogate 
decision making in the clinical context.
    However, we recognize that some studies could be taking place that 
do not relate to the types of decisions that are involved in clinical 
care, or that do not involve procedures utilized in the clinical 
context. If the institution has a policy relating to who acts as a 
surrogate outside of the research context for those types of decisions, 
then such a policy could be employed in the research context. Similar 
to our assessment of policies relating to surrogate decision making in 
the clinical context, we expect that considerations not related to the 
Common Rule would constrain the institution's design and implementation 
of policies in other nonresearch contexts, and thus see relatively 
little risk that this added regulatory flexibility will have 
inappropriate consequences.
    Maintaining the pre-2018 standard would have continued to allow 
disparate results in terms of when research can take place in those 
states that have specific laws governing either surrogate clinical 
consent or research consent, and those that do not. Accepting that the 
Common Rule has been interpreted to allow the use of laws governing 
surrogate consent in the clinical context to be applied to surrogate 
decision making in the research context, it is difficult to see why 
there should be different outcomes in terms of what research is 
allowable based on whether the standards for surrogate consent in the 
clinical context in a state are based on specific laws or some other 
accepted regime.
    This outcome also appears inconsistent with the Belmont Report 
principle of justice. Individuals who lack the capacity to consent to 
research ought not be inappropriately excluded from research 
participation based solely on these circumstances. Research that an IRB 
has approved as ethical to conduct with the participation of subjects 
with impaired decision-making capacity ought not be prohibited in the 
few states and jurisdictions in which no affirmative law authorizing a 
legally authorized representative exists, while being allowed to 
proceed in the vast majority of states and jurisdictions that have laws 
specifically authorizing consent by a legally authorized representative 
in the clinical or research context.
    Reduced ambiguity in the interpretation of the regulatory 
requirements will facilitate research that may offer the promise of 
improved medical treatment for this subject population, thus increasing 
beneficence. This approach reflects the calls for increased clarity in 
the regulatory requirements regarding who may serve as a legally 
authorized representative, which will serve to facilitate the 
responsible inclusion of subjects who cannot consent on their own 
behalf to research participation.

F. Minimal Risk (Sec.  __.102(j))

1. Background and Pre-2018 Requirements
    The concept of ``minimal risk'' is central to numerous aspects of 
the Common Rule, as it affects the type of review required, the 
permissibility of waiver of informed consent, considerations for IRBs 
in the review process, and the frequency of review. In sum, the review 
process has been calibrated, for the most part, to the risk of the 
research. For example, under the pre-2018 rule at Sec.  __.110, a 
research study could receive expedited review if the research 
activities to be conducted

[[Page 7172]]

appeared on the list of activities published by the Secretary of HHS 
that are eligible for such review,\23\ and found by the reviewer(s) to 
involve no more than minimal risk. Under an expedited review procedure, 
the review could be carried out by the IRB chairperson or by one or 
more experienced reviewers designated by the chairperson.
---------------------------------------------------------------------------

    \23\ HHS. Office for Human Research Protections . Categories of 
Research That May Be Reviewed by the Institutional Review Board 
(IRB) through an Expedited Review Procedure. November 9, 1998. 
Retrieved from http://www.hhs.gov/ohrp/policy/expedited98.html.
---------------------------------------------------------------------------

    The definition of ``minimal risk'' in the pre-2018 rule at Sec.  
__.102(i) encompassed research activities where the probability and 
magnitude of harm or discomfort anticipated in the research are not 
greater in and of themselves than those ordinarily encountered in daily 
life or during the performance of routine physical or psychological 
examinations or tests. IRBs report challenges in assessing the level of 
risk presented by some studies in order to make the critical minimal 
risk determination. This is, in part, due to the difficulties in 
applying the definition of minimal risk under the pre-2018 rule, 
particularly because the terms ``ordinarily encountered in daily life'' 
and ``routine physical or psychological examinations or tests'' are not 
clarified.
2. NPRM Proposal
    The NPRM did not propose to modify the definition of ``minimal 
risk,'' but rather proposed adding to the definition a requirement that 
the Secretary of HHS create and publish a list of activities that 
qualify as ``minimal risk.'' This list would be re-evaluated 
periodically, but at least every 8 years, based on recommendations from 
federal departments and agencies and the public. This would not be an 
exhaustive list of all activities that should be considered minimal 
risk under the Common Rule, but would allow IRBs to rely on the 
determination of minimal risk for activities appearing on the list. 
IRBs would still need to make minimal risk determinations about 
activities that do not appear on this list. The public was asked to 
comment on whether 8 years was a reasonable time period for updating 
the list and whether advice should be solicited from outside parties 
when updating the list. The public was also asked to comment on whether 
the Secretary's list would be a useful tool for the research community, 
and whether it would represent a loss of IRB flexibility in risk 
determinations.
3. Public Comments
    Approximately 100 comments were received on this proposal. A strong 
majority supported the proposal, stating that it would be useful to 
have such a list, and some even suggested that the list of minimal risk 
activities should be reviewed more often than once every 8 years. One 
research university suggested that it is impossible to determine the 
future direction of human research and therefore a list of minimal risk 
activities would need to be updated at least yearly.
    Several commenters, including those who supported this proposal 
generally, stated that even though this list of minimal risk activities 
was a good idea in theory, it should be developed separately from a 
final rule to allow for more time to work collaboratively with other 
Common Rule departments and agencies and with members of the regulated 
community. Some of those who supported the proposal asked that there be 
widely solicited public input on the list. Others who supported the 
proposal noted the list does not represent a loss of flexibility 
because the IRB can still override the presumption of minimal risk as 
long as the rationale is documented. One large research university felt 
that the Secretary's list should not replace the IRB's discretion to 
review a study, particularly if it will only be updated periodically. 
One commenter was opposed to the NPRM proposal that the list be further 
codified, suggesting that it should instead be eliminated as a 
regulatory yardstick to simplify the regulations and remove added 
administrative burden.
4. Response to Comments and Explanation of the Final Rule: Definition 
of Minimal Risk
    Although this proposal received significant support, several 
commenters expressed concern that the Secretary's list was another NPRM 
deliverable that the public did not have a chance to see and comment on 
during the NPRM public comment period. These commenters suggested that 
this proposal be removed from a final rule and developed on a separate 
track. We agree that this list should be developed as a separate 
process from the final rule promulgation, and thus this proposal has 
not been included in the final rule.
    Thus, no change is made to the definition of ``minimal risk'' in 
the final rule at Sec.  __.102(j). We still intend to publish guidance 
on this issue and could still pursue publication of such a list in the 
future.

G. Public Health Authority (Sec.  __.102(k))

    The pre-2018 rule did not provide a definition of ``public health 
authority.'' As proposed in the NPRM, the final rule now defines the 
term so that references to it in the definition of research are 
understood. Specifically, because the definition of ``research'' (Sec.  
__.102(l)(2)) removes from that definition public health surveillance 
activities that are conducted, supported, requested, ordered, required, 
or authorized by a public health authority, this definition of ``public 
health authority'' clarifies the scope of the activities removed from 
the definition of ``research'' for the purposes of this final rule.
    In the final rule, as in the NPRM, the term ``public health 
authority'' \24\ means an agency or authority of the United States, a 
state, a territory, a political subdivision of a state or territory, an 
Indian tribe, or a foreign government, or a person or entity acting 
under a grant of authority from or contract with such public agency, 
including the employees or agents of such public agency or its 
contractors or persons or entities to whom it has granted authority, 
that is responsible for public health matters as part of its official 
mandate. We received no public comments on this definition.
---------------------------------------------------------------------------

    \24\ Consistent with 45 CFR 164.501 in the Privacy Rule.
---------------------------------------------------------------------------

H. Research (Sec.  __.102(l))

1. Background and Pre-2018 Requirements
    The pre-2018 rule defined ``research'' as a systematic 
investigation, including research development, testing, and evaluation, 
designed to develop or contribute to generalizable knowledge. 
Activities that met this definition constituted research for the 
purposes of that rule. An activity was only subject to that rule if it 
met this definition (in addition to meeting various other criteria). 
The pre-2018 rule also included categories of research involving human 
subjects that would be considered exempt from the rule.
    The pre-2018 rule was criticized for not being clear about how to 
interpret which activities were covered by the rule and which were not. 
Some commenters also criticized the pre-2018 rule for extending to 
activities that should not be covered and for inhibiting the conduct of 
certain activities. According to some, the definition of ``research'' 
did not provide a sufficiently clear and precise way to distinguish 
between similar activities in a way that made it immediately obvious 
which

[[Page 7173]]

activities fell under the definition and which did not.

2. NPRM Proposals

    The NPRM proposed creating a new section in the regulations 
referred to as ``exclusions.'' By proposing exclusion categories, the 
NPRM intended to make clear that these activities would not have to 
satisfy the regulatory requirements of the Common Rule. That is, the 
proposed excluded activities would have been outside the scope of the 
Common Rule.
    Three of the proposed exclusions sought to reduce uncertainty about 
whether certain internal program improvement activities, historical or 
journalistic inquiries, or quality assurance or improvement activities 
satisfied the Common Rule's definition of research.
    Another three proposed exclusions pertained to activities that are 
part of inherently governmental functions with purposes other than 
research, such as responsibilities to protect public health and welfare 
(i.e., criminal investigations, public health surveillance, and 
national security missions). It was proposed that these activities 
promote recognized specific goods that are crucial to the public 
welfare.
    An additional four categories of proposed exclusions included human 
subjects research activities that were either considered low risk, or 
for which there were appropriate safeguards already in place 
independent of the Common Rule. These four categories pertained to: (1) 
Research that involves the use of educational tests, survey procedures, 
interview procedures, or observation of public behavior uninfluenced by 
the investigators; (2) research involving the collection or study of 
information that has been or will be acquired solely for non-research 
activities or were acquired for research studies other than the 
proposed research study; (3) research conducted by a federal government 
agency using federal government-generated non-research information when 
certain criteria are met; and (4) research regulated as ``health care 
operations,'' ``public health activities,'' or ``research'' under 
HIPAA. As noted in the NPRM, in these categories the principle of 
beneficence alone could support the conduct of these activities after 
considering the level of risk, potential benefits, and nature of human 
participation in these activities, without the need to add the 
protections of the Common Rule.
    A final proposed exclusion would have applied to research involving 
the secondary use of nonidentified biospecimens when the research was 
limited to generating information about the subject that is already 
known by the subject (e.g., disease diagnosis). As such, this research 
would not need any additional protections provided by these 
regulations. This proposed exclusion was directly related to the 
proposed changes in the definition of ``human subject'' to include all 
biospecimens, regardless of whether they are identifiable (as discussed 
above in Section III, that proposal has not been adopted).
3. Public Comments, Response to Comments, and Description of the Final 
Rule: Definition of Research
a. Overview
    Approximately 375 public comments discussed at least one aspect of 
the proposed NPRM exclusions. General concerns about the exclusions 
included that they added a layer of unnecessary complexity in 
determining what studies fall under the Common Rule, and that 
overlapping categories of exclusions and exemptions were proposed. 
Comments also expressed the concern about the lack of requirements on 
who would decide whether an activity met the criteria for an exclusion, 
including investigators, or whether those decisions would be documented 
in any way.
    In response to the public comments, the NPRM's general approach of 
designating various categories of activities as excluded has not been 
adopted. Instead, the final rule reverts to the general structure of 
the pre-2018 rule and integrates some of the categories proposed for 
exclusion in the NPRM into that structure, with some changes to the 
categories.
    The final rule retains the wording of the pre-2018 definition of 
research, and explicitly removes four categories of activities from 
activities that would meet that definition. These revisions are 
intended to make the rule simpler, more familiar to readers who are 
aware of the pre-2018 rule and its definition of research, and easier 
to understand.
    The four categories of activities removed from the definition of 
research are set out in order to make clear that they are not within 
the jurisdiction of the rule. The four categories pertain to certain 
scholarly and journalistic activities, public health surveillance 
activities, criminal justice activities, and authorized operational 
activities in support of national security missions. These categories 
were proposed as exclusions in the NPRM; the final rule retains these 
categories, with some changes made in the wording for clarity, in 
response to public comments.
    The category of certain scholarly or journalistic activities is 
removed from the definition in order to resolve long-standing debate 
and uncertainty about whether these activities are considered research 
in the sense of the regulatory definition. We believe that these 
activities should not be considered research in the context of the 
Common Rule, and that making this explicit in the final rule will help 
to resolve the uncertainty.
    The final rule includes a simpler definition of national security 
missions not considered to be human subject research, as a response to 
concern that the earlier draft language in the NPRM could be 
interpreted too broadly or too narrowly due to the specific activities 
listed, such as surveys, interviews, surveillance activities and 
related analyses, and the collection and use of biospecimens. These 
authorized operational activities, as determined by each agency, do not 
include research activities as defined by the Common Rule, nor have 
they ever in the past been considered regulated by the Common Rule. 
This category of activity is removed from the definition of research to 
make explicit that the requirements of the final rule do not apply to 
authorized operational activities in support of national security 
missions.
    The other two categories of activities deemed not to be research 
under the final rule (pertaining to public health surveillance 
activities and criminal justice activities) include many activities 
that under the pre-2018 rule do not fit the definition of research, and 
some activities that otherwise might. These categories are included in 
the final rule in order to make it explicit that the requirements of 
the final rule do not apply to them.
    Three categories of activities proposed as exclusions have been 
eliminated from the final rule. The proposed exclusion for certain 
quality assurance/quality improvement (QA/QI) activities has been 
dropped because it could create more confusion than it resolved, and it 
might have inadvertently created inappropriate obstacles to those QA/QI 
activities that should not fall under the rule. The proposed exclusion 
for internal program improvement activities has been dropped due to 
similar considerations. The category regarding secondary research 
involving nonidentified biospecimens designed only to generate 
information about an individual that is already known has been dropped 
because it is no longer necessary given that the NPRM proposal

[[Page 7174]]

to modify the definition of human subject to include all biospecimens 
regardless of identifiability is not included in the final rule. The 
discussion of the proposed exclusion for certain research activities 
with nonidentified biospecimens appears in additional detail in Section 
III.D.
    The four exclusions proposed in the NPRM that are incorporated into 
the exemptions in the final rule are: (1) The proposed exclusion for 
certain educational tests, survey or interview procedures or 
observation of public behavior; (2) the proposed exclusion for 
secondary research use of information that is publicly available or 
recorded without identifiers; (3) the proposed exclusion regarding 
secondary research use of information collected by the Federal 
Government for other purposes and subject to certain privacy laws; and 
(4) the proposed exclusion regarding secondary research use of 
information covered by HIPAA protections.
b. Scholarly and Journalistic Activities (e.g., Oral History, 
Journalism, Biography, Literary Criticism, Legal Research, and 
Historical Scholarship) (Sec.  __.102(l)(1))
i. Public Comments
    Approximately 50 comments discussed the NPRM proposal to exclude 
scholarly and journalistic articles from coverage by the rule. The 
majority of these comments supported the intent of the exclusion, 
although several comments suggested possible changes. The minority of 
the comments expressed concerns. Those who opposed this exclusion 
generally opposed all exclusions, arguing that investigators should be 
required to get permission from subjects before engaging in these 
activities.
    One commenter expressed concern about an exclusion that would 
permit oral history activities with tribal nations without oversight. 
This commenter noted that some oral history with tribal nations is 
tantamount to cultural appropriation, and the concern of tribal nations 
might not be adequately protected by the ethical standards of various 
professions.
    Several commenters discussed that the wording of the NPRM 
regulatory text here might be more restrictive than necessary. 
Specifically, several commenters noted that in calling out specific 
disciplines and methodologies, the regulatory text seems counter to the 
NPRM policy goal of allowing this type of research (as opposed to 
research in these specific fields) to occur.
    A few commenters discussed the need for ethnographic research to be 
explicitly called out in this exclusion. One commenter also raised 
cultural anthropology as another academic discipline that should be 
referenced in this exclusion.
    Several commenters, including academic discipline advocacy groups, 
noted that the exclusion conflated broad disciplines (journalism) with 
methodologies (oral history), which could be confusing to those 
attempting to implement the exclusion.
    Several commenters also questioned whether the provision ``that 
focus directly on the specific individuals about whom the information 
is collected'' applied only to historical scholarship activities or to 
all of the activities and disciplines noted in the exclusion. Several 
other commenters indicated that they supported a full exclusion of all 
oral history, journalism, biographical, and historical scholarship 
activities, suggesting that those several individuals do not presume 
that the provision ``that focus directly on the specific individuals 
about whom the information is collected'' served as a limitation on 
what activities were covered under this exclusion.
    A minority of commenters--including accreditation bodies, human 
research protection experts, and research universities--suggested that 
an exclusion for these activities was not needed, and that this topic 
could be addressed through guidance. These comments also indicated that 
addressing this topic in guidance might be clearer to the regulated 
community as well. Others indicated that the exclusion is not warranted 
because the excluded activities are those that would not contribute to 
generalizable knowledge and thus already would not fall under the rule.
    The NPRM also asked whether biospecimens should be included in this 
exclusion. Very few individuals answered this question, and those that 
did indicated that biospecimens should not be included.
    One research university indicated that with respect to oral 
history, the exclusion should make a distinction between oral history 
projects that meet the definition of research and those that do not, 
suggesting that the exclusion should not exempt all projects that might 
fall under the ``oral history'' banner. One commenter noted that oral 
history should be defined in order to distinguish that activity from 
interviews.
ii. Response to Comments and Explanation of the Final Rule: Scholarly 
and Journalistic Activities
    The final rule explicitly removes a category of activities 
consisting of certain scholarly and journalistic activities from the 
definition of research and the scope of the regulations. This category 
of activities concerns certain activities in various fields that focus 
directly on the specific individuals about whom information are 
collected. As described above, this category is removed from the 
definition in order to resolve long-standing debate and uncertainty 
about whether these activities are considered research in the sense of 
the regulatory definition. We believe that these activities should not 
be considered research in the context of the Common Rule, and that 
making this explicit in the final rule will help to resolve the 
uncertainty.
    In these activities, the ethical requirement is to provide an 
accurate and evidence-based portrayal of the individuals involved, and 
not necessarily to protect them from public scrutiny. For example, a 
biographer might collect and present factual information to support the 
biographer's opinion about the character of an individual to show that 
the individual does not deserve the positive reputation he or she 
enjoys in society. These fields of research have their own codes of 
ethics, according to which, for example, consent is obtained for oral 
histories. We note that this consent standard should address the issue 
of oral histories of tribal members. For these reasons, we have 
determined that it is appropriate to remove these activities from the 
definition of research and from the scope of the Common Rule.
    In response to public comments, Sec.  __.102(l)(1) refers to more 
fields and methodological traditions than were proposed in the NPRM. 
The final rule also explicitly cites those fields and traditions as 
examples, in order to clarify that the focus is on the specific 
activities that collect and use information about specific individuals 
themselves, and not generalizing to other individuals, and that such 
activities occur in various fields of inquiry and methodological 
traditions. Literary criticism has been added as an example because 
while a piece of literary criticism might focus on information about 
the author(s), it would typically focus on the specific author(s) in 
view. Legal research has been added as an example because it would 
often focus on the circumstances of specific plaintiffs or parties 
involved in a case. It is not the particular field

[[Page 7175]]

that removes the activity from the definition, but rather the 
particular activity's focus on specific individuals.
    Activities described in Sec.  __.102(l)(1) may sometimes be 
performed in the fields of anthropology or sociology, but not all 
activities characteristic of these fields are outside of the rule. 
Studies using methods such as participant observation and ethnographic 
studies, in which investigators gather information from individuals in 
order to understand their beliefs, customs, and practices, and the 
findings apply to the studied community or group, and not just the 
individuals from whom the information was obtained, fall within the 
scope of the definition of research of the final rule.
c. Public Health Surveillance (Sec.  __.102(l)(2))
i. Public Comments
    Approximately 80 comments discussed the proposed exclusion for 
certain public health surveillance activities. Public comments were 
generally mixed with many comments suggesting that the regulated 
community will need to see additional examples of activities that 
satisfy this exclusion and activities that fall outside its scope. 
Those who supported this exclusion generally said that this would 
streamline important public health surveillance activities.
    Several comments discussed the importance of this exclusion with 
respect to residual newborn DBS screening programs. These comments 
generally expressed the opinion that most state mandated public health 
reporting of such program activities would fall under this exclusion. 
Commenters requested additional explanation of what aspects of these 
state newborn screening programs would be covered under this exclusion, 
and listed components of the program that should be covered, including 
validity testing and test development. Others suggested that this 
exclusion should also exclude minimal risk efforts to evaluate 
surveillance methods. Others suggested that this exclusion should also 
exclude minimal risk efforts to evaluate surveillance methods. Another 
comment suggested that a final rule address, in this exclusion or 
elsewhere, the issue of research that must be conducted during public 
health emergencies, citing the example of HHS's emergency use provision 
with a waiver of informed consent, which describes limited 
circumstances in which a patient is physically incapacitated or 
otherwise unable to give consent.
    Those who opposed excluding these activities argued that in some 
cases, research activities for which informed consent should be sought 
and obtained are sometimes conducted under the auspices of public 
health surveillance; the importance of the activity itself should not 
be an argument to avoid seeking and obtaining consent. Others argued 
that consent should always be sought and obtained for research 
activities and that all of the exemptions and exclusions discussed in 
the NPRM should be covered activities. One institution indicated that 
this exclusion was simply not needed because the activities described 
did not meet the definition of ``research'' and thus were not subject 
to the Common Rule.
    Another commenter indicated that while the intent of the exclusion 
seemed reasonable, implementation of the regulatory intent would be 
difficult, and there are many examples of modern public health 
surveillance activities where informed consent would have been 
appropriate.
    A few comments that opposed the exclusion indicated concern that it 
might be abused, and cited the Tuskegee Syphilis study \25\ as an 
example of what they feared might be included under this exclusion 
category. We do not think that study would fall within this category, 
because it involved research interventions with the subjects, including 
the provision of substandard treatment and efforts to prevent subjects 
from obtaining effective treatment, which under no circumstances could 
be considered surveillance about a condition of public health 
importance.
---------------------------------------------------------------------------

    \25\ The Tuskegee Syphilis study ``initially involved 600 black 
men--399 with syphilis, 201 who did not have the disease. The study 
was conducted without the benefit of patients' informed consent. 
Researchers told the men they were being treated for `bad blood,' a 
local term used to describe several ailments, including syphilis, 
anemia, and fatigue. In truth, they did not receive the proper 
treatment needed to cure their illness. In exchange for taking part 
in the study, the men received free medical exams, free meals, and 
burial insurance. Although originally projected to last 6 months, 
the study actually went on for 40 years.
    The [federal government panel investigating this study] found 
that the men had agreed freely to be examined and treated. However, 
there was no evidence that researchers had informed them of the 
study or its real purpose. In fact, the men had been misled and had 
not been given all the facts required to provide informed consent . 
. . The men were never given adequate treatment for their disease. 
Even when penicillin became the drug of choice for syphilis in 1947, 
researchers did not offer it to the subjects. The advisory panel 
[investigating this study] found nothing to show that subjects were 
ever given the choice of quitting the study, even when this new, 
highly effective treatment became widely used.'' Source: ``The 
Tuskegee Timeline.'' Centers for Disease Control and Prevention, 
last updated 19 Feb 2016. Retrieved from http://www.cdc.gov/tuskegee/timeline.htm.)
---------------------------------------------------------------------------

    The NPRM asked whether the parameters of this exclusion were 
sufficiently clear, and if not, how the exclusion could be clarified. 
In response, one private organization conducting public health research 
stated that it was unclear if this only applies to governmental 
entities like the Centers for Disease Control and Prevention (CDC), or 
if it applies to other organizations as well. Another institution 
suggested that the community needed additional clarification of what 
types of activities fall under this exclusion. One research university 
requested clarification on whether public health surveillance 
activities falling under this exclusion is subject to subpart B and C, 
that is, research involving pregnant women or prisoners, respectively. 
One organization indicated that it would be helpful for the examples 
used in the NPRM preamble to be published as a separate guidance 
document.
    Another comment noted that the examples included in the preamble 
only addressed acute infectious disease surveillance and no other types 
of public health surveillance activities, specifically, chronic disease 
surveillance and biomonitoring for toxic chemical compounds and 
metabolites, which should be covered under this exclusion.
    Another research organization noted that the regulatory text and 
examples provided might be too narrow, suggesting the exclusion be 
broadened to clarify that it applies to public health monitoring aimed 
at evaluating the degree to which affected individuals seek and obtain 
treatment, barriers to care, quality of care, treatment outcomes, and 
health disparities.
    Commenters also requested additional explanation of what aspects of 
state newborn screening programs would be covered under this exclusion, 
and listed a variety of components of the program, including validity 
testing and development of new tests, that should be covered by the 
exclusion. Commenters asked that clarification of the parameters of the 
public health exclusion be provided so that state newborn screening 
programs can undertake the activities necessary for new test 
development. They added that if the parameters are not clarified, given 
the past controversies associated with the retention and secondary use 
of newborn DBS, many programs may not undertake activities for which 
they have not been given express permission to pursue.

[[Page 7176]]

ii. Response to Comments and Explanation of the Final Rule: Public 
Health Surveillance
    The final rule adopts the NPRM proposal related to deeming certain 
public health surveillance activities as explicitly outside of the 
scope of the Common Rule. Several editorial modifications have been 
made to this category to improve readability. Additionally, the final 
rule explicitly specifies that the collection of information is 
permitted under this category of activities.
    The final rule codifies the current interpretation that the 
definition of research does not include a category of activities that 
solely involve public health surveillance, including collecting and 
testing information or biospecimens in activities that are conducted, 
supported, requested, ordered, required, or authorized by a public 
health authority and that are limited to those necessary to allow the 
public health authority to identify, monitor, assess, or investigate 
potential public health signals, onsets of disease outbreaks, or 
conditions of public health importance. Such surveillance activities 
can include collecting information about trends, signals, risk factors, 
patterns in diseases, or increases in injuries from using consumer 
products. Such activities include those associated with providing 
timely situational awareness and priority-setting during the course of 
an event or crisis that threatens public health, including natural or 
man-made disasters.
    This codification of public health surveillance activities as 
outside the definition of research is designed to remove uncertainty, 
but is not intended to change the scope of activities subject to or not 
subject to the Common Rule. When a public health authority conducts 
public health surveillance activities to fulfill its legal mandate to 
protect and maintain the health and welfare of the populations it 
oversees, the regulatory protections of the Common Rule should not 
impede that authority's ability to accomplish its mandated mission of 
promoting this recognized public good, in keeping with the principle of 
beneficence. Other protections independent of the Common Rule exist 
that serve to protect the rights and welfare of individuals 
participating in such activities, including federal and state policies 
to protect privacy, confidentiality, and security safeguards for the 
information collected.
    Public health surveillance refers to collecting, analyzing, and 
using data to target public health and disease prevention. It is the 
foundation of public health practice. Surveillance uses data from a 
variety of sources, including mandatory reporting of certain 
conditions, routine monitoring, vital records, medical billing records, 
and public health investigations. The line between public health 
surveillance and epidemiological research can be difficult to draw, as 
the same epidemiological techniques may be used in both. Generally, the 
difference between the activities is the purpose or context in which 
the investigation is being conducted and the role of the public health 
authority.
    The following are examples of public health surveillance activities 
being codified as outside of the definition of research in this 
regulation:
     Safety and injury surveillance activities designed to 
enable a public health authority to identify, monitor, assess, and 
investigate potential safety signals for a specific product or class of 
products (for example, the surveillance activities of the FDA's Adverse 
Event Reporting System,\26\ the Vaccine Adverse Event Reporting 
System,\27\ Manufacturer and User Facility Device Experience 
database,\28\ the Medical Product Safety Network,\29\ and the Sentinel 
Initiative); \30\
---------------------------------------------------------------------------

    \26\ See http://www.fda.gov/Drugs/InformationOnDrugs/ucm135151.htm.
    \27\ See https://vaers.hhs.gov/index.
    \28\ See http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/PostmarketRequirements/ReportingAdverseEvents/ucm127891.htm.
    \29\ See http://www.fda.gov/MedicalDevices/Safety/MedSunMedicalProductSafetyNetwork/.
    \30\ See http://www.fda.gov/Safety/FDAsSentinelInitiative/ucm2007250.htm.
---------------------------------------------------------------------------

     Surveillance activities designed to enable a public health 
authority to identify unexpected changes in the incidence or prevalence 
of a certain disease in a defined geographic region where specific 
public health concerns have been raised (e.g., the U.S. influenza 
surveillance system, which allows CDC to find out when and where 
influenza activity is occurring, track influenza-related illness, 
determine what strains of influenza virus are circulating, detect 
changes in influenza viruses, and measure the impact influenza is 
having on hospitalizations and deaths in the United States);
     Surveillance activities designed to enable a public health 
authority to identify the prevalence of known risk factors associated 
with a health problem in the context of a domestic or international 
public health emergency;
     Surveillance activities designed to enable a public health 
authority to locate the range and source of a disease outbreak or to 
identify cases of a disease outbreak;
     Surveillance activities designed to enable a public health 
authority to detect the onset of disease outbreaks or provide timely 
situational awareness during the course of an event or crisis that 
threatens the public health, such as a natural or man-made disaster; 
and,
     Surveillance activities designed to enable a public health 
authority to identify the prevalence of a condition of public health 
importance, known risk factors associated with a condition of public 
health importance, or behaviors or medical practices related to 
prevalence of a known condition of public health importance (e.g., 
surveillance of the prevalence of: tobacco use, exposure to secondhand 
smoke, lung cancer, or use of smoking cessation treatments).
    On the other hand, subsequent research using information collected 
during a public health surveillance activity, for instance, genetic 
analysis of biospecimens, would not be removed from the definition.
    This clarification of current interpretation would not remove the 
following activities from the definition of ``research'': exploratory 
studies designed to better understand risk factors for chronic 
diseases, including genetic predisposition, for chronic diseases; 
exploratory studies designed to elucidate the relationships between 
biomarkers of exposure and biomarkers of disease; and exploratory 
studies of potential relationships between behavioral factors (e.g., 
diet) and indicators of environmental exposures. These types of 
activities would be considered research because they would not be 
conducted solely for the purposes described in Sec.  __.102(l)(2), and 
thus would be covered by the Common Rule if they involved human 
subjects, even if conducted by a federal agency with a public health 
mandate. Again, they might fall within an exemption, depending on how 
they are carried out.
    We note that this provision does apply to some activities 
responding to emergencies, and that various department or agency 
activities, not just those of HHS, will be affected. Research 
evaluations of public health surveillance activities are not included 
in this category because the nature of such evaluations is to create 
generalizable knowledge. We also recognize that in some public health 
surveillance activities, it may be appropriate to obtain consent from 
the individuals from whom information or biospecimens are collected.
    We recognize the public comments stating that the boundaries of 
public health surveillance activities being removed from the definition 
of research

[[Page 7177]]

are not entirely clear. We recognize that some of the activities in 
this category are not research, but believe that the inclusion of this 
provision will help to resolve uncertainty in some circumstances about 
whether the rule applies. We believe that developing guidance in this 
area will be useful.
    Finally, to clarify what public health surveillance activities are 
being removed from the definition of research, the final rule contains 
a new definition of ``public health authority'' at Sec.  __.102(k).
d. Criminal Justice Activities (Sec.  __.102(l)(3)) and Authorized 
Operational Activities in Support of National Security Missions (Sec.  
__.102(l)(4))
i. Public Comments
    Approximately 60 comments discussed the exclusion for certain 
criminal justice activities, the exclusion for intelligence 
surveillance activities, or both. The majority of commenters opposed 
these provisions.
    Several commenters stated that the two exclusions seemed to 
contradict President Clinton's Memorandum of 1997, which stated that 
classified research activities are subject to the Common Rule and 
directed that the regulations be revised to include certain protections 
specific to classified research activities.\31\
---------------------------------------------------------------------------

    \31\ Memorandum of March 27, 1997. Strengthened Protections for 
Human Subjects of Classified Research. 62 FR 26367 (May 13, 1997). 
Retrieved from http://www.fas.org/sgp/clinton/humexp.html.
---------------------------------------------------------------------------

    The majority of commenters discussing these provisions also 
expressed concern about what appeared to be an expansion of activities 
not covered by the Common Rule. These commenters also discussed 
concerns about how this exclusion would affect human subjects 
protections in classified research activities.
    Those who supported these exclusions generally did not provide the 
rationale for why they supported them.
    One research organization noted that additional clarification on 
the exclusion for certain criminal justice activities would be needed, 
and noted that such activities should continue to be subject to the 
Common Rule because this type of research often includes the collection 
of sensitive, identifiable information, which, if disclosed could 
present risks to the subjects.
ii. Response to Comments and Explanation of the Final Rule: Criminal 
Justice Activities
    The final rule clarifies that, consistent with current practice, 
data collection and analysis that enables the conduct of certain 
activities carried out as part of the criminal justice system is not 
research. The scope of these activities is collection and analysis of 
information, biospecimens, or records by or for a criminal justice 
agency for activities authorized by law or court order solely for 
criminal justice or criminal investigative purposes. The activities are 
necessary for the operation and implementation of the criminal justice 
system. The final rule changes the wording of the category from that 
proposed in the NPRM only by substituting the word ``information'' for 
``data,'' for consistency with other parts of the rule.
    The provision essentially codifies current federal interpretation 
that such activities are not considered to be research under the Common 
Rule. Revising the regulations to explicitly remove such activities 
from the scope of research subject to the rule is designed to avoid the 
imposition of disparate requirements by IRBs with overlapping 
jurisdictions when information collection or analysis encompasses the 
development of methods required by law or court order for criminal 
justice or criminal investigative purposes. For example, the Federal 
Bureau of Investigation (FBI) is charged by law with setting standards 
governing the collection and processing of DNA biospecimens and 
information taken (forcibly if necessary) from certain federal and 
state criminal suspects or offenders incident to their arrest or 
conviction for prescribed offenses under the National DNA 
Identification Act of 1994 and other acts. Similarly, the FBI is 
charged by law with setting standards governing the collection and 
processing of fingerprints and related biographical information taken 
from federal and state criminal suspects or offenders and certain 
sensitive civil employment applicants. Many criminal law enforcement 
agencies routinely collect human biospecimens at crime scenes from or 
relating to victims, suspects, and offenders both known and unknown. 
Incident to these activities, the FBI is also charged with maintaining, 
and authenticating through identification processes, the criminal 
record history of criminal offenders for federal government agencies 
and for the overwhelming majority of state governments that elect to 
participate and share information through those systems. We have 
determined that this category of activities does not meet the 
definition of research in the final rule, so that these activities can 
be conducted in accordance with the legitimate goals of the criminal 
justice system.
    We do not believe that this provision contradicts President 
Clinton's 1997 memorandum, which addressed the regulatory requirements 
for certain activities that are considered research under the 
regulations. This category pertains to activities that are outside of 
the regulatory requirements.
    This category is also not intended to include social and behavioral 
studies of the causes of criminal behavior. Such studies would be 
considered research under the final rule.
iii. Response to Comments and Explanation of the Final Rule: Authorized 
Operational Activities in Support of National Security Missions
    The final rule clarifies current federal practice that the 
definition of research does not include authorized operational 
activities (as determined by each agency) in support of intelligence, 
homeland security, defense, or other national security missions. This 
clarification codifies the interpretation of the pre-2018 Common Rule.
    As described above, the final rule includes a simpler reference to 
authorized operational activities in support of national security 
missions not considered to be human subject research, as a response to 
concern that the NPRM proposal could be interpreted too broadly or too 
narrowly due to the specific activities listed, such as surveys, 
interviews, surveillance activities and related analyses, and the 
collection and use of biospecimens. These authorized operational 
activities, as determined by each agency, do not include research 
activities as defined by the Common Rule, nor have they ever in the 
past been considered regulated by the Common Rule. This category of 
activity is removed from the definition of research to make explicit 
that the requirements of the final rule do not apply to authorized 
operational activities in support of national security missions. This 
clarification is not intended to narrow the scope of the Common Rule.
    We do not believe that this category contradicts President 
Clinton's Memorandum of 1997 regarding classified research, because 
this category is merely clarifying what activities are not considered 
to meet the definition of research. The Clinton Memorandum calls for a 
number of requirements to be added to protections for classified 
research activities, but it does not address activities that are not 
considered research.

[[Page 7178]]

4. NPRM Exclusions Not Included in the Final Rule
a. Certain Quality Assurance and Quality Improvement Activities
i. Public Comments
    Approximately 90 comments discussed the proposed exclusion for 
certain QA/QI activities in the NPRM involving the implementation of an 
accepted practice. A majority of comments supported the concept of 
excluding some QA/QI activities from the Common Rule, although some 
stated that the QA/QI exclusion proposed in the NPRM was too narrow to 
cover what has evolved as current practice.
    These commenters expressed concerns that: (1) The NPRM proposed to 
exclude only the QA/QI activities that met the exclusion, and that all 
other QA/QI activities would fall under the rule; or (2) the exclusion 
would be interpreted to mean that the activities described in the 
exclusion were the only QA/QI activities that could be considered not 
covered by the rule.
    The most commonly discussed suggestions for expanding the scope of 
this exclusion included:
     Expanding the exclusion beyond ``accepted practices''
     Permitting the collection of outcome measures in the 
category of activities proposed to be excluded by the NPRM

    One hospital noted that QA/QI is not limited to implementation of 
an ``accepted practice'' and that limiting the exclusion in this way 
might impede innovation, for example, accessing an electronic medical 
record system for QA/QI to test incorporating clinical information to 
analyze and test best-practice pop-up alerts that signal important 
information for healthcare providers in caring for a patient. This 
commenter asserted that there is no current ``accepted practice'' for 
activities like this, yet they should be excluded from the definition 
of research to avoid confusion and to support ongoing innovation and 
care improvement activities. This commenter also suggested that any QA/
QI exclusion should permit activities that allow medical centers to 
analyze how they deliver care, improve outcomes, and modify processes 
to achieve healthcare reform goals.
    One commenter also noted that the ``accepted practice'' limitation 
would also be problematic in the social sciences. This commenter 
disagreed that the proposed exclusion for quality improvement or 
assurance practices should be limited to ``an accepted practice,'' and 
felt that it should apply to the evaluation of alternative practices. 
In social sciences research an ``accepted practice'' is generally not 
as well defined, can evolve rapidly, and vary by considerations such as 
timing, culture, geography, and nature of service. In social science 
research, this limitation could severely limit the use of this 
exclusion for research that is equally low in risk and therefore does 
not require review.
    A few commenters explicitly referenced the importance of QA/QI 
activities in the context of a learning health care system, and 
discussed the need for a broader exclusion in order to achieve the 
goals of a learning health system.
    A professional organization focused on advancing the fields of 
health services research and health policy noted that a basic tenet of 
the learning health system is the expectation of continuous learning 
from routine care, which often is accomplished by evaluating health 
outcomes. The intentional assessment of the outcomes related to a QI 
activity by itself should not make the activity subject to the Common 
Rule.
    A medical education membership organization felt that routine 
evaluation of practices and continuous incorporation of knowledge 
learned into patient care is fundamental to a learning health system 
and should not be impeded by the regulatory framework. It stated that 
the current Common Rule provides insufficient guidance to distinguish 
research and improvement in care delivery in a consistent manner. The 
organization indicated that the revised Common Rule explicitly 
recognizes that efforts to improve care by evaluating an accepted 
practice and the resulting effects are not research that should be 
regulated under the Common Rule.
    Commenters suggested many other QA/QI activities that should be 
explicitly excluded or exempted from the Common Rule, such as:
     Activities mandated by the Clinical Laboratory Improvement 
Amendments (CLIA)
     Evaluations of systems-level interventions to improve 
quality and safety
     Comparative assessment of alternative practices to 
determine relative effectiveness
     All QA/QI research for the purpose of health care 
operations, including patient-centered comparative effectiveness 
research
     Evaluation of competing QA/QI strategies for 
implementation of accepted medical practices, which should not be 
subject to IRB review
     Evaluation of competing low-risk interventions that would 
typically be implemented in a QA/QI framework without further research: 
these typically are not direct medical treatments but ancillary aspects 
of care.
     The use of other analytic assessment methods, such as 
interrupted time series analysis, or randomization of clusters 
(including stepped wedge designs)
     Dissemination of QA/QI results, or the intention to 
disseminate results, including by publication, which should not by 
itself make the activity subject to IRB review (consistent with current 
OHRP guidance)
     Multi-institution collaborations of otherwise routine QA/
QI activities
     Public health-related QA/QI activities
     Comparative benchmarking

    Others expressed approval for the proposed exclusion, but suggested 
that substantial guidance would be necessary for the regulated 
community to apply this exclusion appropriately. Specifically, several 
commenters asked about the extent to which OHRP's current guidance on 
QA/QI activities would still apply. Others asked for clarification 
about the extent to which the NPRM proposal would apply in situations 
where a hospital system with several hospitals implemented different 
accepted practices at different hospitals within the system, and 
compared outcomes to determine which accepted practice would be best 
for that hospital system.
    Several comments did not support the NPRM's QA/QI proposal. Reasons 
included: believing that the activities excluded by the NPRM already 
did not meet the definition of research and thus did not need to be 
explicitly excluded; believing that these activities should be subject 
to some type of review because of concerns about investigator self-
determination; and, believing that even in QA/QI activities, human 
subjects should be offered the opportunity to know that they are 
subjects in a research activity and should be offered the option to 
consent.
    One patient advocacy group noted that because much research is done 
in the guise of administration or QI, this proposed exclusion might 
encourage researchers to evade human subjects protections while the 
projects may put primary subjects and third parties at risk. It stated 
that although some hospital-based projects might incur minimal risk to 
primary subjects, they might pose greater risk to other parties, for 
example, patients. Thus, the group argued that this exclusion should be

[[Page 7179]]

stricken and that if personal information and biospecimens are to be 
collected and analyzed for purposes other than the individual patient's 
care, then that activity should be subject to the Common Rule.
    One research institution felt that the proposed change suggests 
that patient consent will be necessary for many activities designed to 
ensure QA/QI in health care settings, and could interfere with the 
imperative to design and evaluate new approaches to enhance patient 
safety and clinical outcomes. The commenter added that the implications 
of this provision should be assessed by clinical practitioners and 
hospital administrators in addition to researchers and research 
institutions.
    Another commenter noted that the proposed exclusion of QA/QI 
activities fails to exclude important activities that are considered 
``not research'' under the current Common Rule, arguing that the new 
NPRM exclusion is more in line with evidence-based practice than with 
QI. Institutions are required under The Joint Commission to perform 
continuous QI activities, which typically are small, iterative changes 
to improve clinical care; these activities are seen as part of hospital 
operations rather than research. The commenter stated that the proposed 
limitations would make certain QI activities subject to IRB review and 
possible informed consent requirements, which could result in 
overregulating an activity that is currently not subject to the Common 
Rule.
    Several of these commenters generally indicated that they 
interpreted the proposed exclusion as providing a definition of QA/QI, 
as opposed to excluding a specific type of QA/QI activity. Several of 
these commenters suggested deleting a QA/QI exclusion from the rule so 
that IRBs and investigators would not be confused. One hospital 
suggested eliminating quality activities from the NPRM since by 
specifying that certain quality activities are not research, the NPRM 
seems to designate all other quality activities as research by default.
ii. Response to Comments and Explanation of the Final Rule: Certain 
Quality Assurance and Quality Improvement Activities
    The proposed exclusion for QA/QI activities is not included in the 
final rule. The degree of concern expressed by the public comments on 
this topic is significant. We recognize that human subject protections 
would be meaningful and appropriate for some QA/QI research activities, 
but not for others. However, to avoid increasing confusion and 
unnecessary obstacles to innovation, the final rule does not single out 
certain QA/QI activities as meeting or not meeting the definition of 
research.
b. Program Improvement Activities
i. Public Comments
    Approximately 20 comments were received on this proposed exclusion 
regarding data collection and analysis for internal operational 
monitoring and program improvement purposes, with a strong majority in 
support. Commenters indicated that the proposed exclusion would require 
significant guidance because it was unclear what types of activities it 
might include and when. Several commenters supported the proposed 
exclusion, but noted that the exclusion should specifically reference 
QI activities instead of just program improvement activities. One 
commenter suggested that activities defined as ``health care 
operations'' under HIPAA also be included in this exclusion. One 
commenter opposed this exclusion because of the lack of specific 
reference to QI. Another opposed this exclusion because they felt it 
was too narrowly written.
    One large private research firm indicated opposition to this 
proposal because it was too confusing. Further, this group questioned 
the need for an exclusion that seemed to only reference activities that 
would not be considered to fall under the rule because these activities 
would not satisfy the definition of research (specifically, these 
activities would not be designed to contribute to generalizable 
knowledge).
    Of those who opposed this proposal, a minority suggested that the 
proposed exclusion could be abused by investigators, especially given 
that the NPRM did not propose to require any institutional oversight of 
exclusion determinations. One commenter noted that because many 
research activities might be conducted under the guise of internal 
improvement activities, this exclusion seemed to be giving 
investigators significant opportunities to conduct human research 
activities outside the confines of the rule.
    One commenter who supported this provision suggested that it could 
be merged with the QA/QI exclusion proposed in the NPRM. This commenter 
also suggested that a definition of program improvement and operational 
monitoring be provided.
    The NPRM asked whether the use of biospecimens should be permitted 
in this exclusion. Of those who answered this question, a majority 
indicated yes. This majority generally referenced a belief that many 
activities with residual newborn DBS (see Section III.D) would fall 
under this exclusion. One commenter who opposed the inclusion of 
biospecimens in this excluded category indicated that if the goal of 
the NPRM was to cover all nonidentified biospecimens, then this 
exclusion should not include the research use of biospecimens.
ii. Response to Comments and Explanation of the Final Rule: Program 
Improvement Activities
    The proposed exclusion for program improvement activities is not 
included in the final rule. Based on the public comments it does not 
seem useful for this category of activities to be singled out as not 
meeting the definition of research. As with the NPRM proposed exclusion 
regarding QI/QA activities implementing accepted practices, public 
commenters raised concerns that this exclusion would have created more 
misunderstanding and confusion than it would have resolved. As with QI/
QA activities, some program improvement activities involve research and 
deserve the protections of the rule, while others are not research and 
are not under the rule. We believe that this topic would be better 
addressed through other means.
I. Written or in Writing (Sec.  __.102(m))
    The final rule includes a definition that was not included in the 
NPRM nor in the pre-2018 rule. The definition of ``written or in 
writing'' is included at Sec.  __.102(m) to clarify that, in accordance 
with the longstanding interpretation of the pre-2018 rule, these terms 
include electronic formats, which are increasingly used to fulfill many 
of the documentation requirements that appear throughout the rule.
    Although public comments did not directly address this issue, we 
are aware that some in the regulated community are uncertain of 
whether, for example, consent forms may be in electronic formats. This 
definition is intended to address this concern. Note that the 
definition of ``written or in writing'' does not preclude the 
possibility that consent forms could be in media other than paper or 
electronic formats and still meet the requirements of the Common Rule.

IV. Ensuring Compliance With This Policy (Sec.  __.103)

A. Background and Pre-2018 Requirements

    Requirements in the pre-2018 rule at Sec.  __.103 delineated 
procedural requirements for institutions and IRBs to follow to comply 
with the rule. The

[[Page 7180]]

requirements pertained to written assurances (through FWAs) that 
institutions engaged in research are in compliance with the regulations 
and that the content of such assurances include: a statement of 
principles governing the institution in the discharge of its 
responsibilities to protect research subjects; designation of one or 
more IRBs; a detailed IRB membership roster; and written procedures for 
IRBs and reporting of unanticipated problems. A U.S. institution also 
was able to voluntarily pledge to conduct all of its nonexempt human 
subjects research, regardless of funding source, in compliance with the 
Common Rule or the Common Rule and subparts B, C, and D of 45 CFR part 
46--often referred to as ``checking the box'' on the assurance form.
    The pre-2018 rule also stated who will execute and evaluate 
assurances. Finally, the rule described the process by which 
institutions certify that nonexempt research has been reviewed and 
approved by an IRB. There has been concern expressed by some that the 
assurance process may have been unduly burdensome for institutions and 
did not provide meaningful protections for human subjects.

B. NPRM Proposals

    The NPRM proposed a number of substantive and procedural 
modifications to Sec.  __.103 of the Common Rule. First, the NPRM 
proposed to move several requirements from Sec.  __.103 to Sec.  
__.108, which pertains to IRB functions and operations: (1) The IRB 
recordkeeping requirements; (2) the requirement in the pre-2018 rule 
that IRBs have sufficient meeting space and staff to support IRB 
reviews and record keeping requirements; and (3) the pre-2018 
requirement that an up-to-date list of the IRB members and their 
qualifications be included in an institution's assurance. The NPRM also 
proposed to modify the IRB membership requirement such that this up-to-
date list would no longer be required as part of an institution's 
assurance. Instead, an IRB or an institution would be required to 
prepare and maintain a current list of IRB members.
    The NPRM proposed to delete several requirements found in the pre-
2018 rule: (1) The requirement that an institution provide a statement 
of ethical principles by which the institution will abide, as part of 
the assurance process; (2) the pre-2018 rule requirement that an 
institution designate one or more IRBs on its FWA; (3) the provision 
found in the pre-2018 rule that a department or agency head's 
evaluation of an assurance will take into consideration the adequacy of 
the proposed IRB(s) designated under the assurance, in light of the 
anticipated scope of the institution's activities and the types of 
subject populations likely to be involved, the appropriateness of the 
proposed initial and continuing review procedures in light of the 
probable risks, and the size and complexity of the institution; and (4) 
the requirement that grant applications undergo IRB review and approval 
for the purposes of certification.
    Note that under the NPRM federal departments or agencies would 
retain the ability to ask for information about which IRBs review 
research conducted at an institution as part of the assurance process, 
even if providing this information is not explicitly mandated.
    According to the NPRM, an additional, nonregulatory change was 
proposed for the assurance mechanism. The current option of ``checking 
the box'' on an FWA (described in section IV.A above) would be 
eliminated.
    To further strengthen the proposed new provision at Sec.  
__.101(a), giving Common Rule departments and agencies explicit 
authority to enforce compliance directly against IRBs that are not 
operated by an assured institution, language was proposed requiring 
that for nonexempt research involving human subjects that is covered by 
this policy and takes place at an institution in which IRB oversight is 
conducted by an IRB that is not operated by the institution, the 
institution and the organization operating the IRB shall establish and 
follow procedures for documenting the institution's reliance on the IRB 
for oversight of the research and the responsibilities that each entity 
will undertake to ensure compliance with the requirements of this 
policy (e.g., a written agreement between the institution and the IRB, 
or by implementation of an institution-wide policy directive providing 
the allocation of responsibilities between the institution and an IRB 
that is not operated by the institution).
    The NPRM requested public comment on whether protection for human 
subjects in research would be enhanced if OHRP conducted routine 
periodic inspections to ensure that the membership of IRBs designated 
under FWAs satisfy the requirements of Sec.  __.107.

C. Public Comments

    Very few comments were received on the proposals at Sec.  __.103. 
Four commenters expressed their views on the proposal to delete the 
requirement that an institution provide a statement of ethical 
principles as part of the assurance process, with three supporting the 
proposal and one opposing it.
    Four commenters supported the proposal to eliminate the requirement 
that an institution designate one or more IRBs on its FWA.
    Two comments were received, one in support and one opposed, on the 
proposed elimination of the requirement that an up-to-date list of the 
IRB members and their qualifications be included in an institution's 
assurance. Two comments, one for and one against, were received on the 
proposal to remove the requirement that a department or agency head's 
evaluation of an assurance take into consideration the adequacy of the 
proposed IRBs. Responses to the question about periodic inspections to 
ensure IRBs were compliant were mixed, with most commenters saying that 
it is not clear that ensuring IRBs are compliant would enhance human 
subjects protections. Others questioned the need for this requirement, 
given other incentives institutions have to ensure they have a duly 
constituted IRB, and still others asked what was meant by ``periodic.''
    Approximately 30 commenters supported the proposal to delete the 
requirement that the IRB review grant applications, with only one 
commenter opposed to the proposal.

D. Response to Comments and Explanation of the Final Rule: Assuring 
Compliance With the Policy

    As proposed in the NPRM, the final rule eliminates the pre-2018 
rule requirement that an institution provide a statement of ethical 
principles by which an institution will abide as part of the assurance 
process. We believe this requirement is unnecessary. Further, for 
international institutions that may receive federal funding for 
research activities, it creates the impression that these international 
institutions must modify their internal procedures to comport with the 
set of principles designated on the FWA for activities conducted at 
those institutions that receive no federal funding. OHRP has received 
many questions about the extent to which international institutions 
must adhere to the ethical principles designated as part of the 
assurance process for research activities conducted by the institution 
that receive no Common Rule department or agency funding. That such 
measures are not required will be made clear by deletion of this 
requirement in the final rule.
    Additionally, as proposed in the NPRM, the final rule eliminates 
the

[[Page 7181]]

requirement that appeared in the pre-2018 rule that an up-to-date list 
of the IRB members and their qualifications be included in an 
institution's assurance. Instead, Sec. Sec.  __.108(a)(2) and 
__.115(a)(5) in the final rule require that an IRB or the institution 
prepare and maintain a current list of IRB members. This eliminates the 
previous requirement that changes in IRB membership be reported to the 
department or agency head, or to OHRP when the existence of an 
assurance approved by HHS for federal-wide use is accepted. Of note, 
SACHRP recommended in March, 2008 that OHRP pursue harmonizing the 
Common Rule with FDA's human subjects protection regulations by 
eliminating the requirement to submit IRB membership lists.
    The final rule, as proposed in the NPRM, also eliminates the 
requirement that appeared in the pre-2018 rule that an institution 
designate one or more IRBs on its FWA. Federal departments or agencies 
retain the ability to ask for information about which IRBs review 
research conducted at an institution as part of the assurance process, 
even if that requirement is not explicitly mandated in the regulations.
    An additional, a nonregulatory change that was described in the 
NPRM will be made to the assurance mechanism. The prior option that 
enabled institutions with an active FWA to ``check the box'' (described 
in section IV.A above) is being eliminated. Importantly, institutions 
could, if they so desire, continue for purposes of their own internal 
rules to voluntarily extend the regulations to all research conducted 
by the institution, but this voluntary extension will no longer be part 
of the assurance process and such research will not be subject to OHRP 
oversight. We expect this change to have the beneficial effect of 
encouraging some institutions to explore a variety of flexible 
approaches to overseeing low-risk research that is not funded by a 
Common Rule department or agency, without reducing protection of human 
subjects, thus furthering the goal to decrease inappropriate 
administrative burdens.
    In addition, as proposed in the NPRM, the final rule removes the 
provision found in the pre-2018 rule that a department or agency head's 
evaluation of an assurance will take into consideration the adequacy of 
the proposed IRB(s) designated under the assurance in light of the 
anticipated scope of the institution's activities and the types of 
subject populations likely to be involved, the appropriateness of the 
proposed initial and continuing review procedures in light of the 
probable risks, and the size and complexity of the institution. We 
believe this deletion aligns the regulations with changes made in 
December 2000 to OHRP's implementation of the FWA process. Those 
changes streamlined and simplified the assurance process and eliminated 
OHRP's institution-specific evaluation of the adequacy of each IRB 
designated under the assurance.
    Each FWA-holding institution continues to have responsibility for 
ensuring that the IRBs on which it relies are registered with OHRP and 
are appropriately constituted to review and approve the institution's 
human subjects research, as required under Sec. Sec.  __.107 and __.108 
of the final rule.
    The final rule contains language at Sec.  __.103(e) requiring that 
for nonexempt research involving human subjects (or exempt research 
that requires limited IRB review) that takes place at an institution 
for which an IRB not operated by that institution exercises oversight, 
the institution and the organization operating the IRB must document 
the institution's reliance on the IRB for its research oversight. The 
final rule also requires that this documentation include the 
responsibilities of each entity to ensure compliance with the 
requirements of the rule.
    The requirement included in the final rule for documenting an 
institution's reliance on an IRB that it does not operate is more 
flexible than what was proposed in the NPRM. The final rule only 
requires that the reliance agreement between the institution and the 
organization operating the IRB be documented. It does not include the 
NPRM proposal that the institution and the organization operating the 
IRB establish and follow procedures for documenting the institution's 
reliance on the IRB for oversight of the research and delineating the 
responsibilities that each entity would assume to ensure compliance 
with the requirements of the rule.
    In considering the public comments, we determined that it was 
unnecessary to require that such reliance relationships be described in 
institutional procedures. Under the final rule, compliance with this 
provision could be achieved in a variety of flexible ways, for example, 
through a written agreement between the institution and a specific IRB, 
through language contained in a protocol of a multi-institutional 
study, or more broadly, by implementation of an institution-wide policy 
directive providing the allocation of responsibilities between the 
institution and all IRBs that are not operated by the institution. 
Documenting the responsibilities of the institution and the IRB is 
already a requirement under the terms of an FWA, but is now a 
regulatory requirement. An additional requirement has been added at 
Sec.  __.115(a)(9) that such documentation be part of the IRB records.
    We acknowledge that the new requirement could increase 
administrative burden for some institutions, but believe that the 
examples cited above reflecting the various options an institution may 
use to document reliance on an IRB not operated by that institution are 
generally already standard practice in the regulated community.
    Finally, the final rule eliminates the requirement in the pre-2018 
rule at Sec.  __.103(f) that grant applications undergo IRB review and 
approval for the purposes of certification. The grant application is 
often outdated by the time the research study is submitted for IRB 
review and contains detailed information about the costs of a study, 
personnel, and administrative issues that go beyond the mission of the 
IRB to protect human subjects. Therefore, experience suggests that 
review and approval of the grant application is not a productive use of 
IRB time.

V. Exempt Research (Sec.  __.104)

A. Applicability of Exemptions to Subparts B, C, and D

1. Background and Pre-2018 Requirements
    In the pre-2018 rule, the application of the exemptions to research 
under subparts B, C, and D was specified through footnote 1, which 
stated that the exemptions do not apply to research involving 
prisoners, and are also limited in their application to research 
involving children. Regarding the latter issue, the pre-2018 exemption 
at Sec.  __.101(b)(2) for research involving educational tests, survey 
or interview procedures or observations of public behavior did not 
apply to subpart D (i.e., such research did not qualify for this 
exemption), except for research involving educational tests, or 
observations of public behavior when the investigator does not 
participate in the activities being observed. The pre-2018 exemptions 
did apply to subpart B.
2. NPRM Proposals
    Although some of the exemptions proposed in the NPRM were based 
largely on exemptions in the pre-2018 rule, not all would have applied 
to subparts B, C, and D. Language in the

[[Page 7182]]

NPRM explained how the proposed exemptions may have applied to the 
subparts. The NPRM proposed that all of the exemptions be applied to 
research conducted under subpart B, and that none of the exemptions may 
be applied to research conducted under subpart C, except for research 
aimed at a broader population that consists mostly of nonprisoners but 
that incidentally includes some number of prisoners. The NPRM proposed 
that some of the exemptions may be applied to research conducted under 
subpart D. Under the NPRM, the exemption at proposed Sec.  __.104(e)(1) 
(Research Involving Educational Tests, Surveys, Interviews, or 
Observation of Public Behavior if the Information is Recorded with 
Identifiers and even if the Information is Sensitive) could not be 
applied to research involving children under subpart D. This was 
because protections including IRB review and parental permission are 
appropriate for research involving educational tests, surveys or 
interview procedures, or observation of public behavior when the 
information collected may be individually identified and sensitive in 
nature.
    Although the NPRM did not propose changes to the HHS regulations at 
45 CFR part 46, subparts B, C and D, consideration was given to whether 
the proposed exemption categories should apply to research involving 
prisoners under subpart C, either if the research consists mostly of 
nonprisoners and only incidentally includes some number of prisoners, 
or if the research intends to involve prisoners as research subjects. 
Public comment was requested on whether the revised exemption 
categories should be permitted to apply to research involving 
prisoners. The NPRM explained considerations including the following: 
The history of HHS subpart C research certifications to date; the 
preponderance of low-risk, sociobehavioral research focused on prisoner 
welfare, substance abuse treatment, community reintegration, and 
services utilization; the occurrence of prisoner-subjects in databases 
or registries; and the broad interpretation of the subpart C 
``prisoner'' definition that includes, for example, subjects in court-
mandated residential substance abuse treatment.
    The NPRM posed a question asking whether language in the final rule 
should resemble the 2003 waiver of the applicability of certain 
provisions of the rule for HHS-conducted or -supported epidemiologic 
research involving prisoners and state that the exemptions apply except 
for research where prisoners are a particular focus of the 
research.\32\ The language of the 2003 waiver criteria are broader than 
what was proposed in the NPRM, and already familiar to the research 
community. They apply to epidemiological research that presents no more 
than minimal risk and no more than inconvenience to the prisoner/
subjects. A question was also asked whether the proposed application of 
the exemptions to subparts B and D was appropriate.
---------------------------------------------------------------------------

    \32\ HHS. Waiver of the Applicability of Certain Provisions of 
Department of Health and Human Services Regulations for Protection 
of Human Research Subjects for Department of Health and Human 
Services Conducted or Supported Epidemiologic Research Involving 
Prisoners as Subjects. FR 68(119):36929 (June 20, 2003). Retrieved 
from https://www.gpo.gov/fdsys/pkg/FR-2003-06-20/pdf/03-15580.pdf.
---------------------------------------------------------------------------

3. Public Comments
    Approximately 50 comments were received on the applicability of the 
proposed exclusions and exemptions to the subparts of the rule. Eight 
comments addressed the applicability of the exemptions to subparts B 
and D. However, responses to the question, ``Is the proposed 
application of the exemptions to subparts B and D appropriate?'' 
uniformly agreed with the proposal. A strong majority of the comments 
addressed the applicability of the exemptions to subpart C.
    The NPRM sought comment on the proposal to allow the exemptions to 
apply in research that only incidentally involves prisoners, but that 
is enrolling a primarily nonprisoner population. This would represent a 
policy shift in how the exemptions historically have been applied to 
subpart C. Comments regarding this proposal were mixed. Some responses 
claimed that the proposal expanded the application of the exemptions to 
all research under subpart C, rather than a small subset of subpart C 
research. Other comments opposed the proposal, pointing to the troubled 
history of research with prisoners, and suggesting that research 
involving prisoners, regardless of the risk level, should always go 
through subpart C IRB review. A narrow majority of comments responded 
that the exemptions should be permitted to apply to subpart C in a 
limited way. However, responses regarding the proposed language or 
which exemptions should be applicable to subpart C prisoners varied. 
Some felt a study should be exempted only if it offered some benefit to 
the prison population. Others felt it could be exempt so long as there 
was no identifiable sensitive information or biospecimens involved. 
Some who supported the proposal indicated that because the NPRM did not 
propose to expand the applicability of the exemptions to research 
targeting prisoners, the proposal seemed to be a reasonable expansion. 
One comment noted that permitting a broader interpretation might enable 
more prisoner-subjects to participate in potentially low-risk 
beneficial research. A few commenters addressed whether the language 
describing the applicability of the subparts to research involving 
subpart C should resemble the 2003 epidemiological waiver criteria. Of 
these, comments were mixed, with some indicating that the 2003 
epidemiological waiver criteria would be too ambiguous, others 
indicating that it would be appropriate language to use, and a final 
minority reiterating their opinion that the exemptions should never be 
permitted in research conducted under subpart C.
4. Response to Comments and Explanation of the Final Rule: 
Applicability of Exemptions to Subparts
    The NPRM proposal regarding how the proposed exemptions may be 
applied to the subparts is largely unchanged in the final rule. The 
language at Sec.  __.104(b)(2) regarding subpart C has been modified 
slightly to reduce ambiguity and potential administrative burden, and 
in response to public comment, to narrow the scope of exemption 
application. The final rule does not adopt the 2003 epidemiological 
waiver language due to concerns from public comments that such language 
would be ambiguous and difficult to interpret.
    The final rule section__.104(b)(1) states that all of the 
exemptions at Sec.  __.104 may be applied to research conducted under 
subpart B if the conditions of the exemption are met. Language at Sec.  
__.104(b)(2) states that none of the Sec.  __.104 exemptions may be 
applied to research conducted under subpart C, except for research 
aimed at involving a broader subject population that only incidentally 
includes prisoners. This is a modification of the NPRM language, which 
proposed that the exemptions could apply if research consisted ``mostly 
of nonprisoners and only incidentally'' included some number of 
prisoners. The language was changed in order to avoid the implied need 
(``mostly'') for institutions to project and track the percentage of 
prisoners participating in nonexempt research. The revision also more 
clearly describes and limits the circumstances in which exempt research 
may include prisoners. The language at Sec.  __.104(b)(3) relevant to 
subpart D has been modified to reflect the revised structure of the 
final rule, and now

[[Page 7183]]

states that the exemptions at paragraphs (d)(1), and (d)(4)-(8) of this 
section may be applied to research that is subject to subpart D if the 
conditions of the exemption are met. Paragraphs (d)(2)(i) and (ii) of 
this section may apply only to research activities that are subject to 
subpart D involving educational tests or the observation of public 
behavior when the investigator(s) do not participate in the activities 
being observed. Paragraph (d)(2)(iii) of this section may not be 
applied to research that is subject to subpart D, because protections, 
including IRB review and parental permission, are appropriate for 
research involving children and educational tests, surveys or interview 
procedures, or observation of public behavior when the information 
collected may be individually identified and sensitive in nature.
    The final rule does not make revisions to the HHS regulations at 45 
CFR part 46, subparts B, C, and D. Throughout this rulemaking process, 
the intent has been to revise subpart A, and to address revisions to 
subparts B, C, and D at a later time. However, particular consideration 
has been given to the specific issue of whether the proposed exemption 
categories should apply in the context of research that is aimed at a 
broad population and only incidentally includes prisoners. We concur 
with the comments expressing support for this change.
    In such instances, the specific protections required by subpart C 
are frequently not relevant to the research subjects. The permitted 
inclusion of this subset of prisoners under the exemptions at Sec.  
__.104 is intended to allow an appropriate reduction in IRB 
administrative burden while preventing IRBs from necessarily 
prohibiting the participation of this group in exempt research 
activities, assuming the conditions of the exemptions are fully 
satisfied.
    We believe this subpart C change is narrow in scope, affecting only 
a small subset of subjects who are prisoners. This change will permit, 
for example, the exempt secondary research use of information or 
biospecimens from subjects who are prisoners, if that analysis is not 
seeking to examine prisoners as a population and only incidentally 
includes prisoners in the broader study. Such inclusion would 
previously have required IRB review under subpart C, including review 
by an IRB prisoner representative, followed by certification to and 
authorization by OHRP. In addition, if the research did not fit into a 
Sec.  46.306(a)(2) subpart C category of permissible research, 
prisoners could not be included as subjects in the study, thereby 
causing problems involving identifying and removing these subjects from 
the analysis of repositories and databases.
    Similarly, the narrow expansion would allow a subject to continue 
participation in exempt research if he or she became a prisoner during 
the course of an exempt study, assuming the study was aimed at a broad 
nonprisoner population, without the need for subpart C IRB review and 
certification to OHRP. For example, an exempt study that recruited 
subjects from a local community center to participate in a comparison 
of HIV educational materials would continue to be exempt, and would not 
trigger the need for review under subpart C, even if some of the 
subjects became prisoners after enrollment. On the other hand, a study 
that recruited subjects from a jail or prison to participate in a 
comparison of HIV educational materials would continue to be nonexempt 
under the final rule and require both subpart A and subpart C review, 
including certification to OHRP.

