What Could Proposed Changes to the Common Rule Mean to Sites, Sponsors
For the first time in over 20 years, the U.S. Department of Health and Human Services (HHS) has proposed changes to the Common Rule which could result in a major overhaul of regulatory requirements for human research. While the field of clinical research has changed dramatically, no major changes have been made or proposed to the Common Rule since it came into effect in 1981 and subsequently published in the 1991 revision of HHS's Title 45 CFR 46 (Public Welfare) Subparts A, B, C, and D1. The Department of Health and Human Services took action on July 26, 2011 and announced a notice of proposed rulemaking (ANPRM). There were a few rounds of requests for comments on the proposed ANPRM, and final comments were due October 26, 2011. No action has been taken to date.
The current human research ethical framework and regulatory principles have its roots in the creation of the Belmont Report in the 1970s.2 The Belmont Report was written by the National Commission for the Protection of Human Subjects of Biomedical & Behavioral Research which was a public, national body tasked with studying the ethical principles underlying biomedical and behavioral research on human subjects. The Belmont Report is easily the single most influential document regarding the current U.S. system of protection for human research subjects. The report serves as a guideline for the basic ethical principles regarding research involving human subjects.
It was not until 1991 that the Common Rule was published and "codified in separate regulations by 15 Federal departments and agencies.” 3 The Common Rule spans multiple federal agencies and is also known as the Federal Policy for the Protection of Human Subjects. HHS took a potentially bold action on July 26, 2011 and announced the ANPRM for revisions to the Common Rule that suggests major regulatory research changes the industry has not seen in decades. This Whitepaper serves to summarize these proposed changes and discuss the potential implications for all parties involved in human research.
The ANPRM proposal addressed seven areas of the Common Rule:4
- Refinement of the existing risk-based regulatory framework
- Utilization of a single Institutional Review Board (IRB) review of record for domestic sites of multi-site studies
- Improvement of consent forms and the consent process
- Establishment of mandatory data security and information protection standards for all studies that involve identifiable or potentially identifiable data.
- Establishment of an improved, more systematic approach for the collection and analysis of data on unanticipated problems and adverse events
- Extension of federal regulatory protections to all research, regardless of funding source, conducted at institutions in the U.S. that receive some federal funding from a Common Rule agency for research with human subjects.
- Improvement in the harmonization of regulations and related agency guidance
HHS publicly stated two predominant goals herein the proposed changes. These goals are to ensure and enhance the protection of research subjects and find areas to improve efficiency within the research process. The proposed changes attempt to keep human research grounded in a risk-based approach, which is appropriate and not new.
HHS analyzed the existing rules and the changes being considered. The table below serves as a comparison for the changes being considered and their respective rationale.5
Comparison of Existing Rules with Some Changes Being Considered
| Current Rule | Changes Being Considered | Rationale for Change |
| Issue 1: There are no specific data security protections for IRB-reviewed research: regulations require IRBs to determine, for each study, “when appropriate [that] there are adequate provisions to protect the privacy of subjects and to maintain the confidentiality of data.” | Specified data security protections would apply to such research, calibrated to the level of identifiability of the information being collected. | IRBs were not designed to evaluate risks to privacy and confidentiality, and often have little expertise in these matters. Setting uniform specific standards will help to assure appropriate privacy and confidentiality protections to all subjects, without administrative burden of needing a specific committee review of each study |
| Issue 2: Research using existing biospecimens (clinical or from prior research) can be done without consent by stripping the specimens of identifiers. | Reforms would require written consent for research use of biospecimens, even those that have been stripped of identifiers. Consent could be obtained using a standard, short form by which a person could provide open-ended consent for most research uses of a variety of biospecimens (such as all clinical specimens that might be collected at a particular hospital). This change would only apply to biospecimens collected after the effective date of the new rules | Changing technology in the field of genomics has dramatically increased the amount and nature of information about individuals that can be obtained from their DNA. Surveys indicate a desire on the part of most respondents to be able to decide whether their specimens can be used in research. Providing mechanisms for such control should enhance public trust in biomedical research. |
| Issue 3: Federal protections only apply to studies that are funded by certain federal agencies (Common Rule agencies), or to clinical investigations that involve products regulated by the FDA | Regulations would apply to all studies, regardless of funding source, that are conducted by a U.S. institution that receives some federal funding for human subjects research from a Common Rule agency. | Many have called for legislation to extend the Common Rule protections to all research with human subjects conducted in the U.S., regardless of funding source. This change would help narrow the current gap in protections. |
