Editor’s note: This post is part of a series stemming from the Fifth Annual Health Law Year in P/Review event held at Harvard Law School on Monday, January 23rd, 2017. The conference brought together leading experts to review major developments in health law over the previous year, and preview what is to come.

On January 19, 2017—President Obama’s last day in office—the Federal Register published a Final Rule to amend the Federal Policy for the Protection of Human Subjects, the set of regulations applicable to most human subjects research conducted or supported with federal funds, and more typically referred to as the “Common Rule.” This rule change had been a long time coming, with an Advance Notice of Proposed Rule Making (ANPRM) published in July 2011 and a Notice of Proposed Rule Making (NPRM) published in September 2015. The seriousness of its impact on the research community, patients, and the public is evidenced by the more than 3,300 public comments submitted during the rulemaking process. So what changed?

First, it is important to understand where things stood. The Common Rule was initially adopted in 1991, with each relevant agency codifying the same set of regulations (the Department of Health and Human Service’s codification is found at 45 C.F.R. Part 46). The primary functions of the Common Rule are to require that research with human subjects be approved by an Institutional Review Board (IRB) and that subjects provide informed consent to research participation, with some important exceptions on each front. (FDA has similar, but not identical requirements, for clinical investigations, which are now likely to be harmonized with the new Common Rule.)

Motivating Change

For more than two decades, the Common Rule went untouched, while the research enterprise changed dramatically around it. More research is being conducted, and more of this research is being conducted across multiple sites. In addition, important new technological developments have come on to the scene, in particular related to genomics and informatics, that expose human subjects primarily to informational harm related to privacy and confidentiality, rather than physical harm.

In this regard, there have also been some important research ethics “scandals” related to the use of biological specimens such as blood and tissue samples without consent (albeit ostensibly within the parameters of the regulations, both pre- and post-Final Rule), including the now-famous case of Henrietta Lacks brought to public attention by a best-selling book in 2010, litigation brought by the Havasupai tribe regarding the scope of research permitted by members’ consent to a particular study, and another lawsuit by parents of newborns whose residual blood spots from standard metabolic screens were used for research purposes.

In light of these changes, the Department of Health and Human Services published the ANPRM, proposing to revise the regulations governing research with biological specimens, as well as a host of changes intended to streamline review processes and reduce burdens on low-risk research. Four years later, the NPRM was published, largely in line with the ANPRM.

Regulating Research with Biospecimens

Most controversially, the 2015 NPRM proposed to dramatically change the landscape for research with biospecimens by altering the definition of human subject to include even nonidentified biospecimens, requiring at least broad consent to research with biospecimens (as opposed to study-specific consent), and making waiver of consent for biospecimen research nearly impossible. This approach would have been a tectonic shift from the status quo, in which the regulatory structure largely facilitates biospecimen research in three ways: (1) by not including it in the regulatory definition of human subject—the threshold for applying the requirements of IRB approval and informed consent—when biospecimens were collected for another purpose and stripped of identifiers; (2) exempting it from the regulations when information is recorded without identifiers; and (3) allowing IRBs to relatively easily waive consent for research with identifiable biospecimens.

The regulators’ stated rationale for the proposed change was two-fold. First, the distinction between identifiable and nonidentifiable biospecimens has been called into question by several demonstration projects indicating that reidentification can occur with little difficulty. Second, the regulators pointed to emerging empirical evidence suggesting that regardless of identifiability, people “want to be asked” about the research use of their materials and information, and that accommodating that desire may be important to promoting continued trust in the research enterprise.

Public commentary on these proposed changes was dramatically opposed, however. Although some members of the public thought the proposal did not go far enough (i.e., by permitting broad rather than specific consent for biospecimen research), research institutions, patient advocacy groups, and a range of advisory committees warned that the proposal risked serious damage to medical advancement by making research with biospecimens more difficult and potentially introducing bias in the types of samples that would remain available. Commenters also noted that research with deidentified biospecimens is very low risk with high social value, such that it is reasonable to expect people to allow their materials to be used in this way. They also pointed out that there are other ways to protect against research risk and to promote autonomy with regard to biospecimen research that would be less damaging. Finally, commenters noted that existing empirical evidence regarding what people want when it comes to their biospecimens leaves important questions unanswered.

