Final (Revised) Common Rule — Part I
Introduction
In 1991, 16 federal agencies adopted 45 CFR 46, Subpart A, also known as the Common Rule. This set of regulations aims to protect human subjects in federally funded research through three basic requirements. These include informed consent of research subjects; review of the proposed research by an Institutional Review Board (IRB); and assurances of compliance with regulations by the institutions involved.
Since the original Common Rule was promulgated almost 3 decades ago, the landscape of research has changed. Through technology, we can now conduct big data research with powerful computers, sequence the genome, and bring large and small institutions into collaboration to do complex, multi-site research. The Common Rule is being revised in light of these changes to better protect human subjects, while also reducing the administrative burden.
After completing the Notice of Proposed Rulemaking (NPRM) process, the final revised Common Rule was published on January 19, 2017, and is scheduled to take effect one year later. Studies approved prior to January 19, 2018, may presume that the pre-2018 rule still applies to them, although an institution may apply the final revised Common Rule to a particular study as long as it does not conflict with the pre-2018 rule (see graphic below). All studies approved after January 20, 2018, are subject to the final revised Common Rule, with the exception of multi-institutional studies that require mandated, single IRB review. These studies have a deadline of January 20, 2020, to comply with the new regulations.
Proposals from the NPRM that were not adopted in the final Common Rule include:
- Extending the Common Rule to cover research that uses nonidentified biospecimens, such as leftover blood samples, which would likely require informed consent;
- Development of a broad consent template, privacy safeguard standards, and online decision tool to determine whether proposed research is exempt from the Common Rule;
- Extending the Common Rule to cover clinical trials that are not federally funded;
- The new category of “excluded” activities. (These activities, which were proposed to be excluded, are either classified as exempt or do not satisfy what is now defined in the final Common Rule as research.)
Key Changes that were adopted in the final Common Rule:
- Revisions to the requirements for informed consent
- Adding a broad consent (i.e., seeking prospective consent to future, unspecified research) option for secondary research
- Removing certain activities from the definition of research
- Expanding exempt research
- Updating and simplifying expedited review
- Eliminating certain continuing reviews
- Using single IRB review for cooperative research
- Changes were made to the five of six pre-2018 Common Rule exemptions, with 2 new exemptions added and limited IRB review.
Four Activities Not Deemed Research
The final revised Common Rule defines research as a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge.
Four activities deemed NOT to be research include:
(1) Scholarly and journalistic activities (e.g., oral history, journalism, biography, literary criticism, legal research, and historical scholarship), including the collection and use of information, that focus directly on the specific individuals about whom the information is collected.
(2) Public health surveillance activities, including the collection and testing of information or biospecimens, conducted, supported, requested, ordered, required, or authorized by a public health authority.
- Such activities are limited to those necessary to allow a public health authority to identify, monitor, assess, or investigate potential public health signals, onsets of disease outbreaks, or conditions of public health importance (including trends, signals, risk factors, patterns in diseases, or increases in injuries from using consumer products).
- Such activities include those associated with providing timely situational awareness and priority setting during the course of an event or crisis that threatens public health (including natural or man-made disasters).
(3) Collection and analysis of information, biospecimens, or records by or for a criminal justice agency for activities authorized by law or court order solely for criminal justice or criminal investigative purposes.
(4) Authorized operational activities (as determined by each agency) in support of intelligence, homeland security, defense, or other national security missions.
§ __.102(l)
Activities two through four are government-related activities — public health surveillance, criminal justice data collection and analysis, and national security activities. Public health surveillance activities have been mandated by a “public health authority” (see definition in right sidebar) for the public’s welfare. Secondary research of public health surveillance activities may fall back under the definition of research, depending on the specific circumstances.
Human Subject Definition and “Identifiability”
The final revised Common Rule defines human subject as a living individual about whom an investigator (whether professional or student) conducting research:
- Obtains information or biospecimens through intervention or interaction with the individual [see definitions in right sidebar], AND uses, studies, or analyzes the information or biospecimens; or
- Obtains, uses, studies, analyzes, or generates identifiable private information or identifiable biospecimens.
(5) Identifiable private information is private information for which the identity of the subject is or may readily be ascertained by the investigator or associated with the information.
(6) An identifiable biospecimen is a biospecimen for which the identity of the subject is or may readily be ascertained by the investigator or associated with the biospecimen.