| Issue 4: Adverse events and unanticipated problems occurring in research are reported to multiple agencies and with various timelines, with no central database as a repository for such data. | A single web site would be created for the electronic reporting of all such events: this would meet all federal reporting requirements and the collected data would be stored in a single database. Reporting requirements across agencies. | This reform would enhance the capacity to harness information quickly and efficiently to identify and respond to risks from experimental interventions, while also decreasing administrative burdens imposed by existing framework. |
| Issue 5: Current provisions of the Common Rule provide only basic information about the elements of informed consent and how consent documents should be written. Many consent forms are too long and hard to understand, and fail to include some of the most important information. | The regulations would be revised to provide greater specificity about how consent forms should be written and what information they should contain. The goal would be consent forms that are shorter, more readily understood, less confusing, contain all of the key information, and that can serve as an aid to help someone make a good decision about whether to participate in a study. | The informed consent of the subject is critical to the conduct of ethical research. The proposed changes will substantially enhance the quality of consent in many studies. |
| Issue 6: Each site in a study requires IRB review. Although the regulations allow one IRB to carry out the review for multiple sites, it is common for a single study conducted at multiple sites to have many IRBs separately reviewing the study. | For all of the U.S. sites in a multi-site study, the changes propose a single IRB of record. | There is very little evidence that having multiple IRBs review the same study results in enhanced protections for subjects. By diffusing responsibility for that review, it might actually contribute to weakened protections |
| Issue 7: Each Common Rule agency, and the FDA, is authorized to issue its own guidance with regard to interpreting and implementing the regulations protecting human subjects. That guidance may substantially differ from agency to agency. | The ANPRM does not propose a specific change but through questions, seeks to determine whether or not the differences in guidance from agency to agency are justified by differences in the applicable statutes or missions of those agencies, and if not, to determine how to make guidance more uniform. | If the differences in guidance are not justified, then it would be appropriate to eliminate those differences. |
| Issue 8: Research involving more-than minimal risk requires review by a convened IRB. | This requirement would remain unchanged. | Higher-risk studies should be subject to the highest level of scrutiny |
| Issue 9: Research that requires review by a convened IRB requires continuing review at least annually | Continuing review would generally not be required after all subjects in the study have completed all study interventions, and the only remaining procedures are standard-of-care procedures that are used to obtain follow-up clinical information (e.g., standard annual CT scans to detect any spread of the patient’s cancer), and the analysis of the research data. | Since the research risks to subjects after completion of study interventions are limited to privacy and confidentiality concerns, which would be dealt with by the new uniform protections, this change would enable IRBs to focus attention on higher risk protocols. |
| Issue 10: Research that poses minimal risk and includes only research activities in a list approved by the HHS Secretary is eligible to be reviewed in an “expedited” manner (e.g., with one reviewer, instead of a convened IRB). | This list would be updated now, and at regular intervals, using appropriate data about risks to the extent possible. | Determinations about the risks imposed by various research activities should be based upon appropriate data. |
| Issue 11: Research that is eligible for expedited review requires continuing review at least annually. | Continuing review would not be required of studies that are eligible for expedited review unless the reviewer, at the time of initial review, determines that continuing review is required, and documents why. | Research eligible for expedited review can involve only research activities that are included in the approved list. These activities are well-understood and it would be very unlikely that research involving such activities would lead to the new or unexpected risks with which continuing review is intended to deal. |
| Issue 12: For a research study to be eligible for expedited review, an IRB member must determine that it is minimal risk. | The “default” assumption will be that a study otherwise eligible for expedited review will be considered minimal risk unless a reviewer documents the rationale for classifying the study as involving more than minimal risk. | Since research that is eligible for expedited review can involve only research activities that are included in the approved list, very few such studies will involve more than minimal risk. This change will better assure that the level of review is well targeted to the level of risk. |
| Issue 13: For a research study to be approved, even if it qualifies for expedited review, the same approval criteria must be met as for studies that are approved by a convened IRB. | The ANPRM does not propose a specific change, but through questions seeks to determine whether some approval criteria do not meaningfully increase protections for subjects (i.e., in the case of studies that otherwise would qualify for expedited review). | may be different for studies that otherwise qualify for expedited review and those that do not. |
| Issue 14: Six categories of studies qualify as “exempt” from the regulations, meaning that they do not have to comply with any of the requirements of the regulations. | These studies would no longer be fully exempt from the regulations. In particular, they would be subject to the new data security protections described above; and for some studies (e.g., those using biospecimens) new consent requirements would apply. | Research that might pose informational risk to subjects should adhere to reasonable data security protections. |