B. Exemption Determination

1. Background and Pre-2018 Requirements
    The pre-2018 rule did not specify who at an institution may 
determine that research is exempt. However, in the past, OHRP has 
recommended that because of the potential for conflict of interest, 
investigators not be given the authority to make an independent 
determination that their human subjects research is exempt. OHRP has 
recommended that institutions implement exemption policies that most 
effectively address the local setting and programs of research. OHRP 
has recognized that this may result in a variety of configurations of 
exemption authority, any of which were acceptable assuming compliance 
with the pre-2018 regulations. In addition, OHRP guidance provided that 
institutional policies and procedures should identify clearly who is 
responsible for making exemption decisions. We note that under the pre-
2018 and final rule a Common Rule department or agency retains final 
authority as to whether a particular human subjects research study 
conducted or supported by that department or agency is exempt from the 
Common Rule.
2. NPRM Proposals
    The NPRM proposed to adopt a requirement that exemption 
determinations be documented, and that such determinations could be 
made only in two specified ways. To assist investigators and 
institutions in making a timely and accurate determination of exemption 
status the NPRM proposed that federal departments or agencies would 
develop one or more exemption determination tools (the use of which 
would constitute one of the ways in which determinations could be 
made). Federal departments or agencies would create their own tool, or 
rely on a tool created by another department or agency (including a 
web-based tool created by HHS). Institutions would have discretion as 
to whether or not to implement such a tool. As proposed in the NPRM, it 
would be designed in such a way that if the person using the tool 
inputs accurate information about the study, the tool would produce a 
determination of whether the study is exempt. Institutions could rely 
on the use of the federally developed tool by investigators as a ``safe 
harbor'' for this determination. Use of the tool would be voluntary, 
and each institution and agency would decide whether to rely on the 
decision tool for their determinations, and if so, who would be allowed 
to use it. Institutions that chose not to use the tool for particular 
determinations would be required to have such determinations made by an 
individual who is knowledgeable about the exemption categories and who 
has access to sufficient information to make an informed and reasonable 
determination. In general, as envisioned in the NPRM, it was expected 
that investigators would not be allowed to make exemption 
determinations for themselves without the use of the decision tool, due 
to considerations of a conflict of interest.
    The NPRM requested public comment on several aspects of the 
proposal to develop a decision tool: (1) The likelihood of an 
institution allowing investigators to use the tool; (2) the ease of 
investigators contriving answers in using the tool; (3) whether use of 
the tool should be restricted to certain exempt categories of research; 
(4) whether deployment of such a tool would erode public trust in 
research; and (5) what additional information should be required to be 
kept as a record other than the information submitted into the decision 
tool.
    The NPRM also proposed that the institution or IRB be required to 
maintain records of exemption determinations, which records must 
include, at a minimum, the name of the research study, the name of the 
investigator, and the exemption category applied to the research study. 
As described in the NPRM, maintenance of the output of the completed 
decision tool would fulfill this recordkeeping

[[Page 7184]]

requirement. Although the NPRM did not propose an auditing requirement 
for assessing the accuracy of exemption determinations, it sought 
public comment about the need for one.
3. Public Comments
    This was one of the more commented-on provisions of the NPRM, 
receiving approximately 280 comments. Public comment was generally 
mixed, with approximately half supporting and half opposing this 
proposal. A large majority noted that they felt unable to adequately 
respond to this proposal without seeing the decision tool first. Many 
of those who indicated general support for this proposal noted 
substantial qualifications to their support, such as the need to see 
the tool before deciding. Some requested that this proposal not be 
included in a final rule, and that a separate NPRM be issued specific 
to this proposal. Many commenters said that for simplicity and 
consistency, one tool should be agreed on by all of the sponsoring 
departments and agencies and that the departments and agencies should 
involve research administration professionals in developing such a tool 
so that it would have field-friendly workability and produces 
trustworthy results. Further, they thought that the tool should be 
pilot tested and validated by institutions and investigators before 
being deployed. For those who supported the concept of a decision tool, 
they felt that its use would speed the review process for exempt 
research. Some cited long wait times to receive an exemption 
determination from their institution's IRB.
    Some commenters stated that the tool should clearly indicate that 
although it determines exemption from federal regulations, state 
restrictions still apply. A large academic center argued that though 
the tool could be useful, for institutions that provide services, 
treatment, and care for vulnerable populations it might be prudent to 
have someone with expertise in human research protections independently 
review research proposals to determine whether they are exempt or 
excluded from IRB review, rather than rely on the tool.
    One large research university questioned the need for such a tool, 
asserting that properly designed oversight and review of exempt 
research should take minimal time and ensure that only exempt research 
is conducted without IRB approval. This commenter preferred 
comprehensive guidance on exempt research to support IRBs in making 
efficient and expeditious exemption determinations. A large academic/
research organization concurred, pointing out confusion among 
investigators about exempt categories, which requires careful 
conversation with IRB officers to understand how their project fits 
into the human protection framework. This organization believed that 
these conversations promote safe and effective research decision making 
and argued that use of the tool could fail to properly educate 
investigators about the complexities of exempt research determinations.
    Some commenters noted that the decisions produced by the tool would 
be only as good as the tool and the materials and guidance that 
accompany it. Some commenters added that it is unlikely, however, that 
the use of a federal decision tool would shield the institution or 
investigator from liability in third-party actions. Still others went 
so far as to say that they doubted their institution would allow its 
use, at least for some time after which it was proven. To the extent 
institutions are not engaged in the exemption determination process 
through the tool, some argued that institutions should not be held 
accountable for any unintended outcomes.
    Of those who commented on whether investigators should be allowed 
and trusted to use the exemption determination tool, some noted that it 
seemed inappropriate and a conflict of interest for investigators to be 
allowed to use the tool to generate exemption determinations for their 
own research activities. Others noted that an investigator might be 
able to use the tool, but that the proposed exemptions categories were 
so nuanced that experienced IRB staff might have difficulty determining 
what qualifies for an exemption. To that end, these comments noted that 
the tool would need to be accompanied with substantial guidance for an 
investigator to be able to accurately input information into it. 
Finally, some commenters expressed concern about the possibility that 
investigators might enter inaccurate or misleading information into the 
tool to ``game the system,'' while others noted that that possibility, 
although remote, exists in the current protocol submission process and 
that a well-developed tool could include a means for validating certain 
types of inputs to assess accuracy.
4. Response to Comments and Explanation of the Final Rule: Exemption 
Determination
    The final rule does not adopt the NPRM proposal at this time. 
Therefore, the final rule does not require that exemption 
determinations be documented, as had been proposed in the NPRM, and 
continues to permit flexibility in how exemption determinations are 
made. We recognize it was difficult to provide detailed feedback in the 
absence of an exemption decision tool to evaluate. However, we continue 
to believe that a well-designed, tested, and validated exemption 
decision tool could offer an expedient mechanism for determining 
whether research studies are exempt. Thus, we will continue to explore 
development of an exemption decision tool. If and when an exemption 
decision tool is developed, we would issue a subsequent (separate) 
Federal Register notice for public comment. The notice would also give 
the public the opportunity to comment on whether the use of the tool 
would be appropriate in making exemption determinations under this 
final rule. Thus, members of the public would be afforded a sufficient 
opportunity to provide meaningful comments on such a proposed decision 
tool.

C. Categories of Exempt Research

    The following sections describe the categories of exempt research 
found in the final rule. Note that several categories of activities 
proposed in the NPRM as exclusions appear in the final rule as 
exemptions.
1. Background and Pre-2018 Rule
    Under the pre-2018 rule, a research activity qualified for 
exemption from the Common Rule if it fell into one or more of six 
categories at Sec.  __.101(b)(1)-(6). Such studies were fully exempt 
from the regulations. That is, so long as a study did indeed fall 
within a category, it did not need to satisfy any other regulatory 
requirements that it needed to satisfy under the pre-2018 rule.
2. NPRM Proposals
    The NPRM proposed that all exemption language would be found at 
Sec.  __.104. The NPRM proposed retaining all of the exemption 
categories in the pre-2018 rule in one form or another except for the 
exemption pertaining to research involving the use of educational 
tests, survey or interview procedures or observation of public behavior 
if the subjects are elected or appointed officials, or if the 
confidentiality of the information were protected by statute. However, 
the NPRM proposed re-classifying some of the pre-2018 rule's exemptions 
as exclusions under the NPRM (and thus they would not have been subject 
to administrative or IRB review), while retaining some of the pre-2018 
rule's

[[Page 7185]]

exemptions as exemptions (versus exclusions).
    The NPRM proposed eight exemptions divided into three categories: 
(1) Low-risk interventions for which there would have been no other 
requirement (e.g., informed consent and privacy safeguards) other than 
the determination and recording requirements; (2) research activities 
that would have required application of privacy safeguards; and (3) 
secondary research involving biospecimens and identifiable private 
information that would have required application of privacy safeguards, 
broad consent, and limited IRB review. The NPRM proposed to have some 
exempt studies meet certain other regulatory requirements while not 
having to meet other requirements, making them not ``fully exempt'' in 
the sense of the pre-2018 rule.
    The NPRM proposed retaining exemption categories Sec.  
__.101(b)(1), (5), and (6) from the pre-2018 rule. The NPRM proposed 
clarifying the exemption for research on public benefit programs or 
demonstration projects in the pre-2018 rule and explained that OHRP's 
guidance would be changed to include the applicability of the exemption 
to cover research on public benefit and service programs that an agency 
does not itself administer through its own employees or agents. The 
NPRM proposed requiring federal departments or agencies conducting such 
studies to publish a list of studies under this exemption.
    The NPRM proposed that new exemptions would be created for:
     Certain research involving benign interventions;
     Certain research involving educational tests, survey or 
interview procedures, or observation of public behavior where 
identifiable private information was recorded, so long as data 
protection standards are met;
     Secondary research use of identifiable private information 
originally collected for nonresearch purposes;
     Activities relating to storing and maintaining 
biospecimens and identifiable private information for secondary 
research use, if subjects provided broad consent;
     Secondary research studies that would use the biospecimens 
and identifiable private information stored or maintained under the 
above exemption.
    The NPRM asked for public comment on several aspects of these 
proposals, as they appeared as either exemptions or exclusions and 
whether their placement in the NPRM was appropriate with regard to 
protecting human subjects in research. Comment was requested on whether 
guidance would be needed to help make exemption determinations and 
whether the scopes of the proposed exemptions or proposed exclusions 
were appropriate. That is, whether particular exclusions or exemptions 
were either too narrow or too broad. For example, several questions 
were posed about whether research should be exempt if it involved 
psychological risks. The NPRM asked about whether notice should be 
given to subjects for any of the activities. The public was asked to 
comment on whether and how exempt activities could comply with the 
NPRM's proposed privacy safeguards.
    The NPRM also inquired whether the exemption category related to 
research conducted in established or commonly accepted educational 
settings should apply only to research activities in which notice is 
given to prospective subjects or their legally authorized 
representatives as a regulatory requirement, when not already required 
under the Privacy Act of 1974. If so, comment was sought on the type of 
information to include in the notice and on how such notice should be 
delivered.
    The NPRM asked for feedback on whether the proposed privacy 
safeguards should apply to research included in the proposed exempt 
category related to research conducted in established or commonly 
accepted educational setting, given that such research may involve risk 
of disclosing identifiable private information. The public was also 
asked to comment on whether the protections provided by the HIPAA Rules 
for identifiable health information used for health care operations, 
public health activities, and research activities are sufficient to 
protect human subjects involved in such activities, and whether the 
current process of seeking IRB approval meaningfully adds to the 
protection of subjects involved in such research studies.
    The NPRM asked about the extent to which the HIPAA Rules and the 
Health Information Technology for Economic and Clinical Health (HITECH) 
Act \33\ adequately address the beneficence, autonomy, and justice 
considerations related to collecting new information and whether any 
exemption for such collection should be limited to data collected or 
generated in the course of clinical practice.
---------------------------------------------------------------------------

    \33\ The legislative language can be found at https://www.healthit.gov/sites/default/files/hitech_act_excerpt_from_arra_with_index.pdf.
---------------------------------------------------------------------------

    With regard to the proposed exemption related to research and 
demonstration projects conducted or supported by a federal department 
or agency, the public was asked to comment on: (1) Whether notice 
should be given to prospective subjects and the nature of such notice; 
(2) whether such activities can involve greater than minimal risk and 
whether they are appropriate as exemptions; and (3) whether existing 
privacy safeguards for such activities were sufficient.
    A proposed new exemption category was intended to facilitate 
secondary research using identifiable private information that would 
have been or would be collected or generated for nonresearch purposes, 
when prior notice had been given and privacy safeguards and 
prohibitions on re-use of the information were in place. The public was 
asked to comment on what types of research should fall under this 
proposed exemption, whether it should be limited to research in which 
individuals have been informed of the potential for future research use 
of their information and given the opportunity to opt out, and whether 
the exemption would be appropriate for clinical data registries.
    Finally, public comment was sought on two related proposed 
exemptions for research involving the use of biospecimens or 
identifiable private information that would have been stored or 
maintained for secondary research use, if consent for the storage and 
maintenance of the information and biospecimens had been obtained using 
a broad consent template that the NPRM proposed would be developed by 
the Secretary of HHS.
3. Public Comments, Response to Comments, and Explanation of the Final 
Rule: Exemption Categories
    All exemption categories, of which there are eight, appear at Sec.  
__.104 in the final rule. Four of the exemption categories were 
proposed as exclusions under the NPRM. In addition, the proposed 
exclusion concerning certain research involving educational tests, 
survey or interview procedures, or observation of public behavior has 
been combined with the exemption regarding additional research 
activities using the same research methods. The rule includes four 
exemptions for research involving normal educational practices, 
research involving benign behavioral interventions, research involving 
public benefit or service programs, and research involving taste and 
food quality, all of which were also proposed in the NPRM.
    Three exemptions pertain to secondary research uses of identifiable 
private information or identifiable

[[Page 7186]]

biospecimens. One exemption, at Sec.  __.104(d)(4), which concerns 
secondary research for which consent is not required, which consists of 
three of the proposals for exclusions in the NPRM. A second exemption, 
at Sec.  __.104(d)(7), pertains to storage or maintenance of 
identifiable private information or identifiable biospecimens for which 
broad consent is required, and a third exemption, at Sec.  
__.104(d)(8), concerns secondary use of identifiable private 
information or identifiable biospecimens for which broad consent is 
required. As will be discussed in more detail below, some of the 
conditions associated with the finalized exemptions differ from what 
was proposed in the NPRM.
    In the final rule, similar to what was proposed in the NPRM, 
``exempt'' does not always mean exempt from all of the requirements of 
the Common Rule; the activity must fit the description of the exempt 
category and not include nonexempt research activities. For example, 
the exemption categories in the final rule at Sec.  __.104(d)(7) and 
(8) identify specific regulatory requirements that must be met (e.g., 
limited IRB review, the use of broad consent) as a condition of being 
exempt from other regulatory requirements.
    Public comments, responses to comments, and explanations of the 
final rule for each exemption category follow.
a. Research Conducted in Established or Commonly Accepted Educational 
Settings When It Specifically Involves Normal Educational Practices 
(Sec.  __.104(d)(1))
i. Public Comments
    Approximately 50 comments discussed this exemption, which was a 
slight modification of an exemption that existed in the pre-2018 rule. 
The NPRM asked two questions about this exemption: (1) whether it 
should require some type of notice and if so, how notice should be 
delivered; and (2) whether the proposed privacy safeguards should apply 
to this exemption.
    One commenter (a research dean from a university) suggested that 
the wording of the exemption be modified from ``research conducted in 
established or commonly accepted educational settings'' to ``research 
conducted in established or commonly accepted educational or other 
settings'' in order to allow more flexibility in how this exemption 
could be applied.
    Other commenters noted a need for guidance on how this exemption 
should be interpreted. For example, one comment suggested that a wide 
array of ``normal'' educational practices exists, and the intention of 
this language was difficult to discern. Another comment noted that 
clarification was needed about permissible data collection methods 
under this exemption.
    One commenter discussing the addition of the limitation that the 
study should not be likely to adversely affect students' opportunity to 
learn noted that it might be difficult to predict ahead of time if the 
research contemplated under this exemption might have this adverse 
impact.
    Several commenters discussed whether notice should be required. The 
majority of these comments indicated that some type of notice should be 
required. A few specifically discussed the importance of notifying 
subjects of these activities (with one commenter stating that parental 
consent should be required), stating that lack of notice could erode 
public trust in research.
    Groups representing AI/AN tribal interests argued that notice for 
this type of research should be required. Specifically, they asserted 
that transparency around research-related activities and policies, 
especially in school settings, can build trust among AI/AN populations 
and ensure that individual and community benefits of participation in 
research are achieved. They also noted that tribal consultation 
facilitates decisions about appropriate ways to implement such notices, 
and observed that the rural nature of many AI/AN communities requires 
the use of multiple modes of communication and more time spent reaching 
the intended audience. The commenter also noted that potential subjects 
should be given the opportunity to opt out of research activities.
    One commenter argued that notice is generally an insufficient 
standard for this type of research and is not a suitable substitute for 
informed consent.
    Approximately 20 comments discussed whether the proposed privacy 
safeguards that appeared at Sec.  __.105 in the NPRM should apply to 
this exclusion. Comments were generally mixed about whether this would 
be appropriate, with a small majority indicating that the privacy 
safeguards should not apply. These comments generally argued that if an 
activity is exempt, no additional requirements should be placed on that 
research activity.
    A privacy advocacy organization that supported both notice and 
attaching the proposed privacy safeguards to this provision, stated 
that notice in this context is also important because other federal 
standards (e.g., Family Educational Rights and Privacy Act [FERPA; 20 
U.S.C. 1232g; 34 CFR part 99], Protection of Pupil Rights Amendment 
[PPRA; 20 U.S.C. 1232h; 34 CFR part 98]) are not acceptable proxies for 
privacy protection. This commenter indicated that the notice should be 
robust with detailed information presented to parents directly. As 
justification for providing additional protections in this context, 
this group noted that the consequences for misuse of data are greater 
for children; that is, lost, misused, or leaked information about 
children could have lifelong consequences. The commenter argued that if 
an exemption is proposed for this class of research, then the lack of 
IRB oversight should require that researchers must comply with 
appropriate privacy safeguards.
ii. Response to Comments and Explanation of the Final Rule: Exemption 
for Certain Research Conducted in Certain Educational Settings
    The final rule includes an exemption at Sec.  __.104(d)(1) for 
research conducted in established or commonly accepted educational 
settings that specifically involves normal educational practices, so 
long as the research is not likely to adversely affect students' 
opportunity to learn required educational content or the assessment of 
educators who provide instruction. This includes most research on 
regular and special education instructional strategies, and research on 
the effectiveness of, or the comparison among, instructional 
techniques, curricula, or classroom management methods.
    This exemption is a revised version of the first exemption in the 
pre-2018 rule and a modified version of the exemption as proposed in 
the NPRM. This change is based on concerns about whether the conduct of 
some research projects of this type might draw enough time and 
attention away from the delivery of the regular educational curriculum 
that they could have a detrimental effect on student achievement. The 
wording of the exemption has been modified to include a condition that 
the research is not likely to have these adverse impacts. This was the 
original intent of the NPRM proposal, and it is an important 
qualification that should apply to any research activity that is exempt 
under this provision. It also drops the phrase ``in that educational 
setting,'' because that phrase is redundant.
    The exemption is retained to allow for the conduct of education 
research that may contribute to the important public good of improving 
education, consistent with the principle of beneficence. The

[[Page 7187]]

exemption retains the condition that the research activity takes place 
in established or commonly accepted educational settings, because 
otherwise IRB review would be warranted for such research activities 
being conducted in unconventional settings.
    We recognize that providing notice for this type of research could 
involve a significant administrative burden and that it is not always 
appropriate, and therefore have decided not to include it as a 
regulatory requirement at this time. We note that making these 
activities exempt does not mean that there ought not to be tribal 
consultation about the research activities, and that such consultation 
may lead to a notice requirement. Where appropriate or mandated by 
tribal law, tribal consultation should take place irrespective of 
whether the activity has to meet the requirements of this final rule. 
Such consultation would represent a free-standing legal obligation, as 
is referred to in Sec.  __.101(f).When appropriate, investigators may 
provide notice in a manner that is appropriate to the research activity 
and the cultural context in which it occurs.
    This exemption is largely unchanged from the pre-2018 rule, and 
does not add requirements for safeguarding privacy at this time.
b. Research That Includes Only Interactions Involving Educational Tests 
(Cognitive, Diagnostic, Aptitude, Achievement), Survey Procedures, 
Interview Procedures, or Observation of Public Behavior (Including 
Visual or Auditory Recording), If at Least One of Three Criteria Is Met 
(Sec.  __.104(d)(2))
    This exemption in the final rule is a revised version of an 
exemption in the pre-2018 rule, and is a combination of a provision 
proposed as an exclusion in the NPRM, and a provision proposed as an 
exemption in the NPRM. Thus, public comments on both of these proposals 
follow here.
i. Public Comments
    Approximately 80 comments discussed this proposed exclusion, which 
was an exemption in the pre-2018 rule. Public comments were mixed. Some 
felt that moving these activities from the exemption to exclusion 
category would streamline this type of low-risk, common research 
activity and allow IRBs to focus time and attention on more complicated 
and higher risk activities. Others, including SACHRP and many research 
universities, argued that based on their experience, investigators have 
difficulty making the assessments required to determine whether an 
activity falls under this exemption. For example, investigators have a 
difficult time determining whether disclosure outside of the research 
context might put someone at risk of criminal or civil liability.
    Commenters also expressed concern about whether the three statutes 
cited in the third prong of the proposed exclusion would provide a 
comparable level of protections to human subjects as does the Common 
Rule. Many of these commenters noted that they simply were not sure 
what types of protections would be afforded to subjects under the 
Privacy Act, the Paperwork Reduction Act, and the E-Government Act of 
2002. Others noted that the main protections provided by these statutes 
involved notice and not ethics review.
    The NPRM requested comment on the extent to which covering 
educational tests, survey procedures, interview procedures, or 
observation of public behavior under the Common Rule would 
substantially add to the protections provided to human subjects. Public 
comment was mixed, but the majority of commenters felt that these 
activities should be exempt rather than excluded. One commenter 
indicated that contrary to the primary justification for excluding 
these categories of research, these activities cannot always be 
considered to be low risk and could pose significant risks depending on 
the nature of the research and sensitivity of the data collected.
    One commenter expressed strong opposition to excluding these 
activities from Common Rule protections, indicating that excluding them 
would compromise the rights and welfare of research subjects. The 
commenter emphasized that consent cannot be inherent to participation 
in the activity because researchers cannot know with certainty that 
participants are familiar with common forms of educational tests, 
surveys, and interview procedures and the potential risks inherent to 
information disclosure. In addition, the commenter pointed out, 
assuming that even vulnerable subjects know the risks associated with 
participation in surveys and interviews is contrary to the Belmont 
Report's assertion that vulnerable subjects need additional protection.
    Some comments were mixed, for example, suggesting that observation 
of public behavior might be an acceptable exclusion, whereas surveys 
and interviews ought to remain exempt. One commenter indicated that it 
might be reasonable for these activities to be excluded if an exclusion 
determination tool was available to help investigators make the 
decision. Another commenter suggested that whether the activities are 
exempt or excluded, notice should be required, to indicate the purpose 
of the activity, describe privacy safeguards, state that participation 
is voluntary, and provide information on opting out.
    Other commenters expressed concern that investigators might not be 
able to effectively make these determinations, and pointed out that 
IRBs, with a broad range of experience and expertise in data 
identifiability, provide a check for researchers' judgment and are 
better placed to make consistent and informed decisions about 
exemptions.
    Even so, some other commenters felt that Common Rule protections do 
not substantially add to the protection of human subjects in these 
categories of activities. Thus, categorizing them as an exemption just 
adds administrative burden.
    The NPRM asked whether this exclusion should apply only to research 
activities in which notice is given to prospective subjects or their 
legally authorized representatives as a regulatory requirement, and if 
so, what information should be included in the notice. Some commenters 
supported a requirement for notice or at a minimum, some sort of 
tracking system for these activities. One emphasized that the ethical 
principle of respect for persons demands some sort of notice. Some 
indicated that requiring notice prevents these activities from being 
excluded and might necessitate including them on the list of activities 
for expedited review rather than deeming them exempt activities.
    Other commenters expressed concern about the proposed exclusion. 
For example, one indicated that it might not be correct to assume that 
people agree to participate, and understand that they can opt out, by 
virtue of their participation, and another reiterated concern about 
assuming that these activities are inherently low risk and expressed a 
desire to keep these activities in the exempt category to maintain a 
level of IRB oversight.
    The NPRM asked whether it is reasonable to rely on investigators to 
make self-determinations for the types of research activities covered 
in this particular exclusion category, and if so, whether documentation 
of any kind should be generated and retained. One commenter expressed a 
strong opinion that investigators should be allowed make these self-
determinations. However, the majority of comments responding to this 
question felt that investigators should not be solely responsible for 
making these determinations.

[[Page 7188]]

    Some commenters felt that self-determination might work in certain 
cases or with certain groups but that there would be too much 
variability to allow it generally. One suggested a screening system 
that might check whether determinations were being made correctly.
    Many commenters pointed out that it is unreasonable to expect 
investigators to be able to reliably discern levels of risk inherent to 
disclosure of information, and that what might seem innocuous to 
researchers could cause real harm to others. Other commenters expressed 
concern about conflicts of interest, and that investigators might be 
more likely to make a determination to not delay their research. 
Another commenter emphasized that oversight is necessary to avoid 
situations in which investigators inaccurately assume that subjects 
understand that they are participating in research, or that they are 
being recorded, for example.
    The NPRM requested comment on whether some or all of these 
activities should be exemptions rather than exclusions. Response to 
this question was mixed. Some commenters felt that these activities 
should be excluded. Others felt that surveys and interview should be 
considered exempt while educational tests and observation of public 
behavior should be excluded. Still others felt that all should be 
exemptions except for observations of public behavior, which could be 
excluded.
    The NPRM asked whether these exclusions should be narrowed such 
that studies with the potential for psychological risk are not included 
and whether certain topics that involve sensitive information should 
not be covered by this exclusion. There was general agreement among 
responses to this question that the exclusions should be narrowed so 
that studies with the potential for psychological risk were not 
included in the exclusion. Some commenters, however, indicated that it 
would be unrealistic to expect investigators to make this determination 
reliably, that it might be challenging to implement such a policy, and 
that guidance would be required from regulatory bodies.
    Commenters felt that these activities should be exemptions rather 
than exclusions, to preserve a level of IRB oversight. One commenter 
pointed out that circumstances that occur in research for which 
psychological risks are possible are fairly common in this category of 
activities and that excluding them would leave the risk unaddressed. 
One professional organization emphasized that the ``potential for 
serious psychological harms that may be associated with participation 
in nonbiological research . . . [is] not merely the result of 
inappropriate disclosure of information.'' It also indicated that ``the 
probability and magnitude of this risk may vary by characteristics of 
individual participants, clinical expertise of the interviewer(s), as 
well as the risk-minimizing protections that are in place.''
    The NPRM requested comment on whether for activities captured under 
the third element of this exclusion, the statutory, regulatory, and 
other policy requirements cited provide enough oversight and protection 
that being subject to expedited review under the Common Rule would 
produce minimal additional subject protections. If so, the NPRM asked 
whether the exclusion should be broadened to also cover secondary 
analysis of information collected pursuant to such activities. Of the 
few responses to this question, one commenter felt that existing 
protections are sufficient if information is stored in a secure 
information technology (IT) infrastructure.
    Other organizations expressed strong sentiments that neither the 
Paperwork Reduction Act nor the Privacy Act were protective in the 
research context and that current privacy protections are inadequate. 
They stressed the importance of safeguarding IT and cyber 
infrastructure and provided examples of large data breaches.
    The NPRM asked about the extent to which excluding any of these 
research activities from the Common Rule could result in an actual or 
perceived reduction or alteration of existing rights or protections 
provided to human subjects. That is, does excluding these research 
activities from the Common Rule pose any risks to scientific integrity 
or public trust? Commenters who responded to this question generally 
felt that excluding any of these research activities could result in an 
actual or perceived reduction or alteration of existing rights or 
protections provided to human subjects. One indicated that reduction in 
oversight would lead to subjects being exposed to unintended risks that 
otherwise would be preventable. Other commenters felt that improper 
assumptions about low levels of risk in these activities and allowing 
for self-determination could lead to a reduction in protections for 
human subjects.
ii. Public Comments on the Proposed Exemption for Research Involving 
Educational Tests, Surveys, Interviews, or Observation of Public 
Behavior If the Information Is Recorded With Identifiers, and Even If 
the Information Is Sensitive
    Approximately 50 comments discussed the proposal to exempt 
educational tests, surveys, interviews, or observation of public 
behavior if the information is recorded with identifiers and even if 
the information is sensitive. Public comment here was mixed, with some 
agreeing that by mandating privacy safeguards, the proposal effectively 
addresses the primary risk that occurs in this type of research. Others 
argued that this type of research still benefits from some type of IRB 
review and thus should be considered covered rather than exempted 
research. Yet other comments noted that it was impossible to make a 
determination about this proposed exemption without seeing the proposed 
privacy safeguards that were proposed in the NPRM.
    Several commenters noted that the parameters of this exclusion 
might be acceptable if it excluded sensitive topics or if it excluded 
research studies that posed psychological harm to potential subjects. 
One comment by a professional organization of psychology professionals 
noted that IRBs often misunderstand and overstate psychological risks 
in research. Because of this, this group argued that the rule should 
not include a limitation based on psychological risks because IRBs are 
not able to effectively assess psychological risks.
    The NPRM also asked whether this exemption should be extended to 
research involving children. The majority of those who responded to 
this question were opposed to such an extension.
iii. Response to Comments and Explanation of the Final Rule: Exemption 
for Certain Research Involving Educational Tests, Surveys, Interviews, 
or Observation of Public Behavior Under Specific Conditions
    The final rule includes an exemption at Sec.  __.104(d)(2) that is 
a revised version of an exemption in the pre-2018 rule. The exemption 
applies to research that only includes interactions involving 
educational tests (cognitive, diagnostic, aptitude, achievement), 
survey procedures, interview procedures, or observation of public 
behavior (including visual or auditory recording) uninfluenced by the 
investigator if at least one of three criteria is met:

[[Page 7189]]

     The information obtained is recorded by the investigator 
in such a manner that the identity of the human subject cannot readily 
be ascertained, directly or through identifiers linked to the subjects;
     Any disclosure of the human subjects' responses outside 
the research would not reasonably place the subjects at risk of 
criminal or civil liability or be damaging to the subjects' financial 
standing, employability, educational advancement, or reputation; or
     The information obtained is recorded by the investigator 
in such a manner that the identity of human subjects can readily be 
ascertained, directly or through identifiers linked to the subjects, 
and an IRB conducts a limited IRB review to make the determination 
required by Sec.  __.111(a)(7) (which relate to there being adequate 
provisions for protecting privacy and maintaining confidentiality).
    The final rule does not include the language proposed in the NPRM 
that offered as one prong of the exemption (proposed as an exclusion) 
that the research be subject to the Privacy Act, the Paperwork 
Reduction Act, or the E-Government Act of 2002. The final rule simply 
includes Sec.  __.104(d)(2)(iii), which requires limited IRB review as 
described at Sec.  __.111(a)(7) if identifiable private information 
will be obtained and recorded in such a way that the identity of human 
subjects can readily be ascertained, either directly or through 
identifiers linked to the subject.
    This exemption is based on the assumption that the potential risks 
raised by this category are largely informational and that subjects are 
aware of them, and thus the most important role that an IRB might play 
with respect to reducing potential harms is to ensure the application 
of privacy safeguards. Under this assumption, the exemption is 
consistent with the principle of respect for persons and the 
preservation of autonomy. In the case of observation of public 
behavior, even if the subject does not know that an investigator is 
watching his or her actions, the subject's behavior is public and could 
be observed by others, and thus the research observation is not 
inappropriately intrusive.
    The term ``survey'' as used here refers to information collected 
about individuals through questionnaires or similar procedures (e.g., 
the Current Population Survey conducted by the U.S. Census). ``Human 
subjects'' do not include organizations or businesses. ``Survey,'' as 
used here, does not include the collection of biospecimens. Thus, an 
activity that included the collection of a biospecimen (e.g., a cheek 
swab), in addition to collecting verbal or written responses to 
questions, could not qualify for this exemption.
    This exemption includes the research activities that appeared at 
Sec.  __.101(b)(2) in the pre-2018 rule, as well as some additional 
information collection research activities using the same methods. As 
in the pre-2018 rule, this exemption includes research studies whose 
methods consist of the use of educational tests, survey or interview 
procedures, or observation of public behavior that does not involve an 
intervention, if the data are recorded anonymously, or the information 
is recorded with identifiers, but is not sensitive such that its 
disclosure could result in harm to the subjects. The exemption provides 
a list of the specific harms that must be considered, as did the pre-
2018 rule, with the addition of the specific harm of potential damage 
to the subjects' educational advancement. This potential harm has been 
added because of the obvious relevance to the effects of the disclosure 
of responses in research involving educational tests.
    This exemption has been expanded to include research using the same 
methods involving identifiable private information that might be 
sensitive or potentially harmful if disclosed, so long as the 
investigators adhere to the limited IRB requirements outlined in Sec.  
__.111(a)(7), and the research is not subject to Subpart D. The limited 
IRB review requirements are designed to provide privacy safeguards to 
reduce the chances that the disclosure of identifiable private 
information will occur and lead to harm.
    The wording of the exemption is clarified to indicate (consistent 
with the interpretation of Sec.  __.101(b)(2) in the pre-2018 rule) 
that the research cannot include interventions in addition to the 
educational tests, survey or interview procedures, or observation of 
public behavior. Research involving interventions that are distinct 
from those information collection methods allowable under this 
exemption do not satisfy the conditions of this exemption. For example, 
if a research study were to randomly assign students to take an 
educational test in a quiet room or in a room with a moderate level of 
noise, or to consume a snack (or not) before taking the test, this 
research would not be exempt under this exemption. It should be noted, 
however, that educational tests may include exposing test takers to 
certain materials as part of the test, and that such materials do not 
constitute interventions distinct from the test. For example, reading 
comprehension tests may direct test takers to read a passage, and a 
geography test may present test takers with a map, and ask them to draw 
information from that map. Likewise, survey procedures may contain some 
information that the respondents are asked questions about, which would 
not be considered distinct interventions. However, research in which 
the purpose of the research is to see whether respondents answer survey 
questions differently depending on the gender of the interviewer would 
not satisfy the conditions of the exemption, because the manipulation 
of the interviewer would be a distinct intervention. Research involving 
observation of public behavior does not qualify for this exemption if 
the investigator intervenes with subjects, for example, by offering 
them an ostensibly lost wallet to see if they will accept it.
    Part of the rationale for exempting the research activities at 
Sec.  __.104(d)(2) from the Common Rule, even when the research is not 
otherwise subject to additional federal controls, is that for education 
tests, survey or interview procedures, agreement to participate is 
inherent in participation and that for much of this research the risks 
most likely to be experienced by subjects are related to disclosure of 
anonymous, nonsensitive information and are thus categorized as 
``low.'' In general, it is reasonable to expect that individuals, 
including vulnerable populations (other than children), would 
understand that actively providing responses to educational tests, 
surveys, or interview procedures constitutes agreement to participate 
and that the risks associated with such participation would be related 
to disclosure of the information they provided. The exemption of this 
type of activity rests in large part on the idea that all individuals, 
regardless of the setting or context in which the activity will take 
place, are generally familiar with common forms of educational tests 
and survey and interview procedures that they experience in their daily 
lives, and do not need additional measures to protect themselves and 
their privacy from investigators who seek their involvement in research 
activities involving these procedures. They can decline to participate, 
or to answer some questions. In addition, if the information collected 
is both identifiable and sensitive or potentially harmful, the 
safeguards offered by the limited IRB review requirements at Sec.  
__.111(a)(7) apply. This is accomplished through the added provision at 
Sec.  __.104(d)(2)(iii).
    Concerns have also been raised about psychological risks of 
participating in

[[Page 7190]]

surveys or interviews, and of situational risks where the simple 
awareness that someone was surveyed or interviewed poses a risk. We 
recognize that this is possible, but believe that this is rare enough 
that it does not warrant adding additional conditions to the exemption 
category.
    With respect to applying this exemption to research with children, 
two subcategories of this exemption--concerning information recorded so 
that subjects cannot be identified (Sec.  __.104(d)(2)(i)), and 
concerning disclosures of the subjects' responses that would not place 
them at certain kinds of risk or create certain kinds of damage (Sec.  
__.104(d)(2)(ii))--may apply to research involving children under 
subpart D if the research involves educational tests or observation of 
public behavior and the investigator does not participate in the 
activities being observed. The final subcategory of this exemption 
(Sec.  __.104(d)(2)(iii)), which allows for obtaining and recording 
identifiable private information, may not be applied to research 
involving children under subpart D.
c. Research Involving Benign Behavioral Interventions in Conjunction 
With the Collection of Information From an Adult Subject (Sec.  
__.104(d)(3))
i. Public Comments
    Approximately 50 comments discussed the NPRM proposed exemption 
involving benign interventions in conjunction with collecting 
information from an adult subject. Public comments here were mixed, 
with a majority favoring this exemption, and with the majority of 
commenters indicating that guidance will be needed for this exemption 
to be implemented properly. For example, one large research university 
stated, ``The proposed category involving benign interventions needs 
further revision. While we are supportive of this category in general, 
the words `benign intervention' without definition leaves too much room 
for different interpretations and these terms are not easily applicable 
to social science research, a context in which these types of 
activities are likely to occur.'' Those that favored this exemption 
generally agreed with the argument put forth in the NPRM that these 
activities were low in risk and IRB review did not provide subjects 
meaningful additional protections in this context.
    Several comments requested clarification on the extent to which 
medical interventions might be covered under this exemption. For 
example, to what extent could proven diagnostic methods that introduce 
energy but are not invasive (e.g., magnetic resonance imaging, 
ultrasound, computerized tomography scan) be considered a ``benign 
intervention'' for the purpose of this exemption? Another comment asked 
whether the provision included the use of medical devices, such as 
blood pressure monitors or thermometers.
    Those who did not support this exemption offered a variety of 
reasons. One comment from a research university indicated that it did 
not support this exemption because it could cause studies like the 
``Milgram Obedience Experiment'' \34\ and the ``Stanford Prison Study'' 
\35\ to occur without IRB review. Another comment reiterated the 
general stance that all research activities should require IRB review 
and informed consent.
---------------------------------------------------------------------------

    \34\ Milgram S. Behavioral Study of Obedience. The Journal of 
Abnormal and Social Psychology, 1963; 67(4):371-378. Retrieved from 
http://www.columbia.edu/cu/psychology/terrace/w1001/readings/milgram.pdf.
    \35\ Haney C, Banks WC, and Zimbardo PG. A study of prisoners 
and guards in a simulated prison. Naval Research Review, 1973, 30:4-
17. Retrieved from http://www.simplypsychology.org/zimbardo-paper.pdf.
---------------------------------------------------------------------------

    One comment from a research ethics, public education, and 
professional organization noted that if the final rule includes an 
expansion of exemption categories such as the proposed benign 
intervention exemption in the NPRM, then investigator education on 
human subjects protection should be mandated.
    Another comment noted that it should be clarified in the regulatory 
text that withholding the investigator's hypothesis from subjects is 
not deception.
    The majority of commenters indicated that no additional 
requirements, be it notice or the proposed privacy safeguards, should 
be applied to this exemption category. A minority of comments indicated 
that some kind of notice should be required with this provision, 
generally asking for that notice to include the purpose of the study, 
the privacy and confidentiality protections in place, a statement that 
participation is voluntary, information on how to opt out of the study, 
and information about who to contact for more information. Comments 
that favored notice suggested that the notice should be study-specific.
    Although commenters generally felt the examples of activities that 
would satisfy this exemption included in the regulatory text were 
sufficient, commenters also indicated that many of the terms used in 
this exemption needed additional explanation, for example, ``brief in 
duration,'' ``painless,'' and ``physically invasive.'' A large research 
university noted that the proposed language raised questions about what 
sorts of impact are significant and how long is ``lasting.''
    One large professional organization representing research 
universities and organizations noted that the term ``benign 
intervention'' did not seem to encapsulate the types of activities that 
the NPRM contemplated. Specifically, this organization argued that 
``benign intervention'' connotes a medical procedure, when the NPRM 
preamble suggested that this exemption encompasses nonmedical ``benign 
interventions'' generally. This organization also suggested that the 
activities contemplated by this exemption are more like interactions 
than interventions.
    In response to a question about whether the decision tool could be 
relied on for making this exemption determination, a majority of those 
who responded indicated that it would be impossible to answer this 
question without first seeing the decision tool. Others indicated that 
without better definition of terms like ``benign intervention,'' 
``prospectively agree,'' ``long lasting,'' and ``significant impact,'' 
it would be impossible for a tool to provide accurate determinations 
for this exemption.
ii. Response to Comments and Explanation of the Final Rule: Exemption 
for Certain Research Involving Benign Behavioral Interventions in 
Adults
    This exemption at Sec.  __.104(d)(3) was not in the pre-2018 rule, 
but was proposed in the NPRM. In response to public comments that 
expressed concern over the need to further clarify the term ``benign 
interventions,'' the word ``behavioral'' has been inserted to modify 
the type of intervention which may be included. The intent of this 
change is to exclude the use of medical interventions (including 
medical tests, procedures and devices). The exemption being finalized 
is specifically for research involving benign ``behavioral'' 
interventions in conjunction with the collection of information from an 
adult subject through verbal or written responses (including data 
entry) or audiovisual recording if the subject prospectively agrees to 
the intervention and information collection and at least one of the 
following is met:
     The information obtained is recorded by the investigator 
in such a manner that the identity of the human subjects cannot readily 
be ascertained

[[Page 7191]]

directly or through identifiers linked to the subjects;
     Any disclosure of the human subjects' responses outside 
the research would not reasonably place the subjects at risk of 
criminal or civil liability or be damaging to the subjects' financial 
standing, employability, educational advancement, or reputation; or
     The information obtained is recorded by the investigator 
in such a manner that the identity of the human subjects can readily be 
ascertained, directly or through identifiers linked to the subject, and 
an IRB conducts a limited IRB review to make the determination required 
by Sec.  __.111(a)(7).

    For the purpose of this provision, the exemption describes benign 
behavioral interventions as being brief in duration, harmless, 
painless, not physically invasive, not likely to have a significant 
adverse lasting impact on the subjects, and the investigator has no 
reason to think the subjects will find the interventions offensive or 
embarrassing. Provided all such criteria are met, examples of such 
benign behavioral interventions include having the subjects play an 
online game, solve puzzles under various noise conditions, or decide 
how to allocate a nominal amount of received cash between themselves 
and someone else.
    Unlike the exemption at Sec.  __.104(d)(2), this exemption allows 
for the intervention to be distinct from the data collection method; 
for example, a research study comparing test performance of test takers 
in quiet or noisy surroundings would qualify for this exemption. Also 
subjects could be asked to perform cognitive tasks, and audiovisual 
recording could be used to collect the data, without any educational 
test, survey or interview procedure occurring, and this research would 
qualify for this exemption.
    If the research involves deceiving the subjects about the nature or 
purposes of the research, this exemption would not be applicable unless 
the subject authorizes the deception. For the purpose of this 
provision, authorized deception would be prospective agreement by the 
subject to participate in research where the subject is informed that 
he or she will be unaware of or misled regarding the nature or purposes 
of the research. The final rule allows this type of research to occur 
without the requirements of informed consent because the intervention 
is not likely to result in harm or offense to the subject, and the 
subject must prospectively agree to the intervention and the data 
collection.
    Subjects must be adults, but the provision does not specify that 
they must be competent, and therefore tests of competency are not 
necessary. However, the presumption is that, in keeping with the 
principle of respect for persons, such subjects will not be exploited.
    This new exemption category is added because respect for persons is 
accomplished through the prospective subject's forthcoming agreement or 
authorization to participate, the research activities pose little risk 
to subjects, and the use of this exemption for many social or 
behavioral studies will enable IRBs to devote more time and attention 
to research studies involving greater risks or ethical challenges. We 
note that the requirement for the agreement of the subject effectively 
serves as a kind of notice, because the subject is asked to agree to 
participate in the research, and the request will be tailored to the 
nature of the specific research study.
    The final rule includes another condition that was not included in 
the NPRM, which broadens the type of research that may meet this 
exemption. The final rule at Sec.  __.104(d)(3)(i)(C) permits 
investigators to obtain and record information in such a manner that 
the identity of the human subjects can readily be ascertained, directly 
or through identifiers linked to the subject, provided the research has 
undergone limited IRB review in accord with Sec.  __.111(a)(7). This 
alternative condition was added to the final rule for reasons similar 
to the exemption at Sec.  __.104(d)(2), as a way of providing 
additional protections when investigators obtain and record information 
in such a manner that human subjects can be identified directly or 
through identifiers linked to the subject. Because the risk associated 
with enabling investigators to obtain and record identifiable private 
information can be addressed by requiring adherence to the privacy 
safeguards provided through limited IRB review, we believe it is 
appropriate to allow such research to be exempt.
    In addition, the final rule permits the collection of data through 
audiovisual recording, not just video recording, as was proposed in the 
NPRM. We believe that broadening the exemption in this way provides 
more flexibility to the permissible data collection methods without 
creating greater risk of harm to research subjects.
    We acknowledge that guidance may be useful for interpreting some of 
the terms in this exemption, and that some cases will be debatable. 
However, we also believe that a substantial number of research 
activities will plainly fit this exemption, and should be allowed to 
proceed without IRB review. We agree that investigator education is 
often desirable, but that the provisions of the exemption are not 
difficult to understand. We believe that Milgram's obedience 
experiments and the Stanford Prison Experiment would obviously not 
qualify for this exemption, because investigators had reason to think 
some subjects would find the interventions offensive or embarrassing. 
We acknowledge that in this exemption the word ``deception'' is used to 
include withholding the purpose of the research, which is consistent 
with how the term is often used in this context.
d. Secondary Research Use of Identifiable Private Information and 
Identifiable Biospecimens for Which Consent Is Not Required (Sec.  
__.104(d)(4))
i. Overview
    The final rule exemption at Sec.  __.104(d)(4) is for secondary 
research use of identifiable private information and identifiable 
biospecimens for which consent is not required. This particular 
exemption combines several NPRM exclusion proposals. It exempts 
secondary research use of identifiable private information and 
identifiable biospecimens when:
     The identifiable private information or identifiable 
biospecimens are publicly available;
     The information is recorded by the investigator in such a 
way that the identity of subjects cannot readily be ascertained, and 
the investigator does not contact subjects or try to re-identify 
subjects;
     The secondary research activity is regulated under HIPAA; 
or
     The secondary research activity is conducted by or on 
behalf of a federal entity and involves the use of federally generated 
nonresearch information provided that the original collection was 
subject to specific federal privacy protections and continues to be 
protected.

    By ``secondary research,'' this exemption is referring to re-using 
identifiable information and identifiable biospecimens that are 
collected for some other ``primary'' or ``initial'' activity. The 
information or biospecimens that are covered by this exemption would 
generally be found by the investigator in some type of records (in the 
case of information) or some type of tissue repository (such as a 
hospital's department for storing clinical pathology specimens).

[[Page 7192]]

    It is important to recognize that this exemption does not cover any 
primary collections of either information or biospecimens. For example, 
if an investigator wants to collect information directly from research 
subjects by asking them to complete a questionnaire, that would not be 
covered by this exemption. If an investigator wants to collect 
biospecimens by having subjects swab their cheek, that would similarly 
not be covered by this exemption. On the other hand, an investigator 
who wants to use information that is in some databank, or use 
biospecimens that are in a pathology laboratory, or use the ``excess'' 
portion of blood that was drawn for clinical purposes, could use this 
exemption assuming all of the relevant conditions are met.
    Also, note that unlike the pre-2018 rule's exemption relating to 
certain secondary uses of information and biospecimens, the final rule 
has no requirement that the information and biospecimens must be pre-
existing at the time that the investigator begins a particular research 
study. For example, an investigator could start a study that involves 
using biospecimens from clinical pathology laboratories, and could 
include specimens that are added to the laboratories during the course 
of the study (again assuming that the other conditions of the exemption 
are met).
    Public comments on each of the exclusions proposed in the NPRM and 
combined in this exemption follow.
(1) Public Comments on the Proposed Exclusion for Research Involving 
the Collection or Study of Identifiable Private Information or 
Identifiable Biospecimens That Are Publicly Available or Recorded by 
the Investigator Without Identifiers
    Approximately 50 commenters discussed this proposed exclusion about 
identifiable private information or identifiable biospecimens that are 
publicly available or recorded by the investigator without identifiers. 
Public comments were mixed, with many indicating that investigators 
should not themselves be allowed to determine whether their research 
fits under this exclusion, and many indicating that this should be an 
exemption rather than an exclusion. A majority supported the clarifying 
language that this category of activities could include information 
that will be collected.
    One commenter indicated that the prohibition on re-identification 
should apply to activities in publicly available data sets. This 
commenter also indicated that any research involving re-identification 
should undergo IRB oversight. Another commenter suggested that there 
should also be a prohibition in this category against the release or 
publication of information that would lead to re-identification.
    One commenter indicated that the terminology used in this provision 
needed clarification. Specifically, the commenter wondered how one 
should interpret the term ``recorded by the investigator'' with respect 
to electronic data?
    In response to a question posed in the NPRM about whether any of 
the exclusion categories should include biospecimens, a majority of 
those who responded to the question indicated that biospecimens should 
be included in this category.
    The NPRM also asked whether this exclusion should apply to 
activities involving prisoners. Of those who responded to this 
question, responses were mixed with some indicating that this exclusion 
should apply to research with prisoners and others indicating that it 
would be inappropriate for research with prisoners to be allowed. One 
commenter indicated that allowing prisoners in this type of research 
would be a weakening of protections in activities involving vulnerable 
populations.
(2) Public Comments on the Proposed Exclusion for Certain Activities 
Covered by HIPAA
    Approximately 50 comments discussed the NPRM proposal to exclude 
certain activities subject to HIPAA. Public comments were mixed, with 
many indicating that the protections required under HIPAA for ``health 
care operations,'' ``research,'' and ``public health activities,'' were 
sufficient, and that for the types of activities identified by the 
exclusion, review under the Common Rule did not provide meaningful 
protections. In contrast, others argued that because the scope of a 
privacy review board is narrower than for an IRB, these activities 
should not receive a blanket exclusion from the Common Rule.
    Under the HIPAA Privacy Rule, health information is de-identified 
and thus exempt from that rule only if it neither identifies nor 
provides a reasonable basis to believe that the information can be used 
to identify an individual. The HIPAA Privacy Rule provides two ways to 
de-identify information: (1) A formal determination by a qualified 
expert that the risk is very small that an individual could be 
identified; or (2) the removal of all 18 specified identifiers of the 
individual and of the individual's relatives, household members, and 
employers, as long as the covered entity has no actual knowledge that 
the remaining information could be used to identify the individual (45 
CFR 164.514(b)).
    Otherwise, the HIPAA Privacy Rule addresses some informational 
risks by imposing restrictions on how individually identifiable health 
information collected by health plans, health care clearinghouses, and 
most health care providers (``covered entities'') may be used and 
disclosed, including for research. In addition, the HIPAA Security Rule 
(45 CFR parts 160 and subparts A and C of part 164) requires that these 
entities implement certain administrative, physical, and technical 
safeguards to protect this information, when in electronic form, from 
unauthorized use or disclosure. However, the HIPAA Rules apply only to 
covered entities (and in certain situations to their business 
associates). Not all investigators are part of a covered entity and 
thus some investigators are not required to comply with those rules. 
Moreover, the HIPAA Rules do not apply specifically to biospecimens in 
and of themselves.
    One commenter proposed that the exclusion be expanded so that 
investigators from noncovered entities (as defined in the HIPAA Rules) 
would be eligible for the exclusion as well. Another commenter 
suggested that the HIPAA exclusion should be expanded to cover business 
associates and researchers that comply with HIPAA.
    The NPRM asked whether the protections provided by the HIPAA Rules 
for identifiable health information used for health care operations, 
public health activities, and research activities are sufficient to 
protect human subjects involved in such activities, and whether the 
current process of seeking IRB approval meaningfully adds to the 
protection of human subjects involved in such research studies. 
Approximately half of the comments that addressed this question 
suggested that HIPAA protections are sufficient and that no additional 
safeguards were needed. Others expressed concern, and suggested that in 
some, if not all, of the categories in the HIPAA exclusion, HIPAA 
protections would not be sufficient.
    One commenter suggested that this exclusion might be appropriate 
for health care operations or public health activities, but that the 
HIPAA rules were not sufficiently protective for research activities. 
Specifically, one commenter expressed concern that excluding from the 
Common Rule the use of PHI for research activities in HIPAA-covered 
entities would weaken protections for patients, because HIPAA's privacy 
safeguards were never intended to

[[Page 7193]]

replace human subject protections and associated ethical and scientific 
review.
    One commenter also noted that other HHS preambles to rules have 
discussed the differences between the Common Rule and HIPAA, and these 
preambles noted that HIPAA was not intended to replace the Common Rule. 
This commenter suggested that given the language included in previous 
HHS preambles, additional justification for this exclusion would be 
needed before being included in a final rule.
    One commenter felt that the HIPAA rules and HITECH adequately 
address the Belmont Report principles with respect to these exclusions 
from the Common Rule, but felt the exclusion should not be limited to 
covered entities. The commenter suggested that the exclusion be 
extended to noncovered entities that receive PHI and are required to 
apply HIPAA safeguards in addition to institutions with equivalent 
protections. Others suggested that the HIPAA and HITECH standards are 
too protective for much research.
    Other commenters felt that this set of exclusions violates the 
protective mandate because HIPAA's provisions are narrow and do not 
reflect research ethics concerns. They noted that HITECH addresses 
technical data security for covered PHI for health care use but not for 
research use, especially if the data are sent elsewhere. Commenters 
felt that data used for research should be subject to HITECH data 
security standards and should not be excluded from Common Rule 
coverage.
    Few commented on whether additional collections (i.e., collections 
beyond what would ordinarily be collected through routine medical care) 
should be covered by this exclusion, and those that did suggested that 
they should be subject to the Common Rule unless those additional 
collections are covered by another exemption and exclusion.
    The NPRM asked whether additional or fewer activities regulated 
under the HIPAA Privacy Rule should be included in this exclusion. One 
commenter expressed concern that the HIPAA Privacy Rule was not 
appropriate because it both underregulates and overregulates research. 
Another commenter felt that the exclusion creates confusion because HHS 
has, in other contexts, discussed the differences between the Common 
Rule and HIPAA and the differing needs in separate contexts.
(3) Public Comments on Research Conducted by a Government Agency Using 
Government-Generated or Government-Collected Data Obtained for 
Nonresearch Activities
    Approximately 20 comments discussed this proposed exclusion. Public 
comment was mixed, with several commenters suggesting that they did not 
understand the full scope of the information generated or collected by 
the government that would fall under this exclusion. A minority of 
comments indicated that this category of activities should be exempt 
rather than excluded.
    The NPRM also asked whether this or a separate exclusion should 
also include research involving information collected for nonresearch 
purposes by nonfederal entities where comparable privacy safeguards 
have been established by state law or regulation. Few responded to this 
question. Of these, several indicated that this exclusion should not be 
expanded to cover nonresearch data, and should not be expanded to cover 
activities conducted by nongovernmental investigators using government-
generated or -collected data. Several comments indicated that this 
category was acceptable as an exclusion, with a few commenters 
suggesting that the category could be further broadened.
    One commenter suggested that this provision should apply to 
nonfederal entities if state laws are as protective as the federal laws 
cited. This commenter indicated that for these types of activities, the 
Common Rule protections did not provide meaningful additional 
protections to subjects. In contrast, several other commenters 
expressed concern that the privacy safeguards identified in this 
exclusion were not as protective of subjects as the Common Rule. One 
commenter indicated that clarifying what constitutes appropriate 
nonfederal use of this exclusion would be needed.
    One commenter suggested that this exclusion might be reasonable as 
an exclusion if there were a public posting requirement for activities 
conducted under this exclusion. If this were the case, this commenter 
indicated that investigator self-determination of whether an activity 
fit under this exclusion would be reasonable.
    In response generally to the question of whether any of the 
exclusions should apply to activities involving prisoners, a small 
number of comments addressed this question in the context of this 
exclusion. Of these responses, comments were mixed.
ii. Response to Public Comments and Explanation of the Final Rule: 
Exemption for Secondary Research for Which Consent Is Not Required
    This exemption at Sec.  __.104(d)(4) is for secondary research uses 
of identifiable private information or identifiable biospecimens when 
consent is not required, if at least one of the following criteria is 
met:
     The identifiable private information or identifiable 
biospecimens are publicly available;
     Information, which may include information about the 
biospecimens, is recorded by the investigator in such a manner that the 
identity of human subjects cannot readily be ascertained directly or 
through identifiers linked to the subjects, the investigator does not 
contact the subjects, and the investigator will not re-identify 
subjects;
     The research involves only information collection and 
analysis involving the investigator's use of identifiable health 
information when that use is regulated under 45 CFR parts 160 and 164, 
subparts A and E, for the purposes of ``health care operations'' or 
``research'' as those terms are defined at 45 CFR 164.501 or for 
``public health activities and purposes'' as described under 45 CFR 
164.512(b); or
     The research is conducted by, or on behalf of, a federal 
department or agency using government-generated or government-collected 
information obtained for nonresearch activities, if the research 
generates identifiable private information that is or will be 
maintained on information technology that is subject to and in 
compliance with section 208(b) of the E-Government Act of 2002, 44 
U.S.C. 3501 note, if all of the identifiable private information 
collected, used, or generated as part of the activity will be 
maintained in systems of records subject to the Privacy Act of 1974, 5 
U.S.C. 552a, and, if applicable, the information used in the research 
was collected subject to the Paperwork Reduction Act of 1995, 44 U.S.C. 
3501 et seq.

    The criteria for this exemption were proposed in the NPRM as three 
exclusions. The final rule modifies the NPRM proposal to allow this 
exemption to apply to secondary research involving identifiable 
biospecimens, provided that the exemption's conditions are met. Note 
that because the NPRM proposal to alter the definition of a human 
subject to extend to research involving nonidentified biospecimens was 
not adopted, an exemption for research with such biospecimens is not 
needed. Accordingly, this exemption is only

[[Page 7194]]

relevant to secondary research use of identifiable biospecimens.
    The goal of the exemption at Sec.  __.104(d)(4) is to facilitate 
secondary research using identifiable private information or 
identifiable biospecimens that have been or will be collected or 
generated for nonresearch purposes or from research studies other than 
the proposed research study. Unlike two other new exemptions that also 
relate to secondary research (the ones at Sec.  __.104(d)(7) and Sec.  
__.104(d)(8), discussed below), this exemption does not depend on any 
consent requirements imposed by the Common Rule being met.
    The first two provisions of this exemption (Sec.  __.104(d)(4)(i) 
and (ii)) are a modified version of the fourth exemption under the pre-
2018 rule. The modified provisions allow the exemption to include 
research with information and biospecimens that do not yet exist when 
the research study is proposed for exemption (i.e., that could be 
collected, for purposes not related to the proposed research study, in 
the future).
    The third and fourth provisions of the exemption have no precursors 
in the pre-2018 rule. The third provision applies the exemption to 
secondary research using identifiable private information covered under 
HIPAA, and the fourth provision applies the exemption to secondary 
research using identifiable private information collected for 
nonresearch purposes by the Federal Government, if compliant with the 
three cited federal statutes. These new rules will allow investigators 
to see identifiable private information, and also allow them to retain 
and record that information (including the identifiers) as part of 
their research records.
    We also note that, according to new language at Sec.  __.104(b)(2) 
adopted as part of this final rule, this exemption permits the 
secondary research use of identifiable private information or 
identifiable biospecimens obtained from subjects who are prisoners, if 
the research is not designed in a way that seeks to recruit prisoners 
as a population but rather only incidentally (i.e., not intentionally) 
includes prisoners.
(1) Response to Public Comments and Explanation of the Final Rule: 
Research Involving the Collection or Study of Identifiable Private 
Information or Identifiable Biospecimens That Are Publicly Available
    The exemption criterion at Sec.  __.104(d)(4)(i) is for secondary 
research if the identifiable private information or identifiable 
biospecimens are publicly available. This would apply to secondary 
research use of archives in a public library, for example, or to 
government or other institutional records where public access is 
provided on request, or from a commercial entity if the information is 
provided to members of the public on request or if the only requirement 
for obtaining the information is paying a user fee, registering or 
signing in as a visitor to an archive. It would also apply if a 
commercial entity made identifiable biospecimens publicly available to 
anyone on request or for a fee. This exemption effectively acknowledges 
that for secondary research with publicly available information or 
biospecimens, IRB review would not reduce the risk.
(2) Response to Public Comments and Explanation of the Final Rule: 
Research Involving the Collection or Study of Information (Which May 
Include Information About Biospecimens) That Has Been or Will Be 
Collected and Is Recorded Without Identifiers
    The provision at Sec.  __.104(d)(4)(ii) exempts research involving 
identifiable private information, which may include information about 
biospecimens, if information is recorded by the investigator in such a 
manner that the identity of human subjects cannot readily be 
ascertained directly or through identifiers linked to the subjects, the 
investigator does not contact the subjects, and the investigator will 
not re-identify subjects. As with the provision at Sec.  
__.104(d)(4)(i), this provision is related to an exemption that existed 
in the pre-2018 rule. In this instance, that prior exemption is being 
extended to now also cover research with information for which 
identifiers have been removed when the original collection of 
information or biospecimens occurs in the future.
(3) Response to Public Comments and Explanation of the Final Rule: The 
HIPAA Exclusion
    The provision at Sec.  __.104(d)(4)(iii) permits the secondary 
research use of identifiable private information or identifiable 
biospecimens when the research involves only information collection and 
analysis involving the investigator's use of identifiable health 
information when that use is regulated under 45 CFR parts 160 and 164 
(the HIPAA Privacy Rule), subparts A and E, for the purposes of 
``health care operations'' or ``research'' as those terms are defined 
at 45 CFR 164.501, or for ``public health activities'' as described 
under 45 CFR 164.512(b).
    With regard to the criterion at Sec.  __.104(d)(4)(iii), HIPAA also 
provides protections in the research context for the information that 
would be subject to this exemption (e.g., clinical records), such that 
additional Common Rule requirements for consent should be unnecessary 
in those contexts. Under HIPAA, these protections include, where 
appropriate, requirements to obtain the individual's authorization for 
future, secondary research uses of protected health information, or 
waiver of that authorization by an IRB or HIPAA Privacy Board. This 
provision introduces a clearer distinction between when the Common Rule 
and the HIPAA Privacy Rule apply to research in order to avoid 
duplication of regulatory burden. We believe that the HIPAA protections 
are adequate for this type of research, and that it is unduly 
burdensome and confusing to require applying the protections of both 
HIPAA and an additional set of protections.
    This provision was not part of the pre-2018 rule, and was proposed 
as an exclusion in the NPRM. It is included as a component of an 
exemption in the final rule, consistent with public comments supporting 
the proposal.
(4) Response to Public Comments and Explanation of the Final Rule: 
Research Conducted by a Government Agency Using Government Generated or 
Government Collected Data Obtained for Nonresearch Activities
    The provision at Sec.  __.104(d)(4)(iv) did not exist in the pre-
2018 rule and was proposed as an exclusion in the NPRM. It appears as a 
component of an exemption in the final rule. The exemption permits the 
use of identifiable private information or identifiable biospecimens 
for secondary research conducted by, or on behalf of, a federal 
department or agency using government-generated or government-collected 
information obtained for nonresearch activities, if the information 
originally involved a collection that adheres to the federal standards 
for safeguarding privacy as described in this part of the exemption.
    We believe that the privacy protections are adequate for this type 
of research, and that it is unduly burdensome and confusing to require 
these protections and an additional set of protections. This provision 
has been modified to apply the federal statutory privacy safeguards 
identified in the exemption provision to both the original collection 
of the information, and to the secondary research use of the 
information to which the exemption applies.

[[Page 7195]]

e. Research and Demonstration Projects Conducted or Supported by a 
Federal Department or Agency (Sec.  __.104(d)(5))
i. Public Comments
    Approximately 35 comments discussed the changes proposed in the 
public benefit or service program exemption. Few of the comments 
discussed the proposed expansion in OHRP's interpretation of this 
exemption to include the applicability of the exemption to cover 
research on public benefit and service programs that an agency does not 
itself administer through its own employees or agents, with a majority 
supporting the NPRM proposed expansion. One research university 
indicated that OHRP should not expand its interpretation of this 
exemption, and that it should be limited to ``federally funded studies 
evaluating federal programs.'' This institution did not offer 
justification for its comment.
    Few comments were received about the proposed requirement for 
exemption designation of research or demonstration projects to be 
posted to a publicly available federal Web site. The comments 
discussing this proposed requirement supported it.
    The majority of comments indicated that no additional requirements 
or limitations should be imposed on this exemption. These institutions 
argued that because this exemption represented a mechanism through 
which the Federal Government evaluated its own programs, additional 
limitations and restrictions in the Common Rule did not seem 
appropriate.
    Specifically, with respect to whether or not some sort of notice 
should be required here, several commenters noted that any notice would 
need to be meaningful. One commenter indicated that because meaningful 
notice would be difficult, a notice requirement should not be imposed. 
One comment suggested that notice should only be required if opt-out 
would be permitted, and if not, no notice requirement should be 
imposed. Groups representing AI/AN populations supported the notice 
requirement and indicated that it should be required at a minimum.
ii. Response to Comments and Explanation of the Final Rule: Exemption 
for Certain Research and Demonstration Projects Conducted or Supported 
by a Federal Department or Agency
    The final rule includes this exemption as a modified version of an 
exemption proposed in the NPRM. The exemption at Sec.  __.104(d)(5) in 
the final rule applies to research and demonstration projects involving 
public benefit or service programs, and is a slightly revised version 
of the exemption in the pre-2018 rule. This revision is designed to 
clarify the scope of the exemption so that more research studies would 
be eligible, and to make the exemption easier to apply. It is also 
designed to allow the Federal Government to carry out important 
evaluations of its public benefit and service programs to ensure that 
those programs are cost effective and provide the intended benefits or 
services, consistent with the principle of beneficence. The wording of 
the exemption has added ``improve'' to the purposes of these 
activities, to make more explicit the idea that the Federal Government 
conducts these activities in order to enable them to make the public 
benefit and service programs better, and not just to gauge their 
current quality.
    This exemption is for research and demonstration projects that are 
conducted or supported by a federal department or agency, or otherwise 
subject to the approval of department or agency heads. It applies to 
activities that are designed to study, evaluate, improve, or otherwise 
examine public benefit or service programs, including, but not limited 
to: Procedures for obtaining benefits or services under those programs; 
possible changes in or alternatives to those programs or procedures; or 
possible changes in methods or levels of payment for benefits or 
services under those programs.
    In addition, the final rule clarifies the language of the exemption 
to conform to OHRP's previous interpretation of public benefit and 
service programs that are being evaluated as part of the research. This 
interpretation includes public benefit or service programs that a 
Common Rule department or agency does not itself administer or conduct 
through its own employees or agents, but rather supports through a 
grant or contract program. Therefore, the exemption applies to research 
and demonstration projects supported through, for example, federal 
grants or cooperative agreements. These changes would bring the 
regulatory language into conformance with other provisions of the rule 
that refer to research ``conducted or supported'' by federal 
departments and agencies. These methods of administration are, of 
course, always subject to department or agency head approval, either 
directly or by delegation. In addition, some of these research and 
demonstration projects are conducted through waivers, interagency 
agreements, or other methods that also require agency head approval. 
Accordingly, both the previous and revised language allow for the full 
panoply of methods by which research and demonstration projects on 
public benefit or service programs can be carried out.
    The wording of the exemption also is clarified to specifically 
include projects involving waivers of otherwise mandatory requirements 
using authorities such as sections 1115 and 1115A of the Social 
Security Act, in order to make it plain that such research projects on 
public benefit or service programs qualify for the exemption. The 
relevant sections of the Social Security Act were also cited when this 
exemption was published in 1983.
    In the interest of transparency, as was proposed in the NPRM, the 
final rule requires that each federal department or agency conducting 
or supporting the research and demonstration projects must establish, 
on a publicly accessible federal Web site or in such other manner as 
the department or agency head may determine, a list of the research and 
demonstration projects the federal department or agency conducts or 
supports under this provision. The research or demonstration project 
must be published on this list before beginning the research involving 
human subjects. The department or agency head can determine what sort 
of information will be included on this list and maintains its 
oversight. Departments and agencies that already publish research and 
demonstration projects on a publicly accessible Web site could satisfy 
this proposed requirement if the existing Web site includes a statement 
indicating which of the studies were determined to meet this exemption.
    The goal of this proposed requirement is to promote transparency of 
federally conducted or supported activities affecting the public that 
are not subject to oversight under the Common Rule. It should not cause 
any delay to the research. HHS will develop a resource that all Common 
Rule departments and agencies may use to satisfy the requirement at 
Sec.  __.104(d)(5)(i). Alternatively, an agency can create or modify 
its own Web site for this purpose.
    The exemption is not modified to require notice, to apply only to 
minimal risk research activities, or to require the privacy safeguards, 
for reasons reflected in the public comments. We agree with the public 
comments that argued that in many cases notice would be difficult or 
impossible to achieve effectively, and that this exemption enables the 
Federal Government to conduct important evaluations of its own programs 
that provide significant benefits to the public. In addition, federal 
departments

[[Page 7196]]

and agencies are already subject to other laws and policies that 
protect the interests of research subjects (e.g., the Privacy Act).
f. Taste and Food Quality Evaluation and Consumer Acceptance Studies 
(Sec.  __.104(d)(6))
i. Public Comments
    Approximately 20 comments discussed this exemption for taste and 
food quality evaluation and consumer acceptance studies. The NPRM did 
not propose changes to this exemption from what appeared in the pre-
2018 rule. However, it did ask whether this exemption should be 
narrowed to apply only to activities for which prospective subjects 
have been given prior notice, and if so, how that notice should be 
issued. The NPRM further asked whether subjects should be allowed to 
opt out of exempt research.
    A majority of comments received indicated that the final rule 
should maintain this exemption without any additional requirements. 
Commenters generally did not include explanation of this position. A 
small minority of commenters indicated that subjects should explicitly 
be provided the opportunity to opt out of this type of activity. In 
addition, a small minority of commenters indicated that subjects should 
be given notice before participation. One comment suggested that this 
exemption include ``odor'' evaluations as well.
ii. Response to Comments and Explanation of the Final Rule: Exemption 
for Taste and Food Quality Evaluation and Consumer Acceptance Studies
    The final rule retains the exemption from the pre-2018 rule, which 
was proposed in the NPRM without any change, for taste and food quality 
evaluation and consumer acceptance studies. This exemption applies if 
wholesome foods without additives are consumed, or if a food is 
consumed that contains a food ingredient at or below the level and for 
a use found to be safe, or agricultural, chemical or environmental 
contaminant at or below the level found to be safe by FDA or approved 
by the Environmental Protection Agency or the Food Safety and 
Inspection Service of the U.S. Department of Agriculture. This 
exemption is retained unchanged from the pre-2018 rule.
g. Secondary Research Use of Identifiable Private Information or 
Identifiable Biospecimens (or Storage or Maintenance for Such Secondary 
Research Use) for Which Broad Consent Is Required (Sec.  __.104(d)(7) 
and (8))
    The final rule includes two exemptions related to the secondary 
research use (including storage or maintenance for such use) of 
identifiable private information and identifiable biospecimens that 
require a subject's broad consent.
    The first of these exemptions is in the final rule at Sec.  
__.104(d)(7), and applies to storing and maintaining identifiable 
private information or identifiable biospecimens for secondary research 
use.
    The second of these exemptions is in the final rule at Sec.  
__.104(d)(8) and applies to the secondary research use of identifiable 
private information and identifiable biospecimens for specific 
secondary research studies. Secondary research under this exemption 
would generally be conducted with the information or biospecimens 
stored and maintained under the exemption at Sec.  __.104(d)(7).
    Both of these exemptions for the secondary use of identifiable 
private information and identifiable biospecimens require broad consent 
and are discussed in detail below. As with the secondary use exemptions 
that do not require the subject's broad consent (discussed above in 
Section V.3.d. of the preamble), the two exemptions at Sec.  
__.104(d)(7) and (8) are also limited to ``secondary research.'' These 
exemptions pertain only to research that involves re-using information 
or biospecimens that were or will be collected for some other 
``primary'' or ``initial'' activity distinct from using them in 
secondary research. These exemptions do not cover any primary 
collections of either information or biospecimens. In other words, if 
an investigator wants to collect information directly from research 
subjects, for example, by asking them to complete a questionnaire, that 
would not be covered by these exemptions. Or if an investigator wants 
to collect biospecimens by having subjects swab their cheeks, that 
collection would similarly not be covered by these exemptions. On the 
other hand, an investigator who wants to use information that is in 
some databank, or to use biospecimens that are in a pathology 
laboratory, could use these exemptions, assuming all of the relevant 
conditions of the exemptions were met.
i. Public Comments on the Proposed Exemptions for Secondary Research 
Use of Identifiable Private Information or Identifiable Biospecimens 
(or Storage or Maintenance for Such Secondary Research Use) for Which 
Broad Consent Is Required
    In combination, approximately 150 comments discussed these 
proposals. Although commenters generally supported creating a pathway 
for low-risk research with biospecimens to occur without IRB review, a 
majority opposed the overarching proposal that these exemptions would, 
for the most part, be the only way (besides study-specific consent) for 
research with biospecimens to occur. Many of the arguments for and 
against these exemptions were outlined in section III.D, summarizing 
public comments received on the proposal to define ``human subject'' as 
including all biospecimens used in research, regardless of 
identifiability.
    Many commenters opposed the idea that the exemption should allow 
specific secondary studies involving biospecimens retained with 
identifiers to occur without IRB review. These commenters noted that 
IRBs are required to assess more than privacy and confidentiality 
protections, and whether informed consent was sought and obtained. 
Other commenters noted that by effectively encouraging the retention of 
identifiers with biospecimens (which would likely be required to track 
which specimens could be used in research at an institution), the NPRM 
proposals effectively introduced new privacy and confidentiality risks 
to subjects that did not exist under the pre-2018 rule.
    Some commenters who supported the expanded definition of human 
subject to include all biospecimens did not support these exemptions. 
These comments were mostly from members of the public and they 
generally argued that study-specific consent should be sought and 
obtained from subjects for every study involving that person's 
biospecimens. These comments expressed concern that, with broad 
consent, investigators could still engage in research activities 
without the individuals' knowledge.
    Several commenters expressed opposition to the NPRM proposal that 
the exemption could not be used if the investigator intended to return 
research results to subjects. These commenters saw this as a 
disincentive to return research results and also noted that it seemed 
at odds with existing law (e.g., HIPAA) and policy. Specifically, they 
argued, because patients are entitled

[[Page 7197]]

under HIPAA to the contents of their medical records, investigators 
must always be ready to return research results to subjects enrolled in 
their studies.
    The NPRM inquired about whether the proposed exemption was the best 
option, or whether there is a better way to balance respect for persons 
with facilitating research. Responses to this question were mixed, with 
a majority indicating that the proposed exemptions were not the best 
option. One comment indicated that broad consent would be reasonable if 
the consent was meaningful.
    Other commenters opposed the proposal as written. One felt it 
provided too little information and another found the language too 
complex and subject to misinterpretation. One institution asserted that 
the exemption would pose a burden on the research enterprise, would 
make a significant subset of studies impracticable, and would increase 
costs.
    Still other commenters indicated that consent should not be 
required for secondary research with biospecimens, noting that it was 
contradictory to determine that a type of research was exempt but still 
require consent, or that this exemption should not apply to state-
mandated newborn DBS programs. One commenter suggested, ``A far better 
option would be to include an exemption for the secondary research use 
of de-identified or nonidentified biospecimens, without the caveat of 
requiring a broad consent.''
    The NPRM requested public comment on whether and how the provision 
regarding the return of research results should be revised. Public 
comment was mixed in response to this question. Several comments 
indicated that the provision was too complex to follow.
    Comments that supported the provision about the return of research 
results in the proposed exemption stressed the complexity of decisions 
around returning results and many indicated support for required IRB 
review of investigators' plans for returning research results. One 
professional organization also emphasized the need to communicate to 
potential participants during the informed consent process the policies 
concerning the return of individual research results. Many commenters 
also called for detailed OHRP guidance on this provision.
    One commenter suggested that the broad consent required when 
biospecimens are collected for storage for future research use include 
an indication as to whether potential subjects would like to be re-
contacted with individual research results if applicable.
    Other commenters were opposed to the provision as written. One 
large health system indicated that the provision discourages 
researchers from returning research results to participants and from 
providing participants with easy access to their individual research 
data. The commenter emphasized that ``Respecting research participants 
as partners obligates us to avoid the assumptions that researchers, an 
IRB, or even a panel of experts . . . know best.'' The commenter went 
on to say: ``While the NPRM suggests researchers cannot use the Common 
Rule as a shield from a request to deliver a designated record set upon 
request, the policy seems to discourage equitable research practices 
and allows informational disparities to continue. This does not serve 
the interest of justice.''
    In addition, one professional organization indicated concern that 
the provision might be interpreted by some to say that IRBs should not 
allow return of results, which it felt would create a bad situation.
    The NPRM sought comment on whether there should be an additional 
exemption that would permit the collection of biospecimens through 
minimally invasive procedures (e.g., cheek swab, saliva). A strong 
majority of commenters indicated no need for an additional exemption to 
permit the collection of biospecimens through minimally invasive 
procedures. One professional organization asserted that specimens 
should not be treated differently based on how they were collected. 
Other commenters indicated that obtaining specimens through minimally 
invasive procedures is similar to data collection and should be treated 
the same way.
ii. Explanation of the Final Rule: Exemptions for Secondary Research 
Use of Identifiable Private Information or Identifiable Biospecimens 
(or Storage or Maintenance for Such Secondary Research Use) for Which 
Broad Consent Is Required
(1) Exemption for the Storage or Maintenance for Secondary Use of 
Identifiable Private Information or Identifiable Biospecimens for Which 
Broad Consent is Required (Sec.  __.104(d)(7))
    Section __.104(d)(7) is an exemption for the storage or maintenance 
for secondary research use of identifiable private information or 
identifiable biospecimens. It requires that an IRB conduct limited IRB 
review to make the following determinations (required by Sec.  
__.111(a)(8)):
     Broad consent for storage, maintenance, and secondary 
research use of identifiable private information or identifiable 
biospecimens is obtained in accordance with the requirements of Sec.  
__.116(a)(1)-(4), and (a)(6), and (d);
     Broad consent is appropriately documented or waiver of 
documentation is appropriate, in accordance with Sec.  __.117; and
     If a change is made for research purposes in the way the 
identifiable private information or identifiable biospecimens are 
stored or maintained, adequate provisions must be in place to protect 
the privacy of subjects and to maintain the confidentiality of data.