(7) Federal departments or agencies implementing this policy shall:
- Upon consultation with appropriate experts (including experts in data matching and re-identification), reexamine the meaning of ‘‘identifiable private information,’’ as defined in paragraph (e)(5) of this section, and ‘‘identifiable biospecimen,’’ as defined in paragraph (e)(6) of this section. This reexamination shall take place within 1 year and regularly thereafter (at least every 4 years).
- This process will be conducted by collaboration among the Federal departments and agencies implementing this policy. If appropriate and permitted by law, such Federal departments and agencies may alter the interpretation of these terms, including through the use of guidance.
- Upon consultation with appropriate experts, assess whether there are analytic technologies or techniques that should be considered by investigators to generate ‘‘identifiable private information,’’ as defined in paragraph (e)(5) of this section, or an ‘‘identifiable biospecimen,’’ as defined in paragraph (e)(6) of this section. This assessment shall take place within 1 year and regularly thereafter (at least every 4 years).
- This process will be conducted by collaboration among the Federal departments and agencies implementing this policy. Any such technologies or techniques will be included on a list of technologies or techniques that produce identifiable private information or identifiable biospecimens. This list will be published in the Federal Register after notice and an opportunity for public comment. The Secretary, HHS, shall maintain the list on a publicly accessible Web site.
§ __.102(e)(1)-(7)
1) obtains and uses information or biospecimens through intervention (physically manipulating the subject or his/her environment) or interaction (communication or interpersonal contact) with the individual or
2) obtains, uses, analyzes, or generates identifiable private information or identifiable biospecimens.
Private information or biospecimens become identifiable when the investigator can readily link the identity of the subject to the research materials or data, either directly through a name or photograph or indirectly through a code that the investigator knows. If the investigator is using fingerprints for example, but does not have or know the code linking the subjects’ identity to the fingerprints, then the materials are not considered identifiable under the regulation. The final revised Common Rule makes provisions to reexamine the meaning of this identifiability at least every 4 years, as analytic technologies develop that may alter the interpretation of these terms. These changes, if any, will be published on a publicly accessible website.
With the exception of stipulations specified in paragraph .104(a), the following categories of human subjects research are exempt from the final revised Common Rule:
Exemption 1:
Educational Practices — Restrictions Added
Research, conducted in established or commonly accepted educational settings, that specifically involves normal educational practices that are not likely to adversely impact students’ opportunity to learn required educational content or the assessment of educators who provide instruction. This includes most research on regular and special education instructional strategies, and research on the effectiveness of or the comparison among instructional techniques, curricula, or classroom management methods.
§ __.104(d)(1)
The final revised Common Rules adds the following restrictions to improve the protections of both students and educators:
- Routine innovations in educational practice should not negatively impact students’ opportunity to learn required educational content, such as, for example, the content necessary to pass a course or grade level.
- Likewise, the assessment of instructors who are required to implement these new or improved educational practices should not be adversely impacted.
Exemption 2:
Educational Tests, Surveys, Interviews, Observation — Expanded
Research that only includes interactions involving educational tests (cognitive, diagnostic, aptitude, achievement), survey procedures, interview procedures, or observation of public behavior (including visual or auditory recording) if at least one of the following criteria is met:
(i) The information obtained is recorded by the investigator in such a manner that the identity of the human subjects cannot readily be ascertained, directly or through identifiers linked to the subjects;
(ii) Any disclosure of the human subjects’ responses outside the research would not reasonably place the subjects at risk of criminal or civil liability or be damaging to the subjects’ financial standing, employability, educational advancement, or reputation; or
(iii) The information obtained is recorded by the investigator in such a manner that the identity of the human subjects can readily be ascertained, directly or through identifiers linked to the subjects, and an IRB conducts a limited IRB review to make the determination required by § __.111(a)(7), [which is,] when appropriate, there are adequate provisions to protect the privacy of subjects and to maintain the confidentiality of data.
[45 CFR § 46.101(b)(3)(i) regarding public officials or candidates for public office has been removed because almost all such research would be exempt under the new Exemption 2.]
§ __.104(d)(2)
- The subjects’ privacy and confidentiality are protected because the research data is recorded in such a manner that it cannot be linked back to the subjects; or
- Disclosure of the research data collected would not place subjects at risk of harm; or
- Recorded data that contains identifiable information may be exempt if a limited IRB review determines that the final revised Common Rule’s requirements to protect subjects’ privacy and confidentiality have been met.