| Issue 15: The categories of studies that qualify as “exempt” are not very clearly defined. As a result, it is sometimes difficult to determine whether a study qualifies as exempt. | The criteria for determining whether a study is exempt would be more clear-cut and less open to interpretation. | Clearer criteria will increase the transparency of the system and reduce the time and effort spent in determining whether or not a study qualifies as exempt. |
| Issue 16: Although the regulations do not require administrative review before a study is determined to be exempt, most institutions follow current federal recommendations and carry out such an administrative review. | The recommendation that all such studies undergo administrative review would be eliminated. Researchers would file a brief “registration” form with their institution or IRB, and would be permitted to commence their research studies immediately after filing the form. Audits of a small percentage of studies would take place to ensure appropriate application of and compliance with the revised regulation. | The major risk in most studies that might qualify as exempt is a breach of confidentiality. Given that there will be clearer criteria to determine when a study meets the standards for exemption, and that all studies will be covered under appropriate data security protections, there should be little need for or benefit from reviewing each study before it commences to determine that it meets the criteria for being exempt. |
| Issue 17: One of the six exempt categories applies to research using educational tests, survey procedures, or observation of public behavior, but not if both (i) information is recorded in a way that allows subjects to be identified, and (ii) disclosure of the subjects’ responses outside of the research could reasonably place subjects at risk of criminal or civil liability or cause damage to financial standing, reputation, or employability. | This exempt category would be broadened by eliminating criteria (i) and (ii) for studies that involve competent adults, i.e., such research would be exempt even if the information was recorded in an identifiable way and the disclosure could pose such risks to the subject. | The new data security protections obviate the need for (i) and (ii) |
| Issue 18: Currently, research studies in the social and behavioral sciences that do not qualify for exemption Category 2, but that involve certain types of well-understood interactions with subjects (e.g., asking someone to watch a video and then conducting word association tests), require IRB review. | The ANPRM does not propose a specific change, but seeks public comment on whether a broad subset of studies using common social and behavioral science methodologies can be identified that should be eligible for exemption 2. | To identify areas of research that do not warrant the current degree of regulatory oversight so that review requirements are better calibrated to the level of risk. |
| Issue 19: One of the six exempt categories applies to research involving the use of existing data, documents, records, and pathological or diagnostic specimens, but only if the sources are publicly available or if the information is recorded by researchers in such a manner that subjects cannot be identified, directly or through identifiers linked to them. | The requirements in this category that (1) all the data or specimens must exist as of the time that the study commences, and (2) the researcher cannot record and retain information that identifies the subjects, would be eliminated. If a researcher chooses to obtain and record identifiable information, the subject’s consent would generally be needed (as required by the current rules), but that could be obtained at the time the materials are collected by using a general, open-ended consent to future research. With regard to studies using existing biospecimens, see Issue 2 above. | The new data security protections obviate the need for limitations in this exempt category. |
While HHS proposed nineteen changes to the Common Rule, this Whitepaper will focus on five areas of clinical research that could be impacted. The focus areas for analysis include:
- Research involving biobanks
- Informed consent requirements
- Clinical research regulation changes
- Changes to IRB scope
- The harmonization of OHRP and FDA guidelines
The discussion of each area focuses on implications these changes could have on research conducted going forward. The proposed changes could affect not only clinical research sites, but sponsors, CROs, study volunteers, research institutions, and IRBs.
Biobank Technology
An increasing amount of research is being done on donated tissue and medical waste. Significant medical advances are being made through stem cell therapy leading to a tremendous increase in clinical research in the field of stem cells. Human genome sequencing technology has improved to the point that researchers are returning to tissue repositories and mining those samples for genetic markers. Biobanks have been a silent and absent issue in human research protection for many years. The suggested changes in the ANPRM bring the topic to surface and suggest changes to the way biobanks execute research. Under the current rule, research using existing biospecimens can be utilized without consent by stripping the biospecimens of identifiers. The proposed change requires written consent for research of this nature which could be obtained by patients filling out standard short forms. The change would solely apply to biospecimens collected after the effective date of any changes to the Common Rule. It is important to note that this suggested change directly counteracts the current FDA guidance regarding the use of leftover biospecimans in the development of vitro-diagnostic products. If this occurs, it would place more of a burden on sites and sponsors to proactively gain consent; however, it allows patients to gain more of a voice by choosing whether or not they would like their specimens to be used for research.