    This exemption is similar to the exemption proposed in the NPRM at 
Sec.  __.104(f)(1), but it has been modified in some respects, and the 
operation of this exemption is also affected by other changes in the 
final rule that are different from the NPRM. Namely, the exemption has 
been modified to apply only to storage or maintenance for secondary 
research use of identifiable private information or identifiable 
biospecimens, because the final rule does not incorporate the NPRM 
proposal to alter the definition of a human subject to extend to 
research involving biospecimens regardless of their identifiability. 
This exemption was also modified given the decision not to adopt the 
privacy safeguards proposed in the NPRM at Sec.  __.105.
    In addition, the Secretary's template for broad consent is not 
being finalized for this exemption. Instead, institutions will have the 
flexibility to create their own consent forms that satisfy requirements 
at Sec.  __.116(a)(1)-(4), (a)(6) and (d) (see Section XIV). The 
consent form may be electronic.
    Given these changes from the NPRM proposal, the limited IRB review 
requirement for this exemption provided at Sec.  __.111(a)(8) has been 
expanded in the final rule to require that the IRB make the following 
determinations, some of which are similar to those proposed in the 
NPRM.
    The final rule requires that for the exemption to apply, the IRB 
must determine that broad consent for storage, maintenance, and 
secondary research use of identifiable private information or 
identifiable biospecimens is obtained in accordance with the 
requirements of Sec.  __.116(a)(1)-(4), (a)(6), and (d); This includes 
the requirement proposed in the NPRM that there be IRB review of the 
process through which broad consent will be obtained.

[[Page 7198]]

    Also, given that we are not finalizing the proposed requirement to 
use the Secretary's template for broad consent, the final rule includes 
in this requirement that an IRB determine that the broad consent 
includes the requirements and elements of consent in accordance with 
Sec.  __.116(a)(1)-4), (a)(6), and (d).
    The final rule also requires that the IRB determine that broad 
consent is appropriately documented or waived in accordance with Sec.  
__.117. Although written broad consent generally will be required for 
this exemption to apply, the final rule also permits the exemption to 
apply when broad consent is obtained and an IRB has waived the 
documentation requirement for written informed consent under Sec.  
__.117(c)(1).
    And because the proposed privacy safeguards proposed in the NPRM at 
Sec.  __.105 are not included in the final rule, if a change will be 
made for research purposes in the way the identifiable private 
information or identifiable biospecimens are stored or maintained, the 
IRB must determine that when appropriate, adequate provisions are in 
place to protect the privacy of subjects and to maintain the 
confidentiality of data. This is the same IRB determination related to 
privacy and confidentiality that is required for nonexempt research. 
Importantly, this IRB determination is required only when a change is 
made for research purposes in the way the identifiable private 
information or identifiable biospecimens are stored or maintained, and 
only pertains to the aspects of storage and maintenance that are 
changed for research purposes. In this circumstance, the investigators 
are assuming responsibility for the manner in which the information and 
biospecimens are stored and maintained, and the IRB should be required 
to ensure that appropriate protections for the subjects are place with 
regard to the aspects of storage or maintenance that were changed for 
research purposes.
    If, on the other hand, no changes are being made for research 
purposes to the storage or maintenance, then this IRB determination 
does not apply. The institution storing and maintaining the information 
or biospecimens of course still has its responsibility to determine 
what protections distinct from those required by the Common Rule are 
appropriate, which may include other legal or regulatory safeguards or 
institutional policies. In light of application of such additional 
safeguards, it appears unnecessary to require additional protections 
through a requirement of this final rule simply because the individuals 
providing broad consent have agreed that their biospecimens or 
information could be used for research at some point in the future. And 
of course this provision regarding changes made for research purposes 
applies only when a Common Rule department or agency supports or 
conducts the research activity.
    Note that in many instances the only change that results from a 
person having signed a broad consent form for research relating to 
storing and maintaining that person's biospecimens or information is 
that the institution that is already holding the biospecimens or 
information (for clinical purposes, for example) merely creates a 
record indicating that this person has signed such a consent form. The 
biospecimens and information could remain stored in whatever way (and 
for whatever period of time) that the institution had previously been 
storing them, based on the legitimate nonresearch or research-related 
reasons that the institution has used for initially collecting and 
storing those biospecimens and information. Any privacy and security 
protections (outside of the Common Rule) that already may apply to the 
institution's information record-keeping or biospecimen preservation 
activities would continue to apply. The Common Rule's protections would 
not apply before a change in storage or maintenance occurs for research 
purposes, but rather the institution would continue to operate in 
accordance with its pre-existing legitimate reasons for having and 
storing the biospecimens and information. The fact that the broad 
consent form has been signed does not by itself mean that there needs 
to be any alteration of what the institution is already doing with the 
biospecimens or information.
    Examples of changed aspects of storage or maintenance for research 
purposes that would require the IRB to find, before those changes go 
into effect, whether there are adequate provisions to protect the 
privacy of subjects and maintain the confidentiality of data include 
the following: If information or biospecimens are moved from one 
electronic or physical storage location to another due to 
considerations related to research plans; if information or 
biospecimens will be stored for longer than they otherwise would have 
been for the original purpose; if information or biospecimens are 
placed in a research registry or repository created to serve as a 
resource for investigators; or investigators are given electronic or 
physical access to the information or biospecimens. The relevant 
changes do not necessarily involve moving information or biospecimens 
from one location to another. Rather, the relevant changes include any 
change for research purposes that introduces or alters risks to the 
privacy or security of the stored information or biospecimens, 
including giving access to or transferring information or biospecimens 
for research purposes to someone who otherwise would not have access.
    The rationale for this exemption is that with the requirement for 
limited IRB review and the specified required IRB determinations, 
including subjects' broad consent, this exemption respects subjects' 
autonomy and provides appropriate privacy safeguards. More 
specifically, we believe that broad consent provides some measure of 
autonomy for individuals to decide whether to allow the research use of 
their identifiable private information or identifiable biospecimens, 
without imposing the kind of burden on investigators that would result 
from a requirement for specific informed consent for each secondary 
research study. We believe that it is appropriate to create a mechanism 
for broad consent for secondary research use, even if it involves the 
potential risk of having identifiers associated with the identifiable 
private information or identifiable biospecimens. We believe the 
administrative burden is also acceptable in order to allow for broad 
consent for secondary research use.
(2) Exemption for Research Involving the Use of Identifiable Private 
Information or Identifable Biospecimens for Which Broad Consent is 
Required (Sec.  __.104(d)(8))
    Section __.104(d)(8) is an exemption that also requires that broad 
consent has been obtained, and is for research involving the use of 
identifiable private information or identifiable biospecimens. This 
exemption will frequently be paired with the exemption at Sec.  
__.104(d)(7), which permits the storage and maintenance of identifiable 
private information and identifiable biospecimens for secondary 
research use. The exemption at Sec.  __.104(d)(8) would apply to a 
specific secondary research study, provided that the following criteria 
are met:
     Broad consent for the storage, maintenance, and secondary 
research use of the identifiable private information or identifiable 
biospecimens was obtained in accordance with Sec.  __.116(a)(1)-(4), 
(a)(6), and (d);
     Documentation of informed consent or waiver of 
documentation of consent

[[Page 7199]]

was obtained in accordance with Sec.  __.117;
     An IRB conducts a limited IRB review to make the 
determination required by Sec.  __.111(a)(7), and to make the 
determination that the research to be conducted is within the scope of 
the broad consent; and
     The investigator does not include returning individual 
research results to subjects as part of the study plan. However, it is 
permissible under this exemption to return individual research results 
when required by law regardless of whether or not such return is 
described in the study plan.
    This exemption could also apply if the investigator obtains 
appropriate broad consent from the subject in addition to the consent 
to an original specific study, and then proceeds to use the information 
or biospecimen in a secondary study.
    The exemption at Sec.  __.104(d)(8) is similar to the exemption 
proposed in the NPRM, but it has been modified in some respects. As 
with the exemption at Sec.  __.104(d)(7), the operation of the 
exemption at Sec.  __.104(d)(8) is also affected by other provisions in 
the final rule that are different from what was proposed in the NPRM. 
Namely, the exemption has been modified to apply only to storage or 
maintenance for secondary research use of identifiable private 
information or identifiable biospecimens because the final rule does 
not incorporate the NPRM proposal to alter the definition of a human 
subject to extend to research involving biospecimens regardless of 
their identifiability.
    Due to the decision not to adopt the proposed privacy and security 
safeguards proposed in the NPRM at Sec.  __.105, this exemption was 
also modified to require that limited IRB review include an IRB 
determination that, when appropriate, adequate provisions are in place 
to protect the privacy of subjects and the confidentiality of data 
(Sec.  __.111(a)(7)). This is the same IRB approval criteria related to 
privacy and confidentiality that is required for nonexempt human 
subjects research.
    In addition, because the final rule does not include a broad 
consent template when a specific study has been proposed, it is 
required that the study be reviewed by an IRB to determine whether the 
proposed secondary analysis fits within the parameters of the broad 
consent that was obtained for secondary research use.
    We believe that the final rule's requirement for limited IRB review 
of the privacy and confidentiality protections and the adequacy of the 
broad consent is responsive to commenters who believe that IRB 
oversight should be retained for the secondary research use of 
identifiable private information and identifiable biospecimens.
    We recognize commenters' point that this exemption does not provide 
an incentive to investigators to provide individual research results to 
subjects, but we believe that the challenges of how and when to return 
such results warrant consultation with the IRB. We note that with the 
other revisions to the NPRM proposals, other options for research 
involving identifiable private information and identifiable 
biospecimens exist, which would be consistent with having plans for 
returning individual results. Although broad consent may include a 
statement that clinically relevant research results might be returned 
to subjects, we believe that when specific secondary studies include 
such a plan to return research results, it would almost always be 
appropriate for the study to be reviewed by an IRB, in part to better 
ensure that research results are disclosed to subjects in an 
appropriate manner. The only exceptions would be if the research 
qualified for another exemption, an IRB waived informed consent under 
Sec.  __.116(e) or (f), or the research was carried out under a 
Secretarial waiver at Sec.  __.101(i). We expect that as part of the 
IRB's review, the IRB would consider what subjects were told in the 
broad consent regarding the return of research results.
    It should be noted that the two exemptions in the final rule at 
Sec.  __.104(d)(7) and (8) create additional options for investigators 
to conduct secondary research studies with identifiable private 
information. The final rule retains, largely unchanged, the options 
previously available to investigators in the pre-2018 rule. For 
instance, the final rule retains the pre-2018 criteria for requesting a 
waiver of consent in order to carry out those studies without obtaining 
consent. Moreover, secondary research using nonidentified biospecimens 
would not have to meet these requirements, because the final rule does 
not finalize the NPRM proposal to alter the definition of a human 
subject to include research involving nonidentified biospecimens under 
the rule.
h. NPRM Proposal To Delete the Pre-2018 Rule's Exemption for Surveys 
and Interviews of Public Officials
    The NPRM proposed to delete language found in the pre-2018 rule 
that exempted surveys and interviews with public officials. 
Approximately 100 comments discussed this proposed deletion and it was 
almost universally opposed. Political science professors, students, 
researchers, and academics from other disciplines generally addressed 
this deletion.
    Comments argued that this deletion would have a chilling effect on 
political science research and might make political science researchers 
more vulnerable to law suits. Other comments noted that public 
officials are generally treated differently in numerous laws, and it is 
in fact appropriate for the Common Rule to have a different standard 
for surveys and interviews with public officials. Comments also 
suggested that this deletion could negatively affect the public's 
ability to hold public officials accountable for their actions. One 
commenter suggested that instead of deleting this exemption, a final 
rule might consider explicitly limiting this exemption to studies that 
relate to the public officials in their official capacity.
    The final rule removes the exemption category in the pre-2018 rule 
at Sec.  __.101(b)(3)(i), which pertained to research involving the use 
of educational tests, survey procedures, interview procedures, or 
observation of public behavior, if the human subjects are elected or 
appointed public officials or candidates for public office, or if 
federal statute requires without exception that the confidentiality of 
the personally identifiable information will be maintained throughout 
the research and thereafter. We note that many of the public comment 
concerns are addressed by other provisions in the final rule. Almost 
all of the research activities in this category would already be 
exempted under the final rule at Sec.  __.104(d)(2), without needing to 
single out elected or appointed officials as being treated differently 
in this way. If the research is designed to provide sensitive 
generalizable knowledge about officials, then the identifiable private 
information obtained should be kept confidential as required by this 
final rule. If the purpose of the activity is in fact designed to hold 
specific elected or appointed officials up for public scrutiny, and not 
keep the information confidential, such an activity is not considered 
research under the provision at Sec.  __.102(l)(2).
    Thus, the final rule adopts the NPRM proposal.
i. NPRM Proposal To Exempt Secondary Research Use of Identifiable 
Private Information Where Notice Was Given
    One exemption proposed in the NPRM is not included in the final 
rule. Note that exclusions proposed in the

[[Page 7200]]

NPRM and not included in the final rule also are described in Section 
III.I.4 of this preamble.
    The NPRM proposed to exempt certain secondary research activities 
involving identifiable private information where notice of such use had 
been given. The proposed exemption was included, in part, to be 
responsive to section 511 of the Medicare Access and CHIP 
Reauthorization Act of 2015 (MACRA), which requires the Secretary to 
issue a clarification or modification with respect to the application 
of these regulations to certain activities involving clinical data 
registries. The preamble for the Common Rule NPRM noted ``. . . this 
exemption category might allow certain research activities of these 
clinical data registries not otherwise covered by the proposed HIPAA-
related exclusion (i.e., when the clinical data registries are not part 
of a HIPAA covered entity or acting as a business associate), such as 
when a clinical data registry may receive information from a health 
care entity for research purposes.''
    Approximately 70 comments discussed this proposal, with the vast 
majority from institutions. A minority of commenters (14) supported the 
NPRM proposal as drafted. In addition, 11 commenters who did not 
indicate whether they supported the inclusion of this proposal in a 
final rule asked questions about implementation and the meaning of 
``notice'' under this proposal.
    A majority of commenters (41) opposed the proposal as drafted in 
the NPRM, citing a variety of conflicting reasons:
     Sixteen commenters felt that the NPRM proposal was too 
permissive as drafted, and that it would not provide adequate 
protections to prospective subjects. Many of these commenters also 
suggested that the proposal as drafted did not respect subject autonomy 
interests sufficiently in not providing subjects with an ability to opt 
out. They indicated that the exemption might be acceptable if 
additional requirements (such as subject opt out), or additional 
limitations (such as limiting the nonresearch information to which this 
exemption applies to data governed by certain privacy-oriented laws) 
were implemented.
     Fourteen commenters felt that the NPRM proposal was too 
restrictive, and that as drafted it would not achieve the stated goal 
of reducing administrative burden on IRBs. These commenters 
specifically discussed the implementation burdens involved in providing 
notice to prospective subjects. These commenters also noted that 
providing an option to opt out would be very burdensome to IRBs and 
investigators, an outcome that seemed counter to the justifications the 
NPRM provided for this exemption.
     Five commenters felt that the type of research encompassed 
by this proposal should not be exempted from the Common Rule, and that 
IRB review or informed consent should be required instead.
    Approximately 25 comments discussed whether the NPRM proposal was 
necessary to enable activities involving qualified clinical data 
registries. A majority of these comments indicated that because the 
activities would be subject to the HIPAA regulations, protection of 
subjects would not be enhanced by the proposed NPRM exemption. Several 
commenters pointed out that qualified clinical data registries also 
might qualify for exclusion under the NPRM proposal at 101(b)(2)(ii). 
Additional comments suggested that other NPRM exemptions and exclusions 
would cover activities with qualified clinical data registries without 
commenting on which exemptions and exclusions applied.
    The NPRM included the exemption at Sec.  __.104(e)(2), in part, to 
be responsive to section 511 of MACRA, but commenters expressed little 
support for this exemption, even for activities carried out by clinical 
data registries. Section 511 of MACRA has directed the Secretary of HHS 
to issue a clarification or modification with respect to the 
application of the Common Rule to activities involving clinical data 
registries, including quality improvement activities. With this final 
rule, the Secretary of HHS is providing that clarification here. 
Because clinical data registries are created for a variety of purposes, 
and are designed and used in different ways, there is no simple, single 
answer regarding how the Common Rule applies to clinical data 
registries. The Secretary of HHS has received advice from SACHRP on 
this topic, and SACHRP recommended that the pre-2018 rule was adequate 
to apply to clinical data registries without those registries being 
given any distinctive status. The Secretary of HHS believes that the 
same is true for the final rule, and so has not created a specific 
provision for clinical data registries.
    The final rule does not impose any requirements on a large portion 
of the activities related to clinical data registries. The following 
points are important: First, the rule does not apply to clinical data 
registry activities not conducted or supported by a Common Rule 
department or agency. Second, many clinical data registry activities, 
including many quality improvement activities, do not meet the 
definition of research, and so the Common Rule does not apply. For 
example, the creation of a clinical data registry designed to provide 
information about the performance quality of institutional care 
providers, and whose design is not influenced or altered to facilitate 
research, is not covered by this rule even if it is known that the 
registry will be used for research studies. Third, the Common Rule does 
not apply to a clinical data registry research study that only involves 
obtaining and analyzing nonidentified information because that activity 
would not involve a ``human subject'' as defined by the rule. Fourth, 
some clinical data registry research activities may qualify for 
exemption under the proposed provision at Sec.  __.104(d). Fifth, if an 
institution solely releases identifiable private information that was 
obtained in the course of patient clinical care to a clinical data 
registry for research, that institution is considered to be not engaged 
in human subjects research, and no requirements of the rule apply to 
that institution.
    In contrast, if investigators receive funding from a Common Rule 
department or agency to design a clinical data registry for research 
purposes and the registry includes identifiable private information, or 
involves interacting with individuals (e.g., a research survey), then 
such an activity involves human subjects research, but may be exempt if 
it meets one or more of the exemption categories under Sec.  
__.104(d)(7). Similarly, if investigators use federal support to obtain 
identifiable private information from a clinical data registry to 
conduct a research study, then such secondary research use of clinical 
registry information would involve human subjects research and the 
requirements of the rule would apply, although the research may qualify 
for exemption under Sec.  __.104(d)(8). This is comparable to how the 
rule applies to a research study that involves chart review of 
identifiable private information drawn directly from hospital medical 
records.

VI. Protection of Identifiable Private Information and Identifiable 
Biospecimens

A. Background and Pre-2018 Requirements

    Increasing research use of genetic information, information 
obtained from analysis of biospecimens, and the ability to more easily 
merge multiple sources of

[[Page 7201]]

administrative and survey datasets (e.g., medical records, claims data, 
vital records, and information about lifestyle behaviors from surveys) 
are some examples of how advances in research have increased the risks 
of data breaches that reveal identifiable private information. For 
example, the unauthorized release or use of information about subjects 
such as the disclosure of Social Security or Medicare numbers may pose 
financial risks, and disclosure of illegal behavior, substance abuse, 
or chronic illness might jeopardize subjects' current or future 
employment, or cause emotional or social harm.
    Based on questions from and conversations with members of the 
regulated community, we are aware that IRBs are not always equipped 
with the expertise needed to evaluate risks to privacy and 
confidentiality, specifically regarding sophisticated IT security. 
However, we note that no data suggest that IRBs are currently approving 
research without requiring appropriate privacy and confidentiality 
safeguards. Despite this, we recognized that setting standards could 
assure appropriate privacy and confidentiality consideration and 
consequent protections to all research subjects, without the 
administrative burden of needing a specific committee review of the 
privacy and confidentiality protections of each study. To that end, the 
2011 ANPRM suggested establishing mandatory data security and 
information protection standards for all studies that involve the 
collection, generation, storage, or use of identifiable or potentially 
identifiable information that might exist electronically or in paper 
form or be contained in a biospecimen. It put forward the idea that 
these standards might adopt the categories used in the HIPAA Rules and 
asked a series of questions about how best to protect private 
information.

B. NPRM Proposal

    A goal of the NPRM was to ensure that researchers protect the 
privacy of their participants and the security of the data, calibrated 
to the likelihood of identifiability and sensitivity of the information 
being collected. The NPRM proposed to require that investigators and 
institutions conducting research subject to the Common Rule implement 
reasonable safeguards for protecting against risks to the security or 
integrity of biospecimens or identifiable private information. Given 
the significant concerns of public commenters about an idea discussed 
in the 2011 ANPRM of adopting the standards solely modeled on certain 
standards of the HIPAA Rules, the NPRM proposed several sets of 
standards, and allowed a choice about which set to use.
    First, the NPRM proposed that the Secretary of HHS could publish a 
list of specific measures that an institution or investigator could use 
to meet the security requirements. The list would be evaluated and 
amended, as appropriate, after consultation with other Common Rule 
departments and agencies. The proposed list would be published in the 
Federal Register, and public comment on the proposed list would be 
sought before the list was finalized.
    The specific safeguards that would be identified by the Secretary 
would be designed so that they could be readily implemented by the 
individual investigator, and could build on existing safeguards already 
in place to protect research data. These standards would include 
security safeguards to assure that access to physical biospecimens or 
data is limited only to those who need access for research purposes. 
The standards would also assure that access to electronic information 
is authorized only for appropriate use. Finally, the safeguards, 
collectively referred to as ``privacy safeguards,'' would assure that 
information and biospecimens posing informational risks to subjects 
would be protected according to appropriate standards.
    Second, the NPRM proposed that if an institution or investigator is 
currently required to comply with the HIPAA rules, then the safeguards 
required by the Common Rule would be satisfied. No additional 
requirements were proposed to protect information subject to the HIPAA 
Rules. The NPRM also proposed to clarify that the proposed provisions 
would not amend or repeal the requirements of 45 CFR parts 160 and 164 
for the institutions or investigators to which these regulations apply 
pursuant to 45 CFR 160.102. Institutions or investigators that are not 
required to follow HIPAA could voluntarily implement the HIPAA Rules 
and be considered as satisfying the proposed requirements. The NPRM 
also proposed that for federal departments and agencies that conduct 
research activities that are or will be maintained on information 
technology that is subject to and in compliance with section 208(b) of 
the E-Government Act of 2002, 44 U.S.C. 3501 note, if all of the 
information collected, used, or generated as part of the activity will 
be maintained in systems of records subject to the Privacy Act of 1974, 
5 U.S.C. 552a, and the research will involve a collection of 
information subject to the Paperwork Reduction Act of 1995, 44 U.S.C. 
3501 et seq., the requirements would be satisfied.
    For purposes of informing the development of the proposed privacy 
safeguards, the NPRM sought comment on the types of safeguards that 
would be appropriate for the Secretary's list. The NPRM also noted that 
additional statutes or acts mandate the protection of privacy and 
confidentiality of identifiable private information. It might be 
reasonable to include these as additional standards that would meet the 
proposed requirement if they were met in research that is subject to 
those standards or for which an investigator or institution has 
voluntarily elected to comply. Public comment was sought on whether any 
of these existing statutes or acts would serve the goals of proposed 
privacy safeguards.
    The NPRM also included conditions for use and disclosure of 
research information to other entities. It required that protections be 
in place when a biospecimen or identifiable private information is 
shared for appropriate research or other purposes. Unless required by 
law, the NPRM proposed to limit the re-disclosure of identifiable 
private information or release of biospecimens obtained for research.
    The NPRM asked for feedback on whether limiting re-disclosure to 
four specific circumstances unless such a disclosure was ``required by 
law'' would be too restrictive, or whether more permissive standards 
would better facilitate the NPRM goal of fostering the secondary 
research use of information. The NPRM also whether the proposed 
limitations on re-disclosure were more or less restrictive than 
necessary and whether there should be additional purposes for which 
release of biospecimens or re-disclosure of identifiable private 
information would be permitted should be allowed.
    The NPRM justified this change by arguing that its benefit would be 
that IRBs would not be required to review the individual plans for 
safeguarding information and biospecimens for each research study. 
Although the NPRM presumed that the proposed privacy safeguards would 
be sufficient, an IRB could determine that a particular activity would 
require more than what was proposed. Once IRBs became familiar with 
standard institutional and investigator-adopted protections, the NPRM 
anticipated that they would become more comfortable with the fact that 
they need not review every protocol for privacy safeguards. In 
addition, it was expected that if the proposed privacy safeguards were 
adopted, overall reduction in regulatory burden would occur because 
IRBs would not

[[Page 7202]]

have to review security provisions on a case-by-case basis.
    Finally, as discussed in Section V, the NPRM contained proposed 
exemptions that would have permitted a larger number of protocols to 
proceed without IRB review if specific conditions were met, conditioned 
on investigators and institutions also meeting the proposed privacy and 
security requirements. Note that there was no requirement for an IRB to 
determine whether investigators were adhering to the privacy safeguards 
for such exempt research.

C. Public Comments

    Approximately 130 comments addressed the privacy safeguards, with a 
majority generally supporting the proposal. Both those who supported 
the proposal and those who opposed it indicated that it was difficult 
to comment on the adequacy of privacy standards that had yet to be 
developed.
    Those who supported the proposal stated that having standardized, 
minimum safeguards would create more consistency across IRBs in how 
biospecimens and identifiable private information are protected. Those 
who were opposed to the proposal stated that patient information is 
already covered by HIPAA security standards and student records are 
already covered by FERPA, arguing that these plus an array of other 
standards cover financial and various other types of sensitive 
information, making inclusion in the Common Rule redundant.
    However, several comments asserted that the HIPAA standards, while 
appropriate for health information, would not be appropriate for other 
types of research data. Others noted that the wide range and nature of 
research makes it too challenging to develop a blanket standard. With 
regard to applying the standards to exempt research, one large 
association of research universities, medical centers, and independent 
research institutes argued that research covered by the proposed exempt 
or excluded categories should be low risk and therefore third party 
evaluation of privacy safeguards was not needed. Several academic 
research institutions urged that if the security and privacy 
requirements were included in the final rule, then the measures should 
be as simple as possible. For example, they suggested developing a 
single set of standards for all identifiable data rather than 
calibrating the safeguards to the sensitivity of the information to be 
collected.
    A few comments addressed the proposed re-disclosure criteria. Of 
these, a majority indicated concerns with the NPRM redisclosure 
provision. Most of the opposition was specifically aimed at imposing 
the sharing criteria for nonidentified biospecimens. These commenters 
indicated that for sharing nonidentified biospecimens, imposing HIPAA-
like privacy safeguards was unnecessary and would be extremely 
burdensome. Several comments suggested that the Common Rule adopt the 
same permissible uses and disclosures of information without 
authorization that exists under HIPAA.
    One scientific professional organization and more than 60 
institutions endorsing its comments noted that specific redisclosure 
considerations should exist for identifiable biospecimens, stating that 
redisclosure of the identity of the source of a biospecimen is 
appropriate in rare situations in which a confirmed research finding 
may have a significant impact on the health of the donor of the 
specimen. A large, private higher education institution noted that the 
limitations on use, release, and disclosure as proposed seemed at odds 
with the permissible uses and disclosures allowed under HIPAA.
    Others suggested that the language stating that biospecimens or 
identifiable private information could be released for any lawful 
purpose with the consent of the subject was too open-ended and 
permissive. One data privacy and security advocacy group also noted 
that the introductory language to the proposed safeguards could be read 
as requiring an investigator to release research biospecimens or 
disclose identifiable private information upon receipt of a valid 
request, as opposed to simply permitting an institution to do so. One 
academic research organization suggested an alternative approach--that 
the Federal Government clarify that institutions and networks may 
designate specialized privacy and security boards to review safeguards.

D. Response to Comments and Explanation of the Final Rule: Privacy and 
Security Protections

    The final rule does not adopt the privacy and security protections 
proposed in the NPRM, but rather retains and acknowledges the IRB's 
role in ensuring that privacy safeguards are appropriate for the 
research studies that require IRB review. To better ensure that 
appropriate privacy protections are required by IRBs, the final rule 
includes a new provision in the IRB review and approval criteria at 
Sec.  __.111(a)(7)(i) that requires the Secretary of HHS in 
consultation with OMB and the Common Rule departments and agencies to 
issue guidance o assist IRBs in assessing what provisions are adequate 
to protect the privacy of subjects and to maintain the confidentiality 
of data. This requirement is discussed in more detail in Section XI.
    Although we continue to believe that appropriately protecting the 
privacy of human subjects who provide identifiable private information 
and identifiable biospecimens as well as preventing security breaches 
is critically important, we agree with the public's concerns about 
requiring adherence to privacy and security standards when the 
safeguards to be issued by the Secretary of HHS have yet to be 
developed. The federal privacy and security laws would apply only to 
certain federally conducted research. Rather than promulgate a 
regulation that lacked sufficient specificity, we determined it would 
be preferable to maintain the requirement that IRBs review research 
studies to ensure that appropriate privacy and security safeguards are 
in place to protect research subjects, but include a commitment that 
the Secretary of HHS will issue guidance to assist IRBs in 
appropriately protecting subjects' privacy and confidentiality. This 
guidance would take into consideration, among other things, the level 
of identifiability and sensitivity of the information being collected. 
Although IRBs were not specifically designed to evaluate risk to 
privacy and confidentiality and the adequacy of safeguards to protect 
against those risks, IRBs have been responsible for evaluating such 
risks under the pre-2018 rule. We believe that guidance in this complex 
and evolving area will assist IRBs to identify appropriate protections, 
and may be better able than standardized protections, to address the 
variety of privacy and confidentiality concerns that arise in the broad 
range of research studies that are being carried out now and those that 
will be conducted in the years to come.
    As discussed in Section V, certain NPRM exemption proposals 
required the application of the NPRM's proposed safeguards in whole or 
in part. To accommodate the fact that the final rule does not include 
the privacy safeguards, exemption categories in the final rule that are 
predicated on the need for some type of privacy safeguards will instead 
require that an IRB conduct a limited review to ensure that adequate 
provisions are in place to protect the privacy of subjects and to 
maintain the confidentiality of data.
    The final rule exemptions subject to this limited IRB review 
requirement are:
     The exemption for research that includes only interactions 
involving

[[Page 7203]]

educational tests, survey procedures, interview procedures, or 
observations of public behavior regardless of the identifiability or 
sensitivity of the information collected/recorded (Sec.  
__.104(d)(2)(iii));
     The exemption for research involving benign behavioral 
interventions in conjunction with the collection of information from an 
adult subject through verbal or written responses or video recording 
(regardless of the identifiability or sensitivity of the information 
collected/recorded (Sec.  __.104(d)(3)(i)(C));
     The exemption for the storage or maintenance of 
identifiable private information or identifiable biospecimens for which 
broad consent is required, when there is a change specific to the 
research activity in how the identifiable private information or 
identifiable biospecimens are stored and maintained (Sec.  
__.104(d)(7)); and
     The exemption for the secondary research use of 
identifiable private information or identified biospecimens for which 
broad consent is required (Sec.  __.104(d)(8))

VII. IRB Membership and Modification to References to Vulnerability 
(Sec. Sec.  __.107(a), __.111(a)(3), and __.111(b))

A. Background and Pre-2018 Requirements

    The pre-2018 rule stipulated a condition of IRB membership at Sec.  
__.107(a) stating that IRBs should aim for membership that does not 
consist entirely of individuals of one gender, race, or cultural 
background. It referred again to the characteristics of IRB members at 
Sec.  __.107(b), stating that efforts should be made to ensure that no 
IRB consists entirely of members of one gender or one profession.
    The pre-2018 rule also referred to the concept of vulnerability and 
consideration of vulnerable populations in three provisions, one of 
which pertained to IRB membership (Sec.  __.107(a)), one with regard to 
selection of subjects (Sec.  __.111(a)(3)), and one with regard to 
additional protections needed for subjects vulnerable to coercion or 
undue influence (at Sec.  __.111(b)). Under the pre-2018 rule, only 
Sec.  __.111(b) of the three provisions specifically referred to 
vulnerability to coercion or undue influence as the type of 
vulnerability that should be considered. In addition, of these same 
three provisions in the pre-2018 rule, only Sec.  __.107(a) identified 
``handicapped'' individuals as a vulnerable category of subjects.

B. NPRM Proposal

    The NPRM proposed eliminating the pre-2018 rule stipulation that 
IRBs should aim for membership that does not consist entirely of 
individuals of one gender or profession because the requirement that 
IRB membership reflect members of varying backgrounds and diversity, 
including gender, accomplishes the same goal.
    Further, the NPRM proposed that the criterion at Sec.  __.111(a)(3) 
be revised to align with the language of Sec.  __.111(b) to reflect 
that the vulnerability of the populations in these research studies 
should be considered to be a function of the possibility of coercion or 
undue influence, and that this vulnerability alone should be the IRB 
focus of concern with respect to this criterion. The proposed change 
was intended to provide greater consistency and clarity in IRB 
consideration of vulnerability of subject populations in research 
activities and appropriate protections. A comparable change was also 
proposed at Sec.  __.107(a), pertaining to IRB membership.
    In addition, the NPRM proposed that the term ``handicapped'' be 
changed to ``physically disabled'' individuals. Therefore, to enhance 
consistency and clarity among these three provisions, it was proposed 
that the term ``physically disabled'' be inserted at Sec.  __.111(a)(3) 
and (b). This would mean that physically disabled persons would be 
among the individuals that the IRB may consider in determining that the 
selection of subjects is equitable (Sec.  __.111(a)(3)), and that the 
IRB may consider to be vulnerable to coercion or undue influence (Sec.  
__.111(b)). Public comment was sought on whether pregnant women and 
those with physical disabilities should be characterized as vulnerable 
to coercion or undue influence. Whether or not these subpopulations are 
considered vulnerable to coercion or undue influence would not affect 
the applicability of subpart B.
    Finally, the NPRM proposed a change in Sec.  __.107(a), involving 
the insertion of ``economically or educationally disadvantaged 
persons'' as an example of a vulnerable population, and requiring an 
IRB to give consideration to membership expertise in this area. This 
language was already included in the pre-2018 rule at Sec.  
__.111(a)(3) and Sec.  __.111(b). Adding this category of individuals 
to those who may be considered vulnerable to coercion or undue 
influence at Sec.  __.107(a) was intended to create greater consistency 
among these three provisions.

C. Public Comments

    Between 40 and 50 NPRM comments discussed the language describing 
vulnerable populations found in Sec. Sec.  __.107(a), __.111(a)(3), and 
(b). A majority of these comments only discussed the inclusion of 
pregnant women as an example of a population that might be vulnerable. 
Typically, comments addressed only one of the three questions posed in 
the NPRM about these provisions. The questions asked whether the Sec.  
__.111(a)(3) and (b) focus on issues related to coercion or undue 
influence in research with vulnerable populations, and no other 
considerations related to vulnerability, was appropriate; whether 
pregnant women and those with physical disabilities should be included 
in the category of subpopulations that may be vulnerable to coercion or 
undue influence; and, whether populations should be considered 
vulnerable for reasons other than vulnerability to coercion or undue 
influence.
    A majority of the comments stated that the inclusion of pregnant 
women as an example of a group that might be vulnerable to coercion or 
undue influence was inappropriate. These commenters noted that to 
suggest that noncognitive limitations make individuals inherently 
vulnerable is insulting to those populations. Of those comments that 
addressed these proposals, a minority discussed whether individuals 
with physical disabilities should be included as an example of a group 
that might be vulnerable to coercion and undue influence. As with 
pregnant women, these commenters stated that the insinuation that 
groups with physical disabilities might be inherently vulnerable to 
coercion and undue influence was insulting. One commenter noted that a 
physical condition might make one vulnerable to coercion or undue 
influence in the research context, but typically only when the research 
activity targets that vulnerability (as opposed to those populations 
always being vulnerable).
    In terms of whether other types of vulnerabilities should be 
considered by IRBs, public comment was mixed. Some commenters indicated 
that in the research context, the specific concerns with respect to 
vulnerable populations are limited to vulnerability to coercion and 
undue influence, while others noted that the regulations do not 
preclude an IRB from considering other types of vulnerability and that 
because of this flexibility, additional regulatory text was not 
necessarily needed. Groups specifically concerned with issues related 
to research involving Native

[[Page 7204]]

American populations noted that there are issues broader than 
vulnerability to coercion and undue influence that should be 
considered, such as vulnerability to group harms; one commenter 
recommended that populations be considered vulnerable as a result of 
being historically marginalized, such as native/tribal communities; 
lesbian, gay, bisexual, and transgender (LGBT) individuals; and racial 
and ethnic groups.
    Commenters who disagreed with this change generally felt that a 
history of societal marginalization, such as that experienced by LGBT 
groups or AI/AN tribes, should be a basis for determining 
vulnerability, and that a focus on only coercion or undue influence may 
be insufficient for IRB consideration.
    Several comments discussed the fact that using the term mentally 
disabled is potentially patronizing. One commenter suggested that 
instead of listing mentally disabled individuals as a group that might 
be vulnerable to coercion and undue influence, the regulations should 
use the term ``populations with impaired decision making ability.'' 
This suggestion echoes a recommendation made by SACHRP in 2009 as 
well.\36\
---------------------------------------------------------------------------

    \36\ HHS. SACHRP. Attachment: Recommendations Regarding Research 
Involving Individuals with Impaired Decision-making (2008, 2009). 
Retrieved from http://www.hhs.gov/ohrp/sachrp-committee/recommendations/2009-july-15-letter-attachment/#.
---------------------------------------------------------------------------

    Another commenter stated that vulnerability status should be based 
on situational context, not on membership in a population, which 
potentially promotes stigmatization. Rather, focus should be more on 
the risk of the research and the situation of each subject when asked 
to participate in research. Finally, it was suggested that terminally 
ill patients who have exhausted all standard therapies, and possibly 
other research interventions, should be considered vulnerable.

D. Response to Comments and Explanation of the Final Rule: References 
to Vulnerability

    A majority of comments agreed that the focus on issues related to 
coercion or undue influence, and no other considerations related to 
vulnerability, was appropriate. We agree with this assessment, and have 
retained this language in the final rule. We believe this change will 
help guide IRBs when assessing the type of vulnerability that should be 
the focus of review. We note that the Sec.  __.111(a)(3) approval 
criterion retains the reference to the purposes of the research and the 
setting in which it is conducted because these considerations are also 
relevant to the assessment of the equitable selection of subjects, and 
may include factors such as societal marginalization or discrimination.
    The language at the three provisions (Sec.  __.107(a), Sec.  
__.111(a)(3), and Sec.  __.111(b)) has been made identical in referring 
to vulnerability as meaning vulnerability to coercion and undue 
influence, in recognition that coercion or undue influence refers to 
the ability to make an informed decision about participating in 
research.
    We agree with comments that said that the list of example 
vulnerable populations listed in the pre-2018 rule is out of date.
    In agreement with the majority of comments, the final rule no 
longer includes pregnant women or ``handicapped'' or physically 
disabled individuals as examples of populations that are potentially 
vulnerable to coercion or undue influence. Adopting a suggestion from 
public comment and SACHRP, the final rule uses the term ``individuals 
with impaired decision-making ability'' to replace the term ``mentally 
disabled persons.''

VIII. IRB Functions and Operations (Sec.  __.108)

A. Background and Pre-2018 Requirements

    The pre-2018 rule outlined IRB functions and operations at 
Sec. Sec.  __.103 and __.108.

B. NPRM Proposals

    The NPRM contained several proposals for changes in IRB functions 
and operations. Of relevance here, the requirements for recordkeeping 
by IRBs would no longer appear in Sec.  __.103 of the rule but in Sec.  
__.108. Much of the discussion related to these changes appears in 
Section IV regarding the assurance process. The issues are summarized 
here.
    The NPRM proposed that the requirement that a written assurance 
include a list of IRB members for each IRB designated under the 
assurance process be replaced. In its place, the NPRM proposed that the 
assurance include a statement for each designated IRB, prepared and 
maintained by the institution, or when appropriate the IRB, with a 
current detailed list of the IRB members including information 
sufficient to describe each member's chief anticipated contributions to 
IRB deliberation; and any employment or other relationship between each 
member and the institution. The regulatory requirement at Sec.  
__.103(b)(3) that changes in IRB membership be reported to the 
department or agency head, or to OHRP when the existence of an HHS-
approved assurance is accepted, would be deleted, eliminating the 
requirement. Instead, an institution would be required under proposed 
Sec.  __.108(a)(2) to maintain a current IRB roster, but such a roster 
would not need to be submitted to OHRP or other agency managing the 
assurance of compliance process.
    The NPRM also proposed to eliminate the requirement in Sec.  
__.103(b)(2) that an institution designate one or more IRBs on its FWA 
established in accordance with the Common Rule. The requirement in the 
pre-2018 Common Rule at Sec.  __.103(b)(2) that IRBs have sufficient 
meeting space and staff to support IRB reviews and record keeping 
requirements was moved in the NPRM to Sec.  __.108(a)(1). Note that 
under this proposal federal departments or agencies would retain the 
ability to ask for information about which IRBs review research 
conducted at an institution as part of the assurance process.

C. Public Comments

    Approximately 10 comments were received on these proposals. Of 
those, all supported the NPRM proposal that changes in IRB membership 
no longer needed to be reported to the funding department or agency. 
All commenters supported the proposal that IRBs would simply need to 
prepare and maintain a current list of IRB members. Commenters agreed 
that the proposed changes to the IRB roster requirement would reduce 
administrative burden without having any significant impact on the 
protection of human subjects. Those who commented on the proposed 
deletion of the requirement to designate one or more IRBs on an 
institution's FWA generally supported the proposal.
    No comments were received on the proposed movement of IRB policy 
and recordkeeping requirements from Sec.  __.103 to Sec.  __.108.

D. Explanation of the Final Rule: IRB Functions and Operations

    The final rule adopts the NPRM proposals to move the IRB 
recordkeeping requirements from Sec.  __.103(b)(3), (4), and (5) to 
Sec.  __.108(a)(2), (3), and (4). (See Section IV regarding changes to 
Sec.  __.103 as well.) The final rule also adopts the NPRM proposal 
that IRBs must maintain an accurate list of IRB members but are not 
required to submit changes to that roster to the funding department or 
agency. The final rule also adopts the NPRM proposal to delete the 
requirement in the pre-2018 rule

[[Page 7205]]

that institutions designate one or more IRBs on that institution's FWA.

IX. IRB Review of Research (Sec.  __.109)

A. Background and Pre-2018 Requirements

    The pre-2018 rule listed four areas of responsibility for IRBs in 
the review process concerning their authority to approve, request 
modification, or disapprove research activities; ensure informed 
consent requirements are met (including documentation or waiver, as 
relevant); notify investigators of their determinations; and conduct 
continuing review of research. The rule at Sec.  __.109(a) stated that 
IRBs have the authority to carry out these responsibilities for all 
research activities covered by the policy.
    In particular, the pre-2018 rule at Sec.  __.109(e) required that 
IRBs conduct continuing review of research covered by this policy at 
intervals appropriate to the degree of risk, but not less than once per 
year. Except when an expedited review procedure was used, continuing 
review of research was to occur at convened meetings at which a 
majority of the IRB members are present, including at least one member 
whose primary concerns are in nonscientific areas.
    An IRB could use an expedited review procedure to conduct 
continuing review of research for some or all of the research appearing 
on the list of research eligible for expedited review \37\ and found by 
the reviewer(s) to involve no more than minimal risk. The Common Rule 
departments and agencies could restrict, suspend, terminate, or choose 
not to authorize an IRB's use of the expedited review procedure (Sec.  
__.110(d)).
---------------------------------------------------------------------------

    \37\ Office for Human Research Protections. Categories of 
Research That May Be Reviewed by the Institutional Review Board 
(IRB) through an Expedited Review Procedure. November 9, 1998. 
Retrieved from http://www.hhs.gov/ohrp/policy/expedited98.html.
---------------------------------------------------------------------------

B. NPRM Proposals

    The NPRM proposed clarifying that the Common Rule does not give 
IRBs the authority to review or approve, require modification in or 
disapprove research that qualifies for the exemptions proposed in the 
NPRM.
    The NPRM also proposed to eliminate continuing review for many 
minimal risk studies (namely those that qualify for expedited review), 
unless the reviewer documents why continuing review should take place, 
which would be required according to the NPRM. Moreover, for studies 
initially reviewed by a convened IRB, continuing review would not be 
required, unless specifically mandated by the IRB, after the study 
reaches the stage where it involves only one or both of the following: 
(1) Analyzing data (even if it is identifiable private information); or 
(2) accessing follow-up clinical data from procedures that subjects 
would undergo as part of standard care for their medical condition or 
disease.
    In addition, the NPRM proposed that continuing review would not be 
required for research involving certain secondary research using 
information and biospecimens that requires limited IRB review in order 
to qualify for an exemption proposed in the NPRM.
    Further, the NPRM proposed that an IRB must receive annual 
confirmation that research is ongoing and that no changes have been 
made that would require the IRB to conduct continuing review (that is, 
the study still qualifies for expedited review because it still meets 
the criteria listed above and still involves no greater than minimal 
risk).
    The NPRM also proposed a new requirement for IRBs to maintain 
records of continuing reviews. Because the NPRM proposed a new 
provision that eliminates the need for continuing review under specific 
circumstances, it also proposed that IRBs need to justify the need for 
continuing review in cases where it was not required. If an IRB chooses 
to conduct continuing review even when these conditions are met, the 
NPRM stated that the rationale for doing so must be documented.

C. Public Comments

    Approximately four comments addressed the clarification proposed in 
the NPRM that IRBs were not authorized by this policy to review exempt 
research. All who commented opposed the proposed modification. Those 
who commented were concerned that IRBs and institutions would interpret 
the modifications to mean that IRBs were precluded from ever reviewing 
such research and pointed to the possibility, although rare, that there 
might be a need to do so, particularly if the initial exemption 
determination was flawed.
    With regard to continuing review, approximately 120 comments 
discussed this proposal. A strong majority of comments (approximately 
95) supported this proposal and approximately 15 opposed it. Other 
comments were mixed. Those who supported the proposal said that it 
would indeed alleviate IRB administrative burden without diminishing 
the protections afforded to human subjects. Those who did not support 
this proposal believed the continuing review process served an 
important role in allowing an institution to periodically re-evaluate 
the benefits, risks, methods, and procedures used in research 
activities, and whether the research had been modified without 
approval. Some commenters who supported the proposal were opposed to 
the requirement for annual confirmation to the IRB that such research 
is ongoing and that no changes have been made that would require the 
IRB to conduct continuing review. They stated that the burden 
alleviated by eliminating the need for continuing review was offset by 
the requirement to submit an annual confirmation.

D. Response to Comments and Explanation of the Final Rule: Review of 
Research

    The final rule at Sec.  __.109(a) modifies the language of the pre-
2018 rule to state that IRBs review and have the authority to approve, 
require modifications in, or disapprove all research activities covered 
by this policy, including exempt research activities under Sec.  __.104 
for which limited IRB review is a condition of exemption (Sec.  
__.104(d)(2)(iii), Sec.  __.104(d)(3)(i)(C), Sec.  __.104(d)(7), and 
Sec.  __.104(d)(8)). Since the final rule requires limited IRB review 
for certain categories of exempt research, the provision at Sec.  
__.109(a) has been modified to clarify that IRBs have the authority 
needed to conduct limited IRB review.
    As proposed in the NPRM, and as generally supported in public 
comments, continuing review is eliminated for all studies that undergo 
expedited review, unless the reviewer explicitly justifies why 
continuing review would enhance protection of research subjects (Sec.  
__.109(f)(1)(i) and Sec.  __.115(a)(3)). For studies initially reviewed 
by a convened IRB, once certain specified procedures are all that 
remain for the study, continuing review would not be required, unless 
specifically mandated by the IRB. These activities include: (1) 
Research eligible for expedited review in accordance with Sec.  __.110; 
or (2) Research that has progressed to the point that it involves only 
one or both of the following, which are part of the IRB-approved study: 
(a) Data analysis, including analysis of identifiable private 
information or identifiable biospecimens, or (b) Accessing follow-up 
clinical data from procedures that subjects would undergo as part of 
clinical care (at Sec.  __.109(f)). In addition, the final rule states 
at Sec.  __.109(f)(1)(ii) that continuing review is not required for 
research reviewed in accordance with the limited IRB review procedure 
described in Sec.  __.104(d)(2)(iii),

[[Page 7206]]

Sec.  __.104(d)(3)(i)(C), Sec.  __.104(d)(7), or Sec.  __.104(d)(8).
    The final rule does not require investigators to provide annual 
confirmation to the IRB that such research is ongoing and that no 
changes have been made that would require the IRB to conduct continuing 
review. Institutions that choose to require some accounting of ongoing 
research not subject to continuing review have significant flexibility 
in how they implement their own requirements. Note that under the final 
rule, investigators would still have the current obligations to report 
various developments (such as unanticipated problems or proposed 
changes to the study) to the IRB.

X. Expedited Review Procedures (Sec.  __.110)

A. Background and Pre-2018 Requirements

    Under the pre-2018 rule, a research study could receive expedited 
review if the research activities to be conducted appear on the list of 
activities published by the Secretary of HHS that are eligible for such 
review,\38\ and was found by the reviewer(s) to involve no more than 
minimal risk. Under an expedited review procedure, the review could be 
carried out by the IRB chairperson or by one or more experienced 
reviewers designated by the chairperson from among the members of the 
IRB. Research that was eligible for expedited review required 
continuing review at least annually.
---------------------------------------------------------------------------

    \38\ HHS. OHRP. Categories of Research That May Be Reviewed by 
the Institutional Review Board (IRB) through an Expedited Review 
Procedure. November 9, 1998. Retrieved from http://www.hhs.gov/ohrp/policy/expedited98.html.
---------------------------------------------------------------------------

B. NPRM Proposals

    The NPRM proposed changes regarding expedited review, to allow 
expedited review to occur for studies on the Secretary's list unless 
the reviewer(s) determine(s) that the study involves more than minimal 
risk. This was in contrast to the pre-2018 regulations, which required 
that an IRB use the expedited review procedure only if the reviewer 
determines (and documents) that the research involves no more than 
minimal risk. In addition, OHRP has indicated that the activities on 
the current list should not be deemed to be of minimal risk simply 
because they are included on the list. In a related change, the NPRM 
contained a requirement that IRBs document the rationale for an 
expedited reviewer's determination that research appearing on the 
expedited review list is more than minimal risk (i.e., an override of 
the presumption that studies on the Secretary's list are minimal risk).
    The NPRM proposed that IRBs reviewing the consent process (and, 
when required, the privacy safeguards) for studies eligible for the 
proposed exemption at Sec.  __.104(f)(1) could use the expedited review 
procedure.
    As discussed in Section III of this preamble, the NPRM did not 
propose to modify the definition of minimal risk, but rather proposed 
adding to the definition a requirement that the Secretary of HHS create 
and publish a list of activities that qualify as ``minimal risk''. This 
Secretary's list would be re-evaluated periodically, but at least every 
8 years, based on recommendations from federal departments and agencies 
and the public. Note that this would not be an exhaustive list of all 
activities that would be considered minimal risk under the Common Rule, 
but would allow IRBs to rely on the determination of minimal risk for 
activities appearing on the list. IRBs would still need to make minimal 
risk determinations about activities that do not appear on this list.
    In addition, the NPRM proposed to eliminate the parenthetical 
phrase ``of one year or less'' when referring to the IRB approval 
period, since annual continuing review of research eligible for 
expedited review would no longer be required.
    The NPRM also proposed that the regulations be revised to require 
evaluation of the list of expedited review categories every 8 years, 
followed by publication in the Federal Register and solicitation of 
public comment. A revised list would be prepared for public comment 
outside the scope of the NPRM.

C. Public Comments

    Approximately 50 comments were received regarding the proposal to 
update the Secretary's list of expedited review categories every 8 
years. A strong majority supported this proposal although some 
recommended that the mandatory period of review occur more frequently 
than every 8 years.
    Approximately 10 comments discussed the NPRM proposal that an IRB 
may use the expedited review procedure to satisfy limited IRB review of 
the consent process as required under the proposed NPRM exemption. A 
strong majority of these comments supported this proposal.

D. Response to Comments and Explanation of the Final Rule: Expedited 
Review Procedures

    Under the final rule, a study is deemed to be minimal risk and thus 
eligible for expedited review if the study only involves activities on 
the Secretary's list, unless the reviewer determines and documents that 
the study involves more than minimal risk (Sec.  __.110(a) and (b)(1)). 
Thus, we anticipate that more studies that involve no more than minimal 
risk will undergo expedited review, rather than full review, which will 
relieve burden on IRBs.
    Further, IRBs will be required to document their rationale when 
they override the presumption that studies on the Secretary's expedited 
review list involve greater than minimal risk (at Sec.  __.115(a)(8)). 
Although public comments argued that this documentation represented an 
unjustified burden on IRBs, we believe that such documentation could 
provide a basis for the Secretary's future determinations about the 
appropriateness of the list, and allow for greater consistency across 
institutions, and thus make the Common Rule more just.
    At Sec.  __.110(b)(1)(iii) the final rule adopts the NPRM proposal 
that an IRB may use the expedited review process when conducting 
limited IRB review as required by the exemptions at Sec.  
__.104(d)(2)(iii), Sec.  __.104(d)(3)(i)(C), Sec.  __.104(d)(7), and 
Sec.  __.104(d)(8).
    Finally, as proposed in the NRPM, evaluation of the list of 
expedited review categories will occur every 8 years, followed by 
publication in the Federal Register and solicitation of public comment.

XI. Criteria for IRB Approval of Research (Sec.  __.111)

A. Background and the Pre-2018 Requirements

    The determinations that an IRB must make before it can approve a 
study were spelled out in the pre-2018 rule at Sec.  __.111. These 
relate, among other things, to minimizing risks to subjects, 
determining that an appropriate relationship exists between risks and 
benefits, and ensuring the equitable selection of subjects. The 
regulations generally required all of these determinations to be made 
for any study that must undergo IRB review.

B. NPRM Proposals

    The NPRM proposed a number of changes regarding the criteria for 
IRB approval of research, including (1) creating a new form of IRB 
review for activities relating to storing or maintaining data and 
biospecimens for later secondary use; (2) revising two of the existing 
criteria for approval of

[[Page 7207]]

research that have special considerations related to the involvement of 
vulnerable populations and for privacy and confidentiality of data 
provisions; and (3) adding a provision about plans to review the return 
of individual results to participants.
    The first set of changes concerned updating the IRB review criteria 
for research activities relating to storing or maintaining information 
and biospecimens, and to the secondary use of such information and 
biospecimens. Paragraph (a)(9)(i) of proposed Sec.  __.111 would have 
applied to a proposed exemption at Sec.  __.104(f)(1) for storing or 
maintaining biospecimens or identifiable private information for use in 
secondary research. This provision would have eliminated the need for 
an IRB to make the usual determinations about such an activity. 
Instead, the IRB would have been required to determine that the 
procedures for obtaining broad consent to storing or maintaining the 
biospecimens or information were appropriate, and met the standards 
included in the introductory paragraph of Sec.  __.116. In addition, if 
these storage and maintenance activities involved a change for research 
purposes from the way the biospecimens or information had been stored 
or maintained, then the IRB would have needed to determine that the 
proposed biospecimen and privacy safeguards at Sec.  __.105 were 
satisfied for the creation of any related storage database or 
repository.
    The second proposed change was related to the NPRM privacy 
safeguard proposal and clarified that it would not be an IRB 
responsibility to review the security plans for biospecimens and 
identifiable private information for every protocol (i.e., on a case-
by-case basis). Also, as discussed in Section VII, the NPRM proposed 
changing how vulnerable populations are referred to in the regulatory 
language at Sec.  __.111(a)(3).
    The third proposed change was the addition of section (a)(8) to 
Sec.  __.111 clarifying that if an investigator submits as part of the 
protocol a plan for returning clinically relevant research results to 
subjects, the IRB would have to evaluate the appropriateness of the 
plan. This criterion was proposed in response to public discussions, 
including SACHRP, recommending that IRBs consider returning individual 
results to subjects.\39\
---------------------------------------------------------------------------

    \39\ http://www.hhs.gov/ohrp/sachrp-committee/recommendations/attachment-b-return-individual-research-results/index.html.
---------------------------------------------------------------------------

C. Public Comments

    Approximately 20 comments discussed the proposed modifications in 
Sec.  __.111 related to the criteria for IRB approval of research. Of 
these comments, a majority discussed the proposal that an IRB be 
required to review the adequacy of plans to return research results, 
should a proposed study include such a plan. Comments on this proposal 
were mixed, with both those opposing and supporting the proposal 
indicating that HHS and other Common Rule departments and agencies 
would need to issue detailed guidance addressing what is considered an 
adequate plan in this context. Several commenters suggested deleting 
this provision due to the lack of clarity surrounding the IRB's role in 
such a review.

D. Response to Comments and Explanation of the Final Rule: Criteria for 
IRB Approval of Research

    The final rule does not adopt all of the NPRM proposals. It does 
not include the NPRM proposal regarding IRB review of plans to review 
the return of clinically relevant results to subjects. This proposal 
was deleted due to concern over the criteria that would be required for 
an IRB to appropriately consider this area, the need for particular IRB 
expertise to appropriately assess the return of results, and ambiguity 
over the meaning of ``clinically relevant.''
    The final rule does, however, revise two of the existing criteria 
for approval of research: (1) Special considerations related to the 
involvement of vulnerable populations, and (2) privacy and 
confidentiality of data provisions.
    As discussed in more detail in Section VII, the language regarding 
vulnerable populations at Sec.  __.111(a)(3) and (b) has been revised 
to reflect the current understanding of which populations should 
receive special consideration due to potential vulnerabilities specific 
to the purposes and context of human subjects studies and to parallel 
other references to vulnerable populations found at Sec.  __.107(a).
    Section __.111(a)(7) in the final rule retains the pre-2018 
language, but also adds an additional requirement, thereby serving a 
dual function as both the primary regulatory provision requiring IRB 
review of the adequacy of protections for the privacy of subjects and 
confidentiality of identifiable private information (including that 
obtained from the analysis of biospecimens), and as the primary limited 
IRB review requirement needed to satisfy certain exemption 
determinations in Sec.  __.104(d).
    In Sec.  __.111(a)(7)(i) the Secretary of HHS commits to issuing 
guidance to assist IRBs in assessing what provisions are adequate to 
protect the privacy of subjects and to maintain the confidentiality of 
information, after consultation with OMB's privacy office and other 
federal departments and agencies that have adopted this policy. This 
modification is intended to serve a similar function as the privacy 
safeguards proposed in the NPRM (but not adopted in the final rule). 
The guidance might address the following considerations such as:
     The extent to which identifiable private information is or 
has been de-identified and the risk that such de-identified information 
can be re-identified;
     The use of the information;
     The extent to which the information will be shared or 
transferred to a third party or otherwise disclosed or released;
     The likely retention period or life of the information;
     The security controls that are in place to protect the 
confidentiality and integrity of the information; and
     The potential risk of harm to individuals should the 
information be lost, stolen, compromised, or otherwise used in a way 
contrary to the contours of the research under the exemption.

    The final rule at Sec.  __.111(a)(8) modifies the NPRM proposal on 
the limited IRB review required by Sec.  __.104(d)(7). Section 
__.111(a)(8) specifies that for the purposes of conducting the limited 
IRB review required by Sec.  __.104(d)(7), the IRB must determine that 
broad consent for storage, maintenance, and secondary research use of 
identifiable biospecimens or identifiable private information is 
obtained in accordance with the requirements of Sec.  __.116(a)(1)-(4), 
(a)(6), and (d). As part of its review of these requirements for broad 
consent, the IRB would review the appropriateness of the process 
proposed for obtaining broad consent, and ensure that the required 
elements of broad consent were appropriately included in the broad 
consent form (or process, if broad consent is to be obtained orally). 
Additionally, the IRB must determine that consent is appropriately 
documented, or that a waiver of documentation is appropriate, in 
accordance with Sec.  __.117. Finally, if a change is made for research 
purposes in the way identifiable private information or identifiable 
biospecimens are stored or maintained, the IRB must determine that 
adequate provisions are in place to protect the privacy of subjects and 
to maintain the

[[Page 7208]]

confidentiality of data. It is expected that the guidance to be 
developed by the Secretary of HHS about protecting the privacy of 
subjects and maintaining the confidentiality of data will also be 
applicable to the privacy and confidentiality considerations included 
in this limited IRB review requirement.

XII. Cooperative Research (Sec.  __.114)

A. Background and Pre-2018 Requirements

    The pre-2018 rule required that each institution engaged in a 
cooperative research study obtain IRB approval of the study, although 
it did not require that a separate local IRB at each institution 
conduct such review. In many cases, however, a local IRB for each 
institution would independently review the research protocol, and 
informed consent forms and other materials, often resulting in multiple 
reviews for one study. When any one of these IRBs would require changes 
to the research protocol that are adopted for the entire study, 
investigators would have to re-submit the revised protocol to all of 
the reviewing IRBs. This process could take many months and 
significantly delay the initiation of research projects and recruitment 
of subjects into studies. More importantly, little evidence has 
suggested that the time and effort put into these activities by 
investigators (in providing materials to IRBs) and IRBs have 
significantly increased the well-being of research subjects.

B. NPRM Proposals

    Taking into consideration the history of public debate on this 
topic and various sources of public comments, the NPRM proposed a 
requirement mandating that all institutions located in the United 
States engaged in cooperative research rely on a single IRB as their 
reviewing IRB for that study. Under this proposal, this requirement 
would not apply to: (1) Cooperative research for which more than single 
IRB review is required by law; or (2) research for which the federal 
department or agency supporting or conducting the research determines 
and documents that the use of a single IRB is not appropriate for the 
particular study. Public comment was sought on whether it would be 
useful for this requirement to include criteria that federal 
departments or agencies would need to apply in determining whether to 
make exceptions to the use of a single IRB requirement and what those 
criteria might be. Further the public was asked whether the exceptions 
proposed were appropriate and sufficient, or whether this mandate 
should have additional exceptions for single IRB review than those 
proposed in the NPRM.
    The change proposed by the NPRM would apply only to U.S.-conducted 
portions of studies because the flexibility to make use of local IRB 
reviews at international sites should be maintained. It might be 
difficult for an IRB in the United States to adequately evaluate local 
conditions in a foreign country that could play an important role in 
the ethical evaluation of the study.
    This policy would apply regardless of whether the study underwent 
convened review or expedited review. Under the NPRM, the IRB of record 
would be expected to be selected either by the funding agency or, if 
there is no funding agency, by the lead institution conducting the 
study. An agency may, but is not required, to solicit input regarding 
which IRB would be most appropriate to designate as the IRB of record. 
Public comment was sought on how this would work in practice.
    This policy would not relieve any site of its other obligations 
under the regulations to protect human subjects. Nor would it prohibit 
institutions from choosing, for their own purposes, to conduct 
additional IRB or other administrative reviews, though such reviews 
would no longer have any regulatory status in terms of compliance with 
the Common Rule.
    Some concerns about a mandated single IRB review for cooperative 
research point to implementation logistics, and the time necessary to 
establish new policies, procedures, and agreements. Recognizing this 
concern, the proposed compliance date was 3 years from the publication 
of the final rule. Public comment was sought on whether this was a 
realistic timeframe.
    The public was asked to comment on whether mandated single IRB 
review for all cooperative research was a realistic option, and what 
the likely costs and benefits to institutions might be. Further, the 
public was asked to comment on whether additional resources would be 
necessary to meet this requirement in the short term and whether 
savings might be anticipated in the long run. Finally, public comment 
was sought regarding in what areas guidance would be needed for 
institutions to comply with this requirement and whether the Common 
Rule departments and agencies could take actions to address concerns 
about institutional liability, such as developing model written 
agreements.