Exemption 3:
Research on Public Officials — Removed
Replaced with New Exemption — Benign Behavioral Interventions
Pre-2018 Rule Exemption 3:
Research involving the use of educational tests (cognitive, diagnostic, aptitude, achievement), survey procedures, interview procedures, or observation of public behavior that is not exempt under paragraph (b)(2) of this section, if:
(i) The human subjects are elected or appointed public officials or candidates for public office; or (ii) federal statute(s) require(s) without exception that the confidentiality of the personally identifiable information will be maintained throughout the research and thereafter.
Why was it removed and replaced with a new exemption?
Almost all of the research described above is now exempt under the final revised Common Rule’s new exemption 2; sensitive identifiable information that is recorded for research purposes about public officials must be kept confidential.
New Exemption 3:
Research involving benign behavioral interventions [not biomedical; see definition below and in right sidebar] in conjunction with the collection of information from an adult subject [not children] through verbal or written responses (including data entry) or audiovisual recording if the subject prospectively agrees [upfront] to the intervention and information collection and at least one of the following criteria is met:
(A) The information obtained is recorded by the investigator in such a manner that the identity of the human subjects cannot readily be ascertained, directly or through identifiers linked to the subjects; [or]
(B) Any disclosure of the human subjects’ responses outside the research would not reasonably place the subjects at risk of criminal or civil liability or be damaging to the subjects’ financial standing, employability, educational advancement, or reputation; or
(C) The information obtained is recorded by the investigator in such a manner that the identity of the human subjects can readily be ascertained, directly or through identifiers linked to the subjects, and an IRB conducts a limited IRB review to make the determination required by § __.111(a)(7), [which is,] when appropriate, there are adequate provisions to protect the privacy of subjects and to maintain the confidentiality of data.
For the purpose of this provision, benign behavioral interventions are brief in duration, harmless, painless, not physically invasive, not likely to have a significant adverse lasting impact on the subjects, and the investigator has no reason to think the subjects will find the interventions offensive or embarrassing. Provided all such criteria are met, examples of such benign behavioral interventions would include having the subjects play an online game, having them solve puzzles under various noise conditions, or having them decide how to allocate a nominal amount of received cash between themselves and someone else.
If the research involves deceiving the subjects regarding the nature or purposes of the research, this exemption is not applicable unless the subject authorizes the deception through a prospective agreement to participate in research in circumstances in which the subject is informed that he or she will be unaware of or misled regarding the nature or purposes of the research.
§ __.104(d)(3)
Benign behavioral interventions are defined as social behavioral research that is brief in duration, harmless, painless, not physically invasive, not likely to have a significant adverse lasting impact on the subjects, and the investigator has no reason to think the subjects will find the interventions offensive or embarrassing, such as having subjects play an online game.
Note key elements of the language that this sections uses:
- Benign behavioral interventions are non-biomedical, social behavioral research
- With adults
- Who agree upfront
- When the information is collected through verbal, written, or audiovisually recorded responses
- And at least one of the following criteria is met (then the 3 criteria from exemption #2 are repeated):
- Recorded data cannot be linked back to subject
- Disclosure of data does not put subjects at risk of harm
- Recorded data that contains identifiable information may be exempt if a limited IRB review determines that the final revised Common Rule’s requirements to protect subjects’ privacy and confidentiality have been met.
- Benign behavioral interventions are defined as brief, harmless, etc. (see above)
- To be considered for this exemption, research that involves deception must inform and gain authorization from the subject through an agreement prior to the research that he or she will be unaware of or misled regarding the nature or purposes of the research.
Exemption 4:
Research on Existing Data — Expanded and New Added
Pre-2018 Rule Exemption 4:
Research, involving the collection or study of existing data, documents, records, pathological specimens, or diagnostic specimens, if these sources are publicly available or if the information is recorded by the investigator in such a manner that subjects cannot be identified, directly or through identifiers linked to the subjects.
