The 2018 Common Rule effective date is January 21, 2019.

The key provisions and changes that researchers at Penn will be expected to comply with are related to:

  • New and revised definitions
  • New exemption categories regarding secondary research
  • Elimination of Continuing Review
  • Revised Informed Consent Requirements
  • Federal Agency Harmonization
  • Guidance on application to clinical data registries
  • Cooperative Research Studies (Single IRB / Central IRB / Reliance Agreements)
  • Elimination of Grant Review

Please see below for detailed information about how each of these provisions will be applied to new research reviewed after 1/21/2019. 

Please also review the separate section which details how these provisions will be applied to existing research in an ongoing fashion.

EXISTING RESEARCH UNDER THE NEW COMMON RULE

IRB staff have been trained to implement the new common rule based on the composition of your research and will either apply the new rule during a routine review, or inform study teams that revisions are required to meet new requirements.

If you have recieved notice in a recent IRB determination letter that your research may qualify for re-assessment under the revised common rule as it relates to elimination of continuing review, please CLICK HERE TO DOWNLOAD a guidance document and follow the instructions to request a re-assessment. Please note all re-assessment requests must be submitted via HSERA modification.

NEW AND REVISED DEFINITIONS

The final rule provides new and revised definitions, including: “clinical trial,” “human subject,” “intervention,” “private information,” “identifiable private information,” “identifiable biospecimen,” “minimal risk,” “research,” and “written or in writing” (to include electronic formats).  

  • Clinical Trial - The final rule added the definition of “clinical trial,” which was not defined in the previous version of the Common Rule.  A clinical trial is “a research study in which one or more human subjects are prospectively assigned to one or more interventions (which may include placebo or other control) to evaluate the effects of the interventions on biomedical or behavioral health-related outcomes.”
  • Human Subject - The final rule expanded the definition of “human subject” to cover the collection of biospecimens (this does not include non-identified biospecimens).  The new definition includes “a living individual about whom an investigator, whether professional or student conducting research: (1) obtains information or biospecimens through intervention or interaction with the individual, and uses, studies, or analyzes the information or biospecimens; or (2) obtains, uses, studies, analyzes, or generates identifiable private information or identifiable biospecimens.”  
  • Activities deemed not to be research - The final rule amended the definition of “research” to include four new activities that are deemed to not be “research”

      - Scholarly and journalistic activities (e.g. oral history, journalism, biography, literary criticism, legal research, and historical scholarship);

      - Public health surveillance activities;

      - Collection and analysis of information, biospecimens, or records for criminal justice or criminal investigative purposes; and

      - Certain activities in support of intelligence, homeland, security, defense, or other national security missions.

Penn Researchers should continue to refer to the How To Submit - Initial page of this website and utilize the guidance documents associated with the topic "Is IRB Review Required?" for assistance with determining whether a project is considered human subjects research.

REVISED AND NEW EXEMPTION CATEGORIES REGARDING SECONDARY RESEARCH

The final rule both revised and introduced new Exempt and Limited Review research categories, if certain conditions are met. 

Exempt Review

Revised

Exempt Review Category #1 (46.104(d)(1)): Revisions to Exemption #1 provide a clarification on risk (the revisions are bolded):   Research, conducted in established or commonly accepted educational settings, that specifically involves normal educational practices that are not likely to adversely impact students' opportunity to learn required educational content or the assessment of educators who provide instruction. This includes most research on regular and special education instructional strategies, and research on the effectiveness of or the comparison among instructional techniques, curricula, or classroom management methods.

Exempt Review Category #2 (46.104(d)(2)): Revisions to Exemption #2 specify research activities that can be reviewed under this category and adds a provision for Limited IRB Review for protocols collecting sensitive and identifiable information (the revisions are bolded):   Research that only includes interactions involving educational tests (cognitive, diagnostic, aptitude, achievement), survey procedures, interview procedures, or observation of public behavior (including visual or auditory recording) if at least one of the following criteria is met:

  • (i) The information obtained is recorded by the investigator in such a manner that the identity of the human subjects cannot readily be ascertained, directly or through identifiers linked to the subjects; 
  • (ii) Any disclosure of the human subjects' responses outside the research would not reasonably place the subjects at risk of criminal or civil liability or be damaging to the subjects' financial standing, employability, educational advancement, or reputation; OR
  • (iii) The information obtained is recorded by the investigator in such a manner that the identity of the human subjects can readily be ascertained, directly or through identifiers linked to the subjects, and an IRB conducts a limited IRB review to make the determination required by §46.111(a)(7).