C. Public Comments

    This proposal was one of the most commented on in the NPRM, 
receiving more than 300 comments. Public comment was divided on whether 
a final rule should implement the proposal to mandate one IRB of record 
in domestic cooperative research studies. Of those who commented on 
this proposal, approximately 130 supported the proposal, and 
approximately 140 opposed it. Others had mixed views.
    Research institutions tended to oppose this proposal, while 
individuals (i.e., those who were not providing comment in an official 
institutional capacity) and scientific organizations tended to support 
the proposal. A strong majority of those who opposed the proposal 
indicated that the final rule should encourage, rather than mandate, a 
single IRB of record in cooperative research studies. Arguments against 
the proposal cited the need for local review and potential loss of 
accountability, as well as operational issues such as the increased 
administrative capacity and technological systems required for a site 
to function effectively as a single IRB. One comment stated that 
mandated single IRB review would not eliminate the challenges 
associated with multi-institutional trials. The commenter argued that 
it would shift the burden from sponsors to investigators and at the 
institutional level, centralized systems would have to be developed and 
sustained in order to manage single IRB reviews.
    Some who supported the proposal stated that it would decrease 
administrative burdens and inefficiencies for investigators and 
institutions. Conversely, some commenters stated that the proposal 
should not be implemented because it would ultimately increase burdens 
and inefficiencies for investigators and institutions.
    In addition to the broad themes for and against this proposal, some 
commenters such as SACHRP noted that the proposed requirement seems 
premature at this time and suggested that more data are needed before 
such a provision could be implemented. Others said the scope of the 
proposal seemed overly broad. Many cited the alternative, narrower 
approach discussed in SACHRP's public comment as a reasonable 
option.\40\ Further commenters stated that the lead institution likely 
would experience

[[Page 7209]]

increased costs if this proposal were implemented because of the 
obligations it would have to assume. In addition, some commenters said 
that the proposal does not address risk of liability to institutions 
and IRBs that are not considered the lead.
---------------------------------------------------------------------------

    \40\ SACHRP's public comment to the NPRM is available here: 
https://www.hhs.gov/ohrp/sachrp-committee/recommendations/2016-january-5-recommendation-nprm-attachment-a/index.html.
---------------------------------------------------------------------------

    Commenters also noted that long review times for prospective 
research studies are not solely related to the IRB review and approval 
itself. Rather, commenters noted that long review times are caused by 
the sum total of the many different types of reviews either mandated by 
other regulations or by institutional policy (e.g., radiation safety 
board review, privacy board review, departmental scientific review) 
that must be completed. These other reviews would likely not be 
affected by the NPRM proposal.
    Several commenters expressed concern that according to the NPRM 
proposal, the supporting federal department or agency would select the 
IRB of record as required by the provision. These commenters were 
concerned that the provisions did not seem to allow for grantee or 
awardee input on what IRB should be the IRB of record nor did they seem 
to suggest that funding departments or agencies should consult with the 
institutions receiving funding about the IRB of record. Several public 
comments also expressed concern about the burden this provision would 
place on nonfederally supported studies subject to the rule solely 
based on the clinical trials expansion proposed in the NPRM.
    Representatives of AI/AN tribes also provided comments emphasizing 
the sovereign status of their governments, and stating that nonlocal 
review would be inappropriate for their communities.

D. Response to Public Comments and Explanation of the Final Rule: 
Cooperative Research

    The final rule adopts the NPRM proposal with modifications that are 
responsive to public comment. We agree with commenters who speculated 
that mandated single IRB review would ultimately decrease 
administrative burdens and inefficiencies for investigators and 
institutions, while acknowledging that the transition to this model 
would require significant time and an adjustment to institutional 
structures and policies. We concur that, rather than offering 
additional protections, in many cases multiple IRB approvals increase 
burden and frequently delay the implementation of studies, increasing 
the costs of clinical trials and potentially stalling access to new 
therapies. We note comments that expressed frustration with the 
frequent occurrence of central IRB participating sites insisting on 
separate institutional reviews. One comment noted that these additional 
IRB reviews generally reach the same conclusions, or conclusions with 
minor changes, that are then imposed solely on that site. When working 
optimally, we expect the central IRB model will work more efficiently 
and require less personnel time and fewer resources for tracking and 
implementing IRB changes and approvals, thereby eliminating the 
potential for unnecessarily duplicative reviews.
    Although a large number of comments believed that single IRB review 
should be encouraged rather than mandated, we feel that this 
incentivized approach would ultimately fail to yield substantive 
positive change in the system. Rather, systematic efficiencies have the 
best chance of occurring if single IRB review is required for all 
review in domestic research involving more than one institution. We 
acknowledge that further guidance for this requirement will need to be 
developed and that initial cost projections may have been low. However, 
we feel this change supports the best interests of the research 
infrastructure through increasing efficiency. Note that the final rule 
permits appropriate flexibilities that will assist in implementation. 
Institutions may still choose to conduct additional internal IRB 
reviews for their own purposes, though such reviews would no longer 
have any regulatory status in terms of compliance with the Common Rule.
    We agree with comments recommending that a greater role should be 
provided for grantee input on choosing the IRB of record, and have 
modified the language accordingly. The language at Sec.  __.114(b)(1) 
now states that the reviewing IRB (i.e., the IRB of record) will be 
identified by the federal department or agency supporting or conducting 
the research, yet allows lead institutions to propose the reviewing 
IRB, subject to the acceptance of the federal department or agency 
supporting the research. This provision is consistent with the NIH 
single IRB policy, which was published on June 21, 2016.
    This final rule adopts (in Sec.  __.114(b)(2)(i)) the NPRM's 
proposal that cooperative research for which more than single IRB 
review is required by law is not subject to the requirements of Sec.  
__.114. The rule also adds clarifying language providing that this 
provision extends to tribal laws passed by the official governing body 
of an AI/AN tribe. Thus, if the official governing body of an AI/AN 
tribe passes a tribal law that requires more than single IRB review for 
certain cooperative research, the requirement for single IRB review 
does not apply to such cooperative research. In addition, we highlight 
that Sec.  __.114(b)(2)(ii) allows a federal department or agency the 
flexibility to determine that the use of a single IRB is not 
appropriate for certain contexts, thereby permitting additional IRB 
review and consideration of local and regional variations in some 
circumstances.
    Finally, the final rule adopts the NPRM proposal for this provision 
to have a delayed compliance date of 3-years from the date the final 
rule is published in the Federal Register. This transition period is 
intended to allow the regulated community appropriate time and 
flexibility in adjusting to this new model.

XIII. IRB Records (Sec.  __.115)

A. Background and Pre-2018 Requirements

    The pre-2018 rule at Sec.  __.115 outlined requirements for IRBs in 
preparing and documenting its activities and for maintaining records.

B. NPRM Proposals

    As discussed in Section IV, the NPRM proposed to revise the pre-
2018 requirement that an up-to-date list of the IRB members and their 
qualifications be included in an institution's assurance. Instead, the 
NPRM proposed the requirement that an IRB or the institution prepare 
and maintain a current list of IRB members.
    As discussed in Section IX, the NPRM proposed a new requirement for 
IRBs to maintain, as part of their records of continuing reviews, the 
rationale for conducting continuing review of research that was deemed 
eligible for elimination of continuing review per proposed changes at 
Sec.  __.109(f)(1)(ii). Specifically, this would apply to research that 
had progressed to the point that it involves only one or both of the 
following, which are part of the IRB-approved study: (1) Conducting 
data analysis, including analysis of identifiable private information, 
or (2) accessing follow-up clinical data from procedures that subjects 
would undergo as part of standard care for their medical condition.
    Also, as discussed in Section IX, the NPRM proposed eliminating 
continuing review for many minimal risk studies (namely those that 
qualify for expedited review), unless the reviewer finds and documents 
why continuing review should take place for the study. Finally,

[[Page 7210]]

the NPRM contained a requirement that IRBs document the rationale for 
an expedited reviewer's determination that research appearing on the 
expedited review list is more than minimal risk (i.e., overturning the 
presumption that studies on the Secretary's list are minimal risk).
    New in the NPRM was a proposal to require that an IRB maintain 
records of exemption determinations. Additionally, the NPRM proposed 
that the use of the proposed exemption determination tool would satisfy 
the proposed documentation requirement.
    In addition, a new provision was proposed to require that the 
institution or IRB that retains IRB records should safeguard, if 
relevant, individually identifiable private information contained in 
those records in compliance with the proposed privacy safeguards.
    Finally, the NPRM proposed a modification of the pre-2018 rule 
clarifying that IRB records may be maintained in print or electronic 
form.

C. Public Comment

    The proposed modifications to Sec.  __.115 received approximately 
25 comments. A majority focused on three proposed revisions. The NPRM 
proposed to require that reviewers document why an IRB required 
continuing review when continuing review was not required as proposed 
in the NPRM. The majority of commenters opposed this requirement 
stating that it merely shifted administrative burden from one activity 
to another with no increase in protections.
    The NPRM also proposed to require that a reviewer document why a 
research activity appearing on the expedited review list is more than 
minimal risk, and thus should be subject to full IRB review. This was 
opposed by the majority of commenters who indicated that this proposal 
was an unjustified administrative burden.
    One commenter stated that the proposed documentation requirements 
would be punitive to IRBs. Several others suggested that this 
requirement served as a disincentive to institutions who wanted to 
implement additional protections than those required by the Common 
Rule. These commenters noted that this seemed in contrast to the 
longstanding policy articulation that the Common Rule served as a 
``floor'' for protections and that institutions could require 
additional protections for research conducted at their institutions.

D. Response to Comments and Explanation of the Final Rule: IRB Records

    A majority of the changes proposed in the NPRM in Sec.  __.115 have 
been retained in the final rule without alteration. However, the final 
rule differs from the NPRM in a few ways. First, the NPRM included two 
provisions requiring documentation of continuing review activities; 
these have been merged into one provision in the final rule at Sec.  
__.115(a)(3). Second, the NPRM required that the IRB keep records of 
the IRB reliance agreements between an institution and the IRBs not 
operated by that institution that review said institution's nonexempt 
research activities. Instead, the final rule includes language at Sec.  
__.115(a)(9) that requires each institution to maintain adequate 
documentation of the responsibilities that each entity will undertake 
to ensure compliance with this policy. This provision differs from the 
NPRM proposal to correspond to the more flexible provision included at 
Sec.  __.103(e), which does not require the creation of a written 
agreement between an institution and a reviewing IRB that said 
institution does not operate.
    Because the final rule does not include an exemption determination 
requirement, the exemption documentation requirement proposed in the 
NPRM is not included in the final rule. Additionally, because the final 
rule does not include specified privacy safeguards, the NPRM proposal 
for an IRB to safeguard records as required by the proposed privacy 
safeguards is not included.
    The final rule includes the NPRM proposal that IRBs document 
decisions to require continuing review or full board review even in 
circumstances when such review is not required because we believe it is 
important to document why an IRB is making a determination that differs 
from the regulatory baseline. This also helps to promote the principle 
of justice (as applied to IRB operations). Note that nothing in these 
regulations prevents an institution from authorizing an IRB to apply 
standards that exceed those in the regulations, if indeed the 
institution has chosen to do so.
    In addition, while the NPRM proposed to require that IRB records 
that contain identifiable private information be safeguarded through 
compliance with the proposed privacy safeguards, the final rule does 
not require such safeguards. Although no public comments were received 
on this provision, in deciding not to include the NPRM's proposed 
privacy safeguard requirements in the final rule, we determined that it 
was unnecessary for the Common Rule to impose additional privacy 
requirements on IRB records as we are unaware of instances in which IRB 
records were breached. In addition, IRB records are not the regulatory 
equivalent of research records, which should be adequately secured or 
safeguarded against inappropriate uses or disclosures of identifiable 
private information. IRB records will generally be secured for a 
variety of reasons. These include not only protecting identifiable 
private information, but also, for example, protecting discrete 
information and intellectual property that might be included in a 
protocol. There are other means for ensuring institutions and IRBs 
protect their records beyond what is required by the Common Rule.

XIV. General Requirements for Informed Consent (Sec.  __.116)

    The final rule contains several major revisions to the requirements 
for informed consent, specifically with respect to: (1) New 
requirements relating to the content, organization, and presentation of 
information included in the consent form and process to facilitate a 
prospective subject's decision about whether to participate in 
research; (2) the basic and additional elements of consent; (3) the 
elements of broad consent for the storage, maintenance, or secondary 
research use of identifiable private information and identifiable 
biospecimens; (4) attendant changes in the waiver or alteration 
criteria for consent; (5) a new provision that allows IRBs to approve a 
research proposal for which investigators obtain information or 
biospecimens without individuals' informed consent for the purpose of 
screening, recruiting, or determining the eligibility of prospective 
human subjects of research, provided certain conditions are met; and, 
(6) a new requirement to post to a federal Web site a copy of an IRB-
approved version of the consent form that was used for enrollment 
purposes for each clinical trial conducted or supported by a federal 
department or agency. Each of the final rule provisions are discussed 
separately below.

A. General Requirements for Informed Consent (Sec.  __.116(a))

1. Background and Pre-2018 Requirements
    Under the pre-2018 rule, many fundamental requirements applicable 
to all informed consents were set forth in

[[Page 7211]]

an introductory (and unnumbered) paragraph at the beginning of Sec.  
__.116.
    In considering changes to the general requirements set forth in 
Sec.  __.116(a), we considered arguments put forth by some that consent 
forms have evolved to protect institutions rather than to provide 
potential research subjects with the most important pieces of 
information that a person would need in order to make an informed 
decision about whether to enroll in a research study.\41\ Instead of 
presenting the information in a way that is most helpful to prospective 
subjects--such as explaining why someone might want to choose not to 
enroll--these individuals argued the forms may function more as sales 
documents or as a means to protect against institutional liability.\42\ 
We also considered a growing body of literature that suggests informed 
consent forms have grown too lengthy and complex, adversely affecting 
their ability to effectively convey the information needed for 
prospective participants to make an informed decision about 
participating in research.\43\
---------------------------------------------------------------------------

    \41\ Levine RJ. Informed consent: Some challenges to the 
universal validity of the western model. J Law Med Ethics 1991;19(3-
4):207-213.
    \42\ Menikoff J., Richards E. What the Doctor Didn't Say: The 
Hidden Truth about Medical Research. New York, NY: Oxford University 
Press; 2006:113-123.
    \43\ Beardsley E. et al. Longer Consent Forms for Clinical 
Trials Compromise Patient Understanding: So Why Are They 
Lengthening? Journal of Clinical Oncology. 2007 Mar 20;25(9):e13-4.
---------------------------------------------------------------------------

2. NPRM Proposals
    The NPRM proposed adding new language to the introductory text of 
Sec.  __.116 to emphasize the need to first provide essential 
information that a reasonable person would want to know in order to 
make an informed decision about whether to participate in research, and 
to provide an opportunity to discuss that information. Furthermore, in 
recognition of complaints that consent forms are too often complicated 
documents primarily used to protect sponsors from legal liability, the 
NPRM proposed requiring that the information in these forms be 
organized and presented in a way that does not merely provide lists of 
isolated facts, but rather facilitated the prospective subject's or 
representative's understanding of the reasons why one might or might 
not want to participate in the research.
    The NPRM also proposed that an investigator seeking to obtain 
informed consent be required to present first the information required 
by Sec.  __.116, which has been recognized by the Common Rule 
departments and agencies as the most fundamental and required content 
of informed consent, before providing other information, if any, to the 
subject. As proposed under the NPRM, the main portion of a consent 
document could include only the elements of informed consent that were 
required by the Common Rule, with any other information included in an 
appendix. This change was intended to lead to substantially shorter 
``core'' sections of consent forms, with prospective subjects receiving 
the most important information in the body of these relatively short 
forms, instead of that key information being buried in long and overly 
complex documents. As proposed, additional information could be set 
forth in appendices to consent forms.
    Given the consensus that informed consent forms should be written 
in appropriate language, this proposal reinforced the need to include 
information using language understandable to the subject. This goal was 
consistent with Federal Plain Language guidelines and the Federal Plain 
Writing Act of 2010. The NPRM proposed that the Secretary publish 
guidance at a later time to explain how consent forms could be written 
to comply with this regulatory requirement. Public comments were sought 
on what topics should be addressed in future guidance on improving the 
understandability of informed consents. As explained in the NPRM, it 
was not envisioned that the revised Common Rule would require a formal 
assessment to evaluate an individual's competency, but we acknowledged 
that such a practice might be appropriate for certain populations or 
studies.
    In addition, the NPRM proposed to clarify in the introductory 
language at Sec.  __.116 that if a HIPAA authorization is combined with 
a consent form, the authorization elements required by 45 CFR 164.508 
(part of the HIPAA Privacy regulations) must be included in the consent 
document and not the appendices. In other words, when informed consent 
for research under the Common Rule is combined with a HIPAA 
authorization, the NPRM proposed that the authorization elements would 
be considered to constitute one of the required elements of informed 
consent.
3. Public Comments
    Approximately 200 comments discussed the proposal to include 
information required by the Common Rule in the consent form and place 
other information in appendices. A majority of those (approximately 
140) supported the proposal and approximately 35 commenters opposed 
this proposal. Those who expressed support for this proposal generally 
noted agreement with the NPRM's rationale for the proposed revisions. 
Even those who supported the proposal stated that guidance would be 
needed for the proposal to be implemented and for the proposal to have 
the desired effect. Among those who opposed this proposal, all 
indicated support for the intention behind it. Reasons for opposing 
this proposal included:
     Concern that having a ``dual document'' system (with a 
primary consent form and appendices) would not actually improve 
subjects' understanding specifically and the informed consent process 
generally.
     Concerns that in some circumstances, the information that 
one might require to make an informed decision about research 
participation may not always be information required under the Common 
Rule when seeking and obtaining informed consent.
     Concern that the proposed language for the Sec.  __.116 
introductory paragraph should not be promulgated as regulatory text 
(and would be more appropriate as guidance).
     Concern that because the proposed language does not 
include specific standards and specific criteria, the provision would 
ultimately be impossible to implement and enforce.
     Concern that the language as proposed would not reduce the 
complexity and length of consent forms because much of the information 
generally contained in an informed consent document is required by 
various regulatory agencies. To this end, several commenters noted that 
the NPRM proposed an additional four required elements of consent, 
which would add to the quantity of information that is required to be 
discussed in an informed consent document.
    Some comments noted that although they liked the general idea of 
the proposal for the introductory paragraph of Sec.  __.116, they felt 
that the proposal should not focus on the length of a consent form, but 
rather on clarity and understandability. One comment expressed a need 
for guidance on how to implement the proposed language in the 
introductory paragraph of Sec.  __.116 and the requirement at Sec.  
__.109(b) of the pre-2018 rule.\44\ The NPRM did not

[[Page 7212]]

propose changing the latter item, which mandated that IRBs require that 
information given to subjects as part of informed consent conform with 
the requirement. However, the NPRM also permitted IRBs to require 
additional information if it would meaningfully add to the protection 
of the rights and welfare of subjects. This comment was made in light 
of the NPRM's proposal that information not required as an element of 
consent at Sec.  __.116 must be provided after providing the required 
elements of consent.
---------------------------------------------------------------------------

    \44\ Section __.109(b) of the pre-2018 rule states that an IRB 
shall require that information given to subjects as part of informed 
consent is in accordance with Sec.  __.116. The IRB may require that 
information, in addition to that specifically mentioned in Sec.  
__.116, be given to the subjects when in the IRB's judgment the 
information would meaningfully add to the protection of the rights 
and welfare of subjects.
---------------------------------------------------------------------------

    The NPRM asked about what topics should be addressed in future 
guidance on improving the understandability of informed consent. 
Approximately 35 commenters answered this question, a majority of which 
were universities and research institutions. Several commenters 
questioned whether the proposals in the introductory paragraph of Sec.  
__.116 would be enforceable, and how Common Rule departments and 
agencies would assess and enforce compliance.
    Several commenters indicated that mandating the order in which the 
content of consent forms should be presented may not always facilitate 
increased understanding by potential subjects because the best way to 
facilitate understanding is likely to be study specific. In other 
words, the order of importance of issues could be dependent on unique 
aspects of a given study. Others noted that most information in consent 
forms is there because the regulations require it to be included. Thus, 
the proposal to include the information required by the regulations up 
front, with all other information included as an appendix, is not a 
requirement that will inherently improve consent forms. Some commenters 
suggested that more research was needed on the informed consent process 
before prescribing specific approaches.
    Many commenters asked that future guidance be developed to assist 
in drafting consent forms that addresses language level, literacy, risk 
communication, and best practices in use of alternative media in the 
informed consent process (e.g., interactive presentation on a tablet, 
comic strips for pediatric populations). In this regard, some comments 
objected to the singular focus on a ``form'' in the proposed language, 
stating that this sends the message that alternative and innovative 
approaches to improving the informed consent process would be 
discouraged. Others noted that future guidance should include topics of 
interest to tribal groups, such as acknowledgement of community-level 
implications of research and clarification about the handling of 
biospecimens in a study.
    Several commenters noted that guidance should focus on how to 
foster understanding rather than focusing on mandatory length 
limitations on consent forms. However, a few comments endorsed a 
recommended page length maximum, citing it as perhaps the only way to 
force investigators and institutions to be brief and concise in the 
presentation of relevant information.
4. Response to Comments and Explanation of the Final Rule: General 
Requirements for Informed Consent
    Before addressing how the general requirements for informed consent 
proposed in the NPRM have been adopted and altered in the final rule, 
it is important to note that the structure for this regulatory text has 
been altered. In the pre-2018 rule, the general requirements were 
included in an unnumbered introductory paragraph. The NPRM proposed the 
same approach. To emphasize the fact that this paragraph includes 
multiple independent and important regulatory requirements, and to 
enable stakeholders and Common Rule departments and agencies to more 
easily reference particular requirements, these general requirements 
have been redesignated into a new Sec.  __.116(a). In addition, the 
general requirement for consent in the final rule at Sec.  __.116(a)(6) 
removes the reference to oral or written consent that was in the pre-
2018 rule. This is the provision that addresses the prohibition on 
including exculpatory language through which the subject or the legally 
authorized representative is made to waive or appear to waive any of 
the subject's legal rights, or releases or appears to release the 
investigator, the sponsor, the institution, or its agents from 
liability for negligence. The reference to oral or written consent was 
removed from this provision in the final rule. In its place, a similar 
reference was included in to Sec.  __.116(a) to clarify that all the 
requirements set forth in Sec.  __.116(a) apply to written and oral 
consent.
    Another change made in the final rule, as compared with the pre-
2018 rule and the language proposed in the NPRM, is that Sec.  
__.116(a) contains introductory language summarizing each paragraph of 
Sec.  __.116 and the relationship between those paragraphs. Given that 
the framework for informed consent has been altered and reorganized 
through this regulation, this introductory language is intended to 
explain the overall approach set forth in revised Sec.  __.116, as well 
as the significance of each paragraph. This introductory language is 
also intended to explain the role of broad consent under revised Sec.  
__.116. The introductory paragraph explains that the general 
requirements for informed consent are now set forth in Sec.  __.116(a) 
and that these general requirements apply with respect to informed 
consent obtained pursuant to Sec.  __.116(b), (c), and (d) (except, as 
described later, Sec.  __.116(a)(5) does not apply to broad consent 
obtained under Sec.  __.116(d)). This introductory language also 
explains that the basic elements of informed consent (which were 
described in Sec.  __.116(a) of the pre-2018 rule) are included in 
Sec.  __.116(b) of this final rule and that additional elements of 
informed consent that pertain only to certain studies (which were 
described in Sec.  __.116(b) of the pre-2018 rule) are included in 
Sec.  __.116(c) of this final rule.
    In addition, this introductory language explains that the 
requirements for broad consent (a concept not specifically addressed in 
the pre-2018 rule) are described in Sec.  __.116(d) of this final rule. 
As discussed below, broad consent under this final rule differs from 
the broad consent approach proposed for Sec.  __.116(c) in the NPRM. 
The introductory language of Sec.  __.116(a) explains that broad 
consent may be obtained in lieu of informed consent obtained under 
Sec.  __.116(b) and Sec.  __.116(c) (which describe basic elements of 
informed consent as a general matter and additional elements of 
informed consent that apply only to certain studies, respectively) for 
certain purposes. Specifically, in lieu of obtaining study-specific 
informed consent in accordance with Sec.  __.116(b) and (c), broad 
consent may be obtained under Sec.  __.116(d) for the use of 
identifiable private information or identifiable biospecimens collected 
for either research studies other than the proposed research or 
nonresearch purposes for: (1) storage and maintenance for secondary 
research use; and (2) secondary research. For those purposes (and no 
others), broad consent under Sec.  __.116(d) may be obtained instead of 
specific consent under Sec.  __.116(b) and (c).
    New introductory language at Sec.  __.116(a) also summarizes the 
provisions describing circumstances in which waiver or alteration of 
the requirements of informed consent are permitted. These circumstances 
pertain to research involving public benefit and service programs 
conducted by or

[[Page 7213]]

subject to the approval of state or local officials at Sec.  __.116(e), 
and to research more generally at Sec.  __.116(f) (see below).
    Another change reflected in the final rule is that specific 
requirements for informed consent have been included in subparagraphs 
for clarity and emphasis. For example, the requirement that information 
that is given to the subject or the legally authorized representative 
shall be in language understandable to such subject or representative 
is no longer included as part of a general introductory paragraph and 
is instead included as Sec.  __.116(a)(3). Except as noted here, these 
requirements remain the same as they were under the pre-2018 rule.
    The final rule adopts, almost verbatim, all of the proposals made 
in the NPRM to improve and clarify the general requirements for 
informed consent. For example, the final rule adopts the proposed 
requirement specifying that the information provided in an informed 
consent form must be presented in sufficient detail relating to the 
research, and must be organized and presented in a way that does not 
merely provide lists of isolated facts, but rather facilitates the 
prospective subject's or legally authorized representative's 
understanding of the reasons why one might or might not want to 
participate. The final rule also adopts new language clarifying that 
this requirement applies to the informed consent as a whole. In 
addition, the final rule adopts the NPRM's proposal that prospective 
subjects or legally authorized representative must be provided with key 
information that is most likely to assist a prospective subject or 
legally authorized representative in making a decision about 
participating in research, and to provide an opportunity to discuss 
that information. Moreover, the final rule adopts an approach, 
consistent with many public comments, emphasizing efforts to foster 
understanding overall rather than imposing specific length limitations 
on the entire consent forms.
    The final rule also includes language slightly different from that 
proposed in the NPRM for clarity or for conformance with other language 
in the final rule. For example, the final rule replaces references to a 
subject's representative with references to a subject's legally 
authorized representative (a term defined in Sec.  __.102) for clarity.
    As discussed above, a significant proposal in the NPRM was that in 
obtaining informed consent, investigators would first have to present 
the information required by Sec.  __.116, before presenting any other 
information, if any. In addition, the NPRM proposed mandating that 
consent forms must include only the required information under Sec.  
__.116 and that any other information be included in appendices. The 
final rule does not adopt a requirement that certain information be 
included only in appendices. This approach is responsive to public 
comments expressing concerns that such a mandate might sometimes 
undermine the informed consent process. The final rule adopts a slight 
variation of that approach in response to public comments about 
perceived lack of flexibility in the proposed language. Whereas the 
NPRM referred to the ``body'' of the consent form as opposed to 
appendices to the consent form, the final rule replaces those concepts 
with references to material that must be at the beginning of the 
consent form, versus material that can appear after that beginning 
section. The final rule does not limit the information that can be 
provided in the beginning of a consent form to only the Sec.  __.116 
requirements, but instead offers a more flexible and meaningful 
approach in response to public concerns that the NPRM proposal was too 
prescriptive. Moreover, the approach recognizes public comments that 
expressed concerns about creating a ``dual document'' system. As such, 
the final rule does not address appendices to the informed consent. 
However, the NPRM's references to the appendices of the consent form 
have in general been conceptually replaced by references to the 
material in a consent form that follows the ``beginning'' section.
    In particular, the final rule imposes a new requirement (set forth 
in Sec.  __.116(a)(5)(i)) that the informed consent begin with a 
concise and focused presentation of the key information that is most 
likely to assist a prospective subject or legally authorized 
representative in understanding the reasons why one might or might not 
want to participate in the research. This provision further requires 
that this beginning portion of the informed consent must be organized 
and presented in a way that facilitates comprehension. This requirement 
applies to all informed consents, except for broad consents obtained 
pursuant to Sec.  __.116(d), which may warrant a different 
presentation.
    This new requirement included at Sec.  __.116(a)(5)(i) is somewhat 
similar to the proposal advanced in the NPRM insofar as both emphasize 
the importance of presenting the information that would be most 
important to a subject (or a legally authorized representative) before 
presenting other information. However, the requirement included in 
Sec.  __.116(a)(5)(i) is more specific, detailed, and flexible. First, 
this provision requires that key information be included in the 
beginning of the informed consent in a concise and focused 
presentation. We recognize that how this requirement applies will 
depend on the nature of the specific research study and the information 
presented in the informed consent and believe that this requirement 
strikes an appropriate balance between facilitating the comprehension 
of subjects of key issues and allowing study-specific flexibilities. In 
general, our expectation is that this initial presentation of the key 
pieces of information will be relatively short. This section of the 
consent could, in appropriate circumstances, include a summary of 
relevant pieces of information that are explained in greater detail 
later in the consent form.
    The requirement that key information be presented in a concise and 
focused way will require an assessment that is specific to a study and 
its informed consent. For example, for most complicated clinical trials 
involving cancer patients with long (e.g., 20- to 25-page) consent 
documents, our expectation would be that the concise and focused 
presentation referred to in Sec.  __.116(a)(5)(i) would be no more than 
a few pages, and would provide the key pieces of information about the 
trial in such a manner that facilitates a person's comprehension of why 
they might or might not want to participate in the research.
    In such cases, for example, we would not consider a 10-page 
description of elements such as potential risks, accompanied by lengthy 
and complex charts and graphs, to satisfy the ``concise and focused'' 
requirement of Sec.  __.116(a)(5)(i). With regard to risks in the type 
of cancer trial mentioned above, for example, instead of needing to 
mention every reasonably foreseeable risk, which would be required by 
Sec.  __.116(b)(2), this beginning section of the consent form should 
identify the most important risks, similar to the information that a 
doctor might deliver in the clinical context in telling a patient how 
sick the chemotherapy drugs will make them, but with a particular 
emphasis on how those risks are changed by participating in the study.
    We recognize the advantages of allowing institutions to design 
informed consents, consistent with Sec.  __.116(a)(5)(i), that are 
tailored to particular research studies to assist prospective subjects 
in understanding the most fundamental aspects of the

[[Page 7214]]

informed consent. For this reason, the final rule does not strictly 
specify the types of information that should or should not be included 
to satisfy Sec.  __.116(a)(5)(i), or the length of such concise and 
focused presentations. This flexibility is responsive to public 
comments recommending against a rigid approach to enable institutions 
and individuals to tailor informed consents to the circumstances of 
particular studies. A discussion of the key information to be included 
in the beginning section of the consent form, and how it will operate 
in practice, may be further clarified in future guidance.
    We also recognize that for some relatively simple research studies 
with limited risks or benefits, the entire informed consent document 
may be relatively brief and still satisfy Sec.  __.116. In such 
circumstances, an institution may determine that virtually all of the 
information required by Sec.  __.116 would also satisfy Sec.  
__.116(a)(5)(i). In such cases, the informed consent document could 
include the concise and focused presentation of Sec.  __.116(a)(5)(i) 
at the beginning of the informed consent document, followed by limited 
additional information required to satisfy Sec.  __.116.
    In all circumstances (those involving lengthy and complex informed 
consents as well as short and relatively simple informed consents), if 
information included at the beginning of the informed consent satisfies 
both Sec.  __.116(a)(5)(i) and the elements of informed consent under 
Sec.  __.116(b) and Sec.  __.116(c) more generally, the information 
included at the beginning need not be repeated later in the body of the 
informed consent. Thus, with respect to the example provided above 
concerning a clinical trial with cancer patients, the most important 
reasonably foreseeable risks to subjects would be summarized at the 
beginning of the informed consent as part of Sec.  __.116(a)(5)(i)'s 
concise and focused presentation, but that a more comprehensive and 
detailed description of reasonably foreseeable risks to subjects would 
be included later in the body of the informed consent. In contrast, 
with respect to a relatively simple research study with limited risks, 
we would expect that all of the information provided to potential 
subjects concerning such risks might satisfy both Sec.  __.116(a)(5)(i) 
(as part of a concise and focused presentation of key information) and 
Sec.  __.116(b)(2) (a description of any reasonably foreseeable risks 
or discomforts to the subject). In such circumstances, the information 
provided at the beginning of the informed consent would not need to be 
repeated or further detailed in the informed consent and the entire 
informed consent could be relatively short.
    In general, we would expect that to satisfy Sec.  __.116(a)(5)(i), 
the beginning of an informed consent would include a concise 
explanation of the following: (1) the fact that consent is being sought 
for research and that participation is voluntary; (2) the purposes of 
the research, the expected duration of the prospective subject's 
participation, and the procedures to be followed in the research; (3) 
the reasonably foreseeable risks or discomforts to the prospective 
subject; (4) the benefits to the prospective subject or to others that 
may reasonably be expected from the research; and (5) appropriate 
alternative procedures or courses of treatment, if any, that might be 
advantageous to the prospective subject. As a general matter, a brief 
description of these five factors would encompass the key information 
most likely to assist a reasonable person (or legally authorized 
representative) in understanding the reasons why one might or might not 
want to participate in research, as required by Sec.  __.116(a)(5)(i) 
and Sec.  __.116(a)(4). However, we recognize that this determination 
is necessarily fact-specific and that IRBs and institutions may require 
that somewhat different (or additional) information be presented at the 
beginning of an informed consent to satisfy Sec.  __.116(a)(5)(i).
    The NPRM also proposed adding a new requirement to the general 
introductory paragraph of Sec.  __.116, which would provide that if an 
authorization required by 45 CFR parts 160 and 164 (parts of the HIPAA 
Privacy Rule) is combined with a consent form, the authorization 
elements required by 45 CFR 164.508 must be included in the consent 
form (and not the appendices). Because this final rule does not 
incorporate the distinction proposed in the NPRM between the informed 
consent and appendices, the final rule does not incorporate this 
language.
    We are satisfied that the approach adopted in this final rule will 
enable regulated entities and individuals to pursue different and 
innovative approaches to obtaining informed consent, as recommended in 
some public comments, while ensuring that the important aspects of 
informed consent are clearly communicated to prospective subjects and 
subjects.

B. Basic Elements of Informed Consent (Sec.  __.116(b))

1. Background and Pre-2018 Requirements
    Under the pre-2018 rule, investigators were generally required to 
obtain the subjects' informed consent to participate in research.\45\ 
The regulations required that the consent form include at least eight 
specific items of information, including: (1) an explanation of the 
purposes of the research, its duration, and procedures involved, and 
identification of any procedures which are experimental; (2) a 
description of the reasonably foreseeable risks; (3) a description of 
any potential benefits; (4) a disclosure of appropriate alternative 
procedures or courses of treatment, as relevant; (5) information about 
confidentiality of records, compensation, and treatments if injury 
occurs; (6) for research involving more than minimal risk, an 
explanation as to whether any compensation or medical treatments are 
available if injury occurs; (7) contact information; and (8) a 
statement that participation is voluntary, and that refusal to 
participate or decision to withdraw will involve no penalty or loss of 
benefits to which the subject is otherwise entitled.
---------------------------------------------------------------------------

    \45\ For general requirements for informed consent see Sec.  
__.116 in the pre-2018 Rule, and 21 CFR 50.20, .25 in FDA's 
comparable requirements. There are provisions under the Common Rule, 
that allow for the waiver of some or all of the elements of informed 
consent (see Sec.  __.116(e) and (f)). The Federal Food, Drug, and 
Cosmetic Act limits the circumstances under which informed consent 
can be waived. See, e.g., section 520(g) (21 U.S.C. 360j(g)). 
Currently, FDA regulations contain only two exceptions from informed 
consent in certain life-threatening and emergency situations under 
21 CFR 50.23-24. However, the 21st Century Cures Act recently 
amended the Federal Food, Drug and Cosmetic Act to allow waiver of 
informed consent for certain FDA-regulated minimal risk 
investigations.
---------------------------------------------------------------------------

2. NPRM Proposals
    In the NPRM it was proposed that research with nonidentified data 
continue to be considered not to involve ``human subjects.'' However, 
to better ensure that subjects are informed of the possibility that 
identifiers collected as part of a research study could be removed from 
the data and then be used for secondary research studies without the 
protections provided by this policy, it was proposed that a new element 
of informed consent be required. The new basic element of consent 
proposed in the NPRM at Sec.  __.116(a)(9) would apply to all research 
collecting identifiable private information. Based on the 
investigator's plans, the informed consent form and process would need 
to inform subjects either that: (1)

[[Page 7215]]

identifiers might be removed from the data and that the nonidentified 
data could be used for future research studies or distributed to 
another investigator for future research studies without additional 
informed consent from the subject or the representative, if this might 
be a possibility; or (2) the subject's data collected as part of the 
research, from which identifiers are removed, would not be used or 
distributed for future research studies.
3. Public Comments
    Approximately 40 public comments were received on the proposed new 
required element of informed consent found in the NPRM at proposed 
Sec.  __.116(a)(9). A large majority favored this proposal. Those who 
supported this proposal indicated that it provided useful information 
to prospective subjects about how private information obtained from a 
study might be used in the future. They also commented that it enhanced 
transparency in research, providing potential subjects with the 
information they need to decide whether to participate. Those who 
opposed this proposal suggested that it would increase the length of 
consent forms without appreciably improving potential subjects' 
understanding of a specific research activity.
4. Response to Comments and Explanation of the Final Rule: Basic 
Elements of Informed Consent
    The final rule, at Sec.  __.116(b)(9), adopts the NPRM proposal to 
inform potential subjects about the possible use of their identifiable 
private information with two clarifying changes. First, because the 
final rule at Sec.  __.102(e)(1) now states that the definition of 
human subject, in part, includes research in which an investigator 
obtains, uses, studies, analyzes, or generates identifiable 
biospecimens or identifiable private information, this new element of 
informed consent has been clarified to specifically apply to any 
research that involves the collection of identifiable biospecimens, 
rather than all biospecimens, in addition to research that involves the 
collection of identifiable private information. In addition, a change 
to what was proposed in the NPRM has been made to the new element of 
consent in the final rule at Sec.  __.116(b)(9)(ii), to clarify that it 
is intended to inform subjects that their information or biospecimens 
collected as part of the research will not be used or distributed for 
future research, even if identifiers are removed.
    We agree with the public comments that indicated this new element 
of consent will provide useful information to prospective subjects 
about whether their identifiable private information or identifiable 
biospecimens might be stripped of identifiers and used for future 
research studies or distributed to another investigator for future 
research studies without additional informed consent from the subject 
or the legally authorized representative.
    We expect that this information can usually be provided in a brief 
statement, and disagree with the commenters that suggested that this 
new basic element of consent would increase the length of consent forms 
without appreciably improving potential subjects' understanding of a 
specific research activity. This new requirement is intended to give 
the potential subject a right to know that identifiers might be removed 
from information or biospecimens and be used for future research 
without additional consent, when such a possibility exists, so he or 
she can make a fully informed decision about whether to participate in 
the research. If subjects' identifiable private information or 
identifiable biospecimens will not be used for future research studies, 
even if identifiers are removed, this new element of consent requires 
that subjects be informed of this as well. Finally, if a specific 
technology or technique determined to be capable of generating 
identifiable private information or identifiable biospecimens through 
the consultative process described at Sec.  __.102(e)(7) will be used, 
that information should be included in the description of the research 
at Sec.  __.116(b)(1).

C. Additional Elements of Informed Consent (Sec.  __.116(c))

1. Background and Pre-2018 Requirements
    The pre-2018 rule contained six additional elements of consent 
required when appropriate: (1) A statement that the particular 
treatment or procedure may involve risks to the subject (or to the 
embryo or fetus, if the subject is or may become pregnant) which are 
currently unforeseeable; (2) anticipated circumstances under which the 
subject's participation may be terminated by the investigator without 
regard to the subject's consent; (3) any additional costs to the 
subject that may result from participation in the research; (4) the 
consequences of a subject's decision to withdraw from the research and 
procedures for orderly termination of participation by the subject; (5) 
a statement that significant new findings developed during the course 
of the research which may relate to the subject's willingness to 
continue participation will be provided to the subject; and (6) the 
approximate number of subjects involved in the study.
2. NPRM Proposals
    The NPRM proposed adding three additional elements of consent that, 
when appropriate, would be required to be included in the informed 
consent form and process. These proposed additional elements of consent 
pertain to issues that have become more relevant in recent years as 
science has advanced and the nature of research has changed. One 
proposed new element would require that prospective subjects be 
informed that their biospecimens may be used for commercial profit and 
whether the subject will or will not share in this commercial profit. A 
second proposed element would require that prospective subjects be 
informed of whether clinically relevant research results, including 
individual research results, will be disclosed to subjects, and if so, 
under what conditions. A third proposed new element would provide 
subjects or their legally authorized representatives with an option to 
consent, or refuse to consent, to investigators re-contacting the 
research subject to obtain additional information or biospecimens, or 
for future research.
3. Public Comments
    Each of the proposed additional elements of informed consent found 
in the NPRM at Sec.  __.116(b)(7)-(9) received approximately 50 
comments. All three proposals were generally favored by the public. 
With respect to the proposed element of consent at Sec.  __.116(b)(7), 
requiring that prospective subjects be informed that their biospecimens 
may be used for commercial profit and whether the subject will or will 
not share in this commercial profit, comments, especially from 
individual members of the public not identified with any institution or 
organization, indicated that the extent to which an investigator might 
profit from information or biospecimens collected or used during a 
study was an important decision point as to whether a prospective 
subject would want to participate in a study. In response to proposed 
element Sec.  __.116(b)(8)--requiring that prospective subjects be 
informed of whether clinically relevant research results, including 
individual research results, will be disclosed to subjects, and if so, 
under what conditions--several public comments stated that knowing 
whether or not

[[Page 7216]]

research results would be returned to them was an important piece of 
information for them to know and understand in deciding whether to 
participate in a study.
    Finally, comments discussing Sec.  __.116(b)(9) regarding the 
potential to be contacted for future studies noted that allowing an 
individual to indicate whether or not he or she might be contacted for 
future research studies respected subject autonomy. Those who opposed 
the provision noted that while the intent of the provision was 
laudable, the ensuing tracking system that would need to be developed 
by institutions to track who had said ``yes'' or ``no'' to being re-
contacted, and in what circumstances, would be difficult to develop and 
maintain, and would also represent significant costs to institutions 
without a corresponding tangible increase in the protections afforded 
to human subjects.
4. Response to Comments and Explanation of the Final Rule: Additional 
Elements of Consent
    The final rule contains two of the three proposed additional 
elements of consent. The final rule does not include the additional 
element proposed in the NPRM relating to providing subjects or their 
legally authorized representatives the option to consent or refuse to 
consent to being re-contacted to obtain additional information or 
biospecimens, or for future research.
    New additional elements included in the final rule are: (1) A 
statement that the subject's biospecimens (even if identifiers are 
removed) may be used for commercial profit and whether the subject will 
or will not share in this commercial profit (Sec.  __.116(c)(7)); and 
(2) a statement regarding whether clinically relevant research results, 
including individual research results, will be disclosed to subjects, 
and if so, under what conditions (Sec.  __.116(c)(8)). Because many 
public comments addressed a desire to share in the profits of 
successful products developed using their biospecimens, we believe that 
investigators, when appropriate, should inform prospective subjects 
about whether they might or might not benefit commercially from future 
products resulting from the research, should that possibility be 
important in their decision making process. Also, several comments 
received from individuals who reported participation in research 
studies described disappointment that research results were not 
returned to them. We believe that potential subjects should be aware of 
the possibility that they might not receive research results, as well 
as the possibility that they might, so that they can factor that 
information into their decision about whether to consent to research. 
This provision is intended to pertain to all clinically relevant 
research results, including general or aggregate research findings and 
individual research results.
    We are also including in the final rule an additional element that 
when appropriate for research involving biospecimens, subjects be 
informed of whether the research will (if known) or might include whole 
genome sequencing (WGS) (Sec.  __.116(c)(9)). This provision of the 
final rule describes WGS as the sequencing of a human germline or 
somatic specimen with the intent to generate the genome or exome 
sequence of that specimen. WGS generates an extremely large amount of 
information about people, including factors that will contribute to 
their future medical conditions. As was recognized in the NPRM's 
Alternative Proposal A to expand the definition of ``human subject'' to 
include WGS (discussed in Section III), data obtained through WGS can 
provide important insights into the health of individuals as well as 
their biological family. It is also possible that WGS data gathered for 
one purpose may reveal important information, perhaps unanticipated and 
unplanned for, years later. Given the unique implications of the 
information that can be developed through WGS, if it is either known 
that a specific research study will include this technique, or might 
include it, we believe that this aspect of the research must be 
disclosed to prospective subjects as part of the informed consent 
process. It is recognized that under the pre-2018 rule, if a research 
study were to involve WGS, this research procedure would have almost 
always been included in the description of the research. However, to 
remove any ambiguity about whether such information would need to be 
included in the informed consent, the final rule makes this requirement 
explicit through this new element of consent.
    The information that would have to be disclosed under these 
additional elements of consent is often relevant to an individual's 
decision of whether to participate in a research study. Such 
information may have been included in informed consent forms under the 
pre-2018 rule. However, the final rule now requires inclusion of these 
additional elements, when appropriate.
    The additional element of consent proposed in the NPRM that was not 
included in the final rule would have required providing subjects or 
their legally authorized representatives with an option to consent, or 
refuse to consent, to investigators re-contacting the subject to seek 
additional information or biospecimens or to discuss participation in 
another research study. Although for some research studies, it will be 
desirable to inform prospective subjects about investigators' plan to 
re-contact subjects for certain purposes, and give them the option to 
agree or disagree to such re-contact, we agree with the public comments 
that questioned the importance of requiring that such information be 
included in the consent form. Although the final rule does not include 
this additional element of consent, this information can be included in 
the consent form.

D. Elements of Broad Consent for the Storage, Maintenance, and 
Secondary Research Use of Identifiable Private Information or 
Identifiable Biospecimens (Sec.  __.116(d))

1. Background and Pre-2018 Requirements
    Under the pre-2018 rule, if identifiers are removed from 
information and biospecimens such that the identity of the subject 
could not be readily ascertained by an investigator or associated with 
the information or biospecimens, then such information and biospecimens 
that have been collected for purposes other than the proposed research 
could be used without any requirement for informed consent. Similarly, 
under the HIPAA Privacy Rule, if data are de-identified or HIPAA 
identifiers do not accompany biospecimens, then the Privacy Rule does 
not apply. When identifiers have not been removed, under the pre-2018 
rule investigators were allowed in certain situations to obtain a 
consent that is broader than for a specific research study, such as for 
creating a research repository that involves obtaining biospecimens 
from living individuals for use in future research studies. In these 
cases, an IRB could determine that the original consent for the 
creation of the research repository satisfied the requirements of the 
Common Rule for the conduct of the future research, provided that the 
elements of consent continue to be satisfied for the future research. 
Despite this flexibility in the Common Rule, stakeholders and the 
Common Rule departments and agencies believe that the elements of 
consent required under Sec.  __.116 of the pre-2018 rule often were not 
satisfied in the case of broad consent for future unspecified research 
use of identifiable private information or identifiable biospecimens.

[[Page 7217]]

    With respect to HIPAA, HHS's pre-2013 interpretation of the HIPAA 
Privacy Rule was that authorizations for research needed to be study-
specific, and thus, that such authorizations could not authorize 
certain future unspecified research. However, in January 2013, the 
Office for Civil Rights modified its prior interpretation.\46\ Under 
the new interpretation, an authorization now may be obtained from an 
individual for uses and disclosures of protected health information for 
future research purposes, so long as the authorization adequately 
describes the future research such that it would be reasonable for the 
individual to expect that his or her protected health information could 
be used or disclosed for the future research purposes.
---------------------------------------------------------------------------

    \46\ HHS. Modifications to the HIPAA Privacy, Security, 
Enforcement, and Breach Notification Rules Under the Health 
Information Technology for Economic and Clinical Health Act and the 
Genetic Information Nondiscrimination Act; Other Modifications to 
the HIPAA Rules. 78 FR 5611 (Jan. 25, 2013). Retrieved from https://www.gpo.gov//fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf.
---------------------------------------------------------------------------

    Because biospecimens and information that have been collected for 
clinical use or purposes other than for the proposed research are often 
an important source of information and material for investigators, and 
the re-use of existing information and materials can be an efficient 
mechanism for conducting research without presenting additional 
physical or psychological risks to the individual, it seemed prudent to 
consider changes to current regulations relating to those issues.
2. NPRM Proposals
    The NPRM proposed to allow broad consent to cover the storage or 
maintenance for secondary research use of all biospecimens (regardless 
of identifiability) and identifiable private information. Broad consent 
would be permissible for the storage or maintenance for secondary 
research of such information and biospecimens that were originally 
collected for either research studies other than the proposed research 
or nonresearch purposes. The broad consent document would also meet the 
consent requirement for the use of such stored biospecimens and 
information for individual research studies. The NPRM made a separate 
case for nonidentified private information than it did for 
biospecimens, stating that consent would not be required for the 
secondary research use of nonidentified private information, such as 
the research use of medical records that have had all identifiers 
removed. Because the NPRM proposed that the definition of human subject 
be expanded to include all biospecimens, it also proposed to facilitate 
research using biospecimens by permitting broad consent to be obtained 
for their storage or maintenance for secondary research.
    It was envisioned that the proposed broad consent provision would 
be used by institutions and investigators to give individuals the 
choice to either allow or disallow the use of their biospecimens and 
identifiable private information for secondary research. In some cases, 
institutions would be expected to seek broad consent as part of a 
research protocol to create a research repository of biospecimens or 
information. However, in other cases it was expected that institutions, 
particularly those that do not typically conduct human subjects 
research, might not develop a research protocol to create a research 
repository, but still choose to seek broad consent from individuals for 
the research use of their biospecimens or identifiable private 
information. In such cases, these institutions might simply ``tag'' 
biospecimens and information as either available or not available for 
secondary research.
    Because broad consent is a different form of consent than the 
consent that is obtained for a specific research study, the NPRM 
proposed required elements for broad consent that would include several 
of the basic and additional elements of informed consent, but not all, 
and would include several additional required elements. The NPRM 
proposed to require that the information included in broad consent 
describe the biospecimens and identifiable private information that 
would be covered by the consent, recognizing that the biospecimens and 
information to be used in future research studies might be collected 
after the consent was obtained. Further, the NPRM proposed that broad 
consent for the research use of biospecimens or identifiable private 
information obtained for nonresearch purposes would be limited to 
covering either or both of the following: (1) Biospecimens or 
identifiable private information that exist at the time at which broad 
consent is sought; and (2) biospecimens or identifiable private 
information that will be collected up to 10 years after broad consent 
is obtained for adult subjects, and, for research involving children as 
subjects, biospecimens or identifiable private information that will be 
collected up to 10 years after broad consent is obtained or until the 
child reaches the legal age of consent to the treatments or procedures 
involved in the research, whichever comes first.
    The NPRM proposed to include the standard concerning who is a child 
based upon the definition of ``children'' as defined at 45 CFR 
46.402(a). At the time the child becomes an adult, the broad consent or 
permission would no longer be valid and either broad consent would need 
to be sought from the child-turned-adult, or the investigator would 
need to seek a waiver of informed consent in order to use the 
individual's biospecimens or identifiable private information for 
research, unless one of the exclusions or exemptions were applicable.
    A proposed element of broad consent in the NPRM included a 
requirement that subjects be informed that they may withdraw consent, 
if feasible, for research use or distribution of the subject's 
information or biospecimens at any time without penalty or loss of 
benefits to which the subject is otherwise entitled. However, 
information that has been stripped of identifiers might not be 
traceable. Thus, it might not be feasible to withdraw consent for 
future use or distribution in this case. If, however, an investigator 
committed to permitting a subject to discontinue the use of such 
information, it was expected that the investigator would honor this 
commitment by not stripping identifiers and using the information or 
biospecimens in research. The proposed regulations would not require 
investigators to make such a commitment.
    Another proposed element of broad consent in the NPRM related to 
the public posting of nonidentified data about a subject. This proposed 
element of broad consent would include an option, when relevant, for an 
adult subject or the subject's legally authorized representative to 
consent or refuse to consent to the inclusion of the subject's data 
with removal of the identifiers listed in the HIPAA Privacy Rule at 45 
CFR 164.514(b)(2)(i)(A) through (Q), in a database that is publicly 
available and openly accessible to anyone. This provision was proposed 
in the context of increasing interest in inviting study participants to 
allow their study data, in some cases including genomic data, to be 
made publicly available in order to maximize the potential for research 
that spurs increased understanding of disease processes. Under this 
provision, the consent document would be required to prominently note 
the option for the participant to allow the investigator to publically 
post (e.g., on a Web site) the participant's genomic or other 
potentially identifiable sensitive information, and to include a

[[Page 7218]]

description of the risks associated with public access to the data.
    To facilitate the use of broad consent, the NPRM proposed that the 
Secretary of HHS would publish in the Federal Register templates for 
broad consent that would contain all of the required elements of 
consent in these situations. It was envisioned that at least two broad 
consent templates would be developed: one for information and 
biospecimens originally collected in the research context, and another 
for information and biospecimens originally collected in the 
nonresearch context.
    Public comment was sought on whether broad consent to secondary 
research use of information and biospecimens collected for nonresearch 
purposes should be permissible without a boundary, or whether a time 
limitation or some other type of limitation should be imposed on 
information and biospecimens collected in the future that could be 
included in the broad consent as proposed in the NPRM. If a time limit 
should be required, public comment was sought on whether the NPRM 
proposal of up to 10 years was a reasonable limitation and whether a 
limitation related to an identified clinical encounter would better 
inform individuals of the clinical information and biospecimens that 
would be covered by a broad consent. Public comment was also sought on 
whether all of the elements of broad consent proposed in the NPRM 
should be required for the secondary use of biospecimens or 
identifiable private information originally collected as part of a 
research study that was conducted without consent because (1) either 
the original research study met an exclusion or exempt category of 
research, or (2) a waiver of consent was approved by an IRB.
    Public comment was sought on how likely investigators are to seek 
broad consent for the use of identifiable private information (as 
contrasted with biospecimens), given that provisions within the NPRM 
would make it easier to do such research without consent. In this 
regard, the NPRM proposal to prohibit waiver of consent by an IRB if a 
person has been asked for broad consent and refused to provide it could 
create a disincentive on the part of investigators from choosing to 
seek broad consent for research involving secondary use of identifiable 
private information. Given the costs and time and effort involved in 
implementing the system for obtaining broad consent for the use of 
identifiable private information and tracking when people provide 
consent or refuse to do so, the public was asked to comment on whether 
the benefits to the system were likely to outweigh the costs, and if 
so, whether the broad consent provisions should be limited to obtaining 
broad consent for research use of biospecimens.
3. Public Comments
    Approximately 475 comments addressed broad consent, a majority of 
which expressed opposition to broad consent as proposed and discussed 
in the NPRM. The basis of this opposition was largely related to the 
NPRM proposal that some type of consent (broad or specific) would be 
required for research with nonidentified biospecimens. A smaller number 
of comments (approximately 150) addressed the adequacy or inadequacy of 
broad consent as a concept, or the proposed broad consent templates to 
be created by HHS.
    Public comment on the proposed, but not yet developed, broad 
consent templates was mixed, with a majority of comments stating that 
it was impossible to comment on a template that had not yet been 
created. Even among those who supported the use of broad consent, some 
had questions about whether broad consent provided at one institution 
would be sufficient for research ultimately conducted at another 
institution. Many comments further noted that the entire regulatory 
schema around broad consent (e.g., exemptions dependent on broad 
consent, prohibition on an IRB waiving broad consent if broad consent 
had been sought and someone declined) required additional study and 
discussion and recommended that the department issue another NPRM on 
these issues following some form of systematic analysis and broader 
public consultation. A professional investigative pathology association 
and many of its members endorsed the concept of broad consent and the 
development of templates by the Federal Government, writing that they 
would be less burdensome but still a functional way of promoting 
ethically conducted biomedical research with biospecimens.
    Several commenters suggested that institutions needed to retain the 
ability to create and amend broad consent forms tailored to a variety 
of situations rather than rely on a federal template. These comments 
also generally stressed the importance of retaining an IRB's active 
role in reviewing the broad consent process and specific secondary 
research studies to ensure that interests other than autonomy and 
concerns other than those related to privacy were considered in a 
proposed study. A minority of commenters additionally expressed concern 
with the Federal Government's ability to develop broad consent 
templates that the regulated community might feel were sufficiently 
informative.
    Public comments were also mixed on whether or not broad consent as 
proposed in the NPRM would constitute meaningful consent. Many comments 
noted that a consent form sufficiently broad to cover all potential 
future secondary research uses of biospecimens or identifiable private 
information might be so broad and vague as to be not meaningful or 
informative to prospective research subjects. Others doubted the 
meaningfulness of broad consent obtained in the clinical setting. One 
academic research institution questioned whether it was really consent 
at all, but rather an agreement or permission, and another commenter 
questioned whether broad consent would increase subjects' autonomy.
    Many of the commenters who opposed broad consent also argued 
against any requirement to obtain consent for the use of nonidentified 
biospecimens. One academic research institution raised serious concerns 
about obtaining meaningful broad consent, which undermines existing 
privacy and other protections for subjects in research. Others noted 
that requiring broad consent for all secondary use of all biospecimens 
would require that there always be a link or code between the 
biospecimen and the subject's identity, which ultimately would result 
in an overall increase in privacy risks. Many commenters favored an 
opt-out system for broad consent (especially with respect to broad 
consent for use of nonidentified biospecimens). An AI/AN organization 
expressed overall concern about the concept of broad consent, noting 
that many AI/AN people believe that specimens and blood are considered 
sacred and recommending that all secondary uses of collected specimens 
and data should require an additional consent process, including tribal 
consent when specimens and data are obtained from AI/AN populations.
    Few comments were received on the actual proposed elements of broad 
consent. Of these, a majority expressed confusion with the proposals 
related to the duration of the consent and the scope of the 
biospecimens and identifiable information that could be collected.
    The NPRM also asked whether broad consent to secondary research use 
of information and biospecimens collected for nonresearch purposes 
should be permissible without a boundary, or whether a time limitation 
or some other

[[Page 7219]]

type of limitation should be imposed on information and biospecimens 
collected in the future that could be included in the broad consent. If 
a time limit should be required, the NPRM asked whether up to 10 years 
was a reasonable limitation. It also asked whether a limitation related 
to an identified clinical encounter would better inform individuals of 
the clinical information and biospecimens that would be covered by a 
broad consent document. Approximately 65 commenters specifically 
answered this question.
    Most who commented were opposed to the 10-year limitation on the 
period of time that an institution could collect biospecimens and 
information from an individual once broad consent had been sought and 
obtained. They stated that the limitation was arbitrary, not 
supportable by anything discussed in the NPRM, and presented an 
administrative burden for institutions and investigators to time stamp 
and track the 10-year limit for each subject. A few commenters stated 
that a 10-year limit is a reasonable boundary, but were concerned about 
the need to re-consent people once they reach the legal age of consent. 
In large data sets, identifying such people could be very challenging 
as people often move locations during such lengths of time, which would 
create an administrative barrier. A few commenters suggested that 10-
year boundary was too long and one research institution commented that 
in its experience individuals seem to prefer shorter time limits tied 
to specific periods (e.g., a series of clinical encounters, 
participation in an ongoing study).
    A few comments stated that any time limit could have a negative 
effect on rare disease research as the numbers of affected people are 
so small and, as discoveries are made, there is often a need to go back 
to years' worth of information or stored biospecimens to search for 
markers, mutations, or clinical information that is related to the new 
discovery. Such commenters expressed concern that this could be 
deleterious to individuals with rare disease seeking a diagnosis.
    Some commenters were confused about how the 10-year boundary 
proposed in the NPRM was supposed to function. Some comments assumed 
that one could only use the biospecimens or data for a 10-year period 
and after that period one would be required to get consent again for 
the use of those items. Others assumed that investigators would have to 
re-consent people every 10 years, but the information and biospecimens 
could be used indefinitely. For these reasons, many comments on the 10-
year boundary said it was unreasonable and unworkable operationally. 
Some suggested that instead of 10-year boundary, patients could be 
routinely reminded that they gave consent and can be reminded that they 
can opt out at any time. Several large research institutions commented 
that the time limit would necessitate a lot of tracking for 
institutions and could lead to smaller health care institutions ceasing 
their collection of biospecimens for research, which would ultimately 
have a negative impact on research.
    The NPRM also asked whether all of the elements of consent proposed 
at Sec.  __.116(c) should be required for the secondary use of 
biospecimens or identifiable private information originally collected 
as part of a research study that was conducted without consent because 
either the original research study met an exclusion or exempt category 
of research, or a waiver of consent was approved by an IRB. 
Approximately 30 comments answered this question. Responses ranged from 
those saying the elements are not as relevant as the burden of having 
to seek consent every 10 years. Many stated that the elements of 
consent appeared to be growing in the proposed rule at the same time 
that the rule was requiring simpler and shorter consent forms. As such, 
efforts should not be made to include all of the elements required in 
specific consent to broad consent; otherwise the intent of broad 
consent would be lost.
    The NPRM also asked whether oral consent should be permissible in 
limited circumstances as proposed under the exemption for the storage 
and maintenance of biospecimens and identifiable private information. 
More than 60 pathologists, pathology departments, and pathology 
organizations suggested that oral consent should not be allowed in this 
context because it raises too many administrative challenges and may 
undermine public trust. A few commenters felt oral consent should be 
permitted but generally did not provide a rationale.
    Finally, some comments indicated that broad consent as a concept 
should not be included in a final rule, and that the standards that 
exist under the pre-2018 rule for secondary research (i.e., either that 
an investigator obtains study specific consent or a waiver of informed 
consent from an IRB) should be maintained in a final rule.
4. Response to Comments and Explanation of the Final Rule: Elements of 
Broad Consent
    The final rule includes an option to obtain broad consent for the 
storage, maintenance, and secondary research use of identifiable 
private information or identifiable biospecimens, as defined at Sec.  
__.102(e)(5) and (6), but several significant changes were made in 
response to public comments. Although in some ways the final rule's 
broad consent provision resembles the provision that was proposed in 
the NPRM, it is important to recognize a very fundamental difference 
between the role that this provision will play under the final rule, as 
compared to the role it was intended to play under the NPRM. This key 
difference relates to the fact that the provisions in the NPRM that 
would have generally required consent for secondary research use of 
nonidentified biospecimens, including imposing narrow stringent 
criteria for IRB waiver of consent with respect to such research, are 
not being implemented because the NPRM's proposal that all 
biospecimens, regardless of their identifiability, be covered under the 
Common Rule has not been adopted. Importantly, under the final rule, 
broad consent is permissible only for secondary research and no other 
types of research.
    Thus, had all of those NPRM provisions been implemented, 
investigators who wanted to conduct secondary research with 
biospecimens would in most instances have found themselves essentially 
forced to use the new broad consent provisions as their only practical 
option for conducting such research. This is because generally, under 
the NPRM proposals, they would no longer have had the option to de-
identify information or biospecimens, or to use them in coded form, to 
avoid application of the Common Rule's requirements. Under the NPRM's 
proposals, had investigators not obtained broad consent, they would 
often not practicably be able to meet the informed consent requirements 
relating to such research (which would have been covered under the 
Common Rule). Therefore, it would generally have been the case that 
they would have had little choice but to obtain broad consent, assuming 
they did not want to undertake the alternative of obtaining study-
specific consent from subjects each and every time they conducted a 
study involving secondary use of biospecimens.
    Given that we did not adopt the NPRM's proposal to cover all 
biospecimens regardless of their

[[Page 7220]]

identifiability under the Common Rule, the final rule also does not 
adopt proposed consent requirements for secondary research with 
nonidentified biospecimens. For this reason, the final rule's 
provisions relating to broad consent now play a very different role 
from those proposed in the NPRM. In most instances, these provisions 
will be providing new options--that is, new flexibility--to an 
investigator, in addition to those options that an investigator would 
have had under the pre-2018 rule. An investigator wishing to do 
secondary research with biospecimens will continue to have the option 
of doing secondary research with nonidentifiable biospecimens, as was 
the case in the pre-2018 rule. An investigator also could continue to 
use biospecimens that are coded, thus allowing the collection of 
additional information about the subjects over time.\47\ In both of 
those instances, no additional consent would be required because the 
research would not involve human subjects as defined by the final rule. 
Furthermore, even if the investigator wanted to use the biospecimens 
with identifiers attached, he or she would still have the option of 
asking an IRB to waive the requirement to obtain informed consent: the 
waiver criteria are in most respects unchanged under the final rule.
---------------------------------------------------------------------------

    \47\ HHS. Office for Human Research Protections. Coded Private 
Information or Specimens Use in Research, Guidance. October 16, 
2008. Retrieved from https://www.hhs.gov/ohrp/regulations-and-policy/guidance/research-involving-coded-private-information/index.html.
---------------------------------------------------------------------------

    For these reasons, the broad consent provisions at Sec.  __.116(d) 
afford investigators wishing to conduct secondary research on 
identifiable private information or identifiable biospecimens an 
additional alternative to obtaining an IRB waiver of consent or to 
obtaining study-specific consent. Given that these new broad consent 
provisions are essentially a new alternative to other options that are 
very similar to those that existed under the pre-2018 rule, these 
provisions are not increasing any regulatory burden or making it more 
difficult to do research. Indeed, just the opposite is the case. The 
changes made in the final rule are responsive to the significant 
criticisms expressed by many of the commenters about what the NPRM 
proposed, under which obtaining broad consent would have imposed 
substantial new burdens on a vast amount of secondary research with 
biospecimens. In contrast, when investigators choose to use the broad 
consent provisions under the final rule, they will presumably be doing 
so because this new option is less burdensome to them than their other 
(largely unchanged) options for conducting such research.
    Although we recognize public commenters' concern that broad consent 
might not be as meaningful or informative as study-specific consent, it 
is also important to note that when an investigator chooses to use this 
new option, doing so will generally provide increased protection to the 
autonomy of research subjects. It will give them a choice to say no to 
such research, in contrast to most of the other routes by which an 
investigator might generally choose to conduct this type of research, 
such as with a waiver of informed consent, which allows research to 
take place regardless of the wishes of the person whose information or 
biospecimens are being studied, and without their knowledge. In 
addition, in response to the public's concerns that broad consent would 
not be meaningful, some of the elements of broad consent have changed 
from what was proposed in the NPRM to require more specific information 
about the research that may be conducted. As discussed in the NPRM, one 
of the main purposes of the final rule is to facilitate the conduct of 
minimal risk research, while enhancing subjects' autonomy. We believe 
that the option to obtain broad consent furthers this goal.
    It is important to recognize that broad consent is a permissible 
option only for secondary research. Secondary research is limited to 
research using identifiable private information or identifiable 
biospecimens that are collected for either research studies other than 
the proposed research or nonresearch purposes. It is not permissible to 
obtain broad consent for any other type of research (e.g., research 
involving the collection of information or biospecimens through a 
research interaction or intervention with a subject). The informed 
consent requirements in Sec.  __.116(b) and (c) will be applicable to 
all human subjects research for which broad consent is not an option. 
However, it is envisioned that research requiring study-specific 
consent, such as research involving the collection of information or 
biospecimens through a research interaction or intervention with a 
subject, will sometimes also involve seeking subjects' broad consent 
for the secondary research use of identifiable private information or 
identifiable biospecimens obtained as part of the original research 
study.
    When broad consent is obtained, the general requirements for 
informed consent in Sec.  __.116(a) apply, except that the requirements 
at Sec.  __.116(a)(5) (imposing certain requirements concerning the 
presentation of information for informed consent and prescribing the 
order in which consent information is presented) do not apply to broad 
consent.
    We expect that, given the different requirements set forth for 
study-specific consent and broad consent, some institutions and 
investigators may elect to pursue study-specific consents for the 
storage, maintenance, and secondary research uses of identifiable 
private information and identifiable biospecimens (or for some subset 
of such research) whereas other institutions and investigators may 
elect to pursue broad consent for the same types of research (or for 
some subset of such research). For instance, with regard to the public 
comments raising concern about broad consent being sought from AI/AN 
peoples, it is expected that institutions, investigators, and IRBs will 
consider these concerns when determining when it might be appropriate 
to seek study-specific consent for the secondary research use of 
identifiable biospecimens, as well as the need for tribal consent, when 
appropriate.
    Perhaps even more commonly, however, given that the NPRM proposal 
regarding generally requiring consent for research use of 
nonidentifiable biospecimens has not been adopted, many investigators 
may choose to use the routes that previously existed under the pre-2018 
rule, and will continue to exist, for conducting such research without 
informed consent under the Common Rule. Those options include using 
nonidentifiable biospecimens, including perhaps having a code 
maintained that will allow the investigator to obtain additional 
information about the subjects, or obtaining a waiver from an IRB of 
the need to obtain informed consent.
    The broad consent provision in the final rule is different in three 
main ways from what was proposed in the NPRM. First, consistent with 
the decision not to revise the definition of human subject to include 
biospecimens regardless of identifiability, the broad consent provision 
in Sec.  __.116(d) only applies to secondary research using 
identifiable private information and identifiable biospecimens.
    Second, the elements of broad consent have been strengthened and 
simplified in response to public comments. The final rule strengthens 
the element of broad consent proposed in the NPRM regarding the need to 
provide a general description of the types of research that may be 
conducted with identifiable private information and identifiable