New Exemption 4:
Secondary research for which consent is not required: Secondary research uses of identifiable private information or identifiable biospecimens [note that materials no longer need to be “existing” as was required in the Pre-2018 exemption 4], if at least one of the following criteria is met:
(i) The identifiable private information or identifiable biospecimens are publicly available; [or]
(ii) Information, which may include information about biospecimens, is recorded by the investigator in such a manner that the identity of the human subjects cannot readily be ascertained directly or through identifiers linked to the subjects [similar to Pre-2018 Rule Exemption 4], the investigator does not contact the subjects, and the investigator will not re-identify subjects; [or]
(iii) The research involves only information collection and analysis involving the investigator’s use of identifiable health information when that use is regulated under 45 CFR parts 160 and 164, subparts A and E [HIPAA], for the purposes of ‘‘health care operations’’ or ‘‘research’’ as those terms are defined at 45 CFR 164.501 or for ‘‘public health activities and purposes’’ as described under 45 CFR 164.512(b); or
(iv) The research is conducted by, or on behalf of, a Federal department or agency using government-generated or government-collected information obtained for nonresearch activities, if the research generates identifiable private information that is or will be maintained on information technology that is subject to and in compliance with [federal privacy laws].
§ __.104(d)(4)
Human subject research as defined in § __.102(e)(1) of the final revised Common Rule is: i) information or biospecimens that an investigator obtains through intervention or interaction with the individual human subject and uses for research purposes or ii) identifiable private information or biospecimens that an investigator obtains, uses, or generates for research purposes.
Therefore, research that does not involve 1) interacting with the subject, 2) intervening with the subject or his/her environment, or 3) obtaining/use of identifiable materials is not considered human subjects research under the final revised Common Rule.
Secondary research that does fall under this exemption involves your research use of identifiable biospecimens or materials that other people have collected for other purposes, such as for example census bureau data.
Criteria for the exemption include:
- Identifiable materials that are publicly available [and thus there are no privacy concerns], or
- Identifiable materials recorded by the investigator that do not link the data to the subject OR the investigator does not contact or re-identify the [primary research] subjects. An example of this would be when a researcher sees identifiable data in a clinical database containing primary research data, but downloads that data in such a way that the identifiers are not linked to the original subjects in the secondary research pull of data.
- Investigators use of identifiable materials for public health, healthcare operations or healthcare research purposes that are regulated under HIPAA
- Secondary research by a federal agency or its designee that uses data collected by the government for nonresearch purposes that is protected by federal privacy standards.
Got Questions?
UNC IRB and Office of Human Research Ethics
HHS.gov Office of Human Research Protections
Need a Quick Guide?
PRIM&R Final Common Rule Quick Reference Guide
Want More In-depth Info?
Common Rule-specific Definitions:
RESEARCH means a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge.
4 activities NOT deemed research:
(1) Scholarly and journalistic activities (e.g., oral history, journalism, biography, literary criticism, legal research, and historical scholarship), including the collection and use of information, that focus directly on the specific individuals about whom the information is collected.
(2) Public health surveillance activities, including the collection and testing of information or biospecimens, conducted, supported, requested, ordered, required, or authorized by a public health authority. Such activities are limited to those necessary to allow a public health authority to identify, monitor, assess, or investigate potential public health signals, onsets of disease outbreaks, or conditions of public health importance (including trends, signals, risk factors, patterns in diseases, or increases in injuries from using consumer products). Such activities include those associated with providing timely situational awareness and priority setting during the course of an event or crisis that threatens public health (including natural or man-made disasters).
(3) Collection and analysis of information, biospecimens, or records by or for a criminal justice agency for activities authorized by law or court order solely for criminal justice or criminal investigative purposes.
(4) Authorized operational activities (as determined by each agency) in support of intelligence, homeland security, defense, or other national security missions.
HUMAN SUBJECT means a living individual about whom an investigator (whether professional or student) conducting research:
- Obtains information or biospecimens through intervention or interaction with the individual, AND uses, studies, or analyzes the information or biospecimens; or
- Obtains, uses, studies, analyzes, or generates identifiable private information or identifiable biospecimens.
IDENTIFIABLE PRIVATE INFORMATION is private information for which the identity of the subject is or may readily be ascertained by the investigator or associated with the information.
An IDENTIFIABLE BIOSPECIMEN is a biospecimen for which the identity of the subject is or may readily be ascertained by the investigator or associated with the biospecimen.