The final rule is largely responsive to these critiques. Slated to take effect in January 2018 (assuming it is not clawed back before then by congressional or executive change), the new regulatory approach will maintain the status quo distinction between identifiable and nonidentifiable biospecimens, such that research with nonidentified biospecimens will still not count as human subjects research — and can be done without IRB review or consent. However, within one year and every four years thereafter, the regulators will reassess the definition of identifiable and which technologies and techniques can generate identifiable information. There is some concern that this approach simply kicks the can down the road, and could potentially get us closer to the world proposed in the NPRM in which substantially more biospecimen research falls under the regulations. That said, many in the research community recognize the need to avoid an approach that is too static.

The revised rule does maintain the new option proposed in the NPRM to allow biospecimen research based on broad, rather than specific, consent, but this option is now intended as another arrow in the quiver for research on identifiable specimens, rather than—as proposed—a more intense requirement to obtain consent in circumstances in which none had been required before. The revised rule also expands the previous exemption applicable to biospecimen research, and rejects the proposal to make it much more difficult to obtain a consent waiver for research with identifiable biospecimens; the new rule will now require only an added finding that research would not be practicable with nonidentified specimens and that specimen sources have not declined to provide their broad consent to research.

In order to respond to the stated concerns regarding trust in the research enterprise, the final rule also makes a number of adjustments to help biospecimen sources understand how their materials may be used for research, with and without consent, although some informational gaps remain. Finally, while the NPRM would have treated biospecimens and private information differently, the final rule takes a consistent approach, given the similar issues raised by both types of research. Overall, after intense concern that the revisions proposed in the NPRM would set biospecimen research back substantially, the final rule seems to be a welcome relief. Time will tell, however, whether future changes to the definition of identifiable will wreak havoc down the road.

Exhibit 1

Additional Changes in the Final Rule

The final rule also makes a slate of additional regulatory changes. With regard to informed consent, the rule seeks to improve decision making, including specific requirements to provide information that a “reasonable person” would want to have, beginning with a “concise and focused” presentation of key information and organized to facilitate understanding, rather than just a list of isolated facts. In addition, federally funded “clinical trials” (as defined by the new rule) will now be required to post consent documents on a public government website, once recruitment is over.

The final rule makes important changes to facilitate social and behavioral research, in particular adding “benign behavioral interventions” to the existing exemption applicable to survey research, and allowing such research to be exempt even when it involves recording identifiable information so long as the IRB conducts a limited review for privacy and confidentiality. Finally, beginning in January 2020, the revised rule requires single IRB review for multi-site studies conducted in the U.S., rather than having each site’s IRB bear regulatory responsibilities. This had been a controversial provision, but given that the National Institutes of Health recently finalized a similar policy for research that it funds, the Common Rule change simply expands the studies to which the requirement will apply.

What’s Next?

As the new regulations are implemented, a number of important questions remain. What will count as research with identifiable biospecimens as the regulators revisit existing definitions in the future? Will broad consent be a meaningful option that can be practicably implemented by research sites and in clinical settings, given concerns about infrastructure, tracking, and implications for consent waivers if broad consent is sought and denied? Will the public be satisfied with the fact that their biospecimens can still be used in many cases without their notice, consent, or IRB review? Can the regulatory changes to consent materials actually improve participant understanding, in light of decades of research demonstrating how difficult that is? Will the requirement for single IRB review actually prove to be more efficient and equally protective of subject interests? The rule also leaves open important questions about regulatory oversight of research with big data, cluster randomized trials, standard of care research, and clinical innovation, making no changes specifically applicable to these contexts, despite calls to do so.

One thing is for sure: Although the wait for the final rule is over, we will be studying its impact for years to come.

Author’s note

The views reflected in this post are only my own, and should not be attributed to any organization with which I am affiliated.