[[Page 7221]]

biospecimens. It does this by requiring that this description must 
include sufficient information to allow a reasonable person to expect 
that the broad consent would permit the types of research conducted. 
This ``reasonable person'' standard is consistent with the 
interpretation that the Office for Civil Rights provided for 
authorization obtained from an individual for the use or disclosure of 
protected health information for future research purposes. In addition, 
the final rule has been strengthened to require that when subjects will 
not be informed about the details for any specific research studies 
that might be conducted using their identifiable private information or 
identifiable biospecimens, the broad consent must disclose this fact 
and inform subjects that they might have chosen not to consent to some 
of those specific research studies. It is envisioned that for certain 
types of research, such as research for which there is reason to 
believe some subjects will find the research controversial or 
objectionable, a more robust description of the research will be 
required in order to meet this ``reasonable person'' standard. This 
requirement has been included in the final rule in recognition of the 
concerns raised by some public commenters that broad consent would not 
be meaningful because it will not provide detailed information about 
specific research studies that might be conducted with the individual's 
identifiable private information or identifiable biospecimens.
    As proposed in the NPRM, the final rule permits broad consent to be 
sought for either a narrow type of research to be conducted in the 
future (e.g., cancer research), or a broader scope of research. Given 
this flexibility, while the final rule includes an exemption for 
secondary research for which broad consent is required, the exemption 
is contingent on several criteria being satisfied, including that an 
IRB determines that the research to be conducted is within the scope of 
the broad consent (Sec.  __.104(d)(8)). This exemption is further 
discussed in Section V. For research that is not exempt, the IRB is 
expected to assess whether the description of the research included in 
the broad consent form is adequate to permit a reasonable person to 
expect that they were providing consent for the currently proposed 
secondary research study.
    While strengthening the broad consent requirements, the final rule 
also adopts simplified and more flexible elements of broad consent than 
what was proposed in the NPRM. For example, the final rule requires 
that the broad consent include a description of the identifiable 
private information or identifiable biospecimens that might be used in 
research, whether sharing of such information or biospecimens might 
occur, and the types of institutions or investigators that might 
conduct research with such information or biospecimens. However, the 
final rule does not adopt the NPRM's proposed limitations on the 
research use of biospecimens or identifiable private information 
obtained for nonresearch purposes, that would have only permitted a 
broad consent to cover either or both of the following: (1) 
Biospecimens or identifiable private information that exist at the time 
at which broad consent is sought; and (2) biospecimens or identifiable 
private information that will be collected up to 10 years after broad 
consent is obtained or until the child reaches the legal age of consent 
to the treatments or procedures involved in the research, whichever 
comes first. We were persuaded by the public comments that raised 
concerns about the complexity and tracking burden that such limitations 
would impose, without clearly offering individuals a more meaningful 
way to control the use of their information or biospecimens.
    In addition, the broad consent requirements have been simplified to 
avoid creating redundant requirements with the basic elements of 
informed consent under Sec.  __.116(b) that must also be included in 
broad consent obtained under Sec.  __.116(d). For example, in the final 
rule, it is required that broad consent include a statement that 
participation is voluntary, refusal to participate will involve no 
penalty or loss of benefits to which the subject is otherwise entitled, 
and the subject may discontinue participation at any time without loss 
of benefits to which the subject is otherwise entitled ((Sec.  
__.116(d)(1), incorporating Sec.  __.116(b)(8) for broad consent). 
Therefore, the comparable element of broad consent that was proposed in 
the NPRM is not included in the final rule.
    As discussed in the NPRM, we expect that, when appropriate, this 
element of broad consent will inform subjects that information that has 
been stripped of identifiers might not be traceable, and thus it might 
not be feasible to withdraw consent for future use or distribution in 
this case. However, if an investigator commits to permitting a subject 
to discontinue use of the subject's identifiable private information or 
identifiable biospecimens, it is expected that the investigator will 
honor this commitment by not removing identifiers.
    Similarly, the final rule also does not include the element of 
broad consent proposed in the NPRM that, when relevant, would have 
required the broad consent to include an option for an adult subject or 
the representative to consent, or refuse to consent, to the inclusion 
of the subject's data, with removal of the identifiers listed in 45 CFR 
164.514(b)(2)(i)(A) through (Q), in a database that is publicly and 
openly accessible to anyone, and that this option be prominently noted 
and include a description of the risks of public access to the data. We 
believe this proposed requirement is unnecessary because it overlaps 
with the broad consent elements included in the final rule requiring a 
statement describing the extent, if any, to which confidentiality of 
records identifying the subject will be maintained (Sec.  __.116(d)(1), 
incorporating Sec.  __.116(b)(5) for broad consent), and a description 
of any reasonably foreseeable risks or discomforts to the subject 
(Sec.  __.116(d)(1), incorporating Sec.  __.116(b)(2) for broad 
consent).
    The final rule includes a slightly different provision relating to 
the return of research results than that proposed in the NPRM. As set 
forth in Sec.  __.116(d)(6) of the final rule, unless it is known that 
clinically relevant research results, including individual research 
results, will be disclosed to the subject in all circumstances, a 
statement that such results may not be disclosed to the subject must be 
included in the broad consent. This element of broad consent differs 
from the related requirement in Sec.  __.116(c)(8) that pertains when 
an investigator is seeking consent for a specific study, since unlike 
the circumstances under which broad consent is likely to be sought, 
investigators seeking consent for a specific study will know if the 
study includes a plan to return research results to subjects. The NPRM 
proposed that a general element of informed consent be included as part 
of a broad consent, namely that the consent include a statement 
regarding whether clinically relevant research results, including 
individual research results, would be disclosed to subjects, and if so, 
under what conditions. The language adopted in the final rule is 
intended to provide transparency, but is tailored to the broad consent 
context as those seeking broad consent may not know whether clinically 
relevant research results, including individual research results, will 
always be disclosed to subjects, and if so, under what conditions. 
Nonetheless, unless investigators know that such results will

[[Page 7222]]

be disclosed to subjects in all circumstances, subjects will be 
informed through a broad consent of the possibility that such results 
will not be disclosed to them. This provision is intended to pertain to 
all clinically relevant research results, including general or 
aggregate research findings and individual research results. This 
element of broad consent will affect the applicability of the exemption 
set forth at Sec.  __.104(d)(8), for secondary research for which broad 
consent is required. This exemption applies only if the investigator 
does not include returning individual research results to subjects as 
part of the study plan (noting, however, that this provision does not 
prevent an investigator from abiding by any legal requirements to 
return individual research results). Although it is envisioned that 
broad consent will often be sought with the expectation that specific 
secondary research studies using identifiable private information or 
identifiable biospecimens will be exempt under Sec.  __.104(d)(8), this 
will not always be the case. Broad consent can also be obtained for 
secondary research that will not qualify for this exemption, such as 
secondary research that will involve returning clinically relevant 
research results to subjects. In these cases, the specific secondary 
research study will need to undergo IRB review and approval under Sec.  
__.111, and we expect that the IRB would consider what subjects were 
told in the broad consent regarding the return of research results. The 
only exception to the requirement for IRB review of such research, if 
covered by this policy, is if the research qualifies for another 
exemption or the research is carried out under a Secretarial waiver at 
Sec.  __.101(i).
    Finally, the third main difference between the NPRM and final rule 
provision on broad consent is that the final rule does not include 
broad consent templates to be established by the Secretary of HHS. We 
agree with the public comments that favored allowing institutions to 
create their own broad consent forms that could be tailored to a 
variety of circumstances. Therefore, under the final rule, 
investigators and institutions may develop broad consent forms, which, 
provided specified conditions are satisfied, would meet the exemption 
for the storage and maintenance for secondary research use of 
identifiable biospecimens or identifiable private information (Sec.  
__.104(d)(7)). This exemption is further discussed in Section V. At a 
later time, the Secretary of HHS expects to develop guidance on broad 
consent, which could include broad consent templates.
    In addition, we are also including in the final rule an element 
that for research involving biospecimens, when appropriate, the broad 
consent must state whether the research will (if known) or might 
include whole genome sequencing (WGS) (Sec.  __.116(d)(1), 
incorporating Sec.  __.116(c)(9)). The reasons for requiring this 
element in the broad consent are similar to those discussed above 
regarding the addition of this requirement in the additional elements 
of consent at Sec.  __.116(c)(9). WGS generates an extremely large 
amount of data, which when analyzed can yield information about an 
individual, including factors that could contribute to their future 
medical conditions. Therefore, given the implications of WGS 
information for an individual and his or her biological family, if it 
is known that the broad consent will or might permit the use of 
individuals' biospecimens for WGS, we believe that this aspect of the 
research must be disclosed to prospective subjects as part of the broad 
consent process. The broad consent must include a general description 
of the types of research that may be conducted with the identifiable 
private information or identifiable biospecimens, with sufficient 
information to allow a reasonable person to expect that the broad 
consent would permit the types of research conducted (Sec.  
__.116(d)(2)). Including an additional element of broad consent that 
specifically addresses WGS makes it clear that such information must be 
disclosed to prospective subjects.
    Under the final rule, if the subject or the subject's legally 
authorized representative is asked to provide broad consent, the broad 
consent must satisfy the general informed consent requirements at Sec.  
__.116(a)(1)-(4), and (a)(6), and must include all of the following 12 
elements that are applicable:
     A description of any reasonably foreseeable risks or 
discomforts to the subjects (Sec.  __.116(d)(1), incorporating basic 
elements of informed consent in Sec.  __.116(b)(2));
     A description of any benefits to the subject or to others 
that may reasonably be expected from the research ((Sec.  __.116(d)(1), 
incorporating basic elements of informed consent in Sec.  __.116(b)(3);
     A statement describing the extent, if any, to which 
confidentiality of records identifying the subject will be maintained 
((Sec.  __.116(d)(1), incorporating basic elements of informed consent 
in Sec.  __.116(b)(5));
     A statement that participation is voluntary, refusal to 
participate will involve no penalty or loss of benefits to which the 
subject is otherwise entitled, and the subject may discontinue 
participation at any time without penalty or loss of benefits to which 
the subject is otherwise entitled ((Sec.  __.116(d)(1), incorporating 
basic elements of informed consent in Sec.  __.116(b)(8));
     If applicable, a statement that the subject's biospecimens 
(even if identifiers are removed) may be used for commercial profit and 
whether the subject will or will not share in this commercial profit 
((Sec.  __.116(d)(1), incorporating additional elements of consent in 
Sec.  __.116(c)(7));
     When appropriate, for research involving biospecimens, 
whether the research will (if known) or might include WGS (i.e., 
sequencing of a human germline or somatic specimen with the intent to 
generate the genome or exome sequence of that specimen.) ((Sec.  
__.116(d)(1), incorporating the additional element of consent in Sec.  
__.116(c)(9));
     A general description of the types of research that may be 
conducted with identifiable private information or identifiable 
biospecimens. This description must include sufficient information to 
permit a reasonable person to expect that the broad consent would 
permit the types of research conducted (Sec.  __.116(d)(2));
     A description of the identifiable private information or 
identifiable biospecimens that might be used in research, whether 
sharing of such information or biospecimens might occur, and the types 
of institutions or investigators that might conduct research with such 
information or biospecimens (Sec.  __.116(d)(3));
     A description of the period of time allowed that the 
identifiable private information or identifiable biospecimens may be 
stored and maintained (which period of time could be indefinite), and a 
description of the period of time that such information or biospecimens 
may be used for research purposes (which period of time could be 
indefinite (Sec.  __.116(d)(4));
     Unless the subject or legally authorized representative 
will be provided details about specific research studies, a statement 
that they will not be informed of the details of any specific research 
studies that might be conducted using the subject's identifiable 
private information or identifiable biospecimens, including the 
purposes of the research and that they

[[Page 7223]]

might have chosen not to consent to some of those specific research 
studies (Sec.  __.116(d)(5));
     Unless it is known that clinically relevant research 
results, including individual research results, will be disclosed to 
the subject in all circumstances, a statement that such results may not 
be disclosed to the subject; (Sec.  __.116(d)(6)); and
     An explanation of whom to contact for answers to questions 
about the subject's rights about storage and use of the subject's 
identifiable private information or identifiable biospecimens, and whom 
to contact in the event of a research-related harm (Sec.  
__.116(d)(7)).
    The elements of broad consent described in the first six bullet 
points above are not unique to broad consent, while the elements 
described in the last six bullet points are specific to the 
requirements of broad consent.

E. Waiver or Alteration of Informed Consent Involving Public Benefit 
and Service Programs (Sec.  __.116(e))

1. Background and Pre-2018 Requirements
    The pre-2018 rule permitted an IRB to waive the requirements for 
obtaining informed consent, or to alter such requirements, under two 
sets of circumstances described at Sec.  __.116(c) or (d) of the pre-
2018 rule. The first set of circumstances, described at Sec.  __.116(c) 
of the pre-2018 rule was more narrow and was limited to certain 
research or demonstration projects conducted by or subject to the 
approval of state or local government officials. These projects are 
similar in some ways to the projects identified in the exemption at 
Sec.  __.104(d)(5) of this final rule. The broader provisions 
concerning waivers or alterations of the requirements of informed 
consent that apply beyond the circumstances described in Sec.  
__.116(c) of the pre-2018 rule are discussed below in the section 
concerning Sec.  __.116(f).
2. NPRM Proposal
    The NPRM proposed retaining the waiver and alteration of informed 
consent provisions included in the pre-2018 rule with respect to 
research involving public benefit and service programs conducted by or 
subject to the approval of state or local officials, with two 
exceptions. First, the NPRM proposed (for proposed Sec.  __.116(e)(2)), 
additional criteria for waiver or alteration of consent for 
biospecimens. This was tied to the NPRM's proposal that all 
biospecimens, regardless of their identifiability, be covered under the 
Common Rule. Under these proposed criteria, IRBs would be able to 
approve waivers or alterations of the required informed consent 
elements only if an IRB found and documented both that there were 
compelling scientific reasons to conduct the research and that the 
research could not be conducted with other biospecimens for which 
informed consent was obtained or could be obtained. Second, the NPRM 
proposed new language (for proposed Sec.  __.116(e)(3)), providing that 
if an individual was asked to consent to the storage or maintenance for 
secondary research use of biospecimens or identifiable private 
information in accordance with the proposed broad consent provisions 
and that individual refused to consent, the IRB would be prohibited 
from waiving consent for the storage, maintenance, or the secondary 
research use of the biospecimens or information.
3. Response to Comments and Explanation of the Final Rule: Waiver or 
Alteration of Informed Consent Involving Public Benefit and Service 
Programs
    Public comments on this proposal are described in section F below 
because the comments submitted generally addressed the waiver and 
alteration criteria under both proposed Sec.  __.116(e) and Sec.  
__.116(f).
    The final rule adopts one of the two proposals made in the NPRM for 
proposed Sec.  __.116(e). The final rule adopts (in Sec.  __.116(e)(1)) 
the language proposed in the NPRM providing that if an individual was 
asked to consent to the storage or maintenance for secondary research 
use of identifiable private information or identifiable biospecimens in 
accordance with the proposed broad consent provisions and such 
individual refused to consent, the IRB would be prohibited from waiving 
consent for the storage, maintenance, or the secondary research use of 
such biospecimens or information. The references in this provision to 
biospecimens are changed to refer specifically to identifiable 
biospecimens as the final rule does not apply to the research use of 
nonidentifiable biospecimens. This change is intended to honor the 
autonomy of individuals and to further the Belmont Report principle of 
respect for persons, in that this provision will prevent an 
individual's refusal to consent to additional research use of 
information or biospecimens from being overridden.
    The final rule does not incorporate the NPRM's proposed additional 
waiver criterion to apply to research involving the use of 
biospecimens. This change is not necessary given that the proposal in 
the NPRM that the Common Rule extend to all biospecimens has not been 
adopted in the final rule. We determined that the waiver and alteration 
criteria included in the final rule are appropriately protective of 
identifiable biospecimens, as defined at Sec.  __.102(e)(6) and that an 
additional waiver criterion for such biospecimens is not warranted. For 
example, Sec.  __.116(e)(3)(ii) mandates that an IRB may not waive or 
alter the requirements of informed consent with respect to research 
under this category unless the research could not practicably be 
carried out without the waiver or alteration.
    The format and organization of Sec.  __.116(e) in the final rule is 
different from that included in the pre-2018 rule or proposed in the 
NPRM. These changes were implemented to be clearer about the effect of 
each requirement. Most significantly, Sec.  __.116(e) in the final rule 
provides separate paragraphs concerning the applicable criteria for 
waiver and the applicable criteria for alteration of the requirements 
for informed consent. This differs from the approach proposed in the 
NPRM, and the approach included in the pre-2018 rule, that did not 
separate those discussions. We concluded that separating the discussion 
of waiver and the discussion of alteration would help clarify the 
applicable criteria, particularly given that the final rule addresses 
broad consent.
    Section __.116(e)(1) describes the general framework for an IRB to 
waive the requirements for informed consent. This paragraph explains 
that an IRB may waive the requirement to obtain informed consent under 
Sec.  __.116(a) (general requirements for informed consent), Sec.  
__.116(b) (basic elements of informed consent), or Sec.  __.116(c) 
(additional elements of informed consent that apply to certain 
research) if the IRB satisfies the criteria set forth at Sec.  
__.116(e)(3) (discussed below). As explained above, the ability to 
satisfy the requirement to obtain informed consent of a subject or a 
subject's legally authorized representative through use of a broad 
consent in particular circumstances is a flexibility offered to 
institutions, but institutions are never required to obtain informed 
consent through a broad consent process. For this reason, Sec.  
__.116(e)(1) does not provide that an IRB may waive the requirement to 
obtain informed consent under Sec.  __.116(d) (broad consent) because 
use of broad consent is not a requirement. As noted above, and to honor 
the autonomy of individuals, Sec.  __.116(e)(1) prohibits an IRB from

[[Page 7224]]

waiving consent for the storage, maintenance, or secondary research 
uses of identifiable private biospecimens or identifiable private 
information if an individual was asked to provide broad consent for 
such purposes and refused to provide such consent.
    Section __.116(e)(2) describes the general framework for an IRB to 
alter the requirements for informed consent. An IRB may omit or alter 
some or all of the elements of informed consent under Sec.  __.116(b) 
(basic elements of informed consent) or Sec.  __.116(c) (additional 
elements of informed consent that apply to certain research) if the IRB 
satisfies the criteria set forth at Sec.  __.116(e)(3) (discussed 
below). This is consistent with the proposal made in the NPRM. This 
paragraph further explains that an IRB may not omit or alter any of the 
requirements described in Sec.  __.116(a) (general requirements for 
informed consent). This is also consistent with the proposal made in 
the NPRM (which proposed permitting an IRB to omit or alter elements of 
informed consent, but did not propose permitting omissions or 
alterations of the general requirements of informed consent that were 
included in the unnumbered introductory paragraph in the pre-2018 rule 
at Sec.  __.116). This paragraph also specifies that if a broad consent 
is used, an IRB may not omit or alter any of the elements required 
under Sec.  __.116(d). We determined that it would not be appropriate 
to permit the omission or alteration of any of the broad consent 
elements given the fact that the required elements of broad consent are 
limited and given our view that each of these elements (described at 
Sec.  __.116(d)) is critical for the purpose of soliciting broad 
consent that is both informed and ethically appropriate. This approach 
is different from what was proposed in the NPRM because of the NPRM's 
different approach to broad consent than that adopted in the final 
rule.
    Section __.116(e)(3) sets forth the specific criteria that an IRB 
must find and document to waive or alter the requirements for informed 
consent, consistent with the limitations set forth in Sec.  
__.116(e)(1) and Sec.  __.116(e)(2). These criteria are the same as 
those proposed in the NPRM. First, the IRB must find and document that 
the research or demonstration project is to be conducted by or subject 
to the approval of state or local government officials and is designed 
to study, evaluate, or otherwise examine public benefit or service 
programs; procedures for obtaining benefits or services under those 
programs; possible changes in or alternatives to those programs or 
procedures; or possible changes in methods or levels of payment for 
benefits or services under those programs. Second, the IRB must find 
and document that the research could not practicably be carried out 
without the waiver or alteration.

F. General Waiver or Alteration of Informed Consent (Sec.  __.116(f))

1. Background and Pre-2018 Requirements
    Beyond the circumstances addressed in Sec.  __.116(c) of the pre-
2018 rule (which is limited to certain research conducted by or subject 
to the approval of state or local government officials), the pre-2018 
rule includes a more general provision that is not limited to any 
particular type of research and that permits an IRB to either waive the 
requirements for obtaining informed consent, or to alter such 
requirements. Waiver or alteration of the requirements of informed 
consent under this general provision requires that the following four 
criteria be satisfied: (1) the research involves no more than minimal 
risk to the subjects; (2) the waiver or alteration will not adversely 
affect the rights and welfare of the subjects; (3) the research could 
not practicably be carried out without the waiver or alteration; and 
(4) whenever appropriate, the subjects will be provided with additional 
pertinent information after participation.
    Concerns have been expressed that requirements for obtaining 
waivers of informed consent or waivers of documentation of informed 
consent were confusing and inflexible, resulting in inconsistent 
application and a lack of uniformity in interpretation, which led to 
the proposals in the NPRM.
2. NPRM Proposals
    The NPRM offered three substantive proposals related to the general 
waiver or alteration of informed consent provisions. First, the NPRM 
proposed to add a new waiver criterion that would require that for 
research involving access to or use of identifiable biospecimens or 
identifiable private information, the requirements of informed consent 
could only be waived or altered if the research could not practicably 
be carried out without accessing or using identifiers. This criterion 
was modeled on the comparable criterion in the HIPAA Privacy Rule, 
which requires as a condition of waiver of the requirement to obtain an 
individual's authorization that the research could not practicably be 
conducted without access to and use of protected health information. 
The principle embodied in this additional proposed criterion was that 
nonidentified information should be used whenever possible in order to 
respect subjects' interests in protecting the confidentiality of their 
data and biospecimens.
    Second, the NPRM proposed two additional waiver criteria for 
research involving the use of biospecimens. For such research, the NPRM 
proposed that the requirements of informed consent could only be waived 
or altered if an IRB found and documented that: (1) there were 
compelling scientific reasons for the research use of the biospecimens; 
and (2) the research could not be conducted with other biospecimens for 
which informed consent was or could be obtained.
    Third, the NPRM proposed that the Common Rule prohibit IRBs from 
waiving informed consent if individuals were asked and refused to 
provide broad consent to the storage and maintenance for secondary 
research use of biospecimens and identifiable private information. If a 
subject refused to provide broad consent, it was proposed that this 
refusal would need to be recorded by the investigator to better ensure 
that the subject's wishes would be honored.
3. Public Comments
    Approximately 975 public comments discussed the NPRM proposals 
found at Sec.  __.116(f) either directly, or as related to linked 
provisions related to the definition of human subject, the broad 
consent proposal, or proposed exemptions. A majority of these discussed 
the NPRM proposals related to the more stringent waiver criteria for 
research involving biospecimens. A majority of these comments were from 
patients (including family members of patients) and other individuals 
who commented anonymously. Patients tended to oppose these proposals 
because they believed they would severely restrict access to 
biospecimens, which would slow research. Some commenters were opposed 
to waiver of consent under any conditions, whether specific or broad 
consent.
    Approximately 40 comments were received on the NPRM's proposal to 
prohibit an IRB from waiving consent for the storage, maintenance, or 
secondary research uses of identifiable biospecimens or identifiable 
private information if an individual was asked to provide broad consent 
for such purposes and refused to provide such consent. Public comment 
was mixed. Those who supported it indicated that this requirement made 
sense in order to respect subject autonomy. Those who

[[Page 7225]]

opposed the proposal indicated that it would be impossible for an IRB 
to know the reasons why an individual refused to sign a broad consent 
form. Thus, these individuals argued, the prohibition on waiver of 
consent did not seem appropriate given the difficulty in understanding 
why someone refused to sign a broad consent form. Several commenters 
noted that it would be reasonable to prohibit an IRB from waiving a 
subject's refusal to provide consent to a specific study, but that such 
a prohibition in the context of broad consent seemed unduly burdensome.
    The NPRM sought comments concerning language in the pre-2018 rule 
(that the NPRM proposed retaining) that waiver or alteration of 
informed consent only occur if the IRB finds that the research could 
not practicably be carried out without the requested waiver or 
alteration. Several commenters recommended further defining or 
clarifying the meaning of ``practicably.'' Some members of the public 
felt that this criterion was too open-ended and that greater emphasis 
should be placed on respect for persons over other ethical concerns and 
scientific validity. Several commenters favored SACHRP's 
recommendations on this topic, including that this requirement be 
interpreted to mean that it would be impracticable to perform the 
research, not impracticable to obtain consent due to financial or 
administrative burdens, without the waiver or alteration. Another 
commenter argued that because of a lack of clarity as to the meaning of 
terms including ``minimal risk,'' ``practicably,'' and ``the rights and 
welfare of subjects,'' as well as the potential that IRBs may not apply 
the criteria uniformly, IRBs should not be able to waive or alter 
consent. The following suggestions were offered as replacement 
language: ``reasonably done without excessive time or financial 
constraints to the researcher that would delay the project so 
significantly as to make it impossible to conduct the research,'' 
``capable of being done or accomplished with available means or 
resources,'' ``reasonably feasible,'' ``capable of being effective,'' 
and ``could practicably be obtained.'' Several commenters favored 
retaining the term ``practicably'' and were satisfied that it was 
clear.
    Other comments raised different issues about waiver or alteration. 
Many commenters who opposed all classified research conducted without 
consent recommended that waivers be prohibited with respect to 
classified research involving humans. One commenter recommended a 
reorganization of the waiver and alteration provisions to clarify the 
different standards that apply to waivers and alterations. Another 
commenter expressed concern that the NPRM's proposed waiver provision 
would unreasonably limit the flexibility of IRBs. One commenter 
believed that the Sec.  __.116(f) alteration criteria were too rigid 
and that the final rule should incorporate a notion of risk adjustment. 
Another commenter (a professional medical organization) supported 
SACHRP's proposed revisions to the waiver criteria at Sec.  __.116(f) 
to allow an IRB to approve the storage, maintenance, and secondary 
research use of identified data.
    The NPRM sought public comment on the proposed differences between 
the criteria for waiving informed consent for the research use of 
biospecimens versus identifiable information. Approximately 60 comments 
stated that no justification exists for treating biospecimens and 
information differently. Some also noted that the proposed criteria for 
waiver of consent for use of biospecimens is so high as to be virtually 
impossible to meet and asked why biospecimens should have a higher 
standard than information (which theoretically could be more easily 
identifiable). One commenter noted that the proposed waiver criteria 
promotes ``biospecimen exceptionalism'' and that data and biospecimens 
should be treated the same.
    A request in the NPRM for public comment on whether the proposal to 
permit an IRB to waive consent for research involving the use of 
biospecimens should be included in the regulations received few 
comments. One commenter noted that it seemed incongruous to include 
biospecimens in the definition of ``human subject,'' but then allow 
waiver based on different criteria. Others stated that IRBs should 
continue to have the ability to waive consent.
    The NPRM sought public comment regarding how likely investigators 
are to seek broad consent for the use of identifiable private 
information (as contrasted with biospecimens), given that the NPRM 
contains provisions that would make it easier to do such research 
without consent (such as the new exemption proposed for Sec.  
__.104(e)(2)). Approximately 30 commenters responded to this question. 
A majority said they would not use the broad consent mechanism for 
secondary use of information if other options were available. Some said 
that they suspected that investigators would continue to seek consent 
waivers for secondary use of identifiable private information instead 
of seeking broad consent.
    The NPRM also sought public comment on several aspects of the 
proposed prohibition on waiving consent when an individual has been 
asked to provide broad consent and refused, including the following 
questions: In particular, how would this prohibition on waiving consent 
affect the secondary research use of identifiable private information? 
If an individual was asked to provide such consent, should the absence 
of a signed secondary use consent be considered a refusal? Does this 
prohibition on waiving consent for the secondary use of identifiable 
private information create a disincentive for institutions to seek 
broad consent for secondary use and instead seek a waiver of consent 
from an IRB? Under what circumstances, if any, would it be justified to 
permit an IRB to waive consent even if an individual declined or 
refused to consent?
    Approximately 35 comments were received on this set of questions. 
Approximately half of these stated that ``no means no.'' If someone was 
asked to give broad consent and the person specifically said no, 
researchers should not be allowed to obtain a waiver of consent. Those 
who opposed the idea of a prohibition on waiver argued that it would be 
very difficult for institutions to understand why someone said no to 
providing broad consent. In other words, a blanket prohibition does not 
accurately address all the issues that can occur in this situation.
    A majority of the responses did not address the questions of how a 
broad consent form with no indication either way should be treated. The 
responses we received to this question suggested that absence of a 
signed form should not be treated as if the individual explicitly said 
no to broad consent (i.e., that in those situations, waiver should be 
permitted).
    A majority of the responses that we received on the question of 
whether the prohibition on waiver in the broad consent context created 
a disincentive for the use of broad consent with identifiable private 
information answered in the affirmative.
4. Response to Comments and Explanation of the Final Rule: General 
Waiver of Alteration of Consent
    Overall, two of the three proposals made in the NPRM for proposed 
Sec.  __.116(f) have been retained. The final rule adopts (in Sec.  
__.116(f)(3)(iii)) a new waiver criterion very similar to that proposed 
in the NPRM, which now mandates that for research involving access to 
or use of identifiable private

[[Page 7226]]

information or identifiable biospecimens, the requirements of informed 
consent can be waived or altered only if the research could not 
practicably be carried out without using such information or 
biospecimens in an identifiable format. The minor wording change made 
in the language of this provision, as compared with that proposed in 
the NPRM, is intended for clarity. This change is intended to protect 
the privacy of individuals, while not unduly inhibiting research. After 
considering the diversity of opinions expressed in the public comments 
on this issue, including many comments seeking further guidance 
concerning the proper interpretation of the ``practicably'' language, 
the final rule does not define this language (which was also included 
in the pre-2018 rule). We have concluded that the requirements for 
waiver and alteration in Sec.  __.116(e) and (f) appropriately honor 
respect for persons and balances this with other ethical principles.
    The final rule also adopts (in Sec.  __.116(f)(1)) the language 
proposed in the NPRM (for Sec.  __.116(f)(3)) prohibiting IRBs from 
waiving informed consent if individuals were asked and declined to 
provide broad consent to the storage and maintenance for secondary 
research use of identifiable private information or identifiable 
biospecimens (except that the final rule's formulation is limited to 
identifiable biospecimens, consistent with changes made in the final 
rule). We considered public comments that opposed this prohibition and 
understand that IRBs may not always understand the reason that 
individuals refused to sign a consent form and that the effects of this 
broad prohibition could be significant in the context of broad consent 
(given the broad scope of research that such a broad consent could 
potentially extend to). Nonetheless, we determined that it is important 
to prevent an individual's refusal to consent to additional research 
use of such information or biospecimens from being overridden. This 
change to the Common Rule is intended to honor the autonomy of 
individuals and to further the Belmont Report principle of respect for 
persons.
    The final rule does not incorporate the NPRM's proposed additional 
waiver criteria (proposed for Sec.  __.116(f)(2)) to apply to research 
involving the use of biospecimens. This change is not necessary given 
that the proposal in the NPRM that the Common Rule extend to all 
biospecimens regardless of their identifiability has not been adopted 
in the final rule. We determined that the waiver and alteration 
criteria included in the final rule are appropriately protective of 
identifiable biospecimens and that an additional waiver criterion for 
such biospecimens is not warranted. For example, Sec.  
__.116(f)(3)(iii) in the final rule is a research criterion specific to 
research that involves using identifiable private information or 
identifiable biospecimens. Under this criterion, an IRB may not waive 
or alter requirements of informed consent with respect to such research 
unless the IRB finds and documents that the research could not 
practicably be carried out without using such information or 
biospecimens in an identifiable format.
    The format and organization of Sec.  __.116(f) in the final rule 
are different from the proposed Sec.  __.116(f) described in the NPRM. 
We made these changes in an effort to be clear about the effect of each 
requirement. Most significantly, Sec.  __.116(f) in the final rule 
provides separate paragraphs concerning the applicable criteria for 
waiver and the applicable criteria for alteration of the requirements 
for informed consent. This differs from the approach proposed in the 
NPRM, and the approach included in the pre-2018 rule that did not 
separate those discussions. We conclude that separating the discussion 
of waiver and alteration will help clarify the applicable criteria, 
particularly given that the final rule addresses the application of the 
waiver and alteration provisions in the context of broad consent.
    Section __.116(f)(1) describes the general framework for an IRB to 
waive the requirements for informed consent. This paragraph explains 
that an IRB may waive the requirement to obtain informed consent under 
Sec.  __.116(a) (general requirements for informed consent), Sec.  
__.116(b) (basic elements of informed consent), or Sec.  __.116(c) 
(additional elements of informed consent that apply to certain 
research) if the research satisfies the criteria set forth at Sec.  
__.116(f)(3) (discussed below). As explained above, the ability to 
satisfy the requirement to obtain informed consent of a subject or a 
subject's legally authorized representative through use of a broad 
consent in particular circumstances is a flexibility offered to 
institutions, but institutions are never required to obtain informed 
consent through a broad consent process. For this reason, Sec.  
__.116(f)(1) does not provide that an IRB may waive the requirement to 
obtain informed consent under Sec.  __.116(d) (broad consent) because 
use of broad consent is a regulatory flexibility, and not a 
requirement. Consistent with the proposal made in the NPRM (proposed 
Sec.  __.116(f)(3)), Sec.  __.116(f)(1) provides that if an individual 
was asked to provide broad consent for the storage, maintenance, and 
secondary research use of identifiable private information or 
identifiable biospecimens and refused to consent, an IRB cannot waive 
consent for either the storage, maintenance, or secondary research use 
of such biospecimens or information.
    Section__.116(f)(2) describes the general framework for an IRB to 
alter the requirements for informed consent. This paragraph explains 
that an IRB may omit or alter some or all of the elements of informed 
consent under Sec.  __.116(b) (basic elements of informed consent) or 
Sec.  __.116(c) (additional elements of informed consent that apply to 
certain research) if the IRB satisfies the criteria set forth at Sec.  
__.116(f)(3) (discussed below). This is consistent with the proposal 
made in the NPRM. This paragraph further explains that an IRB may not 
omit or alter any of the requirements described in Sec.  __.116(a) 
(general requirements for informed consent). This is also consistent 
with the proposal made in the NPRM (which proposed permitting an IRB to 
omit or alter elements of informed consent, but did not propose 
permitting omissions or alterations of the general requirements of 
informed consent that were included in the unnumbered introductory 
paragraph in the pre-2018 rule at Sec.  __.116). This paragraph also 
specifies that when reviewing a broad consent, an IRB may not omit or 
alter any of the elements required under Sec.  __.116(d). As with Sec.  
__.116(e)(2), we determined that it would not be appropriate to permit 
the omission or alteration of any of the broad consent elements in 
Sec.  __.116(f). The elements of broad consent reflected in this NPRM 
are limited. We have concluded that each of these elements (which are 
included at Sec.  __.116(d)) is critical to the solicitation of an 
informed and ethically appropriate broad consent. For that reason, none 
of the elements of broad consent may be omitted or altered if broad 
consent is solicited. This prohibition is different than the NPRM's 
proposal given the different formulation of broad consent represented 
in this final rule.
    Section 116(f)(3) sets forth the specific criteria that an IRB must 
find and document in order to waive or alter the requirements for 
informed consent. These criteria are the same as those proposed in the 
NPRM, except that the third criterion includes minor wording changes 
that were made for clarity: (1) the research involves no more than 
minimal risk to the subjects; (2) the

[[Page 7227]]

research could not practicably be carried out without the requested 
waiver or alteration; (3) if the research involves using identifiable 
private information or identifiable biospecimens, the research could 
not practicably be carried out without using such information or 
biospecimens in an identifiable format; (4) the waiver or alteration 
will not adversely affect the rights and welfare of the subjects; and 
(5) whenever appropriate, the subjects will be provided with additional 
pertinent information after participation.

G. IRB Approval of Research Involving Screening, Recruiting, or 
Determining Eligibility of Prospective Subjects (Sec.  __.116(g))

1. Background and Pre-2018 Requirements
    The pre-2018 rule required an IRB to determine that informed 
consent can be waived under Sec.  __.116(d) before investigators could 
record identifiable private information for the purpose of identifying 
and contacting prospective subjects for a research study. This 
requirement to waive informed consent has been viewed as burdensome and 
unnecessary for protecting subjects, and is not consistent with FDA's 
regulations, which do not require informed consent or a waiver of 
informed consent for such activities.
2. NPRM Proposal
    The NPRM proposed a new provision at Sec.  __.116(g) that would 
authorize an IRB to approve a research proposal in which investigators 
obtain identifiable private information without individuals' informed 
consent for the purpose of screening, recruiting, or determining the 
eligibility of prospective human subjects of research. The IRB would be 
permitted to approve a research proposal only in such circumstances if 
the proposal included an assurance that the investigator would 
implement standards for protecting the information obtained, in 
accordance with and to the extent required by proposed Sec.  __.105. 
This proposal was intended to address concerns that the pre-2018 rule 
required an IRB to determine that informed consent can be waived before 
investigators could record identifiable private information for the 
purpose of identifying and contacting prospective subjects for a 
research study.
3. Public Comments
    Few comments were received regarding this proposal. All were 
generally supportive. One academic institution noted that ``This review 
is unnecessary considering the low potential risk to subjects and will 
expedite research endeavors and ensure harmonization between FDA`s 
expectations and the Common Rule.'' However, one commenter thought that 
prospective subjects should be notified that this might be a 
possibility. Another commenter said that it should be clear that this 
is not an IRB waiver of consent, but rather it is an exception to the 
consent requirement.
4. Response to Comments and Explanation of the Final Rule: Approval of 
Research Involving Screening, Recruiting, or Determining Eligibility of 
Prospective Subjects
    The final rule adopts the NPRM proposal at Sec.  __.116(g), with 
minor changes made for clarity, and without a requirement that 
investigators adhere to the proposed privacy safeguards at Sec.  
__.105, since this provision is not included in the final rule. The 
provision at Sec.  __.116(g) addresses concerns that the pre-2018 
regulations required an IRB to determine that informed consent can be 
waived before investigators may record identifiable private information 
for the purpose of identifying and contacting prospective subjects for 
a research study. This change is intended to address these concerns by 
eliminating the requirement for the IRB to waive informed consent for 
these activities. In response to public comments, we are clarifying 
that this is not a waiver of the consent requirement but rather an 
exception to the requirement. This change is also responsive to 
SACHRP's recommendation regarding how the Common Rule should apply to 
activities that are conducted before subjects provide consent to 
participate in research, such as identifying potential subjects, 
contacting subjects, and recruiting subjects.\48\
---------------------------------------------------------------------------

    \48\ See Secretary's Advisory Committee on Human Research 
Protections (SACHRP). Attachment C: Approved by SACHRP July 20, 
2011. SACHRP Recommendation regarding application of 45 CFR 46 and 
21 CFR 56 to early processes in research, such as identifying 
potential subjects, contacting subjects and recruiting subjects. 
(July 20, 2011). Retrieved from http://www.hhs.gov/ohrp/sachrp-committee/recommendations/2011-october-13-letter-attachment-c/index.html.
---------------------------------------------------------------------------

    The final rule includes some minor changes from the NPRM proposal, 
to clarify the circumstances in which the IRB may approve the 
investigator's proposal to obtain information directly from a 
prospective subject, or to obtain already collected identifiable 
private information or identifiable biospecimens by accessing records 
or stored biospecimens, for purposes of screening, recruiting, or 
eligibility assessment, without the informed consent of the prospective 
subject or the subject's legally authorized representative. The final 
rule also adds a reference to the subject's legally authorized 
representative at Sec.  __.116(g)(1) to clarify that this exception to 
informed consent will also apply in circumstances in which the 
prospective subject has a legally authorized representative who will 
provide information about the prospective subject through oral or 
written communication with the investigator.
    We note that in approving this exception to informed consent for 
the purpose of screening, recruiting, or determining the eligibility of 
prospective subjects, the IRB will be reviewing and approving the 
entire research proposal. Therefore, all of the IRB approval criteria 
at Sec.  __.111 will need to be satisfied, including that when 
appropriate, there are adequate provisions to protect the privacy of 
subjects and to maintain the confidentiality of data (Sec.  
__.111(a)(7)). Thus, as part of its review and approval of the 
research, the IRB must determine that there are adequate privacy and 
confidentiality safeguards for information obtained by investigators 
for these preparatory-to-research activities.
    We believe that these preparatory-to-research activities are 
critical means by which to identify subjects that do not involve 
additional risks, given their limited nature. If prospective subjects 
are identified through these ``screening'' activities, then all other 
relevant requirements of this rule must be met if they are subsequently 
recruited to participate in the research.

H. Posting of Consent Forms (Sec.  __.116(h))

1. Background and Pre-2018 Requirements
    The pre-2018 rule did not have a requirement to post consent forms 
from clinical trials.
2. NPRM Proposal
    The NPRM proposed a new provision that would require that a copy of 
the final version of the consent form (absent any signatures) for each 
clinical trial conducted or supported by a Common Rule department or 
agency be posted on a publicly available federal Web site that will be 
established as a repository for such consent forms. The name of the 
protocol and contact information would be required to be included with 
the submission of the consent form. Under the NPRM proposal, the 
consent form would have to be published on the Web

[[Page 7228]]

site within 60 days after the trial is closed for recruitment.
3. Public Comments
    The NPRM proposal received approximately 130 comments, most of 
which opposed the proposal in whole or in part. Many commenters 
expressed concern that the proposal represented administrative burden 
without a corresponding increase in protections to human subjects or 
benefit to the research community. Some commenters felt that the 
proposal represented a waste of resources that would not increase 
compliance with the regulations, and might result in longer consent 
forms if researchers felt the need to include an abundance of 
additional information to protect against perceived regulatory 
noncompliance or legal challenge. These commenters expressed concern 
that the repository of posted consent forms might be used to seek out 
instances of noncompliance. For example, one large medical school 
indicated that the posting requirement creates a rich environment for 
litigation and represents an effort to publicly shame investigators to 
improve quality of documents that will not work.
    Other commenters, including some private research firms, were 
concerned that the proposal as drafted would not allow for the 
redaction of proprietary or institutionally sensitive information from 
consent forms before they would be posted to the Web site, and allow 
competing research entities access to detailed information about 
investigational drug or research programs beyond what is publicly 
available already. Additional concern was expressed about the proposed 
timeframe in which consent forms needed to be posted. Some felt that 
more time was needed. Other commenters felt it would be more beneficial 
to research participants if consent forms were posted before or during 
recruitment. In addition, some commenters felt that researchers should 
be allowed or encouraged to update posted consent forms if they are 
updated for the study. Others felt that requiring that consent forms be 
posted once (even if the forms were updated after being posted) would 
lead to potential confusion among research participants. For example, 
several commenters noted that should a subject participating in a trial 
see a consent form for a particular study that differed from the form 
that he or she originally signed, that discrepancy could cause 
unnecessary concern and confusion.
    Still other commenters expressed concern that the high volume of 
consent forms that would be posted as a result of this requirement 
would make the collection cumbersome and difficult to use, negating any 
potential benefit gained by increased transparency. Others expressed a 
concern that requiring all studies to post consent forms might lead to 
the perpetuation of poorly written forms, as researchers might use poor 
examples from the database to write their own informed consent 
documents in addition to excellent ones. A few major research 
universities suggested that guidance, best practices, or exemplary 
informed consent forms should be selected and shared publicly, rather 
than all informed consent forms. Some commenters suggested limiting the 
posting requirement to a subset of research studies, for example, to 
only high risk or large multi-institution studies.
    Those who supported the proposal agreed that it would help increase 
accountability and promote transparency in informed consent forms. To 
that end, a minority of commenters said that this proposal should be 
extended to all research that is subject to the Common Rule, not just 
to studies meeting the definition of a clinical trial. Some commenters 
supported the idea of publicly sharing informed consent documents but 
felt it would be best accomplished through guidance or optional 
posting. One federal level advisory committee supported the proposal 
and recommended the creation of robust guidance with the goal of 
minimizing confusion and misuse of the posted documents, and 
facilitating the use of the posted forms to educate investigators, 
institutions, and regulators to improve future informed consent 
documents and the informed consent process generally. Others felt it 
would be helpful to post additional information and documents along 
with consent forms. For example, one investigator suggested that copies 
of IRB proposals and decisions be made public along with approved 
informed consent documents to provide additional transparency and 
accountability. Another commenter suggested that investigators be given 
the option to post assessment tools for evaluating prospective 
subjects' understanding of important study information.
    Both those who supported and opposed the proposal indicated that in 
terms of implementing this proposal, consent forms should be posted to 
ClinicalTrials.gov as opposed to creating a new federal Web site in 
order to limit the additional administrative burden that this proposal 
would impose.
4. Response to Comments and Explanation of the Final Rule: Posting of 
Consent Forms
    The final rule adopts the NPRM proposal with some modifications and 
clarifications. The primary purpose of this provision is to improve the 
quality of consent forms in federally funded research by assuring 
that--contrary to current practices, under which it is often very 
difficult to ever obtain a copy of these documents--they eventually 
would become subject to public scrutiny and that they will provide 
useful models for others. The consent form plays a key role in making 
sure that someone asked to enter a clinical trial receives the 
information they need to be making an informed decision about whether 
to enroll in that trial. Accordingly, it also plays a key role in 
supporting and justifying the public's trust in the integrity of our 
clinical trial enterprise.
    We are not persuaded by the arguments of those commenters who 
suggest that potential negative consequences of this proposal outweigh 
its benefits. Fundamentally, this proposal is about increasing the 
transparency of one of the most important aspects of our human subjects 
protection system. Increased transparency is in general a good thing, 
and in this instance, as in many others, it offers multiple benefits--
including increased trust--at very low cost. This provision is not a 
form of shaming, but rather an effort to ask people to work together to 
create a system that will improve the quality of informed consent. 
Moreover, the new standards for determining the acceptable content of a 
consent form--including Sec.  __.116(a)(5), which will require a 
concise presentation of key information at the beginning of the consent 
form--should counter any consequences of attempts to pad consent forms 
with additional information as a response to the posting requirement.
    We agree with the conclusions of SACHRP that implementing this 
proposal will indeed result in better consent forms. Having a 
repository of such forms freely available for analysis and public 
discussion will create multiple opportunities for improving these 
forms. In an era in which we have previously unheard of capabilities 
for analyzing textual material and processing large amounts of data, 
the fact that there will be a high volume of consent forms posted 
should be a minor impediment, if any, to the ability to learn from the 
content of this database.
    With regard to those who suggested that it would indeed be 
desirable to

[[Page 7229]]

make consent forms more public, but that posting should be optional, we 
note that nothing in the pre-2018 rule prevents the people in charge of 
research from making their consent forms public, yet that is rarely 
done. In order to significantly increase the transparency of this 
portion of our system for protecting subjects, we are finalizing this 
proposal.
    With regard to the commenters who were concerned that posting 
consent forms would create a rich environment for litigation, it is 
noteworthy that the existing evidence fails to suggest that there has 
been much of a problem with regard to inappropriate litigation over 
clinical trials. Whatever disincentives currently exist for such 
litigation, it seems unlikely that the mere fact that consent forms 
would now be more available will dramatically alter such disincentives. 
With regard to the commenters who were concerned about the added 
regulatory burden, we note that this change, compared to the 
traditional costs of clinical trials, will add a relatively small 
amount of additional burden, one that is well justified in comparison 
to the likely increase in transparency. This new provision has 
specifically been designed to minimize that burden. And the final rule 
has been modified in a number of respects from the NPRM proposal in 
response to public comments. As discussed below in detail, the time by 
which a consent form must be posted has been greatly extended. That 
change would also address the concerns of some commenters that the 
posted consent forms might create confusion among research subjects. 
Furthermore, provisions have been added that allow for redaction, as 
necessary, of portions of consent forms.
    As a means of increasing transparency and facilitating the 
development of more informative consent forms, the final rule 
accordingly requires at Sec.  __.116(h)(1) that for clinical trials 
conducted or supported by a Common Rule department or agency, a copy of 
an IRB-approved version of a consent form that was used to enroll 
subjects would need to be posted by the awardee or the federal 
department or agency conducting the trial on a publicly available 
federal Web site that will be established as a repository for such 
forms. Unlike the NPRM, which required that the ``final version'' of 
the consent form be posted, the final rule adds flexibility in merely 
requiring that it be an IRB-approved consent form that was used for 
enrollment purposes. There is accordingly no further restriction as to 
which version of a consent form (which might have been subject to many 
modifications over the course of time) must be posted. The final rule 
also gives greater flexibility than the NPRM proposal in terms of when 
that posting needs to be done. It can take place any time after the 
trial is closed to recruitment, so long as the posting is no later than 
60 days after the last study visit by any subject (as required by the 
protocol). If the federal department or agency supporting or conducting 
the clinical trial determines that certain information should not be 
made publicly available on a federal Web site (e.g., confidential 
commercial information), the department or agency may permit 
appropriate redactions to the information posted. In rare instances, it 
could be the case that the federal department or agency would determine 
that the very existence of a particular clinical trial should not be 
publicly disclosed, in which case no posting relating to such a trial 
would be required.
    The final rule differs from the NPRM proposal in that it no longer 
specifies that certain information needs to be posted in addition to 
the consent form. This change eliminates the need for mandatory posting 
of information that might not be justified by the purposes of this 
provision.
    Only one posting would be required for each multi-institution 
study. There is accordingly no expectation that a version would need to 
be posted for each class of subjects in the study (for example, a 
posting both for adults and for minors), nor for each study site.
    We also note that this provision applies only to those clinical 
trials that are conducted or supported by a federal department or 
agency.
    A Web site will be developed by HHS, which could be used by other 
federal departments or agencies, or the other federal departments or 
agencies could create their own Web sites for the posting of these 
consent forms. Public posting of consent forms is intended to increase 
transparency, enhance confidence in the research enterprise, increase 
accountability, and inform the development of future consent forms. It 
is anticipated that the Web site will be searchable. With regard to the 
comments suggesting that ClinicalTrials.gov might be an appropriate 
choice as the Web site, we agree that such a choice has the possibility 
of minimizing administrative burdens. Using ClinicalTrials.gov has 
another advantage, in addition to what some of the commenters said. 
Many clinical trials funded by HHS have records in ClincialTrials.gov 
due to requirements that certain clinical trials register and submit 
results information to that database (section 402(j) of the Public 
Health Service Act and 42 CFR part 11, and other policies that 
incentivize trial registration and results submission, such as the NIH 
Policy on Dissemination of NIH-Funded Clinical Trial Information). The 
fact that these trials already have a record in the database will mean 
that the burden of submission of the informed consent document will be 
substantially lower. Accordingly, we will take these points into 
consideration as we determine what federal Web site will be used to 
implement this provision.

XV. Documentation of Informed Consent (Sec.  __.117)

A. Background and Pre-2018 Requirements

    The pre-2018 rule at Sec.  __.117 described the requirements for 
documenting informed consent and when the waiver for obtaining a 
written and signed consent form was allowable.

B. NPRM Proposals

    The NPRM proposed to alter the language at Sec.  __.117(b)(1) to 
specify that the consent document should include only the language 
required by Sec.  __.116, with appendices included to cover any 
additional information.
    In addition, the NPRM would make it explicit in the regulatory 
language at proposed Sec.  __.117(c)(1)(iii) that if the subjects are 
members of a distinct cultural group or community for whom signing 
documents is not the norm, so long as the research presents no more 
than minimal risk of harm to subjects and provided there is an 
appropriate alternative mechanism for documenting that informed consent 
was obtained, the requirement to obtain a signed consent form may be 
waived. Documentation must include a description as to why signing 
forms is not the norm for the distinct cultural group or community.
    Additionally, to facilitate the tracking of broad consent to 
storage or maintenance for secondary research use of biospecimens or 
identifiable private information, and to provide information to IRBs 
should IRB review be required, the NPRM proposed that waiver of 
documentation of consent for the research use of such biospecimens 
would not be allowed based upon a new provision at Sec.  __.117(c)(3).
    The NPRM also introduced the term ``oral consent'' in the context 
of the various provisions related to the broad consent for the storage, 
maintenance, and secondary use of biospecimens and identifiable private 
information. As a general matter, under the pre-2018 rule, individuals 
wanting to obtain oral

[[Page 7230]]

consent from subjects in a nonexempt research activity needed to seek a 
waiver of documentation of informed consent under Sec.  __.117(c). 
Therefore, the NPRM proposed to permit investigators to obtain oral 
broad consent for the storage, maintenance, and secondary research use 
in limited circumstances. Specifically, the NPRM proposals would allow 
an investigator to obtain oral broad consent if:
     An investigator used the proposed broad consent template;
     Investigators only sought oral broad consent only for the 
storage, maintenance, and secondary research use context for the use of 
identifiable private information, not for biospecimens;
     If broad consent for the storage, maintenance, and 
secondary research use was obtained only as part of a separate, primary 
research study; and
     The oral broad consent was sought as part of the consent 
process in a study eligible for one specific exclusion or three 
specific exemptions related to the collection of identifiable 
information.
    Finally, the regulatory language proposed at Sec.  __.117(c)(4) was 
intended to clarify that waivers of documentation may not be permitted 
for research subject to regulation by FDA.

C. Public Comments

    Approximately 15 comments were received on the proposals found in 
the NPRM at Sec.  __.117. Several commenters discussing the proposed 
requirement at Sec.  __.117(b)(1) indicated that even if consent forms 
are split into a primary document and appendices, there should be an 
expectation that the content included in the appendices are discussed 
with prospective subjects as part of the informed consent process. 
Although very few comments discussed the requirements of proposed Sec.  
__.117(b)(1) specifically, many of the comments discussing the NPRM 
proposal found in the introductory paragraph of Sec.  __.116 discussed 
the concept of including only the required information in the main body 
of a consent form, and all additional information in appendices.
    Few comments were received on the proposal found in Sec.  
__.117(c)(1)(iii) that documentation of informed consent may be waived 
if consent is being sought amongst subjects who are members of a 
distinct cultural group or community in which signing forms is not the 
norm. Comments received on this proposal were generally favorable.
    Those who commented on the proposals related to oral broad consent 
indicated that the provisions were confusing and difficult to 
understand. We note that these proposals were found in the NPRM through 
a series of interrelated cross references in Sec. Sec.  __.116(d), 
__.117(c), and __.104(f)(1)-(2).
    Several commenters discussed the statement found in Sec.  
__.117(c)(4) that waiver of documentation of consent is generally not 
permitted for research subject to regulation by the FDA. These 
commenters noted that this would be true regardless of whether this was 
included in the Common Rule. Additionally, commenters noted that if the 
FDA regulations ever permitted waiver of documentation of consent, the 
existence of this provision in the Common Rule might result in 
confusion and contradictory requirements for dually regulated research.

D. Response to Comments and Explanation of the Final Rule: 
Documentation of Informed Consent

    The language at Sec.  __.117(b)(1) and (2) are altered in the final 
rule to conform to the requirements included at Sec.  __.116, which are 
discussed above. The goal in Sec. Sec.  __.116 and __.117 of the final 
rule is to facilitate a prospective subject's or legally authorized 
representative's understanding of the reasons why one might or might 
not want to participate in the research, in part by requiring that only 
the key information essential to decision making receive priority by 
appearing at the beginning of the consent document. In the final rule, 
these requirements also apply when a short form written informed 
consent process is used, or the requirement for written informed 
consent is waived.
    We agree with the majority of public comments that favored adding a 
new provision allowing a waiver of the requirement for a signed consent 
form if the subjects are members of a distinct cultural group or 
community for whom signing documents is not the norm, provided that the 
research presents no more than minimal risk of harm to subjects and 
there is an appropriate alternative method for documenting that 
informed consent was obtained. Therefore, this new provision is added 
at Sec.  __.117(c)(1)(iii). The final rule includes a reference to the 
subject's legally authorized representative to clarify that this 
provision applies when a subject has a legally authorized 
representative who is a member of a distinct cultural group or 
community in which signing forms is not the norm.
    The final rule does not include the NPRM's proposal at Sec.  
__.117(c)(3) to prohibit a waiver of documentation of broad consent for 
the storage, maintenance, or secondary research use of biospecimens.
    Some of those who commented on the NPRM proposals related to oral 
broad consent found it to be unnecessarily confusing. In response to 
these comments, the final rule permits waiver of documentation of 
informed consent under Sec.  __.117(c) when a broad consent procedure 
is used. No additional criteria or special restrictions apply. 
Additionally, the final rule removes all NPRM references to ``oral 
consent'' to reduce confusion.
    However, we expect that it will rarely be permissible to waive 
documentation of broad consent for the secondary research use of 
medical records or stored biospecimens because there will likely be a 
need to track which individuals have provided broad consent and which 
have not, so the informed consent would not be the only record linking 
the subject and the research as required for a waiver under Sec.  
__.117(c)(1)(i). Additionally, when identifiable information and 
identifiable biospecimens are shared for a nonresearch purposes, the 
person's consent is usually required, so we expect that documentation 
of consent often could not be waived under Sec.  __.117(c)(1)(ii), 
which requires that the research involves only procedures for which 
written consent is not normally required outside of the research 
context.
    One instance when we believe it may be appropriate for the IRB to 
waive the requirement for a signed broad consent form is when the 
initial activity involved obtaining information from a person through 
oral communication, such as a phone survey, because there might not be 
an opportunity to obtain written broad consent from such individuals 
for the secondary research use of their information. In this scenario, 
documentation of broad consent could be waived under Sec.  
__.117(c)(1)(ii) if the research presents no more than minimal risk of 
harm to subjects and involves no procedures for which written consent 
is normally required outside of the research context. In addition, it 
might be appropriate for an IRB to waive the requirement for a signed 
broad consent document under the provision included in the final rule 
related to when the subjects or their legally authorized 
representatives are members of a distinct cultural group or community 
for whom signing documents is not the norm, provided that the research 
presents no more than minimal risk of harm to subjects and an 
appropriate alternative method is available for

[[Page 7231]]

documenting that informed consent was obtained (Sec.  
__.117(c)(1)(iii)).
    The final rule also does not include the NPRM's proposed 
clarification that waivers of documentation may not be permitted for 
research subject to regulation by FDA. Because this is not the only 
difference between what is permitted under the Common Rule and the FDA 
regulations, we determined that clarifying only this specific 
difference in the final rule is likely to create more confusion rather 
than provide clarification.

XVI. Applications and Proposals Lacking Definite Plans for Involvement 
of Human Subjects (Sec.  __.118)

A. Background and Pre-2018 Requirements

    This provision of the pre-2018 rule stated that while an award or 
grant may be made for a project with indefinite plans to involve human 
subjects, that project must be reviewed by an IRB before human subjects 
may be involved.

B. NPRM Proposals

    The NPRM language clarified that IRB review and approval was 
required before human subjects could be involved in a study unless the 
study was excluded under Sec.  __.101(b), waived under Sec.  __.101(i), 
or exempted under Sec.  __.104(d), (e) or (f)(2).

C. Public Comments

    No comments were received.

D. Explanation of the Final Rule

    The final rule adopts the language of the NPRM, with updated 
citations. This provision makes explicit that it applies only to 
nonexempt human subjects research.

XVII. Research Undertaken Without the Intention of Involving Human 
Subjects (Sec.  __.119)

A. Background and Pre-2018 Requirements

    This provision of the regulations outlines the process that an 
institution must undergo when a federally funded research project that 
was designed without the intention of involving human subjects later 
involves human subjects as defined by this policy.

B. NPRM Proposals

    The NPRM proposed to add language to make clear that this provision 
applies only to nonexempt human subjects research. It also clarifies 
its reference to department or agency to mean a federal department or 
agency component supporting the research.

C. Public Comments

    No comments were received.

D. Explanation of the Final Rule

    The final rule adopts the language of the NPRM, with updated 
citations. This provision makes explicit that it applies only to 
nonexempt human subjects research, and clarifies the reference to 
department or agency to be a federal department or agency component 
supporting the research.

XVIII. Conditions (Sec.  __.124)

A. Background and Pre-2018 Requirements

    This provision of the regulations allows departments and agencies 
to impose additional requirements on human subjects research when such 
requirements are deemed necessary for the protection of human subjects.

B. NPRM Proposals

    The NPRM provided more specific language at Sec.  __.124, stating 
that with respect to any research project or any class of research 
projects the department or agency head of either the conducting or the 
supporting federal department or agency may impose additional 
conditions prior to or at the time of approval when in the judgment of 
the department or agency additional conditions are necessary for the 
protection of human subjects.

C. Public Comments

    One commenter discussed this NPRM proposal, arguing that this would 
increase variance in implementation of the Common Rule, rather than 
promote harmonization as the NPRM suggested.

D. Explanation of the Final Rule

    The final rule adopts the NPRM language, which clarifies the pre-
2018 rule by stating that the head of either the conducting or the 
supporting federal department or agency may impose additional 
conditions on research, when necessary for the protection of human 
subjects.

XIX. Regulatory Impact Analyses

A. Introduction

    HHS has examined the impacts of this final rule under Executive 
Order 12866 on Regulatory Planning and Review (September 30, 1993); 
Executive Order 13563 on Improving Regulation and Regulatory Review 
(January 18, 2011); the Regulatory Flexibility Act of 1980, Pub. L. 96-
354 (September 19, 1980); the Unfunded Mandates Reform Act of 1995, 
Pub. L. 104-4 (March 22, 1995); and Executive Order 13132 on Federalism 
(August 4, 1999).
    Executive Order 12866 directs agencies to assess all costs and 
benefits of available regulatory alternatives and, if regulation is 
necessary, to select regulatory approaches that maximize net benefits 
(including potential economic, environmental, public health and safety 
effects; distributive impacts; and equity). Executive Order 13563 is 
supplemental to and reaffirms the principles, structures, and 
definitions governing regulatory review as established in Executive 
Order 12866. HHS expects that this rule will have an annual effect on 
the economy of $100 million or more in any one year and therefore is a 
significant regulatory action as defined by Executive Order 12866.
    The Regulatory Flexibility Act (RFA) requires agencies that issue a 
regulation to analyze options for regulatory relief for small 
businesses if a rule has a significant impact on a substantial number 
of small entities.\49\ The RFA generally defines a ``small entity'' as 
(1) a proprietary firm meeting the size standards of the Small Business 
Administration (SBA); (2) a nonprofit organization that is not dominant 
in its field; or (3) a small government jurisdiction with a population 
of less than 50,000 (states and individuals are not included in the 
definition of ``small entity'').\50\ HHS considers a rule to have a 
significant economic impact on a substantial number of small entities 
if at least 5 percent of small entities experience an impact of more 
than 3 percent of revenue. HHS anticipates that the rule will not have 
a significant economic impact on a substantial number of small 
entities. Supporting analysis is provided in Section XIX.F below.
---------------------------------------------------------------------------

    \49\ 5 U.S.C. 603.
    \50\ 5 U.S.C. 601.
---------------------------------------------------------------------------

    Section 202(a) of the Unfunded Mandates Reform Act of 1995 \51\ 
requires that agencies prepare a written statement, including an 
assessment of anticipated costs and benefits, before proposing ``any 
rule that includes any Federal mandate that may result in the 
expenditure by State, local, and tribal governments, in the aggregate, 
or by the private sector, of $100,000,000 or more (adjusted annually 
for inflation) in any one year.'' The current threshold after 
adjustment for inflation is $146 million, using the most current (2015) 
implicit price deflator for the gross domestic product. HHS expects 
this rule to result in expenditures that will exceed this amount.
---------------------------------------------------------------------------

    \51\ 2 U.S.C. 1532.
---------------------------------------------------------------------------

    Executive Order 13132 establishes certain requirements that an 
agency

[[Page 7232]]

must meet when it promulgates a rule that imposes substantial direct 
requirement costs on state and local governments or has federalism 
implications. HHS has determined that the rule will not contain 
policies that would have substantial direct effects on the States, on 
the relationship between the Federal Government and the States, or on 
the distribution of power and responsibilities among the various levels 
of government. The changes in the rule represent the Federal Government 
regulating its own program. Accordingly, HHS concludes that the rule 
does not contain policies that have federalism implications as defined 
in Executive Order 13132 and, consequently, a federalism summary impact 
statement is not required.

B. Need for the Final Rule and Summary

    This final rule is being issued to modernize, strengthen, and make 
more effective the regulations for protecting human subjects in 
research. Although professional organizations have codes of conduct and 
guidelines for members conducting research, only the Federal Government 
has the authority to regulate the activities of institutions using 
public funds for human subjects research. Since the Common Rule was 
developed, the volume of research has increased, evolved, and 
diversified.
    Thus, the final rule includes a number of measures to address the 
issues described above. Provisions that strengthen the requirements for 
informed consent and promote transparency in the informed consent 
process include: (1) Requiring that the informed consent form be 
designed and presented in such a way that facilitates a prospective 
subject's understanding of why one would want to participate in a 
research study or not; (2) revising and adding to the required elements 
of consent; (3) requiring for certain clinical trials the posting of a 
copy of at least one version of a consent form on a publicly available 
federal Web site; and (4) clarifying the conditions and requirements 
for waiver or alteration of consent to remove ambiguity, including a 
new provision that, under specific conditions, an IRB may approve a 
research proposal in which investigators obtain information without 
individuals' informed consent for the purpose of screening, recruiting, 
or determining eligibility of prospective human subjects of research.
    Provisions that strengthen the extent to which regulations promotes 
the principle of respect for persons include: (1) Requiring that 
informed consent forms present the key information to potential 
subjects at the beginning of a consent process; (2) allowing 
investigators the option of obtaining broad consent from a potential 
subject for future, unspecified research use of identifiable private 
information and identifiable biospecimens; and (3) adding a provision 
that would prohibit a waiver of consent if someone has been asked to 
provide their broad consent for the storage, maintenance, and secondary 
research use of identifiable biospecimens or identifiable private 
information and refused to do so.
    New provisions that would allow IRBs greater flexibility to focus 
resources on higher-risk research include: (1) Distinguishing 
categories of activities that are deemed not to be research; and (2) 
expanding and clarifying categories of exempt research.
    Provisions that streamline or reduce burden for IRBs or 
institutions include: (1) Requiring consultation among the Common Rule 
agencies for the purpose of harmonizing guidance (to the extent 
appropriate); (2) eliminating an administrative requirement for 
reporting IRB membership; (3) removing the requirement that IRBs must 
review and approve grant applications; (4) eliminating, under certain 
circumstances, continuing review; (5) mandating the use of a single IRB 
for multi-institutional studies; and (6) holding IRBs not operated by 
an FWA-holding institution directly responsible for compliance when 
appropriate.
1. Accounting Table
    Table 1 summarizes the quantified and nonquantified benefits and 
costs of all changes to the Common Rule. Over the 2017-2026 period, 
present value benefits of $1,904 million and annualized benefits of 
$223 million are estimated using a 3 percent discount rate; present 
value benefits of $1,494 million and annualized benefits of $213 
million are estimated using a 7 percent discount rate. Present value 
costs of $528 million and annualized costs of $62.0 million are 
estimated using a 3 percent discount rate; present value costs of $474 
million and annualized costs of $67.0 million are estimated using a 7 
percent discount rate. Nonquantified benefits include improved human 
subjects protections in research; enhanced oversight of research 
reviewed by IRBs not operated by an FWA-holding institution; and 
increased uniformity in regulatory requirements among Common Rule 
departments and agencies. Nonquantified costs include the time needed 
for consultation among Common Rule agencies before federal guidance is 
issued.

                         Table 1--Accounting Table of Benefits and Costs of All Changes
----------------------------------------------------------------------------------------------------------------
                                                   Present value of 10 years by   Annualized value over 10 years
                                                    discount rate (millions of    by discount rate  (millions of
                                                           2015 dollars)                   2015 dollars)
                                                 ---------------------------------------------------------------
                                                     3 percent       7 percent       3 percent       7 percent
----------------------------------------------------------------------------------------------------------------
Benefits:
    Quantified Benefits.........................           1,904           1,494             223             213
----------------------------------------------------------------------------------------------------------------
Nonquantified Benefits:
    Improved human subjects protections in research; enhanced oversight in research reviewed by IRBs not
     operated by an FWA-holding institution; and increased uniformity in regulatory requirements among Common
     Rule departments and agencies..............................................................................
----------------------------------------------------------------------------------------------------------------
Costs:
    Quantified Costs:...........................             528             474            62.0            67.0
----------------------------------------------------------------------------------------------------------------
Nonquantified Costs:
    Time for consultation among Common Rule agencies before federal guidance is issued..........................
----------------------------------------------------------------------------------------------------------------

    Table 2 summarizes the quantified present value benefits and costs 
of each change to the Common Rule using a 3 percent discount rate.