Informed Consent Requirements
The informed consent documents are lengthy and may often be difficult to understand from the participant's standpoint. These are supposed to be written at an eighth grade reading level; however, a study by Nancy Kass, PhD, found the average length of consent forms was more than twenty pages.6 The study found that by shortening the document and modifying verbiage, participants could more easily understand what is going to happen to them during the study. This suggestion could improve the difficulties that lie in the process of explaining complex technologies and therapeutics to the average citizen. Along with making the forms easier to understand, it is helpful if participants are allowed to take the form home to read at their own pace for better understanding. The proposed change suggests consent forms need to be shortened and simplified. Could guidelines be put in place dictating exactly what information consent forms should contain and how long they should be? Increasing transparency within consent forms could not only increase patient awareness but create trust between patients and physicians. However, trying to apply a standard length may not meet the needs of every research study.
Privacy Issue
Currently, one of the exempt categories for IRB oversight applies to research using educational tests, survey procedures, or observation of public behavior, “but not if both (i) information is recorded in a way that allows subjects to be identified, and (ii) disclosure of the subjects’ responses outside of the research could reasonably place subjects at risk of criminal or civil liability or cause damage.”7 The proposed change suggests that even research that is identifiable and could place subjects at risk should be exempt. Therefore, the exempt category would be expanded. Under current rule, there are no specific data security protections for IRB reviewed research. Essentially, it is the IRB's responsibility to determine the appropriate provisions to protect the privacy of research subjects, the extent of confidentiality lies in the hands of the IRB. HHS suggests that specific data security protections be developed. By implementing new standards, the appropriate privacy and confidentiality for all subjects could be ensured without making IRBs accountable to subjectively making the call for each study. An interesting implication to think about is self-determined exempted research that never reaches an IRB. How will such researchers be aware of the required data security provisions?
Another proposed change to the Common Rule suggests that even the current six categories of research that are deemed exempt would have new guidelines to follow – the new data security protections. Therefore, no category of human research study would be truly exempt from regulations.
Harmonization
The ruling federal agencies seem to be attempting to harmonize the process, acknowledging that there are differences in guidance from each agency, i.e., between what FDA and OHRP require. The goal in the ANPRM seems to be to seek and gather feedback on existing discrepancies to uncover what is causing the most disruption in research. Any streamlining, reduction in duplication, or resolution of conflicting policies would make research regulations more clear and implementable.
Increase in Clarity/Potential change to IRB scope Presently, human subject federal protections only apply to studies that are funded by federal agencies or clinical investigations that involve products regulated by the FDA. The revision suggests that regulations should apply to all studies conducted by a U.S. institution that receives any form of federal funding. This proposition could provide regulation of studies that were not subject to IRB review previously, thus, increasing the volume of studies needing IRB oversight.
Another proposed change, the use of a single IRB review for multi-site registration studies, could help eliminate time, expense, and complexity in large biopharmaceutical clinical trial IRB reviews. It is important to note that this provision would only apply to FDA regulated drug research. This presents a challenge to the current way hospitals and academic IRBs execute reviews, as many do not accept the use of an external or central IRB for any of their researchers. It seems doubtful that these hospitals or academic centers would be willing to take on the risk of serving as a central IRB for investigators out of their network. Furthermore, if the provision goes through, will some institutions consider opting out of any FDA regulated submission studies, or will they have to change their policies to work more closely with commercial central IRBs? Undoubtedly, the provision would force central and local IRBs to work more closely together than ever seen before.
The ANPRM sought to introduce a long list of potential changes that could greatly impact many different parties involved in research. The effort to implement even a few of these suggested changes would require action at the congressional level. Because Congress is engaged in so many issues at the national level, any discussion of HHS's proposed changes could be prolonged. Further, it is important to note that HHS is not held to any timeline for next steps regarding this ANPRM. The ANPRM was published on July 26, 2011 with initial comments due September 26, 2011, but that deadline was pushed out to October 26, 2011. Not much else has been said by HHS or other Common Rule regulated Agencies since. Undoubtedly, technological advances including the mapping of the human genome, nanotechnology, the exploding use of information technology, and other trends will continue to impact the clinical research industry significantly. Many of these proposed ANPRM changes could provide clarity for researchers. Some of these ideas could reduce a bit of the regulatory burdens; however, other changes such as the biobank requirement to consent would add more regulatory burden to an exploding field of research.
References
- http://www.hhs.gov/ohrp/humansubjects/guidance/45cfr46.html
- http://www.hhs.gov/ohrp/humansubjects/guidance/belmont.html
- http://www.hhs.gov/ohrp/humansubjects/commonrule.html
- http://www.hhs.gov/ohrp/humansubjects/anprmqanda.html
- http://www.hhs.gov/ohrp/humansubjects/anprmchangetable.html; Regulatory Changes in ANPRM." United States Department of Health and Human Services
- http://www.sciencedaily.com/releases/2011/107/110715135325.htm