Federal departments or agencies implementing this policy shall:
Upon consultation with appropriate experts (including experts in data matching and re-identification), reexamine the meaning of ‘‘identifiable private information’’ and ‘‘identifiable biospecimen,’’ as defined in this section. This reexamination shall take place within 1 year and regularly thereafter (at least every 4 years). This process will be conducted by collaboration among the Federal departments and agencies implementing this policy. If appropriate and permitted by law, such Federal departments and agencies may alter the interpretation of these terms, including through the use of guidance.
Upon consultation with appropriate experts, assess whether there are analytic technologies or techniques that should be considered by investigators to generate ‘‘identifiable private information,’’ or an ‘‘identifiable biospecimen,’’ as defined in this section. This assessment shall take place within 1 year and regularly thereafter (at least every 4 years). This process will be conducted by collaboration among the Federal departments and agencies implementing this policy.
Any such technologies or techniques will be included on a list of technologies or techniques that produce identifiable private information or identifiable biospecimens. This list will be published in the Federal Register after notice and an opportunity for public comment. The Secretary, HHS, shall maintain the list on a publicly accessible Web site.
INTERVENTION includes both physical procedures by which information or biospecimens are gathered (e.g., venipuncture) and manipulations of the subject or the subject’s environment that are performed for research purposes.
INTERACTION includes communication or interpersonal contact between investigator and subject.
MINIMAL RISK means that the probability and magnitude of harm or discomfort anticipated in the research are not greater in and of themselves than those ordinarily encountered in daily life or during the performance of routine physical or psychological examinations or tests.
Research involving BENIGN BEHAVIORAL INTERVENTIONS in conjunction with the collection of information from an adult subject through verbal or written responses (including data entry) or audiovisual recording if the subject prospectively agrees to the intervention and information collection and at least one of the following criteria is met:
(A) The information obtained is recorded by the investigator in such a manner that the identity of the human subjects cannot readily be ascertained, directly or through identifiers linked to the subjects;
(B) Any disclosure of the human subjects’ responses outside the research would not reasonably place the subjects at risk of criminal or civil liability or be damaging to the subjects’ financial standing, employability, educational advancement, or reputation; or
(C) The information obtained is recorded by the investigator in such a manner that the identity of the human subjects can readily be ascertained, directly or through identifiers linked to the subjects, and an IRB conducts a limited IRB review to make the determination required by § __.111(a)(7).
- For the purpose of this provision, BENIGN BEHAVIORAL INTERVENTIONS are brief in duration, harmless, painless, not physically invasive, not likely to have a significant adverse lasting impact on the subjects, and the investigator has no reason to think the subjects will find the interventions offensive or embarrassing. Provided all such criteria are met, examples of such benign behavioral interventions would include having the subjects play an online game, having them solve puzzles under various noise conditions, or having them decide how to allocate a nominal amount of received cash between themselves and someone else.
- If the research involves deceiving the subjects regarding the nature or purposes of the research, this exemption is not applicable unless the subject authorizes the deception through a prospective agreement to participate in research in circumstances in which the subject is informed that he or she will be unaware of or misled regarding the nature or purposes of the research.
SECONDARY RESEARCH for which consent is not required: Secondary research uses of identifiable private information or identifiable biospecimens, if at least one of the following criteria is met:
- The identifiable private information or identifiable biospecimens are publicly available;
- Information, which may include information about biospecimens, is recorded by the investigator in such a manner that the identity of the human subjects cannot readily be ascertained directly or through identifiers linked to the subjects, the investigator does not contact the subjects, and the investigator will not re-identify subjects;
- The research involves only information collection and analysis involving the investigator’s use of identifiable health information when that use is regulated under 45 CFR parts 160 and 164, subparts A and E, for the purposes of ‘‘health care operations’’ or ‘‘research’’ as those terms are defined at 45 CFR 164.501 or for ‘‘public health activities and purposes’’ as described under 45 CFR 164.512(b); or
- The research is conducted by, or on behalf of, a Federal department or agency using government-generated or government-collected information obtained for nonresearch activities, if the research generates identifiable private information that is or will be maintained on information technology that is subject to and in compliance with [various federal privacy laws].
PUBLIC HEALTH AUTHORITY refers an agency or authority of the United States, a state, a territory, a political subdivision of a state or territory, an Indian tribe, or a foreign government, or a person or entity acting under a grant of authority from or contract with such public agency, including the employees or agents of such public agency or its contractors or persons or entities to whom it has granted authority, that is responsible for public health matters as part of its official mandate.