[[Page 7233]]



   Table 2--Accounting Table of Quantified Benefits and Costs of Each
                                 Change
------------------------------------------------------------------------
                                          Present value of 10 years at a
                                              3 percent discount rate
                 Change                     (millions of 2015 dollars)
                                         -------------------------------
                                             Benefits          Costs
------------------------------------------------------------------------
Costs to Learn New Requirements and       ..............             213
 Develop Training Materials; OHRP Costs
 to Develop Training and Guidance
 Materials, and to Implement the Rule...
Extending Oversight to IRBs Unaffiliated  ..............            85.6
 with an Institution Holding an FWA
 (impact to IRBs not operated by an FWA-
 holding institution)...................
Excluding Activities from the                       36.2  ..............
 Requirements of the Common Rule because
 They are not Research..................
Clarifying and Harmonizing Regulatory     ..............  ..............
 Requirements and Agency Guidance.......
Modifying the Assurance Requirements....            5.93  ..............
Requirement for Written Procedures and    ..............            11.4
 Agreements for Reliance on IRBs Not
 Operated by the Engaged Institution
 (impact to FWA-holding institutions)...
Eliminating the Requirement that the                 326  ..............
 Grant Application Undergo IRB Review
 and Approval...........................
Expansion of Research Activities Exempt              798            0.37
 from Full IRB Review...................
Elimination of Continuing Review of                  148            41.0
 Research Under Specific Conditions.....
Amending the Expedited Review Procedures            51.0  ..............
Cooperative Research (single IRB mandate             538             157
 in multi-institutional research).......
Changes in the Basic Elements of          ..............            4.62
 Consent, Including Documentation.......
Obtaining Consent to Secondary Use of     ..............  ..............
 Identifiable biospecimens and
 Identifiable private information.......
Elimination of Pre-2018 Rule Requirement            1.25  ..............
 to Waive Consent in Certain Subject
 Recruitment Activities.................
Requirement for Posting of Consent Forms  ..............            15.4
 for Clinical Trials Conducted or
 supported by Common Rule Department or
 Agencies...............................
Alteration in Waiver for Documentation    ..............  ..............
 of Informed Consent in Certain
 Circumstances..........................
------------------------------------------------------------------------

C. Public Comments and Response to Public Comments

1. General Comments
    Approximately 50 comments discussed the specific cost estimates 
provided in the NPRM's Regulatory Impact Analyses (RIA). Several 
commenters strongly suggested that the final rule eliminate the 
proposals related to biospecimens, cooperative research, and expanding 
coverage to nonfederally funded clinical research because the NPRM 
failed to appreciate the cost and burden that would result from 
implementing these proposals. Although a majority of the comments 
received on the RIA suggested that several of the cost estimates were 
significantly underestimated, few commenters described specific changes 
to the cost and benefit estimates included in the NPRM RIA.
    One commenter noted that the NPRM cost estimates are derived from a 
1998 NIH-sponsored evaluation of the implementation of Section 491 of 
the Public Health Service Act and ``because of the lack of available 
data about IRB effectiveness and how IRBs function operationally, many 
of the estimations in this analysis are based on anecdotal evidence.'' 
This commenter stated that reliance on outdated and anecdotal 
``evidence'' means that the NPRM assumptions seriously underestimate 
predictable costs, such as those derived from current salary data for 
health care workers who would have at least some background sufficient 
to explain consent, and the time needed to obtain consent. They also 
claimed that the NPRM analysis also seriously overestimates cost 
savings because excluding an activity from the Common Rule does not 
necessarily remove it from the purview of the IRB pursuant to other 
laws, such as the HIPAA regulations, and may simply shift the economic 
burden of responsible oversight to personnel elsewhere within the 
organization. This commenter also noted that the initial transition 
costs estimated in the NPRM are staggering, mostly due to costs related 
to biospecimen provisions.
    One commenter stated that a review of the tables indicates that the 
costs used for hourly wages of individuals affected by the proposed 
changes may be underestimated by as much as 12 to 139 percent. 
Similarly, the hours associated with the proposed changes are 
substantially underestimated.
    One commenter stated that an institutional official must be 
administratively high enough to insist on any necessary institutional 
changes, most likely a Vice President or higher, and felt that such an 
official would make at least $250 per hour. This commenter stated that 
the $48.20 estimate in the proposed rules may apply to liberal arts 
colleges, but the proportion of medical research conducted at such 
institutions is small and strongly recommends that salary data from 
medical institutions (published for public institutions) be used to 
generate a revised cost estimate. One commenter stated that the 
estimates of the salary rates presented in the NPRM for institutional 
officials, IRB members and staff, and investigators are far below the 
national average for these roles. Likewise, they state that the 
anticipated benefits of the new proposed rule appear to be grossly 
overstated.
    One commenter stated that the rule as proposed was officially 
estimated to add $1.4 billion a year to the cost of the current system, 
but the true cost increase will be at least triple that due to 
egregious underestimates of wage costs, substantial underestimates of 
time spent on red tape by investigators, and many underestimated or 
omitted costs, as well as some estimates that misrepresent the effects 
of the rule. They claim that the rule is likely to impose about $5 
billion a year in needless costs, while reducing rather than improving 
protection of human subjects. One commenter stated that, at their 
institution, analysts average far greater pay levels than $15 per hour, 
and many of the tasks will have to be borne by faculty whose salaries 
exceed what is identified in the current cost analyses.
    One commenter proposed to mandate instead that institutions 
sufficiently resource their IRBs so as to protect 10 percent of their 
IRBs' and IRB administrators' time (about 1 meeting/year for an IRB 
that meets monthly; about 200 hours/year for a full-time equivalent IRB 
administrator with 2 weeks' vacation and 40-hour work weeks) to devote 
to finding efficiencies and innovations in the IRB review process.

[[Page 7234]]

a. Response to General Comments
    We note that the NPRM discussed the fact that data about IRB 
effectiveness and how IRBs function operationally \52\ is generally 
unavailable. The NPRM further noted that many of the NPRM RIA 
assumptions were based on anecdotal evidence; the NPRM requested 
comment on the accuracy of the assumptions presented and on whether 
better data sources might be available to support the analyses. RIA 
comments did not provide the evidence necessary to improve our 
estimates, and thus, limited changes have been made.
---------------------------------------------------------------------------

    \52\ See, e.g., Abbott L, Grady C. A Systematic Review of the 
Empirical Literature Evaluating IRBs: What We Know and What We Still 
Need to Learn. Retrieved from http://www.ncbi.nlm.nih.gov/pmc/articles/PMC3235475/.
---------------------------------------------------------------------------

    We note that the NPRM RIA used a national average for the salary 
estimates. We received no compelling evidence to change cost estimates 
because we must account for the fact that personnel and salaries in 
affected categories vary widely.
2. Extension of the Common Rule to Certain Nonfederally Funded Clinical 
Trials
    One commenter stated that coverage of this subset of projects will 
extend requirements, such as the single IRB requirement, without any 
consideration or mechanism for how to implement or fund this 
requirement and they do not believe that they should be required to 
accept added cost and burdens without any meaningful or measureable 
benefit to the welfare of human subjects.
    One commenter stated that the inclusion of nonregulated, unfunded 
trials under the regulations for the subset of organizations that 
receive federal grants would lead to a significant increase in burden, 
delay, ambiguity, and cost, and a loss of valuable research without 
increasing protections for human subjects.
    One commenter stated that an unintended burden would be the 
increased administrative costs of requiring reporting of all clinical 
trial Unanticipated Problems Involving Risks to Subjects or Others 
(unanticipated problems) to OHRP. They estimated requiring all 
unanticipated problems to be reported would increase their 
institution's necessary reporting by 25 percent.
a. Response to Comments on Extension of the Common Rule to Certain 
Nonfederally Funded Clinical Trials
    The final rule does not adopt this proposal.
3. Biospecimens
    With respect to expanding the definition of human subject to 
include nonidentifiable biospecimens and creating an exemption for 
secondary research on these specimens and identifiable information, 
many commenters claimed the NPRM significantly underestimated the cost 
of including nonidentified biospecimens under human subjects 
regulations and the consequent requirement for informed consent. 
Comments of a professional association, which were endorsed by numerous 
other commenters, stated that the NPRM has underestimated the financial 
impact of the Common Rule changes by a factor of at least 10, failing 
to account for the significant volume of specimens gathered outside of 
the federally funded environment, vastly underestimating the required 
time commitment and the requirements of administering a database to 
track consents, failing to include the expense incurred should an 
individual withdraw his or her consent for future research, and not 
including the potential expenditures required to develop a robust 
database that may be queried by researchers to identify biospecimens 
for use in future research projects. This association, and the numerous 
commenters who endorsed their comments, also felt that the increased 
administrative and cost burden to obtain informed consent for 
nonidentified biospecimens will disproportionately affect departments 
of pathology and laboratory medicine and will further increase indirect 
costs, which will eventually be built into the cost recovery rate from 
NIH, thereby reducing funds available for research when the NIH budget 
is fixed. One commenter stated that a major operations issue, and the 
one most necessary to ensure compliance with such a change, is the 
appropriate cataloging of biospecimens. Inherent in this new process 
are costs that will vary greatly based on the size of the stock of 
biospecimens held. Another commenter stated that the estimate for these 
costs was not plausible given the costs of developing or re-designing 
electronic systems.
a. Response to Comments on Biospecimens Proposals
    As noted above in the preamble, the provisions relating to making 
nonidentified biospecimens subject to the Common Rule have been 
entirely eliminated. The final rule RIA does include impact estimates 
related to this proposal in Section XIX.E of this preamble, discussing 
the impact of regulatory alternatives considered.
4. Broad Consent
    One commenter wrote that the NPRM stated that institutions would 
need to obtain broad consent from only a third of the 30 million 
individuals who are estimated to provide research and clinical 
biospecimens each year.
    Several commenters stated that this assertion fails to recognize 
that broad consent would need to be obtained from most individuals, not 
just those identified as research subjects, and underestimates the 
amount of time needed to revise consent processes and obtain such 
consent. For one institution, assuming staff time to obtain broad 
consent averages 20 minutes and the minimal staff salary is $25 per 
hour, this cost alone would be $2.54 million per year. Several 
commenters noted that the NPRM estimates that, per subject, the 
investigator or dedicated health care professional will spend 5 to 10 
minutes obtaining broad consent, but this institution believes that a 
more appropriate standard for obtaining broad consents, particularly in 
the initial years, would be 20 to 30 minutes. One commenter stated that 
literally hundreds of employees would need extensive training and 
periodic retraining in research ethics to obtain broad consent, and 
they calculate that every procedure that involves any tissue collection 
should take a minimum of 10 to 15 minutes of additional staff time to 
be able to even attempt to make the process meaningful.
    Many other commenters stated that tracking broad consent would 
impose significant costs, and require significant resources and 
infrastructure restructuring, given the complicated framework proposed 
by the NPRM.
    One of these commenters also stated that a significant cost absent 
from the NPRM analysis is the potential need for rebuilding existing 
biorepositories and databanks that may be invalidated under the NPRM 
because: (1) The samples were collected without initial broad consent; 
(2) the samples are coded and thus not eligible for the transition 
provisions; (3) consenting all human sources would not be feasible; and 
(4) the revised and limited waiver mechanism would not be available. 
One commenter estimated that it will require millions of dollars to 
build and support the necessary IT and infrastructure required to keep 
track of the consents. One commenter stated that, if the NPRM's concern 
for ``respect for persons'' is really sincere, then the cost estimates 
involved should be increased by a factor of 4 to 10 times what is

[[Page 7235]]

estimated in the NPRM. One commenter stated estimates that the 
biospecimen changes alone will cost their institution close to half a 
million U.S. dollars just in system changes to allow for the added 
administrative consent processes followed by the tracking mechanisms 
that will have to be put into place to accommodate the regulatory 
changes.
a. Response to Comments on Broad Consent
    As noted above in the preamble, the provisions relating to making 
nonidentified biospecimens subject to the Common Rule have been 
entirely eliminated. Eliminating that proposal largely addresses the 
concerns regarding costs of the Broad Consent proposal. Note that in 
response to public comments, we have modified our estimates of the time 
it would take to seek, obtain, and document broad consent under the 
regulatory alternatives section of the RIA.
5. Exemptions
    One commenter stated that even if a decision tool is used, IRBs 
will likely still need to review protocols to confirm the exempt 
classification, which will therefore not result in any cost savings.
a. Response to Comments on Exemptions
    The final rule does not include the exemption determination and 
documentation requirement proposed in the NPRM.
6. Privacy Safeguards
    One commenter stated that mandatory use of HIPAA or alternative, 
but yet-to-be determined, data security provisions would lead to a 
significant increase in burden, delay, ambiguity, and cost; this 
commenter also asserted that these safeguards might result in a loss of 
valuable research without increasing protections for human subjects.
    One commenter noted that a large component of the data security 
safeguards is only necessary because of the 10-fold increase in the 
number of identified biospecimens due to tracking informed consent and 
that this adds significantly to the cost of this requirement, well 
beyond what was represented in the NPRM RIA.
a. Response to Comments on Privacy Safeguards
    The final rule does not adopt the NPRM's proposal to implement 
standardized privacy safeguards.
7. Continuing Review
    One commenter applauded the NPRM for recognizing the cost-benefit 
value of eliminating continuing review for many studies. This will have 
a positive impact on the workload of investigators and IRBs.
8. Single IRB Review
    Several commenters stated that mandated single IRB review would not 
decrease the burden for investigators but would, in fact, increase the 
burden in both the long and short term. They stated that investigators 
who currently work only with a single IRB (their institution's IRB) 
will now have to work with multiple IRBs, adding to burden. Further, 
the resources needed to use a commercial IRB would be beyond the 
capacity of small trials, which often have limited resources. One of 
these commenters estimated that, an investigator who has 50 protocols 
and currently two IRBs of record, would have a minimum of 10 different 
IRBs of record under the regulations proposed in the NPRM. As a result, 
the investigator would need to work with at least an additional 8 IRBs 
(10 in total), each with unique and complex requirements.
    One commenter stated that the NPRM grossly underestimates in its 
assumption that a central IRB administrator would cost $15 per hour.
    One commenter stated that developing the infrastructure to support 
this effort will involve significant financial costs. Although using 
single IRBs for multi-institutional studies has the potential for long-
term cost savings and reduction of burden when implemented well, 
reaching that point requires a substantial initial investment. Many 
other commenters agreed that the NPRM underestimated these initial 
costs. They stated that these ``start-up costs'' include but are not 
limited to: The creation of electronic management systems that are 
interoperable among institutions; the adaptation of automated processes 
to multiple institutions; the communications tools necessary to link 
investigators and IRBs; the staff time necessary to develop agreements, 
consensus documents, or standard operating procedures; and the 
interaction necessary to build and maintain trusting relationships 
among institutional officials. One university received an estimate from 
the vendor of such a system that costs to accommodate this change would 
be in excess of $220,000 for the initial changes, with increased 
maintenance costs thereafter. In addition, the university would need to 
hire at least one full-time-equivalent (FTE) to handle the interface 
with all of the potential central IRBs and this position has a salary 
mid-point of $54,000, to which would be applied fringe benefits costs 
of $19,500. Several commenters noted that, even for institutions not 
serving as the IRB of record, there are real financial implications of 
participating in the centralized process in terms of adapting existing 
software systems and protocols.
    One commenter noted that the RIA section of the NPRM assigned 
nearly one-third of the total financial benefit of the revised Common 
Rule to savings achieved by the use of single IRBs for cooperative 
research. The RIA arrived at its estimate by assuming that when a 
single IRB of record reviews a protocol, all institutional costs are 
eliminated. The commenting institution uses numerous single IRBs, and 
they say they know from experience that the assumptions in the RIA are 
erroneous and no net savings accrue for IRB staff when using single 
IRBs of record. This same commenter noted that the NPRM states that its 
authors believe that, over time, standardization of agreements will 
occur so that all issues that currently take weeks or months to 
negotiate will be resolved. This commenter stated that no data to 
support this assumption and that, with each new single IRB required by 
NIH, they find a new set of requirements that requires the negotiation 
of hundreds of agreements with other institutions. They believe that 
study initiation will often be delayed because of this requirement and 
will result in additional software system needs and costs that are not 
even contemplated in the NPRM. They also stated that the vast majority 
of research-intensive universities are already over the federal 
mandated 26 percent facilities and administrative cap. Therefore, the 
commenter noted, the universities have no mechanism for funding the 
additional costs of serving as a central IRB because IRB costs are 
included in the portion of the facilities and administrative costs.
    One commenter estimated the costs of ensuring an appropriate data 
flow between an institution and each new IRB of record, with respect to 
research studies conducted, to require an extra 200 hours of IRB 
administrator time, in addition to software customization, 
configuration, and development costs. This commenter estimated the true 
costs far exceed those included in the NPRM by a factor of 1433 percent 
(2150 hours required in total for 10 IRBs of record, versus 150 hours). 
Even splitting the difference to only a factor of 767 percent (1150 
hours required in total for 10 IRBs of record versus 150 hours), the 
true costs of this approach virtually eclipse any possible quantified 
benefits estimated in the NPRM.

[[Page 7236]]

    Two commenters cautioned that the costs to implement single IRB 
review in multi-institutional studies should not be factored into the 
overall cost breakdown of a contract or grant. In other words, federal 
departments and agencies supporting research should make additional 
funds available to cover the costs associated with implementing Sec.  
__.114.
a. Response to Comments on Single IRB Review
    We agree with commenters who felt that mandated single IRB review 
will ultimately decrease administrative burdens and inefficiencies for 
investigators and institutions, while acknowledging that the transition 
to this model will require time and an adjustment to institutional 
structures and policies. To incorporate this into our estimates, we 
assume that investigators for which multi-institutional reviews are 
eliminated will face a reduction in burden associated with the 
elimination of the site-specific protocol review, but will face 
increased burden in the form of coordination with investigators at 
other sites, for example to ensure that the results of the IRB review 
are effectively communicated. Specifically, we assume that the 
elimination of multi-institutional reviews will result in investigators 
spending half as much time engaging with the review process as they 
would have if IRB review had taken place at all sites. As a result, the 
estimated quantified benefits associated with the elimination of multi-
institutional review have been revised downward by 27 percent.
9. Posting of Clinical Trial Informed Consent Forms
    Several commenters stated that they do not see the utility of the 
proposed provision to publish consent forms to a public Web site as it 
creates a new administrative burden without providing any clear 
additional protection for research subjects or benefit to the public at 
large. One commenter stated that the cost estimates that the NPRM 
attaches to this proposed requirement are unrealistically low. One 
commenter stated that if the site is either ClinicalTrials.gov or some 
future site that is of equal difficulty to use, the cost estimates for 
investigators and institutions to upload to the site are greatly 
underestimated. This institution has found that their investigators 
have found ClinicalTrials.gov sufficiently difficult that they have had 
to add and train staff devoted solely to meet this requirement.
a. Response to Comments on Posting of Consent Forms
    We note that this change, compared to the huge costs of clinical 
trials, will add a relatively small amount of additional burden. The 
time by which a consent form must be posted has been greatly extended. 
Furthermore, provisions have been added that allow for redaction of 
certain portions of consent forms, including the entire form in 
appropriate instances. We estimate that the revised rule will not 
affect the quantified and nonquantified costs summarized in the NPRM.
D. Analysis of Benefits and Costs
    In this section, we present the analysis of the quantified and 
nonquantified benefits and costs of the changes to the Common Rule. 
First, we discuss the common assumptions of the analysis. Then we 
present the estimated quantified and nonquantified benefits and costs 
of the specific changes. As discussed above and in the NPRM, because of 
the lack of available data about IRB effectiveness and how IRBs 
function operationally, many of the estimations in this analysis are 
based on anecdotal evidence.
1. Analytic Assumptions
    The analysis relies on common data elements and assumptions, 
detailed below, concerning the domestic entities, individuals, and IRB 
reviews affected by the changes to the Common Rule. Many of the 
estimates are derived from a 1998 NIH-sponsored evaluation of the 
implementation of Section 491 of the Public Health Service Act, which 
involved nationally representative surveys of IRBs, institutions, and 
investigators. Based on a review of the literature, this study contains 
the best available data on the time spent on protocol reviews as well 
as the characteristics of the reviews themselves. Additionally, OHRP 
processes the majority of FWAs and IRB registrations for all Common 
Rule departments or agencies. Thus, using information from the OHRP 
database of assured institutions and registered institutions or 
organizations and their IRBs is a reasonable way to estimate the number 
of institutions and IRBs regulated by all Common Rule departments or 
agencies that will be affected by these changes. OHRP's IRB 
registration process requires institutions and organizations to provide 
information about the approximate number of active protocols reviewed 
by IRBs during the preceding 12 months. Thus, OHRP's IRB database is 
the best source for determining the total number of protocols reviewed 
by IRBs at this time.
    According to the OHRP database of assured institutions and 
registered institutions or organizations and their IRBs, approximately 
8,035 institutions in the United States have an FWA, of which 2,871 
have an IRB. Some institutions have multiple IRBs and some IRBs are not 
affiliated with an institution with an FWA. In total, 3,499 registered 
IRBs are in the United States.
    The OHRP database of assured institutions and registered 
institutions or organizations and their IRBs shows that 675,390 annual 
reviews of nonexempt protocols involving human subjects are conducted. 
It is estimated that of this total, 324,187 are initial protocol 
reviews (48 percent) and 351,203 are continuing protocol reviews (52 
percent) based on estimates reported in Bell et al.\53\ In each 
category, it is estimated that 69 percent of these reviews are convened 
and 31 percent are expedited based on estimates reported in Bell et al.
---------------------------------------------------------------------------

    \53\ Bell J., Whiton J., and Connelly S., Final Report: 
Evaluation of NIH Implementation of Section 491 of the Public Health 
Service Act, Mandating a Program of Protection for Research 
Subjects, 1998.
---------------------------------------------------------------------------

    It is estimated that 472,773 reviews of single-site protocols (70 
percent) and 202,617 reviews of multi-institutional protocols (30 
percent) take place, based on estimates reported in Bell et al. This 
analysis also assumes that, on average, 5 IRB reviews take place per 
multiple-site protocol. This implies 472,773 single-site protocols and 
40,523 multi-institutional protocols, for a total of 513,296 protocols. 
The above also implies approximately 246,382 new protocols each year.
    Based on queries of ClinicalTrials.gov, we estimated that HHS 
supports 909 new clinical trials annually, of which 575 are regulated 
by FDA. In addition, based on queries of ClinicalTrials.gov, non-HHS 
Common Rule departments and agencies support approximately 5,270 
studies.
    Many individuals in various occupations would be affected by the 
changes to the Common Rule. We estimated that an average of one 
institution official at each institution with an FWA would be affected 
by these changes, for a total of 2,871 institution officials. The OHRP 
database of registered IRBs shows that IRBs have 10,197 full-time 
equivalents (FTEs) staff persons working as administrators or 
administrative staff, and that 89.8 percent of IRBs have an 
administrator. It is assumed that these individuals work full-time, 
implying a total of 3,193 IRB administrators and 7,004 IRB

[[Page 7237]]

administrative staff. The OHRP database of IRB membership rosters 
contains 3,359 individuals who serve as IRB chairs and an additional 
32,518 voting members. The number of IRB chairs is less than the number 
of IRBs because some individuals chair multiple IRBs. It is assumed 
that 439,968 investigators conduct human subjects research in the 
United States.\54\
---------------------------------------------------------------------------

    \54\ To derive this estimate, the number of new protocols, 
estimated above, is divided by the average number of new protocol 
submissions reported per investigator. This is estimated to be 2.8 
based on Bell et al. This number is then multiplied by the average 
number of investigators working on each protocol (which is assumed 
to be 5). This allows for an accounting of investigators working on 
multiple protocols as well as protocols with multiple investigators.
---------------------------------------------------------------------------

    We estimated the hourly wages of individuals affected by the 
changes to the Common Rule using information on annual salaries 
provided by the U.S. Bureau of Labor Statistics and the U.S. Office of 
Personal Management. The salary of postsecondary education 
administrators is used as a proxy for the salary of institution 
officials; the salary of lawyers is used as a proxy for the salary of 
institution legal staff and IRB administrators; the salary of office 
and administrative support workers is used as a proxy for the salary of 
IRB administrative staff; the salary of postsecondary health teachers 
is used as a proxy for the salary of IRB chairs and IRB voting members; 
the salary of postsecondary teachers is used as a proxy for the salary 
of investigators; the salary of database and systems administrators and 
network architects is used as a proxy for the salary of database 
administrators; and the salary of all occupations, as a proxy for the 
salary of prospective human subjects. The federal employees affected by 
the changes to the Common Rule are assumed to be Step 5 within their 
GS-level and earn locality pay for the District of Columbia, Baltimore, 
and Northern Virginia. Annual salaries are divided by 2,087 hours to 
derive hourly wages. To project wages over 2017-2026, wages are 
adjusted for growth over time using the average annual per capita 
growth in real wage income over 1929-2012 reported by the U.S. Bureau 
of Economic Analysis, which is 2.1 percent. The total dollar value of 
labor, which includes wages, benefits, and overhead, is assumed to be 
equal to 200 percent of the wage rate.
    We calculated person-hours by occupation per initial protocol 
review and per continuing protocol review based on each occupation's 
share of total person-hours reported in Bell et al. In particular, Bell 
et al. reports that institution officials account for 4 percent, IRB 
administrators account for 28 percent, IRB administrative staff account 
for 30 percent, IRB chairs account for 7 percent, and IRB voting 
members account for 31 percent of total person-hours. We assumed that 
the average number of person-hours spent per review equals the weighted 
average of the person-hours spent per convened review and the person-
hours spent per expedited review. We further assumed that convened 
review requires twice as many person-hours as expedited review.
    Table 3 shows the number of entities affected by the changes to the 
Common Rule and other common assumptions of the analysis (described 
above).

    Table 3--Number of Affected Entities and Other Common Assumptions
------------------------------------------------------------------------
                  Description                            Estimate
------------------------------------------------------------------------
U.S. Institutions and IRBs:
    Institutions with an FWA...................                    8,035
    FWA Institutions with an IRB...............                    2,871
    FWA Institutions without an IRB............                    5,164
    U.S. IRBs..................................                    3,499
Occupations:
    Institution officials......................                    2,871
    IRB administrators.........................                    3,193
    IRB administrative staff...................                    7,004
    IRB chairs.................................                    3,359
    IRB voting members.........................                   32,518
    Investigators..............................                  439,968
Hourly Wages:
    Institution officials (2015)...............                   $49.17
    Institution legal staff (2015).............                   $65.29
    IRB administrators (2015)..................                   $65.29
    IRB administrative staff (2015)............                   $17.41
    IRB chairs (2015)..........................                   $50.06
    IRB voting members (2015)..................                   $50.06
    Investigators (2015).......................                   $37.13
    Database administrators (2015).............                   $40.37
    Prospective Human Subjects (2015)..........                   $23.15
    Federal employees in the District of         .......................
     Columbia, Baltimore, and Northern Virginia
     (2015)....................................
        GS-11 Step 5...........................                   $34.60
        GS-13 Step 5...........................                   $49.32
        GS-14 Step 5...........................                   $58.28
        GS-15 Step 5...........................                   $68.56
    Average annual per capita growth in real                        2.1%
     wage income...............................
IRB Reviews of Human Subjects Research
 Protocols at U.S. Institutions:
    Annual reviews of nonexempt protocols......                  675,390
        Initial protocol reviews (48%).........                  324,187
            Convened reviews (69%).............                  223,689
            Expedited reviews (31%)............                  100,498
        Continuing protocol reviews (52%)......                  351,203
            Convened reviews (69%).............                   242,30
            Expedited reviews (31%)............                  108,873
    Annual reviews of single-site protocols                      472,773
     (70%).....................................

[[Page 7238]]

 
    Annual reviews of multi-institutional                        202,617
     protocols (30%)...........................
Human Subjects Research Protocols at U.S.
 Institutions:
    Active protocols...........................                  513,296
        Single-site protocols..................                  472,773
        Multi-site protocols...................                   40,523
    New protocols (48%)........................                  246,382
    Average number of IRB reviews per active                           5
     multi-institutional protocol..............
Clinical Trials:
    New clinical trials supported by HHS                             909
     annually..................................
        Regulated by FDA.......................                      575
    Clinical Trials supported by Common Rule                       5,270
     Agencies..................................
Person-Hours per Protocol Reviewed by
 Occupation and Type of Review:
    Institution officials:
        Initial protocol reviews:
            Convened reviews...................                     0.52
            Expedited reviews..................                     0.26
        Continuing protocol reviews:
            Convened reviews...................                     0.10
            Expedited reviews..................                     0.05
    IRB administrators:
        Initial protocol reviews:
            Convened reviews...................                     3.64
            Expedited reviews..................                     1.82
        Continuing protocol reviews:
            Convened reviews...................                     0.68
            Expedited reviews..................                     0.34
    IRB administrative staff:
        Initial protocol reviews:
            Convened reviews...................                     3.91
            Expedited reviews..................                     1.95
        Continuing protocol reviews:
            Convened reviews...................                     0.73
            Expedited reviews..................                     0.36
    IRB chairs:
        Initial protocol reviews:
            Convened reviews...................                     0.91
            Expedited reviews..................                     0.46
        Continuing protocol reviews:
            Convened reviews...................                     0.17
            Expedited reviews..................                     0.08
    IRB voting members:
        Initial protocol reviews:
            Convened reviews...................                     2.70
            Expedited reviews..................                     1.35
            Exempt reviews.....................                     0.50
        Continuing protocol reviews:
            Convened reviews...................                     0.75
            Expedited reviews..................                     0.38
    Investigators:
        Initial protocol reviews:
            Convened reviews...................                    13.65
            Expedited reviews..................                     7.15
            Exempt reviews.....................                     0.50
        Continuing protocol reviews:
            Convened reviews...................                     6.83
            Expedited reviews..................                     3.58
------------------------------------------------------------------------

2. Analysis of Changes
    We present below an analysis of the quantified and nonquantified 
benefits and costs of the changes to the Common Rule. For each change, 
we describe the change, provide a qualitative summary of the 
anticipated benefits and costs, describe the methods we use to quantify 
benefits and costs, and then present estimates.
a. Costs for the Regulated Community To Learn New Requirements and 
Develop Training Materials; Costs for OHRP To Develop Materials and 
Guidance
    Domestic institutions, IRBs, and investigators would need to spend 
time learning the changes to the Common Rule once training materials 
become available to them. In addition, IRBs and OHRP would need to 
update training materials for investigators. OHRP also would need to 
develop guidance, templates, and a number of electronic resources.
    We estimate that institution officials, IRB administrators, IRB 
administrative staff, IRB chairs, IRB voting members, and investigators 
would each spend 5 hours to learn the changes to the Common Rule. We 
also estimate that institution officials would spend 2

[[Page 7239]]

hours to learn new procedures, IRB administrators would spend 20 hours, 
and administrative staff would spend 80 hours. Based on the estimates 
presented in Table 3, the dollar value of their time is calculated by 
multiplying hours by their estimated 2016 wages and adjusting for 
overhead and benefits. For example, to calculate the dollar value of 
time spent by institution officials to learn the changes to the Common 
Rule in 2017, we multiply the number of institution officials (2,871) 
by the number of hours spent per institutional official (5), by the 
projected hourly wage of institution officials ($49.17), and by the 
adjustment factor for benefits and overhead (2).
    In order to develop the resources required by the final rule, we 
anticipate that OHRP would need:
     Three staff people at the GS-14 level and three staff 
people at the GS-13 level to: (1) Promote harmonization efforts to 
issue guidance across Common Rule agencies and departments; (2) develop 
guidance for the regulated community; (3) develop template agreements 
for use by the regulated community; (4) manage the administrative 
transition to the new processes in the final rule; and, (5) develop 
web-based posting portals.
     One staff person at the GS-13 level to manage process 
changes in the final rule, and assist with implementation for the web-
based portals.
     One staff person at the GS-11 level to provide technical 
support for the web-based portals in the final rule.

    In addition, the first year after the final rule is published 
staffing resources beyond what is described above would be necessary:
     Three staff people at the GS-14 level to draft new 
guidance and revise old guidance.
     One staff person at the GS-14 level to conduct educational 
seminars.

    OHRP also anticipates the following in nonpersonnel costs:
     Technical development of two Web-based portals for 
investigators to post final consent forms for HHS-funded clinical 
trials, and for investigators who conduct certain types of 
demonstration projects to post information about said projects 
($350,000)
     Developing five educational seminars (including travel) to 
educate the public about the requirements of the new rule ($150,000)
     Upgrading equipment for education activities ($50,000)

    We also note that additional staff time throughout the Common Rule 
departments and agencies will be needed to fulfill the consultation 
requirement found in Sec.  __.102(e)(7). As we assume that this 
consultation will not involve the hiring of additional personnel to 
fulfill, we consider this a nonquantified cost.
    Present value costs of $214 million and annualized costs of $25.0 
million are estimated using a 3 percent discount rate; present value 
costs of $204 million and annualized costs of $29.1 million are 
estimated using a 7 percent discount rate. Table 4 summarizes the 
quantified and nonquantified benefits and costs to learn new 
requirements and develop training materials.

    Table 4--Summary of Estimated Benefits and Costs To Learn New Requirements and Develop Training Materials
----------------------------------------------------------------------------------------------------------------
                                                Present value of 10  years by    Annualized value over 10  years
                                              discount rate  (millions of 2015   by discount rate  (millions of
                                                          dollars)                        2015 dollars)
                                             -------------------------------------------------------------------
                                                 3 percent        7 percent        3 percent        7 percent
----------------------------------------------------------------------------------------------------------------
BENEFITS:
Quantified Benefits:
    None....................................  ...............  ...............  ...............  ...............
----------------------------------------------------------------------------------------------------------------
Nonquantified Benefits:
    None........................................................................................................
----------------------------------------------------------------------------------------------------------------
COSTS:
Quantified Costs:
    Time and money to learn new                          214              204             25.0             29.1
     requirements, update training
     materials, develop tools and conduct
     consultations..........................
----------------------------------------------------------------------------------------------------------------
Nonquantified Costs:
    Implementation of consultation requirements.................................................................
----------------------------------------------------------------------------------------------------------------

b. Extending Oversight to IRBs Unaffiliated With an Institution Holding 
an FWA (Sec.  __.101(a))
    As outlined in the NPRM, and as generally supported by public 
commenters, the final rule includes a new provision at Sec.  __.101(a) 
that gives Common Rule departments and agencies the authority to 
enforce compliance directly against IRBs that are not operated by an 
assured institution. We anticipate that this change will encourage 
institutions to rely on IRBs not operated by an FWA-holding institution 
more often and also will assist in the implementation of the 
requirements at Sec.  __.114. Here, we estimate the impact that this 
proposal will have on IRBs that are not operated by an FWA- holding 
institution. The estimated impact of this and other related proposals 
on FWA- holding institutions is addressed in Section XIX.D.2.f of this 
RIA.
    The OHRP database of assured institutions and registered IRBs shows 
that approximately 449 IRBs not affiliated with an institution holding 
an FWA will now be subject to oversight. These IRBs will develop an 
estimated average of 10 written agreements with other institutions each 
year as a result of this rule. It is further estimated that each 
agreement will require an average of 10 hours of institution legal 
staff time and 5 hours of IRB administrator time to complete.
    The estimated costs to institution officials, IRB administrators, 
IRB administrative staff, IRB chairs, IRB voting members, and 
investigators of conducting these reviews are based on the estimates 
presented in Table 3. The dollar value of their time is calculated by 
multiplying hours by their estimated 2017-2026 wages and adjusting for 
overhead and benefits.
    Present value costs of $85.6 million and annualized costs of $10.0 
million

[[Page 7240]]

are estimated using a 3 percent discount rate; present value costs of 
$70.0 million and annualized costs of $10.0 million are estimated using 
a 7 percent discount rate. Table 5 summarizes the quantified and 
nonquantified benefits and costs of extending oversight to IRBs 
unaffiliated with an institution holding an FWA.

Table 5--Summary of Estimated Benefits and Costs of Extending Oversight to IRBs Unaffiliated With an Institution
                                        Holding an FWA (Sec.   __.101(a))
----------------------------------------------------------------------------------------------------------------
                                                Present value of 10  years by    Annualized value over 10  years
                                              discount rate  (millions of 2015   by discount rate  (millions of
                                                          dollars)                        2015 dollars)
                                             -------------------------------------------------------------------
                                                 3 percent        7 percent        3 percent        7 percent
----------------------------------------------------------------------------------------------------------------
BENEFITS:
Quantified Benefits:
    None....................................  ...............  ...............  ...............  ...............
----------------------------------------------------------------------------------------------------------------
Nonquantified Benefits:
    Encouraging institutions to rely on single IRBs of record in multi-institutional studies when appropriate...
----------------------------------------------------------------------------------------------------------------
COSTS:
Quantified Costs:
    Developing IRB authorization agreements             85.6             70.0             10.0             10.0
     or other procedures....................
----------------------------------------------------------------------------------------------------------------
Nonquantified Costs:
    None........................................................................................................
----------------------------------------------------------------------------------------------------------------

c. Explicit Carve-Outs of Activities From the Definition of Research 
(Sec.  __.102(l))
    The final rule includes four categories that are explicitly deemed 
to be not research (final rule at Sec.  __.102(l)(1)-(4)). These 
categories include: (1) Scholarly and journalistic activities (e.g., 
oral history, journalism, biography, literary criticism, legal research 
and historical scholarship), including the collection and use of 
information that focuses directly on the specific individuals about 
whom the information is collected; (2) certain public health 
surveillance activities; (3) certain collection and analysis activities 
conducted by a criminal justice agency; and (4) certain activities 
conducted by a defense, national security, or homeland security 
authority.
    Institutions, investigators, and IRBs involved in supporting, 
conducting, or reviewing these activities will no longer incur the 
costs of IRB review and approval and continuing review. Activities that 
were not intended to be subject to the regulations will clearly be 
removed from the definition of research, allowing such activities to 
proceed without delays caused by the need for IRB submission, review, 
and approval.
    We estimate that 3,376 annual reviews of protocols (0.5 percent) 
will no longer be conducted as a result of the activities deemed not to 
be research in Sec.  __.102(l)(1)-(4). Of these reviews, 1,118 will 
have undergone convened initial review, 502 will have undergone 
expedited initial review, 1,212 will have undergone convened continuing 
review, and 544 will have undergone expedited continuing review based 
on the distribution of reviews presented in Table 3.
    The estimated costs to institution officials, IRB administrators, 
IRB administrative staff, IRB chairs, IRB voting members, and 
investigators of conducting these reviews are based on the estimates 
presented in Table 3. The dollar value of their time is calculated by 
multiplying hours by their estimated 2017-2026 wages and adjusting for 
overhead and benefits.
    Present value benefits of $36.2 million and annualized benefits of 
$4.24 million are estimated using a 3 percent discount rate, and 
present value benefits of $29.6 million and annualized benefits of 
$4.22 million are estimated using a 7 percent discount rate. Table 6 
summarizes the quantified and nonquantified benefits and costs of 
excluding these activities from the requirements of the Common Rule.

                      Table 6--Summary of Estimated Benefits and Costs of Sec.   __.102(l)
----------------------------------------------------------------------------------------------------------------
                                                Present value of 10  years by    Annualized value over 10  years
                                              discount rate  (millions of 2015   by discount rate  (millions of
                                                          dollars)                        2015 dollars)
                                             -------------------------------------------------------------------
                                                 3 percent        7 percent        3 percent        7 percent
----------------------------------------------------------------------------------------------------------------
BENEFITS:
Quantified Benefits:
    Reduction in number of reviews..........            36.2             29.6             4.24             4.22
----------------------------------------------------------------------------------------------------------------
Nonquantified Benefits:
    Increased clarity in what must be reviewed; ability for IRBs to focus efforts on reviews of higher-risk,
     more complex research activities...........................................................................
----------------------------------------------------------------------------------------------------------------
COSTS:
Quantified Costs:
    None....................................  ...............  ...............  ...............  ...............
----------------------------------------------------------------------------------------------------------------
Nonquantified Costs:
    None........................................................................................................
----------------------------------------------------------------------------------------------------------------


[[Page 7241]]

d. Clarifying and Harmonizing Regulatory Requirements and Agency 
Guidance (Sec.  __.101(j))
    The final rule at Sec.  __.101(j) requires consultation among the 
Common Rule departments and agencies for the purpose of harmonization 
of guidance (to the extent appropriate) before federal guidance on the 
Common Rule is issued, unless such consultation is not feasible.
    As this change likely will not affect staffing requirements in the 
Federal Government, no costs are quantified here. It is possible 
however, that the harmonization requirement could result in it taking 
longer for Common Rule department or agency guidance to be approved and 
issued to the public. Similarly, as the extent to which this change 
will reduce the time IRBs spend on reviewing protocols is unclear, 
benefits are also not quantified. Table 7 summarizes the nonquantified 
benefits and costs of clarifying and harmonizing regulatory 
requirements and agency guidance.

   Table 7--Summary of Estimated Benefits and Costs of Clarifying and Harmonizing Regulatory Requirements and
                                       Agency Guidance (Sec.   __.101(j))
----------------------------------------------------------------------------------------------------------------
                                                Present value of 10  years by    Annualized value over 10  years
                                              discount rate  (millions of 2015   by discount rate  (millions of
                                                          dollars)                        2015 dollars)
                                             -------------------------------------------------------------------
                                                 3 percent        7 percent        3 percent        7 percent
----------------------------------------------------------------------------------------------------------------
BENEFITS:
Quantified Benefits:
    None....................................  ...............  ...............  ...............  ...............
----------------------------------------------------------------------------------------------------------------
Nonquantified Benefits:
    Increased uniformity in regulatory requirements among Common Rule agencies; increased clarity to the
     regulated community about how regulations should be interpreted............................................
----------------------------------------------------------------------------------------------------------------
COSTS:
Quantified Costs:
    None....................................  ...............  ...............  ...............  ...............
----------------------------------------------------------------------------------------------------------------
Nonquantified Costs:
    Time for consultation among Common Rule agencies before federal guidance is issued..........................
----------------------------------------------------------------------------------------------------------------

e. Modifying the Assurance Requirements (Sec.  __.103)
    The final rule modifies the requirements of the assurance process 
in the following ways. First, the final rule does not include the pre-
2018 requirement of identifying a statement of principles governing all 
research at an institution. The requirement for institutions to 
designate a set of ethical principles by which that institution will 
abide in all research activities was generally not enforced. Further, 
for international institutions that received U.S. Government funding 
for research activities, it created the impression that these 
international institutions must modify their internal procedures to 
comport with the set of principles designated on the FWA for activities 
conducted at those institutions that received no U.S. Government 
funding. This provision was deleted from the final rule to provide 
clarity to these international institutions that such measures are not 
required for activities that receive no Common Rule department or 
agency support.
    The requirement in the pre-2018 rule that a written assurance 
include a list of IRB members for each IRB designated under the 
assurance has been moved to Sec.  __.108(a)(2) and modified. The final 
rule requires that an institution, or when appropriate the IRB, prepare 
and maintain a current detailed list of the IRB members with 
information sufficient to describe each member's chief anticipated 
contributions to IRB deliberation, and any employment or other 
relationship between each member and the institution. The final rule 
also deletes the pre-2018 requirement that changes in IRB membership be 
reported to the department or agency head, or to OHRP when the 
existence of an HHS-approved assurance is accepted.
    The changes to the IRB roster requirement are expected to reduce 
administrative burden without having any significant impact on the 
protection of human subjects:
    Finally, the requirement in the pre-2018 rule that a department or 
agency head's evaluation of an assurance take certain factors into 
consideration has been deleted. These factors include the adequacy of 
the proposed IRB in light of the anticipated scope of the institution's 
activities and the types of subject populations likely to be involved, 
the appropriateness of the proposed initial and continuing review 
procedures in light of the probable risks, and the size and complexity 
of the institution. Deletion of that provision eliminates an 
administrative process that was no longer meaningful given the purpose 
and design of the FWA and OHRP's processes for reviewing IRB 
registrations and reviewing and approving FWAs. This change also 
harmonizes the Common Rule with FDA's human subjects protection 
regulations by eliminating the requirement to submit IRB membership 
lists.
    We estimate that administrative staff at each IRB would spend 5 
fewer hours complying with the assurance requirements. Based on the 
estimates presented in Table 3, the dollar value of their time is 
calculated by multiplying hours by their estimated 2017-2026 wages and 
adjusting for overhead and benefits.
    Present value benefits of $5.93 million and annualized benefits of 
$0.69 million are estimated using a 3 percent discount rate; present 
value benefits of $4.18 million and annualized benefits of $0.60 
million are estimated using a 7 percent discount rate. Table 8 
summarizes the quantified and nonquantified benefits and costs of the 
proposed change to the IRB roster requirement.

[[Page 7242]]



  Table 8--Summary of Estimated Benefits and Costs of Changes to Modifying the Assurance Requirements (Pre-2018
                                    Rule at Sec.   __.103(b)(1), (b)(3), (d))
----------------------------------------------------------------------------------------------------------------
                                                Present value of 10  years by    Annualized value over 10  years
                                              discount rate  (millions of 2015   by discount rate  (millions of
                                                          dollars)                        2015 dollars)
                                             -------------------------------------------------------------------
                                                 3 percent        7 percent        3 percent        7 percent
----------------------------------------------------------------------------------------------------------------
BENEFITS:
Quantified Benefits:
    Reduction in time for IRB administrative            5.93             4.18             0.69             0.60
     staff and OHRP staff to submit, review,
     and process IRB membership lists.......
----------------------------------------------------------------------------------------------------------------
Nonquantified Benefits:
    Reduction in volume of records created by an institution....................................................
----------------------------------------------------------------------------------------------------------------
COSTS:
Quantified Costs:
    None....................................  ...............  ...............  ...............  ...............
----------------------------------------------------------------------------------------------------------------
Nonquantified Costs:
    None........................................................................................................
----------------------------------------------------------------------------------------------------------------

f. Requirement for Documenting Reliance on IRBs Not Operated by the 
FWA-Holding Institution (Sec. Sec.  __.103(e) and __.115(a)(9))
    The final rule contains a requirement at Sec.  __.103(e) that, to 
ensure compliance with the requirements of the Common Rule, nonexempt 
human subjects research subject to this policy that takes place at an 
institution in which IRB oversight is conducted by an IRB that is not 
operated by the institution, the institution and the organization 
operating the IRB shall document the institution's reliance on the IRB 
for oversight of the research and the responsibilities that each entity 
will undertake. This requirement could be satisfied, for example, by: 
(1) Developing a written agreement between the institution and the IRB; 
(2) implementing an institution-wide policy directive providing the 
allocation of responsibilities between the institution and an IRB that 
is not affiliated with the institution; or (3) describing the 
allocation of responsibilities in a research protocol. In addition, a 
requirement is added at Sec.  __.115(a)(9) of the final rule that 
institutions or IRBs retain this written agreement or other procedures 
undertaken to ensure compliance with the requirements of this policy, 
as described in Sec.  __.103(e).
    Initially, costs would be involved in drafting, revising, and 
conducting managerial review of agreements to ensure they satisfy these 
new requirements. Anticipated benefits include greater reliance on IRBs 
not operated by the institutions as the IRB of record for cooperative 
research.
    Table 3 shows that 5,164 FWA-holding institutions do not have an 
IRB and 2,871 FWA-holding institutions have an IRB. We assume that the 
5,164 FWA-holding institutions without an IRB have an average of 1 IRB 
authorization agreement that will need to be modified as a result of 
the new requirements for agreements between institutions and IRBs not 
operated by the institutions in 2017. In addition, we assume that the 
2,871 FWA-holding institutions with an IRB have an average of 0.20 IRB 
authorization agreements that would need to be modified in 2017. We 
estimate that each agreement will require an average of 10 hours of 
institution legal staff time and 5 hours of IRB administrator time to 
complete. The dollar value of their time is calculated by multiplying 
hours by their estimated 2017 wages and adjusting for overhead and 
benefits.
    Present value costs of $11.4 million and annualized costs of $1.33 
million are estimated using a 3 percent discount rate; present value 
costs of $10.9 million and annualized costs of $1.56 million are 
estimated using a 7 percent discount rate. Table 9 summarizes the 
quantified and nonquantified benefits and costs of the requirement for 
written procedures and agreements for reliance on IRBs not operated by 
the FWA-holding institution (Sec. Sec.  __.103(e) and __.115(a)(9) in 
the final rule).

 Table 9--Summary of Requirement for Written Procedures and Agreements for Reliance on IRBs Not Operated by the
                       FWA-Holding Institution (Sec.  Sec.   __.103(e) and __.115(a)(10))
----------------------------------------------------------------------------------------------------------------
                                                Present value of 10  years by    Annualized value over 10  years
                                              discount rate  (millions of 2015   by discount rate  (millions of
                                                          dollars)                        2015 dollars)
                                             -------------------------------------------------------------------
                                                 3 percent        7 percent        3 percent        7 percent
----------------------------------------------------------------------------------------------------------------
BENEFITS:
Quantified Benefits:
    None....................................  ...............  ...............  ...............  ...............
----------------------------------------------------------------------------------------------------------------
Nonquantified Benefits:
    None........................................................................................................
----------------------------------------------------------------------------------------------------------------
COSTS:
Quantified Costs:
    Time to modify written agreements                   11.4             10.9             1.33             1.56
     between IRBs and institutions..........
----------------------------------------------------------------------------------------------------------------

[[Page 7243]]

 
Nonquantified Costs:
    None........................................................................................................
----------------------------------------------------------------------------------------------------------------

g. Eliminating the Requirement That the Grant Application Undergo IRB 
Review and Approval (Pre-2018 Rule at Sec.  __.103(f))
    The final rule eliminates the requirement in the pre-2018 rule that 
grant applications undergo IRB review and approval for the purposes of 
certification. The grant application is often outdated by the time the 
research study is submitted for IRB review and contains detailed 
information about the costs of a study, personnel, and administrative 
issues that go beyond the mission of the IRB to protect human subjects. 
Therefore, experience suggests that review and approval of the grant 
application is not a productive use of IRB time, and the change likely 
will not reduce protections for human subjects or impose other costs.
    We estimate that 324,187 initial reviews of protocols occur 
annually, of which 223,689 involve convened review and 100,498 involve 
expedited review based on the distribution of reviews presented in 
Table 3. For the purpose of this analysis, we assume that each protocol 
reviewed by an IRB is associated with one grant application or other 
funding proposal. We estimate that investigators spend an average of 15 
minutes compiling their grant applications when they submit a protocol 
for initial review. Further, we estimate that IRBs typically use two 
primary reviewers for convened review and one primary reviewer for 
expedited review, and that primary reviewers spend an average of 30 
minutes reviewing the grant application. Based on the estimates in 
Table 3, the dollar value of their time is calculated by multiplying 
hours by their estimated 2017-2026 wages and adjusting for overhead and 
benefits.
    Present value benefits of $326 million and annualized benefits of 
$38.2 million are estimated using a 3 percent discount rate and present 
value benefits of $230 million and annualized benefits of $32.7 million 
are estimated using a 7 percent discount rate. Table 10 below 
summarizes the quantified and nonquantified benefits and costs of 
eliminating the requirement that the grant application undergo IRB 
review and approval.

   Table 10--Summary of Estimated Benefits and Costs of Eliminating the Requirement That the Grant Application
                       Undergo IRB Review and Approval (Pre-2018 Rule at Sec.   __.103(f))
----------------------------------------------------------------------------------------------------------------
                                                Present value of 10  years by    Annualized value over 10  years
                                              discount rate  (millions of 2015   by discount rate  (millions of
                                                          dollars)                        2015 dollars)
                                             -------------------------------------------------------------------
                                                 3 percent        7 percent        3 percent        7 percent
----------------------------------------------------------------------------------------------------------------
BENEFITS:
Quantified Benefits:
    Decreased time associated with reviewing             326              230             38.2             32.7
     grant applications.....................
----------------------------------------------------------------------------------------------------------------
Nonquantified Benefits:
    None........................................................................................................
----------------------------------------------------------------------------------------------------------------
COSTS:
Quantified Costs:
    None....................................  ...............  ...............  ...............  ...............
----------------------------------------------------------------------------------------------------------------
Nonquantified Costs:
    None........................................................................................................
----------------------------------------------------------------------------------------------------------------

h. Expansion of Exemption Categories (Sec.  __.104(d))
    The final rule includes eight exemption categories. Some of these 
categories include subcategories of exemptions.
    We note that one pre-2018 exemption does not appear in the final 
rule (exemption for educational tests, survey procedures, interview 
procedures, or observation of public behavior where a statute requires 
confidentiality of the information collected, or where the human 
subjects involved in the activity are public figures). We also note 
that several of the final rule exemptions were proposed in the NPRM as 
exclusions. Finally, we note that only one pre-2018 exemption has been 
unmodified in the final rule (the exemption for taste and food quality 
evaluations).
    The exemptions included in the final rule are:
     Certain research involving normal educational practices
     Certain research that involves the use of educational 
tests, survey procedures, interview procedures, or observation of 
public behavior
     Research involving benign behavioral interventions in 
conjunction with the collection of information from an adult subject 
through verbal or written responses or video recording
     Research involving the secondary use of identifiable 
private information or identifiable biospecimens provided that:

[[Page 7244]]

    [cir] The sources are publicly available
    [cir] The information is recorded in such a manner that the 
identity of subjects is not readily ascertainable by the investigator
    [cir] The research is regulated as ``health care operations,'' 
``public health activities,'' or ``research'' under HIPAA
    [cir] The research is conducted by or on behalf of a federal 
department or agency using government-generated or government-collected 
nonresearch information, provided that certain conditions are met
     Research and demonstration projects conducted or supported 
by a federal department or agency
    [cir] In addition to OHRP's interpretation of this exemption 
expanding under the final rule, and language being modified in this 
exemption to reflect that expanded interpretation, the final rule also 
includes a requirement that federal departments or agencies conducting 
or supporting demonstration projects post information about these 
studies on a publicly accessible federal Web site
     Taste and food quality evaluation and consumer acceptance 
studies
     The storage and maintenance of identifiable biospecimens 
or identifiable private information for unspecified secondary research 
studies
     The secondary research use of identifiable biospecimens or 
identifiable private information where broad consent has been sought 
and obtained
    The goal of the posting requirement in the exemption for research 
and demonstration projects (final rule at Sec.  __.104(d)(5)) is to 
promote transparency in federally conducted or supported activities 
affecting the public that are not subject to oversight under the Common 
Rule. It should not create any delay in research. HHS will develop a 
resource that all Common Rule departments and agencies may use to 
satisfy the posting requirement (accounted for in Section XIX.D.2.a of 
this RIA). Alternatively, an agency can create or modify its own Web 
site for this purpose. Thus, increased transparency in federally funded 
or supported demonstration projects is a non-quantified benefit of the 
final rule modifications.
    Other nonquantified benefits of the expansion to the modifications 
of exempt research include clearer instructions to the regulated 
community about the extent to which creating a system for storing and 
maintaining identifiable biospecimens and identifiable private 
information for future, unspecified secondary research activities is 
governed by this rule. Additionally, by reducing the IRB burden 
associated with approving this type of activity, the new exemption for 
storing and maintaining identifiable biospecimens and identifiable 
private information also incentivizes the creation of institution-wide, 
comprehensive systems for storing and maintaining such biospecimens and 
information. We anticipate that this will, in turn, foster research 
while also giving human subjects increased control over how their 
identifiable biospecimens and identifiable private information will be 
used (promoting the principle of respect for persons).
    Consistent with the NPRM, we estimate that 70,916 annual reviews of 
protocols (10.5 percent) would no longer be conducted as a result of 
the changes at Sec.  __.104(d). Of these reviews, 23,487 will have 
undergone convened initial review, 10,552 will have undergone expedited 
initial review, 25,445 will have undergone convened continuing review, 
and 11,432 will have undergone expedited continuing review based on the 
distribution of reviews presented in Table 3.
    Further, we estimate that that 1,000 exempt research and 
demonstration studies are currently conducted each year.\55\ We further 
estimate that due to the change in OHRP's interpretation of the 
research and demonstration project exemption at Sec.  __.104(d)(5), an 
additional 3,376 annual reviews of protocols (0.5 percent) will no 
longer be conducted. Of these 3,376 reviews, 1,118 would have undergone 
convened initial review, 502 would have undergone expedited initial 
review, 1,212 would have undergone convened continuing review, and 544 
would have undergone expedited continuing review based on the 
distribution of reviews presented in Table 3. The 4,376 estimated 
annual studies conducted under this exemption will need to be posted on 
a federal Web site as required by Sec.  __.104(d)(5)(i). We anticipate 
that it will take individuals at the IRB administrative staff level 15 
minutes per study to post the study on the Web site.
---------------------------------------------------------------------------

    \55\ Estimates based on queries of ClinicalTrials.gov and a 
search of the CMS Web site. See e.g., http://www.medicaid.gov/medicaid-chip-program-information/by-topics/waivers/waivers_faceted.html, and https://www.cms.gov/Research-Statistics-Data-and-Systems/Statistics-Trends-and-Reports/ActiveProjectReports/APR_2011_Edition.html.
---------------------------------------------------------------------------

    Present value benefits of $798 million and annualized benefits of 
$93.6 million are estimated using a 3 percent discount rate, and 
present value benefits of $653 million and annualized benefits of $93.0 
million are estimated using a 7 percent discount rate. Present value 
costs of $0.37 million and annualized costs of $0.04 million are 
estimated using a 3 percent discount rate; present value costs of $0.30 
million and annualized costs of $0.04 million are estimated using a 7 
percent discount rate. Table 11 summarizes the quantified and 
nonquantified benefits and costs of amending an exempt category.

   Table 11--Summary of Estimated Benefits and Costs of Expanding the Exemption Categories (Sec.   __.104(d))
----------------------------------------------------------------------------------------------------------------
                                                Present value of 10  years by    Annualized value over 10  years
                                              discount rate  (millions of 2015   by discount rate  (millions of
                                                          dollars)                        2015 dollars)
                                             -------------------------------------------------------------------
                                                 3 percent        7 percent        3 percent        7 percent
----------------------------------------------------------------------------------------------------------------
BENEFITS:
Quantified Benefits:
    Reduction in number of reviews..........             798              653             93.6             93.0
----------------------------------------------------------------------------------------------------------------
Nonquantified Benefits:
    Clarity in what research activities must be reviewed; ability for IRBs to focus efforts on reviews of higher-
     risk, more complex, research activities; fostering research with biospecimens and identifiable private
     information................................................................................................
----------------------------------------------------------------------------------------------------------------
COSTS:
Quantified Costs:
    None....................................            0.37             0.30             0.04             0.04
----------------------------------------------------------------------------------------------------------------

[[Page 7245]]

 
Nonquantified Costs:
    None........................................................................................................
----------------------------------------------------------------------------------------------------------------

i. Elimination of Continuing Review of Research Under Specific 
Conditions (Sec. Sec.  __.109(f) and __.115(a)(3))
    The final rule eliminates continuing review for many minimal risk 
studies, as detailed at Sec.  __.109(f). Unless an IRB determines 
otherwise, continuing review of research is not required if: (1) The 
research is eligible for expedited review in accordance with Sec.  
__.110; (2) the research is reviewed by the IRB in accordance with the 
limited IRB review procedure described in several of the exemption 
categories (specifically, Sec.  __.104(d)(2)(iii), Sec.  
__.104(d)(3)(i)(C), Sec.  __.104(d)(7), or Sec.  __.104(d)(8)); or (3) 
the research has progressed to the point that it only involves data 
analysis (including analysis of identifiable information or 
identifiable biospecimens) or access to follow-up clinical data from 
procedures that subjects would undergo as part of clinical care. If an 
IRB chooses to conduct continuing review even when these conditions are 
met, the rationale for doing so must be documented according to a new 
provision at Sec.  __.115(a)(3).
    We estimate that 108,873 expedited continuing reviews of protocols 
occur annually, based on the distribution of reviews presented in Table 
3. Of these reviews, we further estimate that 81,546 reviews (75 
percent) will not be eliminated by other changes to the Common Rule 
(such as the modifications at Sec.  __.104(d)). It is estimated that 
40,773 of these 81,546 reviews (50 percent) will be discontinued under 
Sec.  __.109(f), and the remaining 40,773 reviews (50 percent) will 
still require documentation of the rationale for doing so (as required 
under Sec.  __.115(a)(3)). We also estimate that IRB voting members 
will spend 1 hour per review providing the necessary documentation. In 
addition, administrative staff at each IRB will spend an estimated 10 
hours in 2017 updating their communication systems to no longer send 
continuing review reminders to affected investigators.
    The estimated costs to institution officials, IRB administrators, 
IRB administrative staff, IRB chairs, IRB voting members, and 
investigators of conducting these reviews are based on the estimates 
presented in Table 3. The dollar value of their time is calculated by 
multiplying hours by their estimated 2017-2026 wages and adjusting for 
overhead and benefits.
    Present value benefits of $148 million and annualized benefits of 
$17.4 million are estimated using a 3 percent discount rate, and 
present value benefits of $121 million and annualized benefits of $17.3 
million are estimated using a 7 percent discount rate. Present value 
costs of $41.0 million and annualized costs of $4.80 million are 
estimated using a 3 percent discount rate; present value costs of $33.7 
million and annualized costs of $4.80 million are estimated using a 7 
percent discount rate. Table 12 summarizes the quantified and 
nonquantified benefits and costs of the elimination of continuing 
review of research under specific conditions.

   Table 12--Summary of Estimated Benefits and Costs of the Elimination of Continuing Review of Research Under
                          Specific Conditions (Sec.  Sec.   __.109(f) and __.115(a)(3))
----------------------------------------------------------------------------------------------------------------
                                                Present value of 10 years by     Annualized value over 10 years
                                               discount rate (millions of 2015    by discount rate (millions of
                                                          dollars)                        2015 dollars)
                                             -------------------------------------------------------------------
                                                 3 percent        7 percent        3 percent        7 percent
----------------------------------------------------------------------------------------------------------------
BENEFITS:
Quantified Benefits:
    Reduction in number of continuing                    148              121             17.4             17.3
     reviews................................
----------------------------------------------------------------------------------------------------------------
Nonquantified Benefits:
    None........................................................................................................
----------------------------------------------------------------------------------------------------------------
                                                 3 Percent        7 Percent        3 Percent        7 Percent
----------------------------------------------------------------------------------------------------------------
COSTS:
Quantified Costs:
    Time to document rationale for                      41.0             33.7             4.80             4.80
     conducting continuing review and update
     IRB communication systems..............
----------------------------------------------------------------------------------------------------------------
Nonquantified Costs:
    None........................................................................................................
----------------------------------------------------------------------------------------------------------------


[[Page 7246]]

j. Expedited Review Procedures (Sec. Sec.  __.110 and __.115(a)(8))
    The final rule changes the default position such that any research 
activity appearing on the expedited review list is presumed to be 
minimal risk. Additionally, the final rule requires that, in 
consultation with other Common Rule departments or agencies, the 
expedited review categories be reviewed every 8 years and amended as 
appropriate, followed by publication in the Federal Register and 
solicitation of public comment. Finally, the final rule contains a new 
requirement at Sec.  __.115(a)(8) concerning IRB records, requiring 
that IRBs document the rationale for an expedited reviewer's 
determination that research activities appearing on the expedited 
review list are more than minimal risk (i.e., an override of the 
presumption that studies on the Secretary's list of expedited review 
activities are minimal risk). We note that because the final rule does 
not include a proposal to develop guidance with a list of activities 
presumed to be minimal risk, cost estimates in the final rule have been 
modified accordingly.
    Changes to the expedited review procedures are expected to reduce 
IRB workload by decreasing the amount of time IRB voting members spend 
making minimal risk determinations and documenting such determinations. 
Nonquantified benefits include a reduction in the number of studies 
that require full, convened IRB review should more categories of 
activities be added to the expedited review list.
    According to the estimates presented in Table 3, 209,371 protocols 
undergo expedited review each year. For these protocols, we estimate 
that, as a result of these changes, IRB voting members will spend an 
average of 15 fewer minutes per protocol developing and documenting a 
rationale for why certain activities that are permitted to be reviewed 
under the expedited review procedure are minimal risk.
    The dollar value of IRB voting member time is calculated by 
multiplying hours by their estimated 2017-2026 wages and adjusting for 
overhead and benefits.
    Present value benefits of $51.0 million and annualized benefits of 
$5.98 million are estimated using a 3 percent discount rate, and 
present value benefits of $41.7 million and annualized benefits of 
$5.94 million are estimated using a 7 percent discount rate. Table 13 
summarizes the quantified and nonquantified benefits and costs of 
amending expedited review procedures.

    Table 13--Summary of Estimated Benefits and Costs of Amending the Expedited Review Procedures (Sec.  Sec.
                                            __.110 and __.115(a)(8))
----------------------------------------------------------------------------------------------------------------
                                                Present value of 10 years by     Annualized value over 10 years
                                               discount rate (millions of 2015    by discount rate (millions of
                                                          dollars)                        2015 dollars)
                                             -------------------------------------------------------------------
                                                 3 percent        7 percent        3 percent        7 percent
----------------------------------------------------------------------------------------------------------------
BENEFITS:
Quantified Benefits:
    Reduction in time spent making and                  51.0             41.7             5.98             5.94
     documenting minimal risk determinations
     and documenting such determinations....
----------------------------------------------------------------------------------------------------------------
Nonquantified Benefits:
    None........................................................................................................
----------------------------------------------------------------------------------------------------------------
                                                 3 Percent        7 Percent        3 Percent        7 Percent
COSTS:
Quantified Costs:
    None....................................  ...............  ...............  ...............  ...............
----------------------------------------------------------------------------------------------------------------
Nonquantified Costs:
    None........................................................................................................
----------------------------------------------------------------------------------------------------------------

k. Cooperative Research (Sec.  __.114))
    The final rule requires under Sec.  __.114 that any institution 
located in the United States that is engaged in cooperative research 
shall rely on approval by a single IRB for that portion of the research 
that is conducted in the United States. This policy has two exceptions 
(detailed in Sec.  __.114(b)(2)): (1) Cooperative research for which 
more than single IRB review is required by law (including tribal law 
passed by the official governing body of a American Indian or Alaska 
Native tribe); and (2) research for which any federal department or 
agency supporting or conducting the research determines and documents 
that the use of a single IRB is not appropriate for the particular 
study. Nonquantified benefits of this change include standardization of 
human subjects protections in multi-institutional studies.
    Ultimately, these revisions are expected to lower costs associated 
with multiple reviews for investigators, institutions, and IRBs. Some 
cost shifting may occur as certain IRBs assume the role of reviewing 
IRB. However, these will be offset by savings at other IRBs that are no 
longer required to conduct additional reviews of the same research 
study. Initially, IRBs and institutions will have to draft and revise 
their policies regarding their reliance on single IRBs. It is expected 
that, over time, reliance agreements and other methods of documenting 
external reliance will become standardized, which will result in 
reduced costs associated with multiple reviews and time savings for 
investigators who no longer must wait for multiple reviews.
    The OHRP database of registered institutions and IRBs shows that 
8,035 institutions have an FWA. We estimate that these institutions 
will develop an average of 10 written joint review agreements with 
other institutions in 2019 before the first year of compliance. We 
further estimate that each agreement will require an average of 10 
hours of institution legal staff time and 5 hours of IRB administrator 
time to complete. The dollar value of their time is calculated by 
multiplying hours by their estimated wages and adjusting for overhead 
and benefits.
    We estimate that 202,617 annual reviews of multi-institutional 
protocols take place, and an average of 5 reviews per multi-
institutional protocol,

[[Page 7247]]

implying that 40,523 multi-institutional protocols are reviewed each 
year. We further estimate that 16,209 (40 percent) of these multi-
institutional studies are funded by NIH \56\ and thus will already be 
subject to NIH's single IRB review policy. Accordingly, we estimate 
that approximately 97,256 annual reviews of protocols will no longer be 
conducted as a result of these proposed changes. Of these reviews, 
32,211 would have undergone convened initial review, 14,472 would have 
undergone expedited initial review, 34,896 would have undergone 
convened continuing review, and 15,678 would have undergone expedited 
continuing review based on the distribution of reviews presented in 
Table 3.
---------------------------------------------------------------------------

    \56\ Moral Science: Protecting Participants in Human Subjects 
Research. Washington, DC: Presidential Advisory Commission for the 
Study of Bioethical Issues. Retrieved from http://bioethics.gov/sites/default/files/Moral%20Science%20June%202012.pdf, p. 34.
---------------------------------------------------------------------------

    In response to comments on the NPRM RIA, we have modified our 
assumptions of how much time would ultimately be saved by the 
implementation of this proposal (see Section XIX.C of this RIA). We 
assume that investigators for whom multi-institutional reviews are 
eliminated will face a reduction in burden associated with the 
elimination of the site-specific protocol review, but will face 
increased burden in the form of coordination with investigators at 
other sites, for example, to ensure that the results of the IRB review 
are effectively communicated. Specifically, we assume that the 
elimination of multi-institutional reviews will result in investigators 
spending half as much time engaging with the review process as they 
would have if IRB review had taken place at all sites.
    The estimated costs to institution officials, IRB administrators, 
IRB administrative staff, IRB chairs, IRB voting members, and 
investigators of conducting these reviews are based on the estimates 
presented in Table 3, adjusted accordingly to account for our 
assumption that the time savings for these eliminated reviews is 
reduced by half for investigators. The dollar value of their time is 
calculated by multiplying hours by their estimated 2020-2026 wages and 
adjusting for overhead and benefits.
    Present value benefits of $538 million and annualized benefits of 
$63.1 million are estimated using a 3 percent discount rate, and 
present value benefits of $414 million and annualized benefits of $59.0 
million are estimated using a 7 percent discount rate. Present value 
costs of $157 million and annualized costs of $18.3 million are 
estimated using a 3 percent discount rate; present value costs of $140 
million and annualized costs of $19.9 million are estimated using a 7 
percent discount rate. Table 14 summarizes the quantified and 
nonquantified benefits and costs of cooperative research.

            Table 14--Summary of Estimated Benefits and Costs of Cooperative Research (Sec.   __.114)
----------------------------------------------------------------------------------------------------------------
                                                Present value of 10 years by     Annualized value over 10 years
                                               discount rate (millions of 2015    by discount rate (millions of
                                                          dollars)                        2015 dollars)
                                             -------------------------------------------------------------------
                                                 3 percent        7 percent        3 percent        7 percent
----------------------------------------------------------------------------------------------------------------
BENEFITS:
Quantified Benefits:
    Reduction in number of reviews..........             538              414             63.1             59.0
----------------------------------------------------------------------------------------------------------------
Nonquantified Benefits:
    Standardization of human subjects protections in multi-institutional studies................................
----------------------------------------------------------------------------------------------------------------
                                                 3 Percent        7 Percent        3 Percent        7 Percent
COSTS:
Quantified Costs:
    Time required to develop model reliance              157              140             18.3             19.9
     agreement and written joint review
     agreements.............................
----------------------------------------------------------------------------------------------------------------
Nonquantified Costs:
    None........................................................................................................
----------------------------------------------------------------------------------------------------------------

l. Changes in the Elements of Consent, Including Documentation 
(Sec. Sec.  __.116(a)(5), (b)(9), (c)(7)-(9), and __.117(b))
    The final rule imposes a new requirement at Sec.  __.116(a)(5)(i) 
that informed consent must begin with a concise and focused 
presentation of the key information that is most likely to assist a 
prospective subject or legally authorized representative in 
understanding the reasons why one might or might not want to 
participate in the research. This provision further mandates that this 
part of the informed consent must be organized and presented in a way 
that facilitates comprehension. This requirement applies to all 
informed consent processes, except for broad consent obtained pursuant 
to Sec.  __.116(d), which may warrant a different presentation.
    The final rule includes a new element of consent at Sec.  
__.116(b)(9) that requires one of the following statements be included 
for any research that involves the collection of identifiable private 
information or identifiable biospecimens:
     A statement that identifiers might be removed from the 
identifiable private information or identifiable biospecimens and that, 
after such removal, the information or biospecimens could be used for 
future research studies or distributed to another investigator for 
future research studies without additional informed consent from the 
subject or the legally authorized representative, if this might be a 
possibility; or
     A statement that the subject's information or biospecimens 
collected as part of the research, even if identifiers are removed, 
will not be used or distributed for future research studies.
    This new requirement is intended to give the potential subject the 
knowledge that identifiers might be removed from information or 
biospecimens for their use in future research without additional 
consent, when such a

[[Page 7248]]

possibility exists, so he or she can make a fully informed decision 
about whether to participate in the research. If subjects' identifiable 
private information or identifiable biospecimens will not be used for 
future research studies, even if identifiers are removed, this new 
element of consent requires that subjects be informed of this as well.
    The final rule's three additional elements of consent are in Sec.  
__.116(c)(7), (8), and (9). These require that a subject be informed of 
the following, when appropriate:
     That the subject's biospecimens (even if identifiers are 
removed) may be used for commercial profit and whether the subject will 
or will not share in this commercial profit;
     Whether clinically relevant research results, including 
individual research results, will be disclosed to subjects, and if so, 
under what conditions.
     For research involving biospecimens, whether the research 
will (if known) or might include whole genome sequencing (i.e., 
sequencing of a human germline or somatic specimen with the intent to 
generate the genome or exome sequence of that specimen.
    These three additional elements of consent will promote respect for 
persons and greater transparency in the research enterprise. 
Additionally, including the information referenced in these provisions 
in a consent form will help ensure that prospective subjects are given 
information necessary for understanding why one might want to 
participate (or not) in a research study.
    The language at Sec.  __.117(b)(1) in the final rule was modified 
to reference Sec.  __.116(a)(5)(i) and state that if a short form 
consent process is used, the key information required by Sec.  
__.116(a)(5)(i) must be presented first to the prospective subject, 
before other information, if any, is provided.
    We estimate that 246,382 new protocols annually use identifiable 
information. For each protocol, we estimate that investigators will 
spend an average of 15 minutes in 2017 updating consent forms to comply 
with the new requirements found in the final rule at Sec.  
__.116(a)(5), (b)(9), (c)(7), (c)(8), or (c)(9). Based on the estimates 
presented in Table 3, the dollar value of investigators' time is 
calculated by multiplying hours by their estimated 2017 wages and 
adjusting for overhead and benefits.
    We assume that few additional investigators will elect to offer the 
second option at Sec.  __.116(b)(9), and that the investigators who 
currently offer equivalent options already track the permissible and 
impermissible uses of information in line with the requirements 
discussed above. As a result, we estimate that no additional costs are 
associated with tracking.
    Present value costs of $4.62 million and annualized costs of $0.54 
million are estimated using a 3 percent discount rate; present value 
costs of $4.32 million and annualized costs of $0.62 million are 
estimated using a 7 percent discount rate. Table 15 summarizes the 
quantified and nonquantified benefits and costs of changes in the basic 
elements of consent, including documentation.

Table 15--Summary of Estimated Benefits and Costs of Changes in the Elements of Consent, Including Documentation
                        (Sec.  Sec.   __.116(a)(5), (b)(9), (c)(7), (c)(8) and __.117(b))
----------------------------------------------------------------------------------------------------------------
                                                Present value of 10  years by    Annualized value over 10  years
                                              discount rate  (millions of 2015   by discount rate  (millions of
                                                          dollars)                        2015 dollars)
                                             -------------------------------------------------------------------
                                                 3 percent        7 percent        3 percent        7 percent
----------------------------------------------------------------------------------------------------------------
BENEFITS:
Quantified Benefits:
    None....................................  ...............  ...............  ...............  ...............
----------------------------------------------------------------------------------------------------------------
Nonquantified Benefits:
    Improved informed consent forms and processes; greater transparency in the research enterprise..............
----------------------------------------------------------------------------------------------------------------
COSTS:
Quantified Costs:
    Time to update consent forms............            4.62             4.32             0.54             0.62
----------------------------------------------------------------------------------------------------------------
Nonquantified Costs:
    None........................................................................................................
----------------------------------------------------------------------------------------------------------------

m. Obtaining Consent to Secondary Use of Identifiable Biospecimens and 
Identifiable Private Information (Sec.  __.116(d))
    Because the final rule does not adopt the NPRM proposal to consider 
all biospecimens as human subjects regardless of identifiability, the 
costs associated with seeking, obtaining, and tracking broad consent 
are reduced significantly. As noted above, comments on the NPRM suggest 
that the costs associated with building systems to track broad consent 
are very burdensome. Therefore, we expect that broad consent and 
institution-wide tracking systems will be pursued only in situations 
where it generates net benefits. As a result, in the short term, we are 
unsure of the extent to which institutions will adopt institution-wide 
mechanisms to seek, obtain, and track broad consent. We anticipate in 
the short term that broad consent (and the attendant tracking and 
maintenance obligations) will be a system used and managed by 
investigators or teams of investigators in their research portfolios. 
However, we believe that it will be adopted more over time at an 
institutional level as IT systems evolve at research institutions 
through normal practice. We lack data to estimate the number of 
research studies for which this option will be adopted. Each of these 
studies will have some variable costs (e.g., consent, tracking) and 
fixed costs (IT infrastructure). Because this is optional, we believe 
that it will be pursued only if private benefits exceed private costs. 
Therefore, we anticipate benefits, in terms of improvements in the 
quality and efficiency of human subjects research, proportional to the 
adoption of broad consent. We note that the voluntary nature of 
adoption implies that broad consent may not be sought in some 
situations where its social benefit exceeds its social cost.

[[Page 7249]]



     Table 16--Summary of Estimated Benefits and Costs of Obtaining Consent to Secondary Use of Identifiable
                      Biospecimens and Identifiable Private Information (Sec.   __.116(d))
----------------------------------------------------------------------------------------------------------------
                                                Present value of 10  years by    Annualized value over 10  years
                                              discount rate  (millions of 2015   by discount rate  (millions of
                                                          dollars)                        2015 dollars)
                                             -------------------------------------------------------------------
                                                 3 percent        7 percent        3 percent        7 percent
----------------------------------------------------------------------------------------------------------------
BENEFITS:
Quantified Benefits:
    None....................................  ...............  ...............  ...............  ...............
----------------------------------------------------------------------------------------------------------------
Nonquantified Benefits:
    Improvements in the quality and efficiency of human subjects research.......................................
----------------------------------------------------------------------------------------------------------------
COSTS:
Quantified Costs:
    None....................................  ...............  ...............  ...............  ...............
----------------------------------------------------------------------------------------------------------------
Nonquantified Costs:
    Time and infrastructure required to obtain and track broad consent..........................................
----------------------------------------------------------------------------------------------------------------

n. Allowing IRBs To Approve a Research Proposal for Subject Recruitment 
Activities Without Granting a Waiver of Consent (Sec.  __.116(g))
    The final rule will allow an IRB to approve a research proposal in 
which investigators obtain information or biospecimens without 
individuals' informed consent for the purpose of screening, recruiting, 
or determining the eligibility of prospective human subjects of 
research in certain circumstances.
    This addresses concerns that the pre-2018 regulations required an 
IRB to determine that informed consent could be waived before 
investigators could record identifiable private information for the 
purpose of screening, recruiting, or determining the eligibility of 
prospective subjects for a research study. The pre-2018 rule 
requirement was viewed as burdensome without providing meaningful 
protections to subjects.
    The policy adopted in the final rule should result in time and cost 
savings for investigators and IRBs, but they likely will be small. The 
savings will come from IRBs no longer needing to consider whether 
informed consent can be waived for such preparatory-to-research 
activities. Savings will accrue for investigators who can proceed with 
such activities in less time.
    We estimate that 1,620 annual initial reviews of protocols (0.5 
percent) involve a waiver of consent for recruitment activities that 
will not be required as a result of these changes. Of these reviews, 
1,118 will have undergone convened initial review and 502 will have 
undergone expedited initial review based on the distribution of reviews 
presented in Table 3. We estimate that investigators spend an average 
of 15 minutes requesting a waiver of consent for recruitment activities 
when they submit a protocol for initial review. We further estimate 
that IRBs typically use two primary reviewers for convened review and 
one primary reviewer for expedited review, and that primary reviewers 
spend an average of 15 minutes determining whether informed consent can 
be waived. Based on the estimates in Table 3, the dollar value of their 
time is calculated by multiplying hours by their estimated 2017-2026 
wages and adjusting for overhead and benefits.
    Present value benefits of $1.25 million and annualized benefits of 
$0.15 million are estimated using a 3 percent discount rate, and 
present value benefits of $0.88 million and annualized benefits of 
$0.13 million are estimated using a 7 percent discount rate. Table 17 
summarizes the quantified and nonquantified benefits and costs of 
eliminating the requirement to waive consent in certain subject 
recruitment activities.

   Table 17--Summary of Estimated Benefits and Costs of Elimination of Requirement To Waive Consent in Certain
                                Subject Recruitment Activities (Sec.   __.116(g))
----------------------------------------------------------------------------------------------------------------
                                                Present value of 10 years by     Annualized value over 10 years
                                               discount rate (millions of 2015    by discount rate (millions of
                                                          dollars)                        2015 dollars)
                                             -------------------------------------------------------------------
                                                 3 percent        7 percent        3 percent        7 percent
----------------------------------------------------------------------------------------------------------------
Quantified Benefits:
    Decreased time associated with review...            1.25             0.88             0.15             0.13
----------------------------------------------------------------------------------------------------------------
BENEFITS:
Nonquantified Benefits:
    None........................................................................................................
----------------------------------------------------------------------------------------------------------------
                                                 3 Percent        7 Percent        3 Percent        7 Percent
COSTS:
Quantified Costs:                             ...............  ...............  ...............  ...............
    None....................................
----------------------------------------------------------------------------------------------------------------

[[Page 7250]]

 
Nonquantified Costs:
    None........................................................................................................
----------------------------------------------------------------------------------------------------------------

o. Requirement for Posting of Consent Forms for Common Rule Department 
or Agency-Supported Clinical Trials (Sec.  __.116(h))
    The final rule requires that for each clinical trial conducted or 
supported by a Federal department or agency, one IRB-approved form used 
to recruit subjects must be posted by the awardee or the federal 
department or agency component conducting the trial on a publicly 
available federal Web site that will be established as a repository for 
such informed consent forms. The consent form must be posted after the 
clinical trial is closed to recruitment and no later than 60 days after 
the last study visit by any subject, as required by the protocol. This 
provision permits federal departments or agencies to require or permit 
redactions to these consent forms. As described in Section XIV.H, 
federal departments or agencies have great latitude in what they may 
permit or require be redacted.
    We believe that public posting of consent forms will increase 
transparency, enhance confidence in the research enterprise, increase 
accountability, and inform the development of future consent forms, 
possibly resulting in future savings in time for investigators 
developing consent forms. Costs to the Federal Government in creating 
and maintaining such a repository are described in Section XIX.D.2.a of 
this RIA.
    According to queries of ClinicalTrials.gov, estimated 5,270 
clinical trials are conducted or supported by Common Rule agencies, of 
which an estimated 575 are regulated by provisions in the Federal Food, 
Drug, and Cosmetic (FD&C) Act and Trade Secrets Act based on the 
information presented in Table 3. For the purpose of this analysis, it 
is assumed that each clinical trial is associated with one consent form 
that must be submitted to the federal system by an investigator.
    It is unknown at this time in what other circumstances federal 
departments or agencies might permit or require redaction, thus the RIA 
calculates redaction time only in those studies for which the FD&C Act 
and Trade Secrets Act applies. For the 575 clinical trials regulated by 
provisions in the FD&C Act and Trade Secrets Act, it is estimated that 
investigators will spend an average of 30 minutes redacting information 
before submission. We estimate that investigators will spend an average 
of 15 minutes submitting each consent form.
    Based on the estimates presented in Table 3, the dollar value of 
investigator time is calculated by multiplying hours by their estimated 
2017-2026 wages and adjusting for overhead and benefits.
    In addition, submitted consent forms must be reviewed and made 
accessible to persons with disabilities in compliance with Section 508 
Amendment to the Rehabilitation Act of 1973. We estimate that each 
consent form contains an average of 10 pages and that making each page 
508-compliant costs an average of $30 per page.
    Present value costs of $15.4 million and annualized costs of $1.80 
million are estimated using a 3 percent discount rate; present value 
costs of $11.0 million and annualized costs of $1.56 million are 
estimated using a 7 percent discount rate. Table 18 summarizes the 
quantified and nonquantified benefits and the requirement for posting 
of consent forms for Common Rule department or agency-supported 
clinical trials.

  Table 18--Summary of Estimated Benefits and Costs of Requirement for Posting of Consent Forms for Common Rule
                        Department or Agency-Supported Clinical Trials (Sec.   __.116(h))
----------------------------------------------------------------------------------------------------------------
                                                Present value of 10 years by     Annualized value over 10 years
                                               discount rate (millions of 2015    by discount rate (millions of
                                                          dollars)                        2015 dollars)
                                             -------------------------------------------------------------------
                                                 3 percent        7 percent        3 percent        7 percent
----------------------------------------------------------------------------------------------------------------
Quantified Benefits:
    None....................................  ...............  ...............  ...............  ...............
----------------------------------------------------------------------------------------------------------------
BENEFITS:
Nonquantified Benefits:
    Increase transparency of Common Rule department or agency-supported clinical trials; improvement of clinical
     trial informed consent forms...............................................................................
----------------------------------------------------------------------------------------------------------------
                                                 3 Percent        7 Percent        3 Percent        7 Percent
COSTS:
Quantified Costs:
    Preparation and submission of consent               15.4             11.0             1.80             1.56
     forms for posting, and redaction of
     information............................
----------------------------------------------------------------------------------------------------------------
Nonquantified Costs:
    None........................................................................................................
----------------------------------------------------------------------------------------------------------------


[[Page 7251]]

p. Alteration in Waiver for Documentation of Informed Consent in 
Certain Circumstances (Sec.  __.117(c)(1)(iii))
    The final rule adds a provision allowing a waiver of the 
requirement to obtain a signed informed consent form if the subjects 
are members of a distinct cultural group or community in which signing 
documents is not the norm. This will be allowed only if the research 
presents no more than minimal risk of harm to subjects and provided an 
appropriate alternative method is available to document that informed 
consent was obtained.
    Under the pre-2018 rule, IRBs could waive the requirement for the 
investigator to obtain a signed consent form for some or all subjects. 
The pre-2018 criteria for such a waiver may not have been flexible 
enough for dealing with a variety of circumstances, such as when 
federally sponsored research is conducted in an international setting 
where, for example, cultural or historical reasons suggest that signing 
documents may be viewed as offensive and problematic.
    This should not involve cost as its intent is to improve the 
informed consent process by providing more flexibility regarding the 
documentation of consent (an ethical gain) while reducing 
administrative requirements for investigators and research subjects in 
specific circumstances. Thus, benefits and costs of this new provision 
are not quantified. Table 19 summarizes the nonquantified benefits and 
costs of alteration in waiver for documentation of informed consent in 
certain circumstances.

 Table 19--Summary of Estimated Benefits and Costs of Alteration in Waiver for Documentation of Informed Consent
                               in Certain Circumstances (Sec.   __.117(c)(1)(iii))
----------------------------------------------------------------------------------------------------------------
                                                Present value of 10  years by    Annualized value over 10  years
                                              discount rate  (millions of 2015   by discount rate  (millions of
                                                          dollars)                        2015 dollars)
                                             -------------------------------------------------------------------
                                                 3 percent        7 percent        3 percent        7 percent
----------------------------------------------------------------------------------------------------------------
BENEFITS:
Quantified Benefits:
    None....................................  ...............  ...............  ...............  ...............
----------------------------------------------------------------------------------------------------------------
Nonquantified Benefits:.........................................................................................
    Improved informed consent process for distinct cultural groups and communities..............................
----------------------------------------------------------------------------------------------------------------
COSTS:
Quantified Costs:
    None....................................  ...............  ...............  ...............  ...............
----------------------------------------------------------------------------------------------------------------
Nonquantified Costs:
    None........................................................................................................
----------------------------------------------------------------------------------------------------------------

E. Alternative Approaches to the Definition of Human Subject (NPRM at 
Sec.  __.102(e)) and Related Provisions

1. Overview
    We carefully considered the option of not pursuing regulatory 
action. However, because of shifts in science, technology, public 
engagement, and public expectations in the past 2 decades, a wide range 
of stakeholders have raised concerns about the limitations of the 
existing ethical framework in research, arguing for a re-evaluation of 
how the fundamental principles that underlie the Common Rule--respect 
for persons, beneficence, and justice--are applied in practice to the 
myriad new contexts in which U.S. research is conducted in the 21st 
century.
    The final rule addresses these concerns through three aims. The 
first aim is to increase human subjects' ability and opportunity to 
make informed decisions. The second aim is to reduce potential for harm 
and promote justice by increasing the uniformity of human subject 
protections. The third aim is to facilitate current and evolving types 
of research that offer promising approaches to treating and preventing 
medical and societal problems by reducing ambiguity in interpretation 
of the regulations, increasing efficiencies in the review system, and 
reducing requirements on investigators when said requirements do not 
appear to provide meaningful protections to human subjects. We hope 
that these changes will also build public trust in the research system. 
We estimate that the benefits of this regulatory action exceed its 
costs, and as a result we have chosen to pursue this regulatory action.
    The NPRM proposed to expand the definition of human subjects to 
include research in which an investigator obtains, uses, studies or 
analyzes a biospecimen. This would have applied regardless of the 
identifiability of the biospecimen. Generally, investigators would not 
have been allowed to remove identifiers from biospecimens without 
obtaining informed consent or a waiver of consent. The NPRM also 
proposed to modify the criteria for waiver of consent in research 
involving biospecimens such that a waiver would be very rare. Written 
consent would generally have been required for such activities. Thus, 
this change would have significantly expanded the amount of research 
subject to the Common Rule. This requirement would not have applied to 
biospecimens and information already collected at the time the final 
rule is published. The NPRM proposed to exclude from its scope research 
activities involving nonidentified biospecimens where no new 
information about an individual is generated. Although activities such 
as developing new testing assays could have been excluded under this 
provision, it is anticipated that under the NPRM proposals, most 
research with biospecimens would have come under the rule.
    In addition to promoting respect for persons in the research 
enterprise, the alternative regulatory structure for research with 
biospecimens (whereby consent is sought for almost all research 
activities involving biospecimens) would have encouraged investigators 
to retain identifiers, which can enhance research by preserving the 
ability to link biospecimens to important additional information about 
the subject. Additionally, members of the regulated community have 
reported situations

[[Page 7252]]

where, even though not currently required by regulation, investigators 
were told by an IRB that they needed to obtain study-specific consent 
for research activities involving nonidentified biospecimens. Under the 
NPRM proposals, such a situation would not occur because consent--be it 
broad or study-specific--would always be obtained for research 
involving biospecimens.
    Though this proposal would promote the ethical principle of respect 
for persons, it also would have significantly increased the volume of 
studies for which investigators must seek and document informed consent 
(unless more stringent waiver criteria were met). Additionally, the 
NPRM acknowledged, and the regulated community reiterated, during the 
public comment period, that the majority of the studies that the NPRM 
proposal would have newly regulated were studies involving no more than 
minimal risk to human subjects.
    As an example of the tradeoffs between the NPRM proposal and the 
ultimate position taken in the final rule, some commenters noted that 
the proposal to cover all biospecimens under the Common Rule regardless 
of identifiability might privilege the Belmont Report's principle of 
autonomy over the principle of justice. Because the NPRM would have 
required investigators to obtain informed consent in all but rare 
circumstances for research involving biospecimens, concern was 
expressed that this could result in lower representation rates in 
research of minority groups, marginalized members of society, and 
citizens receiving care in community health clinics (which would be 
less able to cover the costs of tracking consent status over time). We 
note that although the available literature suggests that minority 
consent rates are generally high, minority consent rates in some cases 
may be lower than for nonminorities.57 58 59 This 
discrepancy in turn could create issues in the applicability of 
research discoveries on the population as a whole. Respecting persons 
is a worthy goal, but the need to achieve representative samples (and 
thus helping to ensure the applicability of research findings across a 
population) also must be taken into consideration. In addition, the 
principle of beneficence requires that all reasonable efforts be made 
to improve the public good. To balance these sometimes competing 
interests, the final rule incentivizes asking potential subjects for 
permission in minimal risk activities (even if a waiver of informed 
consent could be sought from an IRB), while still allowing other 
avenues for this research to occur should compelling reasons exist or 
not obtaining informed consent.
---------------------------------------------------------------------------

    \57\ Pentz RD, et al. Research on Stored Biological Samples: 
Views of African American and White American Cancer Patients. 
American Journal of Medical Genetics, Part A. 2006 Apr; 140(7):733-
739.
    \58\ Chen, DT et al. Research With Stored Biological Samples; 
What Do Research Participants Want? Archives of Internal Medicine 
2005 Mar; 165(6):652-655.
    \59\ Scott EA, et al. Biospecimen Repositories: Are Blood Donors 
Willing to Participate? Transfusion. 2010 September; 50(9):1943-
1950.
---------------------------------------------------------------------------

2. Estimated Impact of Alternative Approaches to the Final Rule
    The benefit and cost estimations presented below are based upon the 
proposals and structure presented in the NPRM, not the provisions 
included in the final rule.
a. Estimating How Many Studies Involving Nonidentified Biospecimens 
Occur Each Year
    We estimate that each year 250,000 studies are not currently 
subject to oversight by either the Common Rule or FDA regulations 
because they use biospecimens that have been stripped of identifiers. 
Extrapolations from 1999 data \60\ suggest that biospecimens are 
collected from as many as 30 million individuals each year and are 
stored for both clinical and research purposes. Based on conversations 
with experts in this area, this 1999 report represents the most recent, 
comprehensive analysis of the volume of nonidentified biospecimens used 
in research activities.
---------------------------------------------------------------------------

    \60\ Eiseman E., Haga S. Handbook of Human Tissue Sources: A 
National Resource of Human Tissue Samples. Washington, DC: RAND 
Corporation; 1999.
---------------------------------------------------------------------------

    Approximately 9 million individuals' biospecimens (30 percent of 
those collected) are collected for research purposes. Approximately 6.3 
million individuals' biospecimens (30 percent) could potentially be 
used in future research studies. Thus, it is possible that 
investigators would have had to seek consent to secondary use of 
biospecimens or a waiver of consent for an additional 15 million 
individuals annually for secondary use of biospecimens.
    In the absence of comprehensive data, to calculate the number of 
protocols that would have been covered, we proposed two approaches. 
Under method one, we estimated that approximately 50 biospecimens would 
have been used on average per research protocol involving biospecimens. 
This gave a potential 300,000 new research protocols using 
nonidentified biospecimens. This estimate of 300,000 new research 
protocols was rounded down to 250,000 new studies based on ANPRM 
comments and industry data, because it seemed reasonable to assume that 
the number of new biospecimen studies covered by the alternative 
proposal would equal the total number of new protocols conducted each 
year (i.e., the number of new biospecimen studies was likely close to 
the estimate of 246,382 new annual studies each year).
    Under method two, biospecimen repository representatives reported 
that roughly 90 percent of their collections were used in nonidentified 
form in research activities that did not fall under the pre-2018 rule. 
Thus, only 10 percent of biospecimen studies were covered under the 
pre-2018 rule, representing a 9:1 ratio of studies involving 
nonidentified biospecimens to studies involving identifiable 
biospecimens. Of the 246,382 new protocols each year that were 
nonexempt (Table 3), we assumed that 10 to15 percent used identifiable 
biospecimens. This equated to between 24,638 and 36,957 new studies 
each year using identifiable biospecimens. We estimated that the number 
of biospecimen studies that occurred on nonidentified biospecimens each 
year was approximately 9 times the number of studies using identifiable 
biospecimens, or between 221,742 and 332,613 studies each year. Thus, 
under method two, an estimate of 250,000 new studies on nonidentified 
biospecimens each year was also reasonable.
    To facilitate research with biospecimens, the NPRM proposed to 
create separate elements of broad consent such that investigators and 
institutions could seek, and individuals could grant, consent for 
future unspecified research activities. The NPRM also proposed an 
exemption that relied on obtaining broad consent for future, 
unspecified research studies. To be eligible for the proposed exemption 
for specific secondary studies, broad consent must have been sought and 
obtained using the proposed Secretary's template for broad consent, and 
the investigator must not have anticipated returning individual 
research results to subjects.
b. Facilitating Research With Nonidentified Biospecimens Under the 
NPRM: Exemption for Specific, Secondary Studies When Broad Consent Had 
Been Sought and Obtained
    The NPRM proposed to allow broad consent to secondary research use 
of biospecimens or identifiable private information for unspecified 
research purposes. Such broad consent would

[[Page 7253]]

have specified elements and limitations, and could have been obtained 
in both the research and nonresearch setting.
    The proposed exemption was specifically for secondary research 
studies involving biospecimens and identifiable private information 
that had been or would have been acquired for purposes other than the 
currently proposed research study. If a secondary research study did 
not meet the requirements of this exemption, the investigator would 
have needed to seek IRB review of the study, and would have needed to 
obtain either study-specific consent or a waiver of informed consent. 
Note that for biospecimens, an IRB would have applied the more 
stringent waiver criteria under which waiver of informed consent in 
research involving biospecimens would have been rare. For identifiable 
private information, an IRB would have applied the waiver criteria 
almost identical to the criteria in the pre-2018 rule.
    We anticipated that a majority of studies that would have used this 
exemption would have been biospecimen studies. The extent to which 
individuals conducting secondary research studies involving 
identifiable private information would have used this exemption is 
unknown, given the proposed rule provided additional pathways to 
facilitate such studies. To that end, the benefits and costs associated 
take into consideration only secondary research involving biospecimens. 
We further anticipated that the NPRM proposals would have resulted in 
higher value research with biospecimens being conducted with subjects' 
consent and without the need for full IRB review, or the need to go 
back to subjects to obtain consent for every secondary research study, 
as long as certain conditions were met.
    Because the estimated 250,000 biospecimen studies each year that 
would have been newly covered under the rule as a result of the 
proposed modification to the definition of human subject would likely 
have been minimal risk, we assume that all of these would have been 
eligible for the exemption for secondary use as long as broad consent 
had been sought and obtained.
    Benefits and costs associated with obtaining and tracking broad 
consent under this alternative proposal are discussed below.
    Because the compliance date for the expansion to the definition of 
human subject would have been 3 years after the date of publication of 
a final rule, the benefits and costs described below assume a start 
date of 2020. In the absence of the proposed exemption for secondary 
research studies, but taking into consideration the expansion to the 
definition of human subject, we estimate that each year, all 250,000 of 
these studies would undergo convened initial review. In subsequent 
years, we estimate that 120,000 protocols would undergo convened 
initial review, 89,700 would undergo convened continuing review, and 
40,300 would undergo expedited continuing review based on the 
distribution of reviews presented in Table 3. The estimated costs to 
institution officials, IRB administrators, IRB administrative staff, 
IRB chairs, IRB voting members, and investigators conducting these 
reviews are based on the estimates presented in Table 3. The dollar 
value of their time is calculated by multiplying hours by their 
estimated 2017-2026 wages and adjusting for overhead and benefits.
c. Facilitating Research With Nonidentified Biospecimens Under the 
NPRM: Seeking and Obtaining Broad Consent
    To facilitate secondary research using biospecimens and 
identifiable private information, the NPRM also proposed an exemption 
for storing and maintaining biospecimens and identifiable private 
information for future, unspecified, secondary research activities. 
Given the creation of this exemption, the NPRM envisioned that 
institutions would need to develop tracking systems to monitor which 
biospecimens or information could be used in secondary research by 
investigators. Because both the exemption for secondary research use 
described above, and the exemption required using the proposed 
Secretary's broad consent, the NPRM assumed that a majority of 
investigators and institutions would employ the Secretary's consent 
template. Thus, the NPRM anticipated that minimal time would have been 
spent updating consent forms or drafting new broad consent forms.
    We estimate that 6,428 FWA-holding institutions (80 percent) would 
have stored and maintained clinical and nonclinical biospecimens and 
identifiable private information for unspecified future research 
studies in the manner prescribed under the NPRM. As also discussed 
previously, extrapolations from 1999 data suggest that biospecimens are 
collected from as many as 30 million individuals each year and stored 
for both clinical and research purposes. Approximately 9 million 
individuals' biospecimens (30 percent) are collected for research 
purposes, and thus consent would be sought in the research context for 
the secondary use of these biospecimens. For these 9 million 
individuals per year, an investigator would spend an estimated 20 
minutes per person conducting the consent process specific to seeking 
broad consent, and the subjects would spend an estimated 20 minutes 
engaging in the process of having their broad consent for future 
research uses of their biospecimens or information sought. This 
estimate of the investigator's time also includes the time for the 
investigator to log the information into the appropriate database. We 
note that the NPRM RIA estimated that it would take 5 minutes for an 
investigator to seek broad consent in the research setting, and that 
prospective subjects would spend 5 minutes having their broad consent 
sought. Based on public comments, we have revised this estimate to 
better reflect experience in the regulated community about how long it 
takes to seek and obtain consent. We further estimate that 
investigators would spend 10 minutes of time per protocol updating 
their study specific consent form to include the language from the 
Secretary's consent template.
    In the clinical setting, approximately 21 million individuals' 
biospecimens (70 percent of the estimated 30 million individuals' 
biospecimens collected each year) are collected for clinical purposes. 
In the first year that the proposed changes would have been 
implemented, as many as 21 million broad, secondary use consent forms 
could have been collected from individuals. We anticipate 30 minutes of 
a subject's time to engage in the consent process. We further 
anticipate 30 minutes of an institutional employee's time at the IRB 
Administrative Staff level to seek consent and put the information in 
the appropriate tracking system. As with the estimate for seeking and 
obtaining broad consent in the clinical setting, we have increased the 
estimate of how long it would take institutional employees to seek 
broad consent and how long prospective subjects would spend 
participating in the broad consent process based on public comments.
    The NPRM proposed that once an individual gave broad consent to use 
his or her biospecimens in future, unspecified research studies, that 
consent could cover any biospecimen collected from that individual over 
the course of a 10-year period. Note that an institution could retain 
and use the biospecimens collected indefinitely. This provision merely 
stated that every 10 years an institution must ask people whether or 
not they may use newly collected biospecimens in research. Given that 
an institution needed to seek

[[Page 7254]]

broad consent from an individual only once over the course of a 10-year 
period, we assumed that after the first year the NPRM was implemented, 
the number of individuals from whom an institution would seek broad 
consent would decrease.
    To account for this, the RIA alternative approach assumes that 
after the first year, a fraction of the clinical subjects from whom 
broad consent was sought in year one would be sought in subsequent 
years. We anticipate that in year two, secondary use consent would be 
sought in the clinical context from 10.5 million subjects (50 percent 
of the number of individuals involved in the year one estimates). We 
anticipate that in year three and after, secondary use consent would be 
sought in the clinical context from approximately 6.3 million subjects 
each year (30 percent of the number of individuals involved in the year 
one estimates). As in year one, we assume that a prospective subject 
would spend 30 minutes of time undergoing the consent process and that 
an institutional employee at the IRB Administrative Staff level would 
spend 30 minutes of time conducting the consent process with an 
individual and updating the appropriate tracking system.
d. Estimating the Cost of the Broad Consent Tracking System
    To appropriately track biospecimens or identifiable private 
information for which broad consent had been sought and obtained on an 
institutional level, an institution would need to develop an 
institution-wide repository-like schema. The costs include the design, 
implementation, and operation of the informatics system that would be 
required to document and keep current thousands of consent documents 
per year. In addition, the institution would have to come up with a 
system to mark or otherwise flag which biospecimens and pieces of 
identifiable private information could be used in future unspecified 
secondary research studies.
    Under the NPRM proposal, we estimate that 80 percent of the 8,035 
institutions with FWAs would develop these informatics systems (or 
modify existing systems) to facilitate research with nonidentified 
biospecimens. We estimate that under this proposal, institutions on 
average would require 1.0 database administrator FTE to develop and 
maintain these systems. We note that as this estimate is a nationwide 
average, and we expect some institutions would require more database 
administrators, and others would require fewer.
    For all of the estimates described above, the estimated costs to 
institution officials, IRB administrators, IRB administrative staff, 
IRB chairs, IRB voting members, database administrators, and 
investigators of are based on the estimates presented in Table 3. The 
dollar value of their time is calculated by multiplying hours by their 
estimated 2017-2026 wages and adjusting for overhead and benefits.
    For the alternative proposal (i.e., the NPRM proposal to treat all 
biospecimens regardless of identifiability as covered under the Common 
Rule), present value costs of $19.7 billion and annualized costs of 
$2.31 billion are estimated using a 3 percent discount rate; and 
present value costs of $14.2 billion and annualized costs of $2.02 
billion are estimated using a 7 percent discount rate. Table 20 
summarizes the quantified and nonquantified benefits and costs of 
amending the definition of human subject and obtaining consent to 
secondary use of biospecimens and identifiable private information.

            Table 20--Alternative Proposal To Treat All Biospecimens as Covered Under the Common Rule
----------------------------------------------------------------------------------------------------------------
                                                Present value of 10  years by    Annualized value over 10  years
                                              discount rate  (millions of 2015   by discount rate  (millions of
                                                          dollars)                        2015 dollars)
                                             -------------------------------------------------------------------
                                                 3 percent        7 percent        3 percent        7 percent
----------------------------------------------------------------------------------------------------------------
BENEFITS:
Quantified Benefits:
    None....................................  ...............  ...............  ...............  ...............
----------------------------------------------------------------------------------------------------------------
Nonquantified Benefits:
    Increased protections for human subjects....................................................................
----------------------------------------------------------------------------------------------------------------
COSTS:
Quantified Costs:
    Increase in number of reviews; time to            19,670           14,214            2,306            2,024
     update consent forms; document and
     track permissible and impermissible
     secondary uses of information and
     biospecimens; and cost to develop and
     maintain tracking system...............
----------------------------------------------------------------------------------------------------------------
Nonquantified Costs:
    None........................................................................................................
----------------------------------------------------------------------------------------------------------------

F. Regulatory Flexibility Analysis

    As discussed above, the RFA requires agencies that issue a 
regulation to analyze options for regulatory relief of small entities 
if a rule has a significant impact on a substantial number of small 
entities. HHS considers a rule to have a significant economic impact on 
a substantial number of small entities if at least 5 percent of small 
entities experience an impact of more than 3 percent of revenue.
    We calculate the costs of the proposed changes to the Common Rule 
over 2017-2026 to institutions with an FWA. The estimated annualized 
cost to institutions with an FWA, on average, is $2,516 using a 3 
percent discount rate. The U.S. Small Business Administration 
establishes size standards that define a small entity. According to 
these standards, colleges, universities, and professional schools with 
revenues below $27.5 million and hospitals with revenues below $38.5 
million are considered small entities. It is not anticipated that a 
majority of institutions with an FWA are in any of these categories.

[[Page 7255]]

XX. Environmental Impact

    We have determined under 21 CFR 25.30(k) that this action is of a 
type that does not individually or cumulatively have a significant 
effect on the human environment. Therefore, neither an environmental 
assessment nor an environmental impact statement is required.

XXI. Paperwork Reduction Analysis

    This final rule contains collections of information that are 
subject to review and approval by the Office of Management and Budget 
(OMB) under the Paperwork Reduction Act (PRA), as amended (44 U.S.C. 
3501-3520). A description of these provisions is given in this document 
with an estimate of the annual reporting and recordkeeping burden.
    Title: Federal Policy for the Protection of Human Subjects.
    Description: In this document is a discussion of the regulatory 
provisions we believe are subject to the PRA and the probable 
information collection burden associated with these provisions. In 
general, the following actions trigger the PRA: (i) Reporting; (ii) 
Recordkeeping.
    Description of Respondents: The reporting and recordkeeping 
requirements in this document are imposed on institutions, 
institutional review boards, and investigators involved in human 
subjects research conducted or supported or otherwise subject to 
regulation by any federal department or agency that takes 
administrative action that makes the policy applicable to such 
research.

Sec.  __.101(a)(1) Extending Oversight to IRBs-Not Operated by an 
Institution Holding an FWA (OMB Control No 0990-0260)

    Section __.101 is amended, as described in Sec.  __.101(a), to give 
Common Rule departments and agencies the authority to enforce 
compliance directly against IRBs that, are not operated by an assured 
institution. It is anticipated that institutions using an IRB that it 
does not operate will be reassured because compliance actions can be 
taken directly against the IRB responsible for the regulatory 
noncompliance, rather than the institutions that relied on that review. 
As a result of this change, we anticipate that FWA-holding institutions 
will increase their reliance on IRBs not operated by an FWA-holding 
institution when appropriate.
    The OHRP database of assured institutions and registered IRBs shows 
that approximately 449 IRBs not operated by an institution holding an 
FWA will now be subject to oversight. These IRBs will develop an 
estimated average of 10 written agreements with other institutions each 
year as a result of this rule. We further estimate that each agreement 
will require an average of 10 hours of institution legal staff time and 
5 hours of IRB administrator time to complete. We note that elsewhere 
in the final rule (specifically Sec. Sec.  __.103(e) and __.115(a)(9)) 
requires that IRBs document the specific responsibilities that an 
institution and an organization operating an IRB each will undertake, 
when an institution relies on an IRB that it does not operate. The 
impact of these provisions on FWA-holding institutions is described 
below.

Sec.  __.103(e) Documentation of IRB Oversight Reliance Requirement for 
Institution and Organization Operating the IRB (OMB Control No 0990-
0260)

    To further strengthen the compliance enforcement authority 
provision in Sec.  __.101(a) and provide a record for oversight and 
compliance purposes, the final rule contains a requirement at Sec.  
__.103(e), that for nonexempt research involving human subjects covered 
by this policy (or exempt research for which limited IRB takes place 
pursuant to Sec.  __.104(d)(2)(iii), Sec.  __.104(d)(3)(i)(C), Sec.  
__.104(d)(7), or Sec.  __.104(d)(8)) that take place at an institution 
in which IRB oversight is conducted by an IRB that is not operated by 
the institution, the institution and the organization operating the IRB 
shall document the institution's reliance on the IRB for oversight of 
the research and the responsibilities that each entity will undertake 
to ensure compliance with the requirements of this policy. This might 
be accomplished through a written agreement between the institution and 
the IRB, or by implementing an institution-wide policy directive 
providing the allocation of responsibilities between the institution 
and an IRB that is not affiliated with the institution, or as set forth 
in a research protocol). In addition, a requirement is included at 
Sec.  __.115(a)(9) that an institution include documentation of such 
arrangements in the IRB records.
    Table 3 of the RIA section of the preamble shows that 5,164 FWA-
holding institutions do not have an IRB and 2,871 FWA-holding 
institutions have an IRB. We assume that the 5,164 FWA-holding 
institutions without an IRB have an average of 1 IRB authorization 
agreement that will need to be modified as a result of the new 
requirements for agreements between institutions and IRBs not operated 
by the institutions in 2017. In addition, we assume that the 2,871 FWA-
holding institutions with an IRB have an average of 0.20 IRB 
authorization agreements that will need to be modified in 2017. We 
estimate that each agreement will require an average of 10 hours of 
institution legal staff time and 5 hours of IRB administrator time to 
complete. The dollar value of their time is calculated by multiplying 
hours by their estimated 2017 wages and adjusting for overhead and 
benefits.

Sec.  __.104(d)(5)(i) Posting of Information About Federally Funded or 
Supported Demonstration Projects

    Section 104(d)(5)(i) requires each federal department or agency 
conducting or supporting the research or demonstration projects covered 
under this exemption to establish, on a publicly accessible federal Web 
site or in such other manner as the department or agency head may 
determine, a list of the research and demonstration projects that the 
federal department or agency conducts or supports under this provision. 
We estimate that under the pre-2018 rule, approximately 1,000 
demonstration projects occurred each year. Under the modifications to 
this exemption in the final rule, we estimate that an additional 3,376 
studies will fall under this exemption. Thus, approximately 4,376 
studies will be subject to this posting requirement each year. We 
anticipate that investigators will spend approximately 15 minutes per 
study submitting information about these studies to the federal Web 
site.

Sec.  __.114 Cooperative Research (OMB Control No 0990-0260)

    The final rule requires any institution located in the United 
States that is engaged in cooperative research to rely upon approval by 
a single IRB for that portion of the research that is conducted in the 
United States, as detailed in Sec.  __.114 (b)(1). The following 
research is not subject to the requirements of this provision, as 
described in Sec.  __.114 (b)(2): (1) Cooperative research for which 
more than single IRB review is required by law (including tribal law 
passed by the official governing body of a Native American or Alaska 
Native tribe); or (2) research for which any federal department or 
agency supporting or conducting the research determines and documents 
that the use of a single IRB is not appropriate for the particular 
study.
    The OHRP database of assurances shows that 8,035 institutions in 
the United States have an FWA. We estimate that these institutions will

[[Page 7256]]

develop an average of 10 written joint IRB review agreements with other 
institutions or organizations in 2019 before the first year of 
compliance. We further estimate that each agreement will require an 
average of 10 hours of institution legal staff time and 5 hours of IRB 
administrator time to complete.
    We estimate that 202,617 annual reviews of multi-institutional 
protocols take place, and an average of 5 reviews per multi-
institutional protocol, implying that 40,523 multi-institutional 
protocols are reviewed each year. We further estimate that 16,209 (40 
percent) of these multi-institutional studies are funded by NIH and 
thus will already be subject to NIH's single IRB review policy. 
Accordingly, we estimate that approximately 97,256 annual reviews of 
protocols will no longer be conducted as a result of these proposed 
changes. Of these reviews, 32,211 would have undergone convened initial 
review, 14,472 would have undergone expedited initial review, 34,896 
would have undergone convened continuing review, and 15,678 would have 
undergone expedited continuing review based on the distribution of 
reviews presented in Table 3 in the RIA section of the preamble.

Sec.  __.115(a)(3) Documenting the Rationale for Conducting Continuing 
Review of Research That Otherwise Would Not Require Continuing 
Review(OMB Control No 0990-0260)

    The final rule eliminates continuing review for many minimal risk 
studies, as detailed at Sec.  __.109(f). Unless an IRB determines 
otherwise, continuing review of research is not required if: (1) The 
research is eligible for expedited review in accordance with Sec.  
__.110; (2) the research is reviewed by the IRB in accordance with the 
limited IRB review procedure described in several of the exemption 
categories (specifically, Sec.  __.104(d)(2)(iii), Sec.  
__.104(d)(3)(i)(C), Sec.  __.104(d)(7), or Sec.  __.104(d)(8)); or (3) 
the research has progressed to the point that it involves data analysis 
(including analysis of identifiable information or identifiable 
biospecimens) or access to follow-up clinical data from procedures that 
subjects would undergo as part of clinical care. If an IRB chooses to 
conduct continuing review even when these conditions are met, the 
rationale for doing so must be documented according to a new provision 
at Sec.  __.115(a)(3).
    We estimate that 40,773 reviews will require documentation of the 
rationale for doing so (as required under Sec.  __.115(a)(3)). We also 
estimate that IRB voting members will spend 1 hour per review providing 
the necessary documentation.

Sec. Sec.  __.116(a)(5), (b)(9), (c)(7)-(9) and __.117(b) Changes in 
the Elements of Consent, Including Documentation (OMB Control No 0990-
0260)

    The final rule imposes a new requirement at Sec.  __.116(a)(5)(i) 
informed consent must begin with a concise and focused presentation of 
the key information that is most likely to assist a prospective subject 
or legally authorized representative in understanding the reasons why 
one might or might not want to participate in the research. This part 
of informed consent must be organized and presented in a way that 
facilitates comprehension. This requirement applies to all informed 
consent process, except for broad consent obtained pursuant to Sec.  
__.116(d), which may warrant a different presentation.
    The final rule includes a new element of consent at Sec.  
__.116(b)(9) that requires one of the following statements be included 
for any research that involves the collection of identifiable private 
information or identifiable biospecimens: (1) A statement that 
identifiers might be removed from the identifiable private information 
or identifiable biospecimens and that after such removal, the 
information or biospecimens could be used for future research studies 
or distributed to another investigator for future research studies 
without additional informed consent from the subject or the legally 
authorized representative, if this might be a possibility; or (2) a 
statement that the subject's information or biospecimens collected as 
part of the research, even if identifiers are removed, will not be used 
or distributed for future research studies.
    The final rule's three additional elements of consent are in Sec.  
__.116(c)(7), (8), and (9). These require that a subject be informed of 
the following, when appropriate:
     That the subject's biospecimens (even if identifiers are 
removed) may be used for commercial profit and whether the subject will 
or will not share in this commercial profit;
     Whether clinically relevant research results, including 
individual research results, will be disclosed to subjects, and if so, 
under what conditions;
     For research involving biospecimens, whether the research 
will (if known) or might include whole genome sequencing (i.e., 
sequencing of a human germline or somatic specimen with the intent to 
generate the genome or exome sequence of that specimen.
    These additional elements of consent will promote respect for 
persons and greater transparency in the research enterprise. 
Additionally, including the information referenced in these provisions 
in a consent form will help ensure that prospective subjects are given 
information necessary for understanding why one might choose whether to 
participate in a research study.
    The language at Sec.  __.117(b)(1) in the final rule was modified 
to reference Sec.  __.116(a)(5)(i) and state that if a short form 
consent process is used, the key information required by Sec.  
__.116(a)(5)(i) must be presented first to the prospective subject, 
before other information, if any, is provided.
    We estimate that 246,382 new protocols annually will use 
identifiable private information. For each protocol, we estimate that 
investigators will spend an average of 15 minutes in 2017 updating 
consent forms to comply with the new requirements found in the final 
rule at Sec.  __.116(a)(5), (b)(9), (c)(7), (c)(8), or (c)(9) (in Table 
3 in the RIA section).
    We assume that few additional investigators will elect to offer the 
second option at Sec.  __.116(b)(9), and that the investigators who 
currently offer equivalent options already track the permissible and 
impermissible uses of information in line with the requirements 
discussed above. As a result, we estimate that tracking will have no 
additional associated impacts.

Sec.  __.116(h) Requirement for Posting of Consent Forms for Common 
Rule Department or Agency-Supported or Conducted Clinical Trials (OMB 
Control No 0990-0260)

    A new provision in the final rule, Sec.  __.116(h), requires that, 
for each clinical trial conducted or supported by a federal department 
or agency, one IRB-approved informed consent form used to enroll 
subjects must be posted by the awardee or federal department or agency 
component conducting the trial on a publicly available federal Web site 
that is established as a repository for such informed consent forms. 
The informed consent form must be published on the federal Web site 
after the trial is closed to recruitment, and no later than 60 days 
after the last study visit by any subject, as required by the protocol.
    If the federal department or agency supporting or conducting the 
clinical trial determines that certain information should not be made 
publicly available on a federal Web site (e.g., confidential commercial 
information), such Federal department or agency may permit or

[[Page 7257]]

require redactions to the information posted.
    We believe that public posting of consent forms will increase 
transparency, enhance confidence in the research enterprise, increase 
accountability, and inform the development of future consent forms, 
possibly resulting in future savings in time for investigators 
developing consent forms.
    According to queries of ClinicalTrials.gov, an estimated 5,270 
clinical trials are conducted or supported by Common Rule agencies, of 
which an estimated 575 are regulated by provisions in the FD&C Act and 
Trade Secrets Act based on the information presented in Table 3 in the 
RIA section of the preamble. We assume that each clinical trial is 
associated with one consent form that must be submitted to the HHS 
system by an investigator. We estimate that investigators will spend an 
average of 15 minutes submitting each consent form. In addition, for 
the 575 clinical trials regulated by provisions in the FD&C Act and 
Trade Secrets Act, we estimate that investigators will spend an average 
of 30 minutes redacting information before submission.

                                                       Table 21--Estimated Annual Reporting Burden
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                                             Number of
             Sec. description                   Description of burden        Number of     responses per   Total annual    Average hours    Total hours
                                                                            respondents     respondent       responses     per response
--------------------------------------------------------------------------------------------------------------------------------------------------------
101(a)--Extending Oversight Authority to    Develop agreements..........             449              10           4,490              15          67,350
 IRBs not operated by an FWA-holding
 institution.
103(e)--IRB Reliance Documentation          Modify agreements...........           5,164               1           5,164              15          77,460
 (institutions without an internal IRB).
103(e)--IRB Reliance Documentation          Develop agreements..........           2,871            0.20          574.20              15           8,613
 (institutions with an internal IRB).
104(d)(5)(i)--Posting information about     Posting information.........           4,376               1           4,376            0.25           1,094
 demonstration projects.
114--Cooperative Review...................  Time to create agreements              8,035              10          80,350              15       1,205,250
                                             for all institutions
                                             involved in a study will
                                             rely on one IRB of record.
115(a)(3)--Continuing Review Rationale      Provide rationale...........          40,773               1          40,773               1          40,773
 Documentation.
116(a)(5), (b)(9), (c)(7)-(8) & 117(b)--    Updating IC forms with new           246,382               1         246,382            0.25          61,596
 Changes in elements of informed consent,    elements.
 including documentation.
116(h)--Requirement for posting consent     Posting consent forms for              5,270               1           5,270            0.25           1,318
 forms for Common Rule department or         new clinical trials.
 agency-supported clinical trials.
116(h)--Requirement for posting consent     Redact information from                  575               1             575            0.50             288
 forms for Common Rule department or         consent forms.
 agency-supported clinical trials.
rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr
    Total.................................  ............................  ..............  ..............  ..............  ..............       1,422,968
--------------------------------------------------------------------------------------------------------------------------------------------------------

    The total estimated burden imposed by these information collection 
requirements is 1,422,968 burden hours.
    It should be noted that the burden estimates for the Common Rule 
include approved information requirements in OMB No. 0990-0260, 
Protection of Human Subjects: Compliance with Federal Policy/IRB 
Recordkeeping/Informed Consent/Consent Documentation, approved through 
May 31, 2018. As such, it will be amended and submitted to OMB as 
revisions to currently approved collections once the rule is finalized 
and the collections are due for renewal.
    In compliance with the Paperwork Reduction Act of 1995 (44 U.S.C. 
3507(d)), the information collection provisions of this rule will be 
submitted to OMB for review. These requirements will not be effective 
until OMB approves them.

XXII. Tribal Consultation Statement

    We are committed to consulting with AI/AN tribes and tribal 
leadership to the extent practicable and permitted by law before 
promulgating any regulation that has tribal implications. As we 
developed this rule, we engaged with tribes through tribal consultation 
and the public comment process. The requirements in this final rule 
were informed by consultations with and comments from tribal 
representatives.
    On January 5, 2016, HHS conducted a tribal consultation through 
conference call in accordance with the HHS Tribal Consultation Policy 
\61\ with tribal representatives to obtain comments on

[[Page 7258]]

the proposed changes to the Common Rule. This conference call was 
moderated by Elizabeth Carr, a Tribal Affairs Specialist within HHS and 
a federal representative of HHS's American Indian and Alaska Native 
Health Research Advisory Council. Tribal leaders and other interested 
parties were informed of this consultation through written 
communication. The written invitation included a solicitation for 
formal comments and information on how to submit a formal comment to 
the public docket. Public comments were also solicited during the 
consultation conference call. A transcript of this call was posted to 
the Regulations.gov public docket for the Common Rule on January 13, 
2016.
---------------------------------------------------------------------------

    \61\ U.S. Department of Health and Human Services Tribal 
Consultation Policy. Retrieved from https://www.hhs.gov/sites/default/files/iea/tribal/tribalconsultation/hhs-consultation-policy.pdf.
---------------------------------------------------------------------------

    During the tribal consultation conference call, participants 
discussed:
     Concern about the NPRM not acknowledging the role of 
tribal governments in research oversight of research occurring on 
tribal land or with tribal citizens;
     Concern about the pre-2018 rule and the NPRM not 
explicitly acknowledging tribal sovereignty. HHS representatives 
acknowledged an outstanding legal question about whether rules created 
by tribal governments were encompassed by the provision in the pre-2018 
rule and the NPRM's statement that the policy does not affect any state 
or local laws or regulations that may otherwise be applicable and that 
provide additional protections for human subjects;
     Concern about the NPRM not acknowledging the unique and 
significant impact that the proposed changes would have on American 
Indian and Alaska Native populations;
     Concern that the NPRM does not address risks of research 
to communities and only addresses individual risks;
     Concern that the NPRM proposals seem to reduce 
institutional responsibility but increase investigator responsibility. 
This presents a unique challenge when institutions have entered into 
agreements with tribal governments or tribal representatives, as 
opposed to individual investigators entering into these arrangements. 
The exemption decision tool was cited as an example of the proposals 
placing more responsibility on the investigators while perhaps reducing 
responsibility on the institutions; and
     Concern about the single IRB review mandate for multi-
institutional studies affecting the ability of tribal communities to 
conduct local reviews of research involving tribal citizens or research 
that takes place on tribal land. One commenter noted that a one size 
fits all approach to addressing American Indian and Alaska Native 
concerns in human subjects protections might not be appropriate as 
needs and concerns might vary from tribe to tribe.
    HHS reiterated its commitment to engaging in an ongoing dialogue 
with tribal communities and tribal representatives, and welcomed 
ongoing discussion and comment on how the Common Rule affects these 
groups.
    In addition to the January 2016 tribal consultation, we reviewed 
public comments from tribal representatives, and individuals and groups 
representing tribal interests to the ANPRM and NPRM. We received one 
comment on the ANPRM from a group representing tribal interests. This 
group noted ``the long and challenging history'' of research involving 
AI/AN populations, and how this history informs current research 
activities involving these groups. This comment argued that, for 
research involving AI/AN populations:
     Continuing review should be required;
     IRBs, not investigators or other parties, should determine 
whether a prospective study is exempt or excluded from the Common Rule;
     IRBs should be required to consider potential harms to 
populations or groups, not just individuals, when reviewing research 
activities;
     Incorporating tribal IRBs into the process for multi-
institutional studies is a crucial aspect of respecting these 
populations and ensuring human subjects protections;
     Study-specific informed consent forms should be required, 
and general, multi-purpose consent forms should be avoided;
     Mandated information and biospecimen privacy safeguards 
would be a welcome improvement to the current research landscape and 
would help prevent harm to human subjects; and
     Consultation with tribal representatives would be crucial 
should a proposed rule or final rule mandate single IRB review for 
multi-institutional studies.
    We received approximately 15 comments on the NPRM from groups 
representing tribal interests. As described in Section II.E of this 
preamble, overarching concerns raised by these groups in comments to 
the NPRM included:
     Lack of group consent requirements proposed in the NPRM;
     Concern about the allowance for broad consent for future 
unspecified research uses;
     Lack of consideration for research activities involving 
research with biospecimens or information from individuals who are no 
longer alive;
     Mandating the use of single IRB review in multi-
institutional research activities undermining the ability of tribal 
groups to conduct local review of studies; and
     Concern about the breadth and depth of exclusions and 
exemptions proposed in the NPRM exempting or excluding activities that 
tribal populations might find sensitive and requiring IRB review.
    Commenters also raised concerns about the timing of the tribal 
consultation call and noted that the tribal consultation call occurred 
one day before the closing of the extended comment period for the NPRM. 
When HHS received notice that tribal representatives desired to consult 
on this proposed rule, a consultation was immediately scheduled in 
accordance with HHS policy.
    The final rule includes a modification to the provision requiring 
single IRB review, and several clarifications specifying that 
regulatory references to state and local law are intended to include 
tribal law, in response to concerns raised during the tribal 
consultation and in the NPRM public comments. As described in this 
preamble, the final rule clarifies in Sec.  __.101(f) that tribal 
governments can develop laws related to the protection of human 
subjects that are more protective than the Common Rule, and that these 
laws must be followed by federally funded researches in activities 
involving these populations. Section __.114 now provides that if a 
tribal government requires review by more than one IRB by law in multi-
institutional research, the single IRB review requirement in Sec.  
__.114 does not apply. Additional clarification has also been made to 
Sec.  __.116(i) that tribal governments can develop their own informed 
consent standards that provide additional protections to subjects and 
that investigators conducting research involving populations under the 
jurisdiction of the tribal governments would have to follow these 
rules. Finally, additional language has been added to Sec.  __.116(j) 
noting that nothing in Sec.  __.116 is intended to limit the authority 
of a treating physician to the extent the authority is granted by 
tribal law.
    Additional details of public comments from individuals representing 
tribal interests are included above in the relevant public comment 
summaries for the various final rule provisions discussed in Sections 
II through XVIII of this preamble.

[[Page 7259]]

    For the reasons set forth in this preamble, the Federal Policy for 
the Protection of Human Subjects is amended.

Text of the Final Common Rule

    The text of the final common rule appears below:
    1. Part/subpart __is amended/revised/added to read as follows:

PART __--PROTECTION OF HUMAN SUBJECTS

__.101 To what does this policy apply?
__.102 Definitions for purposes of this policy.
__.103 Assuring compliance with this policy--research conducted or 
supported by any Federal department or agency.
__.104 Exempt research.
__.105 [Reserved]
__.106 [Reserved]
__.107 IRB membership.
__.108 IRB functions and operations.
__.109 IRB review of research.
__.110 Expedited review procedures for certain kinds of research 
involving no more than minimal risk, and for minor changes in 
approved research.
__.111 Criteria for IRB approval of research.
__.112 Review by institution.
__.113 Suspension or termination of IRB approval of research.
__.114 Cooperative research.
__.115 IRB records.
__.116 General requirements for informed consent.
__.117 Documentation of informed consent.
__.118 Applications and proposals lacking definite plans for 
involvement of human subjects.
__.119 Research undertaken without the intention of involving human 
subjects.
__.120 Evaluation and disposition of applications and proposals for 
research to be conducted or supported by a Federal department or 
agency.
__.121 [Reserved]
__.122 Use of Federal funds.
__.123 Early termination of research support: Evaluation of 
applications and proposals.
__.124 Conditions.

Sec.  __.101 To what does this policy apply?

    (a) Except as detailed in Sec.  __.104, this policy applies to all 
research involving human subjects conducted, supported, or otherwise 
subject to regulation by any Federal department or agency that takes 
appropriate administrative action to make the policy applicable to such 
research. This includes research conducted by Federal civilian 
employees or military personnel, except that each department or agency 
head may adopt such procedural modifications as may be appropriate from 
an administrative standpoint. It also includes research conducted, 
supported, or otherwise subject to regulation by the Federal Government 
outside the United States. Institutions that are engaged in research 
described in this paragraph and institutional review boards (IRBs) 
reviewing research that is subject to this policy must comply with this 
policy.
    (b) [Reserved]
    (c) Department or agency heads retain final judgment as to whether 
a particular activity is covered by this policy and this judgment shall 
be exercised consistent with the ethical principles of the Belmont 
Report.\62\
---------------------------------------------------------------------------

    \62\ The National Commission for the Protection of Human 
Subjects of Biomedical and Behavioral Research.- Belmont Report. 
Washington, DC: U.S. Department of Health and Human Services. 1979.
---------------------------------------------------------------------------

    (d) Department or agency heads may require that specific research 
activities or classes of research activities conducted, supported, or 
otherwise subject to regulation by the Federal department or agency but 
not otherwise covered by this policy comply with some or all of the 
requirements of this policy.
    (e) Compliance with this policy requires compliance with pertinent 
federal laws or regulations that provide additional protections for 
human subjects.
    (f) This policy does not affect any state or local laws or 
regulations (including tribal law passed by the official governing body 
of an American Indian or Alaska Native tribe) that may otherwise be 
applicable and that provide additional protections for human subjects.
    (g) This policy does not affect any foreign laws or regulations 
that may otherwise be applicable and that provide additional 
protections to human subjects of research.
    (h) When research covered by this policy takes place in foreign 
countries, procedures normally followed in the foreign countries to 
protect human subjects may differ from those set forth in this policy. 
In these circumstances, if a department or agency head determines that 
the procedures prescribed by the institution afford protections that 
are at least equivalent to those provided in this policy, the 
department or agency head may approve the substitution of the foreign 
procedures in lieu of the procedural requirements provided in this 
policy. Except when otherwise required by statute, Executive Order, or 
the department or agency head, notices of these actions as they occur 
will be published in the Federal Register or will be otherwise 
published as provided in department or agency procedures.
    (i) Unless otherwise required by law, department or agency heads 
may waive the applicability of some or all of the provisions of this 
policy to specific research activities or classes of research 
activities otherwise covered by this policy, provided the alternative 
procedures to be followed are consistent with the principles of the 
Belmont Report.\63\ Except when otherwise required by statute or 
Executive Order, the department or agency head shall forward advance 
notices of these actions to the Office for Human Research Protections, 
Department of Health and Human Services (HHS), or any successor office, 
or to the equivalent office within the appropriate Federal department 
or agency, and shall also publish them in the Federal Register or in 
such other manner as provided in department or agency procedures. The 
waiver notice must include a statement that identifies the conditions 
under which the waiver will be applied and a justification as to why 
the waiver is appropriate for the research, including how the decision 
is consistent with the principles of the Belmont Report.
---------------------------------------------------------------------------

    \63\ Id.
---------------------------------------------------------------------------

    (j) Federal guidance on the requirements of this policy shall be 
issued only after consultation, for the purpose of harmonization (to 
the extent appropriate), with other Federal departments and agencies 
that have adopted this policy, unless such consultation is not 
feasible.
    (k) [Reserved]
    (l) Compliance dates and transition provisions:
    (1) For purposes of this section, the pre-2018 Requirements means 
this subpart as published in the 2016 edition of the Code of Federal 
Regulations.
    (2) For purposes of this section, the 2018 Requirements means the 
Federal Policy for the Protection of Human Subjects requirements 
contained in this subpart. The compliance date for Sec.  __.114(b) 
(cooperative research) of the 2018 Requirements is January 20, 2020.
    (3) Research initially approved by an IRB, for which such review 
was waived pursuant to Sec.  __.101(i), or for which a determination 
was made that the research was exempt before January 19, 2018, shall 
comply with the pre-2018 Requirements, except that an institution 
engaged in such research on or after January 19, 2018, may instead 
comply with the 2018 Requirements if the institution determines that 
such ongoing research will comply with the 2018 Requirements and an IRB 
documents such determination.
    (4) Research initially approved by an IRB, for which such review 
was waived pursuant to Sec.  __.101(i), or for which a

[[Page 7260]]

determination was made that the research was exempt on or after January 
19, 2018, shall comply with the 2018 Requirements.
    (m) Severability: Any provision of this part held to be invalid or 
unenforceable by its terms, or as applied to any person or 
circumstance, shall be construed so as to continue to give maximum 
effect to the provision permitted by law, unless such holding shall be 
one of utter invalidity or unenforceability, in which event the 
provision shall be severable from this part and shall not affect the 
remainder thereof or the application of the provision to other persons 
not similarly situated or to other dissimilar circumstances.

Sec.  __.102 Definitions for purposes of this policy.

    (a) Certification means the official notification by the 
institution to the supporting Federal department or agency component, 
in accordance with the requirements of this policy, that a research 
project or activity involving human subjects has been reviewed and 
approved by an IRB in accordance with an approved assurance.
    (b) Clinical trial means a research study in which one or more 
human subjects are prospectively assigned to one or more interventions 
(which may include placebo or other control) to evaluate the effects of 
the interventions on biomedical or behavioral health-related outcomes.
    (c) Department or agency head means the head of any Federal 
department or agency, for example, the Secretary of HHS, and any other 
officer or employee of any Federal department or agency to whom the 
authority provided by these regulations to the department or agency 
head has been delegated.
    (d) Federal department or agency refers to a federal department or 
agency (the department or agency itself rather than its bureaus, 
offices or divisions) that takes appropriate administrative action to 
make this policy applicable to the research involving human subjects it 
conducts, supports, or otherwise regulates (e.g., the U.S. Department 
of Health and Human Services, the U.S. Department of Defense, or the 
Central Intelligence Agency).
    (e)(1) Human subject means a living individual about whom an 
investigator (whether professional or student) conducting research:
    (i) Obtains information or biospecimens through intervention or 
interaction with the individual, and uses, studies, or analyzes the 
information or biospecimens; or (ii) Obtains, uses, studies, analyzes, 
or generates identifiable private information or identifiable 
biospecimens.
    (2) Intervention includes both physical procedures by which 
information or biospecimens are gathered (e.g., venipuncture) and 
manipulations of the subject or the subject's environment that are 
performed for research purposes.
    (3) Interaction includes communication or interpersonal contact 
between investigator and subject.
    (4) Private information includes information about behavior that 
occurs in a context in which an individual can reasonably expect that 
no observation or recording is taking place, and information that has 
been provided for specific purposes by an individual and that the 
individual can reasonably expect will not be made public (e.g., a 
medical record).
    (5) Identifiable private information is private information for 
which the identity of the subject is or may readily be ascertained by 
the investigator or associated with the information.
    (6) An identifiable biospecimen is a biospecimen for which the 
identity of the subject is or may readily be ascertained by the 
investigator or associated with the biospecimen.
    (7) Federal departments or agencies implementing this policy shall:
    (i) Upon consultation with appropriate experts (including experts 
in data matching and re-identification), reexamine the meaning of 
``identifiable private information,'' as defined in paragraph (e)(5) of 
this section, and ``identifiable biospecimen,'' as defined in paragraph 
(e)(6) of this section. This reexamination shall take place within 1 
year and regularly thereafter (at least every 4 years). This process 
will be conducted by collaboration among the Federal departments and 
agencies implementing this policy. If appropriate and permitted by law, 
such Federal departments and agencies may alter the interpretation of 
these terms, including through the use of guidance.
    (ii) Upon consultation with appropriate experts, assess whether 
there are analytic technologies or techniques that should be considered 
by investigators to generate ``identifiable private information,'' as 
defined in paragraph (e)(5) of this section, or an ``identifiable 
biospecimen,'' as defined in paragraph (e)(6) of this section. This 
assessment shall take place within 1 year and regularly thereafter (at 
least every 4 years). This process will be conducted by collaboration 
among the Federal departments and agencies implementing this policy. 
Any such technologies or techniques will be included on a list of 
technologies or techniques that produce identifiable private 
information or identifiable biospecimens. This list will be published 
in the Federal Register after notice and an opportunity for public 
comment. The Secretary, HHS, shall maintain the list on a publicly 
accessible Web site.
    (f) Institution means any public or private entity, or department 
or agency (including federal, state, and other agencies).
    (g) IRB means an institutional review board established in accord 
with and for the purposes expressed in this policy.
    (h) IRB approval means the determination of the IRB that the 
research has been reviewed and may be conducted at an institution 
within the constraints set forth by the IRB and by other institutional 
and federal requirements.
    (i) Legally authorized representative means an individual or 
judicial or other body authorized under applicable law to consent on 
behalf of a prospective subject to the subject's participation in the 
procedure(s) involved in the research. If there is no applicable law 
addressing this issue, legally authorized representative means an 
individual recognized by institutional policy as acceptable for 
providing consent in the nonresearch context on behalf of the 
prospective subject to the subject's participation in the procedure(s) 
involved in the research.
    (j) Minimal risk means that the probability and magnitude of harm 
or discomfort anticipated in the research are not greater in and of 
themselves than those ordinarily encountered in daily life or during 
the performance of routine physical or psychological examinations or 
tests.
    (k) Public health authority means an agency or authority of the 
United States, a state, a territory, a political subdivision of a state 
or territory, an Indian tribe, or a foreign government, or a person or 
entity acting under a grant of authority from or contract with such 
public agency, including the employees or agents of such public agency 
or its contractors or persons or entities to whom it has granted 
authority, that is responsible for public health matters as part of its 
official mandate.
    (l) Research means a systematic investigation, including research 
development, testing, and evaluation, designed to develop or contribute 
to generalizable knowledge. Activities that meet this definition 
constitute research for purposes of this policy, whether or not they 
are conducted or supported under a program that is considered research 
for other purposes. For example, some demonstration and

[[Page 7261]]

service programs may include research activities. For purposes of this 
part, the following activities are deemed not to be research:
    (1) Scholarly and journalistic activities (e.g., oral history, 
journalism, biography, literary criticism, legal research, and 
historical scholarship), including the collection and use of 
information, that focus directly on the specific individuals about whom 
the information is collected.
    (2) Public health surveillance activities, including the collection 
and testing of information or biospecimens, conducted, supported, 
requested, ordered, required, or authorized by a public health 
authority. Such activities are limited to those necessary to allow a 
public health authority to identify, monitor, assess, or investigate 
potential public health signals, onsets of disease outbreaks, or 
conditions of public health importance (including trends, signals, risk 
factors, patterns in diseases, or increases in injuries from using 
consumer products). Such activities include those associated with 
providing timely situational awareness and priority setting during the 
course of an event or crisis that threatens public health (including 
natural or man-made disasters).
    (3) Collection and analysis of information, biospecimens, or 
records by or for a criminal justice agency for activities authorized 
by law or court order solely for criminal justice or criminal 
investigative purposes.
    (4) Authorized operational activities (as determined by each 
agency) in support of intelligence, homeland security, defense, or 
other national security missions.
    (m) Written, or in writing, for purposes of this part, refers to 
writing on a tangible medium (e.g., paper) or in an electronic format.

Sec.  __.103 Assuring compliance with this policy--research conducted 
or supported by any Federal department or agency.

    (a) Each institution engaged in research that is covered by this 
policy, with the exception of research eligible for exemption under 
Sec.  __.104, and that is conducted or supported by a Federal 
department or agency, shall provide written assurance satisfactory to 
the department or agency head that it will comply with the requirements 
of this policy. In lieu of requiring submission of an assurance, 
individual department or agency heads shall accept the existence of a 
current assurance, appropriate for the research in question, on file 
with the Office for Human Research Protections, HHS, or any successor 
office, and approved for Federal-wide use by that office. When the 
existence of an HHS-approved assurance is accepted in lieu of requiring 
submission of an assurance, reports (except certification) required by 
this policy to be made to department and agency heads shall also be 
made to the Office for Human Research Protections, HHS, or any 
successor office. Federal departments and agencies will conduct or 
support research covered by this policy only if the institution has 
provided an assurance that it will comply with the requirements of this 
policy, as provided in this section, and only if the institution has 
certified to the department or agency head that the research has been 
reviewed and approved by an IRB (if such certification is required by 
Sec.  __.103(d)).
    (b) The assurance shall be executed by an individual authorized to 
act for the institution and to assume on behalf of the institution the 
obligations imposed by this policy and shall be filed in such form and 
manner as the department or agency head prescribes.
    (c) The department or agency head may limit the period during which 
any assurance shall remain effective or otherwise condition or restrict 
the assurance.
    (d) Certification is required when the research is supported by a 
Federal department or agency and not otherwise waived under Sec.  
__.101(i) or exempted under Sec.  __.104. For such research, 
institutions shall certify that each proposed research study covered by 
the assurance and this section has been reviewed and approved by the 
IRB. Such certification must be submitted as prescribed by the Federal 
department or agency component supporting the research. Under no 
condition shall research covered by this section be initiated prior to 
receipt of the certification that the research has been reviewed and 
approved by the IRB.
    (e) For nonexempt research involving human subjects covered by this 
policy (or exempt research for which limited IRB review takes place 
pursuant to Sec.  __.104(d)(2)(iii), (d)(3)(i)(C), or (d)(7) or (8)) 
that takes place at an institution in which IRB oversight is conducted 
by an IRB that is not operated by the institution, the institution and 
the organization operating the IRB shall document the institution's 
reliance on the IRB for oversight of the research and the 
responsibilities that each entity will undertake to ensure compliance 
with the requirements of this policy (e.g., in a written agreement 
between the institution and the IRB, by implementation of an 
institution-wide policy directive providing the allocation of 
responsibilities between the institution and an IRB that is not 
affiliated with the institution, or as set forth in a research 
protocol).

(Approved by the Office of Management and Budget under Control 
Number 0990-0260)

Sec.  __.104 Exempt research.

    (a) Unless otherwise required by law or by department or agency 
heads, research activities in which the only involvement of human 
subjects will be in one or more of the categories in paragraph (d) of 
this section are exempt from the requirements of this policy, except 
that such activities must comply with the requirements of this section 
and as specified in each category.
    (b) Use of the exemption categories for research subject to the 
requirements of subparts B, C, and D: Application of the exemption 
categories to research subject to the requirements of 45 CFR part 46, 
subparts B, C, and D, is as follows:
    (1) Subpart B. Each of the exemptions at this section may be 
applied to research subject to subpart B if the conditions of the 
exemption are met.
    (2) Subpart C. The exemptions at this section do not apply to 
research subject to subpart C, except for research aimed at involving a 
broader subject population that only incidentally includes prisoners.
    (3) Subpart D. The exemptions at paragraphs (d)(1), (4), (5), (6), 
(7), and (8) of this section may be applied to research subject to 
subpart D if the conditions of the exemption are met. Paragraphs 
(d)(2)(i) and (ii) of this section only may apply to research subject 
to subpart D involving educational tests or the observation of public 
behavior when the investigator(s) do not participate in the activities 
being observed. Paragraph (d)(2)(iii) of this section may not be 
applied to research subject to subpart D.
    (c) [Reserved.]
    (d) Except as described in paragraph (a) of this section, the 
following categories of human subjects research are exempt from this 
policy:
    (1) Research, conducted in established or commonly accepted 
educational settings, that specifically involves normal educational 
practices that are not likely to adversely impact students' opportunity 
to learn required educational content or the assessment of educators 
who provide instruction. This includes most research on regular and 
special education instructional strategies, and research on the 
effectiveness of or the comparison among instructional techniques,

[[Page 7262]]

curricula, or classroom management methods.
    (2) Research that only includes interactions involving educational 
tests (cognitive, diagnostic, aptitude, achievement), survey 
procedures, interview procedures, or observation of public behavior 
(including visual or auditory recording) if at least one of the 
following criteria is met:
    (i) The information obtained is recorded by the investigator in 
such a manner that the identity of the human subjects cannot readily be 
ascertained, directly or through identifiers linked to the subjects;
    (ii) Any disclosure of the human subjects' responses outside the 
research would not reasonably place the subjects at risk of criminal or 
civil liability or be damaging to the subjects' financial standing, 
employability, educational advancement, or reputation; or
    (iii) The information obtained is recorded by the investigator in 
such a manner that the identity of the human subjects can readily be 
ascertained, directly or through identifiers linked to the subjects, 
and an IRB conducts a limited IRB review to make the determination 
required by Sec.  __.111(a)(7).
    (3)(i) Research involving benign behavioral interventions in 
conjunction with the collection of information from an adult subject 
through verbal or written responses (including data entry) or 
audiovisual recording if the subject prospectively agrees to the 
intervention and information collection and at least one of the 
following criteria is met:
    (A) The information obtained is recorded by the investigator in 
such a manner that the identity of the human subjects cannot readily be 
ascertained, directly or through identifiers linked to the subjects;
    (B) Any disclosure of the human subjects' responses outside the 
research would not reasonably place the subjects at risk of criminal or 
civil liability or be damaging to the subjects' financial standing, 
employability, educational advancement, or reputation; or
    (C) The information obtained is recorded by the investigator in 
such a manner that the identity of the human subjects can readily be 
ascertained, directly or through identifiers linked to the subjects, 
and an IRB conducts a limited IRB review to make the determination 
required by Sec.  __.111(a)(7).
    (ii) For the purpose of this provision, benign behavioral 
interventions are brief in duration, harmless, painless, not physically 
invasive, not likely to have a significant adverse lasting impact on 
the subjects, and the investigator has no reason to think the subjects 
will find the interventions offensive or embarrassing. Provided all 
such criteria are met, examples of such benign behavioral interventions 
would include having the subjects play an online game, having them 
solve puzzles under various noise conditions, or having them decide how 
to allocate a nominal amount of received cash between themselves and 
someone else.
    (iii) If the research involves deceiving the subjects regarding the 
nature or purposes of the research, this exemption is not applicable 
unless the subject authorizes the deception through a prospective 
agreement to participate in research in circumstances in which the 
subject is informed that he or she will be unaware of or misled 
regarding the nature or purposes of the research.
    (4) Secondary research for which consent is not required: Secondary 
research uses of identifiable private information or identifiable 
biospecimens, if at least one of the following criteria is met:
    (i) The identifiable private information or identifiable 
biospecimens are publicly available;
    (ii) Information, which may include information about biospecimens, 
is recorded by the investigator in such a manner that the identity of 
the human subjects cannot readily be ascertained directly or through 
identifiers linked to the subjects, the investigator does not contact 
the subjects, and the investigator will not re-identify subjects;
    (iii) The research involves only information collection and 
analysis involving the investigator's use of identifiable health 
information when that use is regulated under 45 CFR parts 160 and 164, 
subparts A and E, for the purposes of ``health care operations'' or 
``research'' as those terms are defined at 45 CFR 164.501 or for 
``public health activities and purposes'' as described under 45 CFR 
164.512(b); or
    (iv) The research is conducted by, or on behalf of, a Federal 
department or agency using government-generated or government-collected 
information obtained for nonresearch activities, if the research 
generates identifiable private information that is or will be 
maintained on information technology that is subject to and in 
compliance with section 208(b) of the E-Government Act of 2002, 44 
U.S.C. 3501 note, if all of the identifiable private information 
collected, used, or generated as part of the activity will be 
maintained in systems of records subject to the Privacy Act of 1974, 5 
U.S.C. 552a, and, if applicable, the information used in the research 
was collected subject to the Paperwork Reduction Act of 1995, 44 U.S.C. 
3501 et seq.
    (5) Research and demonstration projects that are conducted or 
supported by a Federal department or agency, or otherwise subject to 
the approval of department or agency heads (or the approval of the 
heads of bureaus or other subordinate agencies that have been delegated 
authority to conduct the research and demonstration projects), and that 
are designed to study, evaluate, improve, or otherwise examine public 
benefit or service programs, including procedures for obtaining 
benefits or services under those programs, possible changes in or 
alternatives to those programs or procedures, or possible changes in 
methods or levels of payment for benefits or services under those 
programs. Such projects include, but are not limited to, internal 
studies by Federal employees, and studies under contracts or consulting 
arrangements, cooperative agreements, or grants. Exempt projects also 
include waivers of otherwise mandatory requirements using authorities 
such as sections 1115 and 1115A of the Social Security Act, as amended.
    (i) Each Federal department or agency conducting or supporting the 
research and demonstration projects must establish, on a publicly 
accessible Federal Web site or in such other manner as the department 
or agency head may determine, a list of the research and demonstration 
projects that the Federal department or agency conducts or supports 
under this provision. The research or demonstration project must be 
published on this list prior to commencing the research involving human 
subjects.
    (ii) [Reserved]
    (6) Taste and food quality evaluation and consumer acceptance 
studies:
    (i) If wholesome foods without additives are consumed, or
    (ii) If a food is consumed that contains a food ingredient at or 
below the level and for a use found to be safe, or agricultural 
chemical or environmental contaminant at or below the level found to be 
safe, by the Food and Drug Administration or approved by the 
Environmental Protection Agency or the Food Safety and Inspection 
Service of the U.S. Department of Agriculture.
    (7) Storage or maintenance for secondary research for which broad 
consent is required: Storage or maintenance of identifiable private 
information or identifiable biospecimens for potential secondary 
research use if an IRB conducts a limited IRB review and makes the

[[Page 7263]]

determinations required by Sec.  __.111(a)(8).
    (8) Secondary research for which broad consent is required: 
Research involving the use of identifiable private information or 
identifiable biospecimens for secondary research use, if the following 
criteria are met:
    (i) Broad consent for the storage, maintenance, and secondary 
research use of the identifiable private information or identifiable 
biospecimens was obtained in accordance with Sec.  __.116(a)(1) through 
(4), (a)(6), and (d);
    (ii) Documentation of informed consent or waiver of documentation 
of consent was obtained in accordance with Sec.  __.117;
    (iii) An IRB conducts a limited IRB review and makes the 
determination required by Sec.  __.111(a)(7) and makes the 
determination that the research to be conducted is within the scope of 
the broad consent referenced in paragraph (d)(8)(i) of this section; 
and (iv) The investigator does not include returning individual 
research results to subjects as part of the study plan. This provision 
does not prevent an investigator from abiding by any legal requirements 
to return individual research results.

(Approved by the Office of Management and Budget under Control 
Number 0990-0260)

Sec.  __.105 [Reserved.]

Sec.  __.106 [Reserved]

Sec.  __.107 IRB membership.

    (a) Each IRB shall have at least five members, with varying 
backgrounds to promote complete and adequate review of research 
activities commonly conducted by the institution. The IRB shall be 
sufficiently qualified through the experience and expertise of its 
members (professional competence), and the diversity of its members, 
including race, gender, and cultural backgrounds and sensitivity to 
such issues as community attitudes, to promote respect for its advice 
and counsel in safeguarding the rights and welfare of human subjects. 
The IRB shall be able to ascertain the acceptability of proposed 
research in terms of institutional commitments (including policies and 
resources) and regulations, applicable law, and standards of 
professional conduct and practice. The IRB shall therefore include 
persons knowledgeable in these areas. If an IRB regularly reviews 
research that involves a category of subjects that is vulnerable to 
coercion or undue influence, such as children, prisoners, individuals 
with impaired decision-making capacity, or economically or 
educationally disadvantaged persons, consideration shall be given to 
the inclusion of one or more individuals who are knowledgeable about 
and experienced in working with these categories of subjects.
    (b) Each IRB shall include at least one member whose primary 
concerns are in scientific areas and at least one member whose primary 
concerns are in nonscientific areas.
    (c) Each IRB shall include at least one member who is not otherwise 
affiliated with the institution and who is not part of the immediate 
family of a person who is affiliated with the institution.
    (d) No IRB may have a member participate in the IRB's initial or 
continuing review of any project in which the member has a conflicting 
interest, except to provide information requested by the IRB.
    (e) An IRB may, in its discretion, invite individuals with 
competence in special areas to assist in the review of issues that 
require expertise beyond or in addition to that available on the IRB. 
These individuals may not vote with the IRB.

Sec.  __.108 IRB functions and operations.

    (a) In order to fulfill the requirements of this policy each IRB 
shall:
    (1) Have access to meeting space and sufficient staff to support 
the IRB's review and recordkeeping duties;
    (2) Prepare and maintain a current list of the IRB members 
identified by name; earned degrees; representative capacity; 
indications of experience such as board certifications or licenses 
sufficient to describe each member's chief anticipated contributions to 
IRB deliberations; and any employment or other relationship between 
each member and the institution, for example, full-time employee, part-
time employee, member of governing panel or board, stockholder, paid or 
unpaid consultant;
    (3) Establish and follow written procedures for:
    (i) Conducting its initial and continuing review of research and 
for reporting its findings and actions to the investigator and the 
institution;
    (ii) Determining which projects require review more often than 
annually and which projects need verification from sources other than 
the investigators that no material changes have occurred since previous 
IRB review; and
    (iii) Ensuring prompt reporting to the IRB of proposed changes in a 
research activity, and for ensuring that investigators will conduct the 
research activity in accordance with the terms of the IRB approval 
until any proposed changes have been reviewed and approved by the IRB, 
except when necessary to eliminate apparent immediate hazards to the 
subject.
    (4) Establish and follow written procedures for ensuring prompt 
reporting to the IRB; appropriate institutional officials; the 
department or agency head; and the Office for Human Research 
Protections, HHS, or any successor office, or the equivalent office 
within the appropriate Federal department or agency of
    (i) Any unanticipated problems involving risks to subjects or 
others or any serious or continuing noncompliance with this policy or 
the requirements or determinations of the IRB; and
    (ii) Any suspension or termination of IRB approval.
    (b) Except when an expedited review procedure is used (as described 
in Sec.  __.110), an IRB must review proposed research at convened 
meetings at which a majority of the members of the IRB are present, 
including at least one member whose primary concerns are in 
nonscientific areas. In order for the research to be approved, it shall 
receive the approval of a majority of those members present at the 
meeting.

(Approved by the Office of Management and Budget under Control 
Number 0990-0260)

Sec.  __.109 IRB review of research.

    (a) An IRB shall review and have authority to approve, require 
modifications in (to secure approval), or disapprove all research 
activities covered by this policy, including exempt research activities 
under Sec.  __.104 for which limited IRB review is a condition of 
exemption (under Sec.  __.104(d)(2)(iii), (d)(3)(i)(C), and (d)(7), and 
(8)).
    (b) An IRB shall require that information given to subjects (or 
legally authorized representatives, when appropriate) as part of 
informed consent is in accordance with Sec.  __.116. The IRB may 
require that information, in addition to that specifically mentioned in 
Sec.  __.116, be given to the subjects when in the IRB's judgment the 
information would meaningfully add to the protection of the rights and 
welfare of subjects.
    (c) An IRB shall require documentation of informed consent or may 
waive documentation in accordance with Sec.  __.117.
    (d) An IRB shall notify investigators and the institution in 
writing of its decision to approve or disapprove the proposed research 
activity, or of modifications required to secure IRB

[[Page 7264]]

approval of the research activity. If the IRB decides to disapprove a 
research activity, it shall include in its written notification a 
statement of the reasons for its decision and give the investigator an 
opportunity to respond in person or in writing.
    (e) An IRB shall conduct continuing review of research requiring 
review by the convened IRB at intervals appropriate to the degree of 
risk, not less than once per year, except as described in Sec.  
__.109(f).
    (f)(1) Unless an IRB determines otherwise, continuing review of 
research is not required in the following circumstances:
    (i) Research eligible for expedited review in accordance with Sec.  
__.110;
    (ii) Research reviewed by the IRB in accordance with the limited 
IRB review described in Sec.  __.104(d)(2)(iii), (d)(3)(i)(C), or 
(d)(7) or (8);
    (iii) Research that has progressed to the point that it involves 
only one or both of the following, which are part of the IRB-approved 
study:
    (A) Data analysis, including analysis of identifiable private 
information or identifiable biospecimens, or
    (B) Accessing follow-up clinical data from procedures that subjects 
would undergo as part of clinical care.
    (2) [Reserved.]
    (g) An IRB shall have authority to observe or have a third party 
observe the consent process and the research.

(Approved by the Office of Management and Budget under Control 
Number 0990-0260)

Sec.  __.110 Expedited review procedures for certain kinds of research 
involving no more than minimal risk, and for minor changes in approved 
research.

    (a) The Secretary of HHS has established, and published as a Notice 
in the Federal Register, a list of categories of research that may be 
reviewed by the IRB through an expedited review procedure. The 
Secretary will evaluate the list at least every 8 years and amend it, 
as appropriate, after consultation with other federal departments and 
agencies and after publication in the Federal Register for public 
comment. A copy of the list is available from the Office for Human 
Research Protections, HHS, or any successor office.
    (b)(1) An IRB may use the expedited review procedure to review the 
following:
    (i) Some or all of the research appearing on the list described in 
paragraph (a) of this section, unless the reviewer determines that the 
study involves more than minimal risk;
    (ii) Minor changes in previously approved research during the 
period for which approval is authorized; or
    (iii) Research for which limited IRB review is a condition of 
exemption under Sec.  __.104(d)(2)(iii), (d)(3)(i)(C), and (d)(7) and 
(8).
    (2) Under an expedited review procedure, the review may be carried 
out by the IRB chairperson or by one or more experienced reviewers 
designated by the chairperson from among members of the IRB. In 
reviewing the research, the reviewers may exercise all of the 
authorities of the IRB except that the reviewers may not disapprove the 
research. A research activity may be disapproved only after review in 
accordance with the nonexpedited procedure set forth in Sec.  
__.108(b).
    (c) Each IRB that uses an expedited review procedure shall adopt a 
method for keeping all members advised of research proposals that have 
been approved under the procedure.
    (d) The department or agency head may restrict, suspend, terminate, 
or choose not to authorize an institution's or IRB's use of the 
expedited review procedure.

Sec.  __.111 Criteria for IRB approval of research.

    (a) In order to approve research covered by this policy the IRB 
shall determine that all of the following requirements are satisfied:
    (1) Risks to subjects are minimized:
    (i) By using procedures that are consistent with sound research 
design and that do not unnecessarily expose subjects to risk, and
    (ii) Whenever appropriate, by using procedures already being 
performed on the subjects for diagnostic or treatment purposes.
    (2) Risks to subjects are reasonable in relation to anticipated 
benefits, if any, to subjects, and the importance of the knowledge that 
may reasonably be expected to result. In evaluating risks and benefits, 
the IRB should consider only those risks and benefits that may result 
from the research (as distinguished from risks and benefits of 
therapies subjects would receive even if not participating in the 
research). The IRB should not consider possible long-range effects of 
applying knowledge gained in the research (e.g., the possible effects 
of the research on public policy) as among those research risks that 
fall within the purview of its responsibility.
    (3) Selection of subjects is equitable. In making this assessment 
the IRB should take into account the purposes of the research and the 
setting in which the research will be conducted. The IRB should be 
particularly cognizant of the special problems of research that 
involves a category of subjects who are vulnerable to coercion or undue 
influence, such as children, prisoners, individuals with impaired 
decision-making capacity, or economically or educationally 
disadvantaged persons.
    (4) Informed consent will be sought from each prospective subject 
or the subject's legally authorized representative, in accordance with, 
and to the extent required by, Sec.  __.116.
    (5) Informed consent will be appropriately documented or 
appropriately waived in accordance with Sec.  __.117.
    (6) When appropriate, the research plan makes adequate provision 
for monitoring the data collected to ensure the safety of subjects.
    (7) When appropriate, there are adequate provisions to protect the 
privacy of subjects and to maintain the confidentiality of data.
    (i) The Secretary of HHS will, after consultation with the Office 
of Management and Budget's privacy office and other Federal departments 
and agencies that have adopted this policy, issue guidance to assist 
IRBs in assessing what provisions are adequate to protect the privacy 
of subjects and to maintain the confidentiality of data.
    (ii) [Reserved.]
    (8) For purposes of conducting the limited IRB review required by 
Sec.  __.104(d)(7)), the IRB need not make the determinations at 
paragraphs (a)(1) through (7) of this section, and shall make the 
following determinations:
    (i) Broad consent for storage, maintenance, and secondary research 
use of identifiable private information or identifiable biospecimens is 
obtained in accordance with the requirements of Sec.  __.116(a)(1)-(4), 
(a)(6), and (d);
    (ii) Broad consent is appropriately documented or waiver of 
documentation is appropriate, in accordance with Sec.  __.117; and
    (iii) If there is a change made for research purposes in the way 
the identifiable private information or identifiable biospecimens are 
stored or maintained, there are adequate provisions to protect the 
privacy of subjects and to maintain the confidentiality of data.
    (b) When some or all of the subjects are likely to be vulnerable to 
coercion or undue influence, such as children, prisoners, individuals 
with impaired decision-making capacity, or economically or 
educationally disadvantaged persons, additional safeguards have been 
included in the study to protect the rights and welfare of these 
subjects.

[[Page 7265]]

Sec.  __.112 Review by Institution

    Research covered by this policy that has been approved by an IRB 
may be subject to further appropriate review and approval or 
disapproval by officials of the institution. However, those officials 
may not approve the research if it has not been approved by an IRB.

Sec.  __.113 Suspension or Termination of IRB Approval of Research

    An IRB shall have authority to suspend or terminate approval of 
research that is not being conducted in accordance with the IRB's 
requirements or that has been associated with unexpected serious harm 
to subjects. Any suspension or termination of approval shall include a 
statement of the reasons for the IRB's action and shall be reported 
promptly to the investigator, appropriate institutional officials, and 
the department or agency head.

(Approved by the Office of Management and Budget under Control 
Number 0990-0260)

Sec.  __.114 Cooperative Research

    (a) Cooperative research projects are those projects covered by 
this policy that involve more than one institution. In the conduct of 
cooperative research projects, each institution is responsible for 
safeguarding the rights and welfare of human subjects and for complying 
with this policy.
    (b)(1) Any institution located in the United States that is engaged 
in cooperative research must rely upon approval by a single IRB for 
that portion of the research that is conducted in the United States. 
The reviewing IRB will be identified by the Federal department or 
agency supporting or conducting the research or proposed by the lead 
institution subject to the acceptance of the Federal department or 
agency supporting the research.
    (2) The following research is not subject to this provision:
    (i) Cooperative research for which more than single IRB review is 
required by law (including tribal law passed by the official governing 
body of an American Indian or Alaska Native tribe); or
    (ii) Research for which any Federal department or agency supporting 
or conducting the research determines and documents that the use of a 
single IRB is not appropriate for the particular context.
    (c) For research not subject to paragraph (b) of this section, an 
institution participating in a cooperative project may enter into a 
joint review arrangement, rely on the review of another IRB, or make 
similar arrangements for avoiding duplication of effort.

Sec.  __.115 IRB Records

    (a) An institution, or when appropriate an IRB, shall prepare and 
maintain adequate documentation of IRB activities, including the 
following:
    (1) Copies of all research proposals reviewed, scientific 
evaluations, if any, that accompany the proposals, approved sample 
consent forms, progress reports submitted by investigators, and reports 
of injuries to subjects.
    (2) Minutes of IRB meetings, which shall be in sufficient detail to 
show attendance at the meetings; actions taken by the IRB; the vote on 
these actions including the number of members voting for, against, and 
abstaining; the basis for requiring changes in or disapproving 
research; and a written summary of the discussion of controverted 
issues and their resolution.
    (3) Records of continuing review activities, including the 
rationale for conducting continuing review of research that otherwise 
would not require continuing review as described in Sec.  __.109(f)(1).
    (4) Copies of all correspondence between the IRB and the 
investigators.
    (5) A list of IRB members in the same detail as described in Sec.  
__.108(a)(2).
    (6) Written procedures for the IRB in the same detail as described 
in Sec.  __.108(a)(3) and (4).
    (7) Statements of significant new findings provided to subjects, as 
required by Sec.  __.116(c)(5).
    (8) The rationale for an expedited reviewer's determination under 
Sec.  __.110(b)(1)(i) that research appearing on the expedited review 
list described in Sec.  __.110(a) is more than minimal risk.
    (9) Documentation specifying the responsibilities that an 
institution and an organization operating an IRB each will undertake to 
ensure compliance with the requirements of this policy, as described in 
Sec.  __.103(e).
    (b) The records required by this policy shall be retained for at 
least 3 years, and records relating to research that is conducted shall 
be retained for at least 3 years after completion of the research. The 
institution or IRB may maintain the records in printed form, or 
electronically. All records shall be accessible for inspection and 
copying by authorized representatives of the Federal department or 
agency at reasonable times and in a reasonable manner.

(Approved by the Office of Management and Budget under Control 
Number 0990-0260)

Sec.  __.116 General Requirements for Informed Consent

    (a) General. General requirements for informed consent, whether 
written or oral, are set forth in this paragraph and apply to consent 
obtained in accordance with the requirements set forth in paragraphs 
(b) through (d) of this section. Broad consent may be obtained in lieu 
of informed consent obtained in accordance with paragraphs (b) and (c) 
of this section only with respect to the storage, maintenance, and 
secondary research uses of identifiable private information and 
identifiable biospecimens. Waiver or alteration of consent in research 
involving public benefit and service programs conducted by or subject 
to the approval of state or local officials is described in paragraph 
(e) of this section. General waiver or alteration of informed consent 
is described in paragraph (f) of this section. Except as provided 
elsewhere in this policy:
    (1) Before involving a human subject in research covered by this 
policy, an investigator shall obtain the legally effective informed 
consent of the subject or the subject's legally authorized 
representative.
    (2) An investigator shall seek informed consent only under 
circumstances that provide the prospective subject or the legally 
authorized representative sufficient opportunity to discuss and 
consider whether or not to participate and that minimize the 
possibility of coercion or undue influence.
    (3) The information that is given to the subject or the legally 
authorized representative shall be in language understandable to the 
subject or the legally authorized representative.
    (4) The prospective subject or the legally authorized 
representative must be provided with the information that a reasonable 
person would want to have in order to make an informed decision about 
whether to participate, and an opportunity to discuss that information.
    (5) Except for broad consent obtained in accordance with paragraph 
(d) of this section:
    (i) Informed consent must begin with a concise and focused 
presentation of the key information that is most likely to assist a 
prospective subject or legally authorized representative in 
understanding the reasons why one might or might not want to 
participate in the research. This part of the informed consent must be 
organized and presented in a way that facilitates comprehension.
    (ii) Informed consent as a whole must present information in 
sufficient detail

[[Page 7266]]

relating to the research, and must be organized and presented in a way 
that does not merely provide lists of isolated facts, but rather 
facilitates the prospective subject's or legally authorized 
representative's understanding of the reasons why one might or might 
not want to participate.
    (6) No informed consent may include any exculpatory language 
through which the subject or the legally authorized representative is 
made to waive or appear to waive any of the subject's legal rights, or 
releases or appears to release the investigator, the sponsor, the 
institution, or its agents from liability for negligence.
    (b) Basic elements of informed consent. Except as provided in 
paragraph (d), (e), or (f) of this section, in seeking informed consent 
the following information shall be provided to each subject or the 
legally authorized representative:
    (1) A statement that the study involves research, an explanation of 
the purposes of the research and the expected duration of the subject's 
participation, a description of the procedures to be followed, and 
identification of any procedures that are experimental;
    (2) A description of any reasonably foreseeable risks or 
discomforts to the subject;
    (3) A description of any benefits to the subject or to others that 
may reasonably be expected from the research;
    (4) A disclosure of appropriate alternative procedures or courses 
of treatment, if any, that might be advantageous to the subject;
    (5) A statement describing the extent, if any, to which 
confidentiality of records identifying the subject will be maintained;
    (6) For research involving more than minimal risk, an explanation 
as to whether any compensation and an explanation as to whether any 
medical treatments are available if injury occurs and, if so, what they 
consist of, or where further information may be obtained;
    (7) An explanation of whom to contact for answers to pertinent 
questions about the research and research subjects' rights, and whom to 
contact in the event of a research-related injury to the subject;
    (8) A statement that participation is voluntary, refusal to 
participate will involve no penalty or loss of benefits to which the 
subject is otherwise entitled, and the subject may discontinue 
participation at any time without penalty or loss of benefits to which 
the subject is otherwise entitled; and
    (9) One of the following statements about any research that 
involves the collection of identifiable private information or 
identifiable biospecimens:
    (i) A statement that identifiers might be removed from the 
identifiable private information or identifiable biospecimens and that, 
after such removal, the information or biospecimens could be used for 
future research studies or distributed to another investigator for 
future research studies without additional informed consent from the 
subject or the legally authorized representative, if this might be a 
possibility; or
    (ii) A statement that the subject's information or biospecimens 
collected as part of the research, even if identifiers are removed, 
will not be used or distributed for future research studies.
    (c) Additional elements of informed consent. Except as provided in 
paragraph (d), (e), or (f) of this section, one or more of the 
following elements of information, when appropriate, shall also be 
provided to each subject or the legally authorized representative:
    (1) A statement that the particular treatment or procedure may 
involve risks to the subject (or to the embryo or fetus, if the subject 
is or may become pregnant) that are currently unforeseeable;
    (2) Anticipated circumstances under which the subject's 
participation may be terminated by the investigator without regard to 
the subject's or the legally authorized representative's consent;
    (3) Any additional costs to the subject that may result from 
participation in the research;
    (4) The consequences of a subject's decision to withdraw from the 
research and procedures for orderly termination of participation by the 
subject;
    (5) A statement that significant new findings developed during the 
course of the research that may relate to the subject's willingness to 
continue participation will be provided to the subject;
    (6) The approximate number of subjects involved in the study;
    (7) A statement that the subject's biospecimens (even if 
identifiers are removed) may be used for commercial profit and whether 
the subject will or will not share in this commercial profit;
    (8) A statement regarding whether clinically relevant research 
results, including individual research results, will be disclosed to 
subjects, and if so, under what conditions; and
    (9) For research involving biospecimens, whether the research will 
(if known) or might include whole genome sequencing (i.e., sequencing 
of a human germline or somatic specimen with the intent to generate the 
genome or exome sequence of that specimen).
    (d) Elements of broad consent for the storage, maintenance, and 
secondary research use of identifiable private information or 
identifiable biospecimens. Broad consent for the storage, maintenance, 
and secondary research use of identifiable private information or 
identifiable biospecimens (collected for either research studies other 
than the proposed research or nonresearch purposes) is permitted as an 
alternative to the informed consent requirements in paragraphs (b) and 
(c) of this section. If the subject or the legally authorized 
representative is asked to provide broad consent, the following shall 
be provided to each subject or the subject's legally authorized 
representative:
    (1) The information required in paragraphs (b)(2), (b)(3), (b)(5), 
and (b)(8) and, when appropriate, (c)(7) and (9) of this section;
    (2) A general description of the types of research that may be 
conducted with the identifiable private information or identifiable 
biospecimens. This description must include sufficient information such 
that a reasonable person would expect that the broad consent would 
permit the types of research conducted;
    (3) A description of the identifiable private information or 
identifiable biospecimens that might be used in research, whether 
sharing of identifiable private information or identifiable 
biospecimens might occur, and the types of institutions or researchers 
that might conduct research with the identifiable private information 
or identifiable biospecimens;
    (4) A description of the period of time that the identifiable 
private information or identifiable biospecimens may be stored and 
maintained (which period of time could be indefinite), and a 
description of the period of time that the identifiable private 
information or identifiable biospecimens may be used for research 
purposes (which period of time could be indefinite);
    (5) Unless the subject or legally authorized representative will be 
provided details about specific research studies, a statement that they 
will not be informed of the details of any specific research studies 
that might be conducted using the subject's identifiable private 
information or identifiable biospecimens, including the purposes of the 
research, and that they might have chosen not to consent to some of 
those specific research studies;
    (6) Unless it is known that clinically relevant research results, 
including individual research results, will be

[[Page 7267]]

disclosed to the subject in all circumstances, a statement that such 
results may not be disclosed to the subject; and
    (7) An explanation of whom to contact for answers to questions 
about the subject's rights and about storage and use of the subject's 
identifiable private information or identifiable biospecimens, and whom 
to contact in the event of a research-related harm.
    (e) Waiver or alteration of consent in research involving public 
benefit and service programs conducted by or subject to the approval of 
state or local officials--(1) Waiver. An IRB may waive the requirement 
to obtain informed consent for research under paragraphs (a) through 
(c) of this section, provided the IRB satisfies the requirements of 
paragraph (e)(3) of this section. If an individual was asked to provide 
broad consent for the storage, maintenance, and secondary research use 
of identifiable private information or identifiable biospecimens in 
accordance with the requirements at paragraph (d) of this section, and 
refused to consent, an IRB cannot waive consent for the storage, 
maintenance, or secondary research use of the identifiable private 
information or identifiable biospecimens.
    (2) Alteration. An IRB may approve a consent procedure that omits 
some, or alters some or all, of the elements of informed consent set 
forth in paragraphs (b) and (c) of this section provided the IRB 
satisfies the requirements of paragraph (e)(3) of this section. An IRB 
may not omit or alter any of the requirements described in paragraph 
(a) of this section. If a broad consent procedure is used, an IRB may 
not omit or alter any of the elements required under paragraph (d) of 
this section.
    (3) Requirements for waiver and alteration. In order for an IRB to 
waive or alter consent as described in this subsection, the IRB must 
find and document that:
    (i) The research or demonstration project is to be conducted by or 
subject to the approval of state or local government officials and is 
designed to study, evaluate, or otherwise examine:
    (A) Public benefit or service programs;
    (B) Procedures for obtaining benefits or services under those 
programs;
    (C) Possible changes in or alternatives to those programs or 
procedures; or
    (D) Possible changes in methods or levels of payment for benefits 
or services under those programs; and
    (ii) The research could not practicably be carried out without the 
waiver or alteration.
    (f) General waiver or alteration of consent--(1) Waiver. An IRB may 
waive the requirement to obtain informed consent for research under 
paragraphs (a) through (c) of this section, provided the IRB satisfies 
the requirements of paragraph (f)(3) of this section. If an individual 
was asked to provide broad consent for the storage, maintenance, and 
secondary research use of identifiable private information or 
identifiable biospecimens in accordance with the requirements at 
paragraph (d) of this section, and refused to consent, an IRB cannot 
waive consent for the storage, maintenance, or secondary research use 
of the identifiable private information or identifiable biospecimens.
    (2) Alteration. An IRB may approve a consent procedure that omits 
some, or alters some or all, of the elements of informed consent set 
forth in paragraphs (b) and (c) of this section provided the IRB 
satisfies the requirements of paragraph (f)(3) of this section. An IRB 
may not omit or alter any of the requirements described in paragraph 
(a) of this section. If a broad consent procedure is used, an IRB may 
not omit or alter any of the elements required under paragraph (d) of 
this section.
    (3) Requirements for waiver and alteration. In order for an IRB to 
waive or alter consent as described in this subsection, the IRB must 
find and document that:
    (i) The research involves no more than minimal risk to the 
subjects;
    (ii) The research could not practicably be carried out without the 
requested waiver or alteration;
    (iii) If the research involves using identifiable private 
information or identifiable biospecimens, the research could not 
practicably be carried out without using such information or 
biospecimens in an identifiable format;
    (iv) The waiver or alteration will not adversely affect the rights 
and welfare of the subjects; and
    (v) Whenever appropriate, the subjects or legally authorized 
representatives will be provided with additional pertinent information 
after participation.
    (g) Screening, recruiting, or determining eligibility. An IRB may 
approve a research proposal in which an investigator will obtain 
information or biospecimens for the purpose of screening, recruiting, 
or determining the eligibility of prospective subjects without the 
informed consent of the prospective subject or the subject's legally 
authorized representative, if either of the following conditions are 
met:
    (1) The investigator will obtain information through oral or 
written communication with the prospective subject or legally 
authorized representative, or
    (2) The investigator will obtain identifiable private information 
or identifiable biospecimens by accessing records or stored 
identifiable biospecimens.
    (h) Posting of clinical trial consent form. (1) For each clinical 
trial conducted or supported by a Federal department or agency, one 
IRB-approved informed consent form used to enroll subjects must be 
posted by the awardee or the Federal department or agency component 
conducting the trial on a publicly available Federal Web site that will 
be established as a repository for such informed consent forms.
    (2) If the Federal department or agency supporting or conducting 
the clinical trial determines that certain information should not be 
made publicly available on a Federal Web site (e.g. confidential 
commercial information), such Federal department or agency may permit 
or require redactions to the information posted.
    (3) The informed consent form must be posted on the Federal Web 
site after the clinical trial is closed to recruitment, and no later 
than 60 days after the last study visit by any subject, as required by 
the protocol.
    (i) Preemption. The informed consent requirements in this policy 
are not intended to preempt any applicable Federal, state, or local 
laws (including tribal laws passed by the official governing body of an 
American Indian or Alaska Native tribe) that require additional 
information to be disclosed in order for informed consent to be legally 
effective.
    (j) Emergency medical care. Nothing in this policy is intended to 
limit the authority of a physician to provide emergency medical care, 
to the extent the physician is permitted to do so under applicable 
Federal, state, or local law (including tribal law passed by the 
official governing body of an American Indian or Alaska Native tribe).

(Approved by the Office of Management and Budget under Control 
Number 0990-0260)

Sec.  __.117 Documentation of informed consent.

    (a) Except as provided in paragraph (c) of this section, informed 
consent shall be documented by the use of a written informed consent 
form approved by the IRB and signed (including in an electronic format) 
by the subject or the subject's legally authorized representative. A 
written copy shall be given to the person signing the informed consent 
form.

[[Page 7268]]

    (b) Except as provided in paragraph (c) of this section, the 
informed consent form may be either of the following:
    (1) A written informed consent form that meets the requirements of 
Sec.  __.116. The investigator shall give either the subject or the 
subject's legally authorized representative adequate opportunity to 
read the informed consent form before it is signed; alternatively, this 
form may be read to the subject or the subject's legally authorized 
representative.
    (2) A short form written informed consent form stating that the 
elements of informed consent required by Sec.  __.116 have been 
presented orally to the subject or the subject's legally authorized 
representative, and that the key information required by Sec.  
__.116(a)(5)(i) was presented first to the subject, before other 
information, if any, was provided. The IRB shall approve a written 
summary of what is to be said to the subject or the legally authorized 
representative. When this method is used, there shall be a witness to 
the oral presentation. Only the short form itself is to be signed by 
the subject or the subject's legally authorized representative. 
However, the witness shall sign both the short form and a copy of the 
summary, and the person actually obtaining consent shall sign a copy of 
the summary. A copy of the summary shall be given to the subject or the 
subject's legally authorized representative, in addition to a copy of 
the short form.
    (c)(1) An IRB may waive the requirement for the investigator to 
obtain a signed informed consent form for some or all subjects if it 
finds any of the following:
    (i) That the only record linking the subject and the research would 
be the informed consent form and the principal risk would be potential 
harm resulting from a breach of confidentiality. Each subject (or 
legally authorized representative) will be asked whether the subject 
wants documentation linking the subject with the research, and the 
subject's wishes will govern;
    (ii) That the research presents no more than minimal risk of harm 
to subjects and involves no procedures for which written consent is 
normally required outside of the research context; or
    (iii) If the subjects or legally authorized representatives are 
members of a distinct cultural group or community in which signing 
forms is not the norm, that the research presents no more than minimal 
risk of harm to subjects and provided there is an appropriate 
alternative mechanism for documenting that informed consent was 
obtained.
    (2) In cases in which the documentation requirement is waived, the 
IRB may require the investigator to provide subjects or legally 
authorized representatives with a written statement regarding the 
research.

(Approved by the Office of Management and Budget under Control 
Number 0990-0260)

Sec.  __.118 Applications and proposals lacking definite plans for 
involvement of human subjects.

    Certain types of applications for grants, cooperative agreements, 
or contracts are submitted to Federal departments or agencies with the 
knowledge that subjects may be involved within the period of support, 
but definite plans would not normally be set forth in the application 
or proposal. These include activities such as institutional type grants 
when selection of specific projects is the institution's 
responsibility; research training grants in which the activities 
involving subjects remain to be selected; and projects in which human 
subjects' involvement will depend upon completion of instruments, prior 
animal studies, or purification of compounds. Except for research 
waived under Sec.  __.101(i) or exempted under Sec.  __.104, no human 
subjects may be involved in any project supported by these awards until 
the project has been reviewed and approved by the IRB, as provided in 
this policy, and certification submitted, by the institution, to the 
Federal department or agency component supporting the research.

Sec.  __.119 Research undertaken without the intention of involving 
human subjects.

    Except for research waived under Sec.  __.101(i) or exempted under 
Sec.  __.104, in the event research is undertaken without the intention 
of involving human subjects, but it is later proposed to involve human 
subjects in the research, the research shall first be reviewed and 
approved by an IRB, as provided in this policy, a certification 
submitted by the institution to the Federal department or agency 
component supporting the research, and final approval given to the 
proposed change by the Federal department or agency component.

Sec.  __.120 Evaluation and disposition of applications and proposals 
for research to be conducted or supported by a Federal department or 
agency.

    (a) The department or agency head will evaluate all applications 
and proposals involving human subjects submitted to the Federal 
department or agency through such officers and employees of the Federal 
department or agency and such experts and consultants as the department 
or agency head determines to be appropriate. This evaluation will take 
into consideration the risks to the subjects, the adequacy of 
protection against these risks, the potential benefits of the research 
to the subjects and others, and the importance of the knowledge gained 
or to be gained.
    (b) On the basis of this evaluation, the department or agency head 
may approve or disapprove the application or proposal, or enter into 
negotiations to develop an approvable one.

Sec.  __.121 [Reserved]

Sec.  __.122 Use of Federal funds.

    Federal funds administered by a Federal department or agency may 
not be expended for research involving human subjects unless the 
requirements of this policy have been satisfied.

Sec.  __.123 Early termination of research support: Evaluation of 
applications and proposals.

    (a) The department or agency head may require that Federal 
department or agency support for any project be terminated or suspended 
in the manner prescribed in applicable program requirements, when the 
department or agency head finds an institution has materially failed to 
comply with the terms of this policy.
    (b) In making decisions about supporting or approving applications 
or proposals covered by this policy the department or agency head may 
take into account, in addition to all other eligibility requirements 
and program criteria, factors such as whether the applicant has been 
subject to a termination or suspension under paragraph (a) of this 
section and whether the applicant or the person or persons who would 
direct or has/have directed the scientific and technical aspects of an 
activity has/have, in the judgment of the department or agency head, 
materially failed to discharge responsibility for the protection of the 
rights and welfare of human subjects (whether or not the research was 
subject to federal regulation).

Sec.  __.124 Conditions.

    With respect to any research project or any class of research 
projects the department or agency head of either the conducting or the 
supporting Federal department or agency may impose additional 
conditions prior to or at the time of approval when in the judgment of 
the department or agency head

[[Page 7269]]

additional conditions are necessary for the protection of human 
subjects.

Adoption of the Common Rules

    The adoption of the common rules by the participating agencies, as 
modified by agency-specific text, is set forth below.

DEPARTMENT OF HOMELAND SECURITY

List of Subjects in 6 CFR Part 46

    Human research subjects, Reporting and record-keeping requirements, 
Research.

0
For the reasons stated in the preamble, the Department of Homeland 
Security adds 6 CFR part 46 as set forth at the end of the common 
preamble of this document.

PART 46--PROTECTION OF HUMAN SUBJECTS

Sec.
46.101 To what does this policy apply?
46.102 Definitions for purposes of this policy.
46.103 Assuring compliance with this policy--research conducted or 
supported by any Federal department or agency.
46.104 Exempt research.
46.105 [Reserved]
46.106 [Reserved]
46.107 IRB membership.
46.108 IRB functions and operations.
46.109 IRB review of research.
46.110 Expedited review procedures for certain kinds of research 
involving no more than minimal risk, and for minor changes in 
approved research.
46.111 Criteria for IRB approval of research.
46.112 Review by institution.
46.113 Suspension or termination of IRB approval of research.
46.114 Cooperative research.
46.115 IRB records.
46.116 General requirements for informed consent.
46.117 Documentation of informed consent.
46.118 Applications and proposals lacking definite plans for 
involvement of human subjects.
46.119 Research undertaken without the intention of involving human 
subjects.
46.120 Evaluation and disposition of applications and proposals for 
research to be conducted or supported by a Federal department or 
agency.
46.121 [Reserved]
46.122 Use of Federal funds.
46.123 Early termination of research support: Evaluation of 
applications and proposals.
46.124 Conditions.

    Authority:  5 U.S.C. 301; Pub. L. 107-296, sec. 102, 306(c); 
Pub. L. 108-458, sec. 8306.

Reginald Brothers,
Under Secretary for Science and Technology, DHS.

DEPARTMENT OF AGRICULTURE

List of Subjects in 7 CFR Part 1c

    Human research subjects, Reporting and record-keeping requirements, 
Research.

0
For the reasons stated in the preamble, the Department of Agriculture 
revises 7 CFR part 1c as set forth at the end of the common preamble of 
this document.

PART 1c--PROTECTION OF HUMAN SUBJECTS

Sec.
1c.101 To what does this policy apply?
1c.102 Definitions for purposes of this policy.
1c.103 Assuring compliance with this policy--research conducted or 
supported by any Federal department or agency.
1c.104 Exempt research.
1c.105 [Reserved]
1c.106 [Reserved]
1c.107 IRB membership.
1c.108 IRB functions and operations.
1c.109 IRB review of research.
1c.110 Expedited review procedures for certain kinds of research 
involving no more than minimal risk, and for minor changes in 
approved research.
1c.111 Criteria for IRB approval of research.
1c.112 Review by institution.
1c.113 Suspension or termination of IRB approval of research.
1c.114 Cooperative research.
1c.115 IRB records.
1c.116 General requirements for informed consent.
1c.117 Documentation of informed consent.
1c.118 Applications and proposals lacking definite plans for 
involvement of human subjects.
1c.119 Research undertaken without the intention of involving human 
subjects.
1c.120 Evaluation and disposition of applications and proposals for 
research to be conducted or supported by a Federal department or 
agency.
1c.121 [Reserved]
1c.122 Use of Federal funds.
1c.123 Early termination of research support: Evaluation of 
applications and proposals.
1c.124 Conditions.

    Authority:  5 U.S.C. 301; 42 U.S.C. 300v-1(b).

Ann M. Bartuska,
Acting Under Secretary for Research, Education, and Economics, USDA.

DEPARTMENT OF ENERGY

List of Subjects in 10 CFR Part 745

10 CFR Part 745

    Human research subjects, Reporting and record-keeping requirements, 
Research.
0
For the reasons stated in the preamble, the Department of Energy 
revises 10 CFR part 745 as set forth at the end of the common preamble 
of this document.

PART 745--PROTECTION OF HUMAN SUBJECTS

Sec.
745.101 To what does this policy apply?
745.102 Definitions for purposes of this policy.
745.103 Assuring compliance with this policy--research conducted or 
supported by any Federal department or agency.
745.104 Exempt research.
745.105 [Reserved]
745.106 [Reserved]
745.107 IRB membership.
745.108 IRB functions and operations.
745.109 IRB review of research.
745.110 Expedited review procedures for certain kinds of research 
involving no more than minimal risk, and for minor changes in 
approved research.
745.111 Criteria for IRB approval of research.
745.112 Review by institution.
745.113 Suspension or termination of IRB approval of research.
745.114 Cooperative research.
745.115 IRB records.
745.116 General requirements for informed consent.
745.117 Documentation of informed consent.
745.118 Applications and proposals lacking definite plans for 
involvement of human subjects.
745.119 Research undertaken without the intention of involving human 
subjects.
745.120 Evaluation and disposition of applications and proposals for 
research to be conducted or supported by a Federal department or 
agency.
745.121 [Reserved]
745.122 Use of Federal funds.
745.123 Early termination of research support: Evaluation of 
applications and proposals.
745.124 Conditions.


[[Page 7270]]


    Authority: 5 U.S.C. 301; 42 U.S.C. 7254; 42 U.S.C. 300v-1(b).

Elizabeth Sherwood-Randall,
Deputy Secretary of Energy.

NATIONAL AERONAUTICS AND SPACE ADMINISTRATION

List of Subjects in 14 CFR Part 1230

14 CFR Part 1230

    Human research subjects, Reporting and record-keeping requirements, 
Research.
0
For the reasons stated in the preamble, the National Aeronautics and 
Space Administration revises 14 CFR part 1230 as set forth at the end 
of the common preamble of this document.

PART 1230--PROTECTION OF HUMAN SUBJECTS

Sec.
1230.101 To what does this policy apply?
1230.102 Definitions for purposes of this policy.
1230.103 Assuring compliance with this policy--research conducted or 
supported by any Federal department or agency.
1230.104 Exempt research.
1230.105 [Reserved]
1230.106 [Reserved]
1230.107 IRB membership.
1230.108 IRB functions and operations.
1230.109 IRB review of research.
1230.110 Expedited review procedures for certain kinds of research 
involving no more than minimal risk, and for minor changes in 
approved research.
1230.111 Criteria for IRB approval of research.
1230.112 Review by institution.
1230.113 Suspension or termination of IRB approval of research.
1230.114 Cooperative research.
1230.115 IRB records.
1230.116 General requirements for informed consent.
1230.117 Documentation of informed consent.
1230.118 Applications and proposals lacking definite plans for 
involvement of human subjects.
1230.119 Research undertaken without the intention of involving 
human subjects.
1230.120 Evaluation and disposition of applications and proposals 
for research to be conducted or supported by a Federal department or 
agency.
1230.121 [Reserved]
1230.122 Use of Federal funds.
1230.123 Early termination of research support: Evaluation of 
applications and proposals.
1230.124 Conditions.

    Authority: 5 U.S.C. 301;42 U.S.C. 300v-1(b).

James D. Polk,
Chief Health and Medical Officer, NASA.

DEPARTMENT OF COMMERCE

List of Subjects in 15 CFR Part 27

15 CFR Part 27

    Human research subjects, Reporting and record-keeping requirements, 
Research.

0
For the reasons stated in the preamble, the Department of Commerce 
revises 15 CFR part 27 as set forth at the end of the common preamble 
of this document.

PART 27--PROTECTION OF HUMAN SUBJECTS

Sec.
27.101 To what does this policy apply?
27.102 Definitions for purposes of this policy.
27.103 Assuring compliance with this policy--research conducted or 
supported by any Federal department or agency.
27.104 Exempt research.
27.105 [Reserved]
27.106 [Reserved]
27.107 IRB membership.
27.108 IRB functions and operations.
27.109 IRB review of research.
27.110 Expedited review procedures for certain kinds of research 
involving no more than minimal risk, and for minor changes in 
approved research.
27.111 Criteria for IRB approval of research.
27.112 Review by institution.
27.113 Suspension or termination of IRB approval of research.
27.114 Cooperative research.
27.115 IRB records.
27.116 General requirements for informed consent.
27.117 Documentation of informed consent.
27.118 Applications and proposals lacking definite plans for 
involvement of human subjects.
27.119 Research undertaken without the intention of involving human 
subjects.
27.120 Evaluation and disposition of applications and proposals for 
research to be conducted or supported by a Federal department or 
agency.
27.121 [Reserved]
27.122 Use of Federal funds.
27.123 Early termination of research support: Evaluation of 
applications and proposals.
27.124 Conditions.

    Authority: 5 U.S.C. 301; 42 U.S.C. 300v-1(b).

James Hock,
Chief of Staff, Department of Commerce.

SOCIAL SECURITY ADMINISTRATION

List of Subjects in 20 CFR Part 431

20 CFR Part 431

    Human research subjects, Reporting and record-keeping requirements, 
Research.
0
For the reasons stated in the preamble, the Social Security 
Administration adds 20 CFR part 431 as set forth at the end of the 
common preamble of this document.

PART 431--PROTECTION OF HUMAN SUBJECTS

Sec.
431.101 To what does this policy apply?
431.102 Definitions for purposes of this policy.
431.103 Assuring compliance with this policy--research conducted or 
supported by any Federal department or agency.
431.104 Exempt research.
431.105 [Reserved]
431.106 [Reserved]
431.107 IRB membership.
431.108 IRB functions and operations.
431.109 IRB review of research.
431.110 Expedited review procedures for certain kinds of research 
involving no more than minimal risk, and for minor changes in 
approved research.
431.111 Criteria for IRB approval of research.
431.112 Review by institution.
431.113 Suspension or termination of IRB approval of research.
431.114 Cooperative research.
431.115 IRB records.
431.116 General requirements for informed consent.
431.117 Documentation of informed consent.
431.118 Applications and proposals lacking definite plans for 
involvement of human subjects.
431.119 Research undertaken without the intention of involving human 
subjects.
431.120 Evaluation and disposition of applications and proposals for 
research to be conducted or supported by a Federal department or 
agency.
431.121 [Reserved]
431.122 Use of Federal funds.
431.123 Early termination of research support: Evaluation of 
applications and proposals.
431.124 Conditions.


[[Page 7271]]


    Authority: 5 U.S.C. 301; 42 U.S.C. 289(a).

Carolyn W. Colvin,
Acting Commissioner of Social Security.

AGENCY FOR INTERNATIONAL DEVELOPMENT

List of Subjects in 22 CFR Part 225

22 CFR Part 225

    Human research subjects, Reporting and record-keeping requirements, 
Research.

0
For the reasons stated in the preamble, the Agency for International 
Development revises 22 CFR part 225 as set forth at the end of the 
common preamble of this document.

PART 225--PROTECTION OF HUMAN SUBJECTS

Sec.
225.101 To what does this policy apply?
225.102 Definitions for purposes of this policy.
225.103 Assuring compliance with this policy--research conducted or 
supported by any Federal department or agency.
225.104 Exempt research.
225.105 [Reserved]
225.106 [Reserved]
225.107 IRB membership.
225.108 IRB functions and operations.
225.109 IRB review of research.
225.110 Expedited review procedures for certain kinds of research 
involving no more than minimal risk, and for minor changes in 
approved research.
225.111 Criteria for IRB approval of research.
225.112 Review by institution.
225.113 Suspension or termination of IRB approval of research.
225.114 Cooperative research.
225.115 IRB records.
225.116 General requirements for informed consent.
225.117 Documentation of informed consent.
225.118 Applications and proposals lacking definite plans for 
involvement of human subjects.
225.119 Research undertaken without the intention of involving human 
subjects.
225.120 Evaluation and disposition of applications and proposals for 
research to be conducted or supported by a Federal department or 
agency.
225.121 [Reserved]
225.122 Use of Federal funds.
225.123 Early termination of research support: Evaluation of 
applications and proposals.
225.124 Conditions.

    Authority: 5 U.S.C. 301; 42 U.S.C. 300v-1(b), unless otherwise 
noted.

Irene Koek,
Acting Deputy Assistant Administrator for Global Health, U.S. Agency 
for International Development.

DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT

List of Subjects in 24 CFR Part 60

24 CFR Part 60

    Human research subjects, Reporting and record-keeping requirements, 
Research.

0
For the reasons stated in the preamble, the Department of Housing and 
Urban Development revises 24 CFR part 60 as set forth at the end of the 
common preamble of this document.

PART 60--PROTECTION OF HUMAN SUBJECTS

Sec.
60.101 To what does this policy apply?
60.102 Definitions for purposes of this policy.
60.103 Assuring compliance with this policy--research conducted or 
supported by any Federal department or agency.
60.104 Exempt research.
60.105 [Reserved]
60.106 [Reserved]
60.107 IRB membership.
60.108 IRB functions and operations.
60.109 IRB review of research.
60.110 Expedited review procedures for certain kinds of research 
involving no more than minimal risk, and for minor changes in 
approved research.
60.111 Criteria for IRB approval of research.
60.112 Review by institution.
60.113 Suspension or termination of IRB approval of research.
60.114 Cooperative research.
60.115 IRB records.
60.116 General requirements for informed consent.
60.117 Documentation of informed consent.
60.118 Applications and proposals lacking definite plans for 
involvement of human subjects.
60.119 Research undertaken without the intention of involving human 
subjects.
60.120 Evaluation and disposition of applications and proposals for 
research to be conducted or supported by a Federal department or 
agency.
60.121 [Reserved]
60.122 Use of Federal funds.
60.123 Early termination of research support: Evaluation of 
applications and proposals.
60.124 Conditions.

    Authority:  5 U.S.C. 301; 42 U.S.C. 300v-1(b) and 3535(d).

Katherine M. O'Regan,
Assistant Secretary for Policy Development and Research, Department of 
Housing and Urban Development.

DEPARTMENT OF LABOR

List of Subjects in 29 CFR Part 21

29 CFR Part 21

    Human research subjects, Reporting and record-keeping requirements, 
Research.
0
For the reasons stated in the preamble, the Department of Labor adds 29 
CFR part 21 as set forth at the end of the common preamble of this 
document.

PART 21--PROTECTION OF HUMAN SUBJECTS

Sec.
21.101 To what does this policy apply?
21.102 Definitions for purposes of this policy.
21.103 Assuring compliance with this policy--research conducted or 
supported by any Federal department or agency.
21.104 Exempt research.
21.105 [Reserved]
21.106 [Reserved]
21.107 IRB membership.
21.108 IRB functions and operations.
21.109 IRB review of research.
21.110 Expedited review procedures for certain kinds of research 
involving no more than minimal risk, and for minor changes in 
approved research.
21.111 Criteria for IRB approval of research.
21.112 Review by institution.
21.113 Suspension or termination of IRB approval of research.
21.114 Cooperative research.
21.115 IRB records.
21.116 General requirements for informed consent.
21.117 Documentation of informed consent.
21.118 Applications and proposals lacking definite plans for 
involvement of human subjects.
21.119 Research undertaken without the intention of involving human 
subjects.
21.120 Evaluation and disposition of applications and proposals for 
research to be conducted or supported by a Federal department or 
agency.
21.121 [Reserved]
21.122 Use of Federal funds.
21.123 Early termination of research support: Evaluation of 
applications and proposals.
21.124 Conditions.


[[Page 7272]]


    Authority: 5 U.S.C. 301; 29 U.S.C. 551.

Christopher P. Lu,
Deputy Secretary of Labor.

DEPARTMENT OF DEFENSE

List of Subjects in 32 CFR Part 219

32 CFR Part 219

    Human research subjects, Reporting and record-keeping requirements, 
Research.

0
For the reasons stated in the preamble, the Department of Defense 
revises 32 CFR part 219 as set forth at the end of the common preamble 
of this document.

PART 219--PROTECTION OF HUMAN SUBJECTS

Sec.
219.101 To what does this policy apply?
219.102 Definitions for purposes of this policy.
219.103 Assuring compliance with this policy--research conducted or 
supported by any Federal department or agency.
219.104 Exempt research.
219.105 [Reserved]
219.106 [Reserved]
219.107 IRB membership.
219.108 IRB functions and operations.
219.109 IRB review of research.
219.110 Expedited review procedures for certain kinds of research 
involving no more than minimal risk, and for minor changes in 
approved research.
219.111 Criteria for IRB approval of research.
219.112 Review by institution.
219.113 Suspension or termination of IRB approval of research.
219.114 Cooperative research.
219.115 IRB records.
219.116 General requirements for informed consent.
219.117 Documentation of informed consent.
219.118 Applications and proposals lacking definite plans for 
involvement of human subjects.
219.119 Research undertaken without the intention of involving human 
subjects.
219.120 Evaluation and disposition of applications and proposals for 
research to be conducted or supported by a Federal department or 
agency.
219.121 [Reserved]
219.122 Use of Federal funds.
219.123 Early termination of research support: Evaluation of 
applications and proposals.
219.124 Conditions.

    Authority: 5 U.S.C. 301; 42 U.S.C. 300v-1(b).

Stephen P. Welby,
Assistant Secretary of Defense (Research and Engineering).

DEPARTMENT OF EDUCATION

List of Subjects in 34 CFR Part 97

    Human research subjects, Reporting and record-keeping requirements, 
Research.
0
For the reasons stated in the preamble, the Department of Education 
amends 34 CFR part 97 as follows:

PART 97--PROTECTION OF HUMAN SUBJECTS

0
1. The authority citation for part 97 continues to read as follows:

    Authority: 5 U.S.C. 301; 20 U.S.C. 1221e-3, 3474; 42 U.S.C. 
300v-1(b).


0
2. Subpart A is revised as set forth at the end of the common preamble 
of this document.

Subpart A--Federal Policy for the Protection of Human Subjects 
(Basic ED Policy for Protection of Human Research Subjects)

Sec.
97.101 To what does this policy apply?
97.102 Definitions for purposes of this policy.
97.103 Assuring compliance with this policy--research conducted or 
supported by any Federal department or agency.
97.104 Exempt research.
97.105 [Reserved]
97.106 [Reserved]
97.107 IRB membership.
97.108 IRB functions and operations.
97.109 IRB review of research.
97.110 Expedited review procedures for certain kinds of research 
involving no more than minimal risk, and for minor changes in 
approved research.
97.111 Criteria for IRB approval of research.
97.112 Review by institution.
97.113 Suspension or termination of IRB approval of research.
97.114 Cooperative research.
97.115 IRB records.
97.116 General requirements for informed consent.
97.117 Documentation of informed consent.
97.118 Applications and proposals lacking definite plans for 
involvement of human subjects.
97.119 Research undertaken without the intention of involving human 
subjects.
97.120 Evaluation and disposition of applications and proposals for 
research to be conducted or supported by a Federal department or 
agency.
97.121 [Reserved]
97.122 Use of Federal funds.
97.123 Early termination of research support: Evaluation of 
applications and proposals.
97.124 Conditions.

John B. King Jr.,
Secretary of Education.

DEPARTMENT OF VETERANS AFFAIRS

List of Subjects in 38 CFR Part 16

38 CFR Part 16

    Human research subjects, Reporting and record-keeping requirements, 
Research.
0
For the reasons stated in the preamble, the Department of Veterans 
Affairs revises 38 CFR part 16 as set forth at the end of the common 
preamble of this document.

PART 16--PROTECTION OF HUMAN SUBJECTS

Sec.
16.101 To what does this policy apply?
16.102 Definitions for purposes of this policy.
16.103 Assuring compliance with this policy--research conducted or 
supported by any Federal department or agency.
16.104 Exempt research.
16.105 [Reserved]
16.106 [Reserved]
16.107 IRB membership.
16.108 IRB functions and operations.
16.109 IRB review of research.
16.110 Expedited review procedures for certain kinds of research 
involving no more than minimal risk, and for minor changes in 
approved research.
16.111 Criteria for IRB approval of research.
16.112 Review by institution.
16.113 Suspension or termination of IRB approval of research.
16.114 Cooperative research.
16.115 IRB records.
16.116 General requirements for informed consent.
16.117 Documentation of informed consent.
16.118 Applications and proposals lacking definite plans for 
involvement of human subjects.
16.119 Research undertaken without the intention of involving human 
subjects.
16.120 Evaluation and disposition of applications and proposals for 
research to be conducted or supported by a Federal department or 
agency.
16.121 [Reserved]
16.122 Use of Federal funds.
16.123 Early termination of research support: Evaluation of 
applications and proposals.
16.124 Conditions.


[[Page 7273]]


    Authority: 5 U.S.C. 301; 38 U.S.C. 501, 7331, 7334; 42 U.S.C. 
300v-1(b).

Gina S. Farrisee,
Deputy Chief of Staff, U.S. Department of Veterans Affairs.

ENVIRONMENTAL PROTECTION AGENCY

List of Subjects in 40 CFR Part 26

40 CFR Part 26

    Human research subjects, Reporting and record-keeping requirements, 
Research.
0
For the reasons stated in the preamble, the Environmental Protection 
Agency amends 40 CFR part 26 as follows:

 PART 26--PROTECTION OF HUMAN SUBJECTS

0
1. The authority citation for part 26 continues to read as follows:

    Authority: 5 U.S.C. 301; 7 U.S.C. 136a(a) and 136w(a)(1); 21 
U.S.C. 346a(e)(1)(C); sec. 201, Pub. L. 109-54, 119 Stat. 531; and 
42 U.S.C. 300v-1(b).


0
2. Subpart A is revised as set forth at the end of the common preamble 
of this document.

Subpart A--Basic EPA Policy for Protection of Subjects in Human 
Research Conducted or Supported by EPA

Sec.
26.101 To what does this policy apply?
26.102 Definitions for purposes of this policy.
26.103 Assuring compliance with this policy--research conducted or 
supported by any Federal department or agency.
26.104 Exempt research.
26.105 [Reserved]
26.106 [Reserved]
26.107 IRB membership.
26.108 IRB functions and operations.
26.109 IRB review of research.
26.110 Expedited review procedures for certain kinds of research 
involving no more than minimal risk, and for minor changes in 
approved research.
26.111 Criteria for IRB approval of research.
26.112 Review by institution.
26.113 Suspension or termination of IRB approval of research.
26.114 Cooperative research.
26.115 IRB records.
26.116 General requirements for informed consent.
26.117 Documentation of informed consent.
26.118 Applications and proposals lacking definite plans for 
involvement of human subjects.
26.119 Research undertaken without the intention of involving human 
subjects.
26.120 Evaluation and disposition of applications and proposals for 
research to be conducted or supported by a Federal department or 
agency.
26.121 [Reserved]
26.122 Use of Federal funds.
26.123 Early termination of research support: Evaluation of 
applications and proposals.
26.124 Conditions.

A. Stanley Meiburg,
Acting Deputy Administrator, Environmental Protection Agency.

DEPARTMENT OF HEALTH AND HUMAN SERVICES

List of Subjects in 45 CFR Part 46

45 CFR Part 46

    Human research subjects, Reporting and record-keeping requirements, 
Research.

0
For the reasons stated in the preamble, the Department of Health and 
Human Services amends 45 CFR part 46 as follows:

PART 46--PROTECTION OF HUMAN SUBJECTS

0
1. The authority citation for part 46 is revised to read as follows:

    Authority:  5 U.S.C. 301; 42 U.S.C. 289(a); 42 U.S.C. 300v-1(b).


0
2. Subpart A is revised as set forth at the end of the common preamble 
of this document.

Subpart A--Basic HHS Policy for Protection of Human Research 
Subjects

Sec.
46.101 To what does this policy apply?
46.102 Definitions for purposes of this policy.
46.103 Assuring compliance with this policy--research conducted or 
supported by any Federal department or agency.
46.104 Exempt research.
46.105 [Reserved]
46.106 [Reserved]
46.107 IRB membership.
46.108 IRB functions and operations.
46.109 IRB review of research.
46.110 Expedited review procedures for certain kinds of research 
involving no more than minimal risk, and for minor changes in 
approved research.
46.111 Criteria for IRB approval of research.
46.112 Review by institution.
46.113 Suspension or termination of IRB approval of research.
46.114 Cooperative research.
46.115 IRB records.
46.116 General requirements for informed consent.
46.117 Documentation of informed consent.
46.118 Applications and proposals lacking definite plans for 
involvement of human subjects.
46.119 Research undertaken without the intention of involving human 
subjects.
46.120 Evaluation and disposition of applications and proposals for 
research to be conducted or supported by a Federal department or 
agency.
46.121 [Reserved]
46.122 Use of Federal funds.
46.123 Early termination of research support: Evaluation of 
applications and proposals.
46.124 Conditions.

Sylvia M. Burwell,
Secretary, HHS.

NATIONAL SCIENCE FOUNDATION

List of Subjects in 45 CFR Part 690

45 CFR Part 690

    Human research subjects, Reporting and record-keeping requirements, 
Research.
0
For the reasons stated in the preamble, the National Science Foundation 
revises 45 CFR part 690 as set forth at the end of the common preamble 
of this document.

PART 690--PROTECTION OF HUMAN SUBJECTS

Sec.
690.101 To what does this policy apply?
690.102 Definitions for purposes of this policy.
690.103 Assuring compliance with this policy--research conducted or 
supported by any Federal department or agency.
690.104 Exempt research.
690.105 [Reserved]
690.106 [Reserved]
690.107 IRB membership.
690.108 IRB functions and operations.
690.109 IRB review of research.
690.110 Expedited review procedures for certain kinds of research 
involving no more than minimal risk, and for minor changes in 
approved research.
690.111 Criteria for IRB approval of research.
690.112 Review by institution.
690.113 Suspension or termination of IRB approval of research.
690.114 Cooperative research.
690.115 IRB records.
690.116 General requirements for informed consent.
690.117 Documentation of informed consent.
690.118 Applications and proposals lacking definite plans for 
involvement of human subjects.
690.119 Research undertaken without the intention of involving human 
subjects.
690.120 Evaluation and disposition of applications and proposals for 
research to be conducted or supported by a Federal department or 
agency.
690.121 [Reserved]
690.122 Use of Federal funds.
690.123 Early termination of research support: Evaluation of 
applications and proposals.
690.124 Conditions.


[[Page 7274]]


    Authority: 5 U.S.C. 301; 42 U.S.C. 300v-1(b).

Lawrence Rudolph,
General Counsel, National Science Foundation.

DEPARTMENT OF TRANSPORTATION

List of Subjects in 49 CFR Part 11

49 CFR Part 11

    Human research subjects, Reporting and record-keeping requirements, 
Research.

0
For the reasons stated in the preamble, the Department of 
Transportation revises 49 CFR part 11 as set forth at the end of the 
common preamble of this document.

PART 11--PROTECTION OF HUMAN SUBJECTS

Sec.
11.101 To what does this policy apply?
11.102 Definitions for purposes of this policy.
11.103 Assuring compliance with this policy--research conducted or 
supported by any Federal department or agency.
11.104 Exempt research.
11.105 [Reserved]
11.106 [Reserved]
11.107 IRB membership.
11.108 IRB functions and operations.
11.109 IRB review of research.
11.110 Expedited review procedures for certain kinds of research 
involving no more than minimal risk, and for minor changes in 
approved research.
11.111 Criteria for IRB approval of research.
11.112 Review by institution.
11.113 Suspension or termination of IRB approval of research.
11.114 Cooperative research.
11.115 IRB records.
11.116 General requirements for informed consent.
11.117 Documentation of informed consent.
11.118 Applications and proposals lacking definite plans for 
involvement of human subjects.
11.119 Research undertaken without the intention of involving human 
subjects.
11.120 Evaluation and disposition of applications and proposals for 
research to be conducted or supported by a Federal department or 
agency.
11.121 [Reserved]
11.122 Use of Federal funds.
11.123 Early termination of research support: Evaluation of 
applications and proposals.
11.124 Conditions.

    Authority:  5 U.S.C. 301; 42 U.S.C. 300v-1(b).

Anthony R. Foxx,
Secretary of Transportation.
[FR Doc. 2017-01058 Filed 1-18-17; 8:45 am]
 BILLING CODE 4150-36-P