Exempt Review Category #4 (46.104(d)(4)): Revisions to Exemption #4 specify that research activities are no longer limited to retrospective data review and permit secondary use of identifiable protected health information (PHI) with HIPAA privacy board review (the revisions are bolded):   Secondary research for which consent is not required: Secondary research uses of identifiable private information or identifiable biospecimens, if at least one of the following criteria is met:

(i) The identifiable private information or identifiable biospecimens are publicly available; OR

(ii) Information, which may include information about biospecimens [excluding actual physical biospecimens], is recorded by the investigator in such a manner that the identity of the human subjects cannot readily be ascertained directly or through identifiers linked to the subjects, the investigator does not contact the subjects, and the investigator will not re-identify subjects; OR

(iii) The research involves only information collection and analysis involving the investigator's use of identifiable health information when that use is regulated under 45 CFR parts 160 and 164, subparts A and E, for the purposes of “health care operations” or “research” as those terms are defined at 45 CFR 164.501 or for “public health activities and purposes” as described under 45 CFR 164.512(b)

Notice how use of biospecimens under category 4 is restricted to those that are publicly available.

New

Exempt Review Category #3 (46.104(d)(3)): This category provides criteria for research involving benign behavioral interventions, and includes Limited IRB Review for protocols collecting sensitive and identifiable data:   (3)(i) Research involving benign behavioral interventions in conjunction with the collection of information from an adult subject through verbal or written responses (including data entry) or audiovisual recording if the subject prospectively agrees to the intervention and information collection and at least one of the following criteria is met:

(A) The information obtained is recorded by the investigator in such a manner that the identity of the human subjects cannot readily be ascertained, directly or through identifiers linked to the subjects;

(B) Any disclosure of the human subjects' responses outside the research would not reasonably place the subjects at risk of criminal or civil liability or be damaging to the subjects' financial standing, employability, educational advancement, or reputation; or

(C) The information obtained is recorded by the investigator in such a manner that the identity of the human subjects can readily be ascertained, directly or through identifiers linked to the subjects, and an IRB conducts a limited IRB review to make the determination required by §46.111(a)(7).

  • (ii) For the purpose of this provision, benign behavioral interventions are brief in duration, harmless, painless, not physically invasive, not likely to have a significant adverse lasting impact on the subjects, and the investigator has no reason to think the subjects will find the interventions offensive or embarrassing. Provided all such criteria are met, examples of such benign behavioral interventions would include having the subjects play an online game, having them solve puzzles under various noise conditions, or having them decide how to allocate a nominal amount of received cash between themselves and someone else.
  • (iii) If the research involves deceiving the subjects regarding the nature or purposes of the research, this exemption is not applicable unless the subject authorizes the deception through a prospective agreement to participate in research in circumstances in which the subject is informed that he or she will be unaware of or misled regarding the nature or purposes of the research

Limited Review

The 2018 Rule institutes a new process of "Limited IRB Review" to provide a special review for certain activities: 

  • Storage or maintenance of identifiable private information or biospecimens for secondary research use. The IRB must confirm: 1) broad consent is obtained, 2) broad consent is appropriately documented, or documentation is waived, and 3) [when applicable] adequate provisions are in place to protect the privacy of subjects and to maintain the confidentiality of data. 
  • Secondary research involving identifiable private information or biospecimens, IF the investigator does not include returning individual research results to subjects as part of the study plan AND the research to be conducted is within the scope of the broad consent obtained. The IRB must confirm 1) broad consent was obtained, 2) broad consent was appropriately documented, or documentation is waived, and 3) there are adequate provisions in place to protect the privacy of subjects and to maintain the confidentiality of data. 

ELIMINATION OF CONTINUING REVIEW

The final rule eliminated continuing review for many minimal risk studies (non-FDA regulated research; benign behavioral interventions, consumer preference surveys and research). Unless an IRB determines otherwise, continuing review of research is not required if the research:

  • Is eligible for limited review;
  • Is eligible for expedited review;
  • Only involves data analysis (including analysis of identifiable information or identifiable biospecimens) or access to follow-up clinical data from procedures that subjects would undergo as part of clinical care.

The IRB must document the rationale for conducting continuing review if any of the above conditions are met.

NOTE: The FDA has not harmonized with the 2018 common rule and still requires annual continuing review for FDA-regulated studies.

Studies that qualify for approval with no continuing review are still required to submit modifications, deviations, and reportable events to the IRB.

REVISED INFORMED CONSENT REQUIREMENTS

The Common Rule Update includes changes to the information being presented during the consent process. The Penn IRB Biomedical and Social Behavioral Science consent form templates have been updated to include a section that outlines these new requirements. Penn Researchers are encouraged to utilize the IRB developed templates. Please see visit the Forms and Templates page of this website to download these and other available templates. 

New General Regulations [§46.116(a)] 

  1. §46.116(a)(4): The prospective subject (or the legally authorized representative) must be provided with the information that a reasonable person would want to have in order to make an informed decision about whether to participate, and an opportunity to discuss that information. 
  2. §46.116(a)(5)(i): Informed consent must begin with a focused presentation of key information. Please review our guidance for developing a concise summary that meets the new regulatory requirements. Click here for the Concise Summary Guidance. The Penn IRB has incorporated the concise summary of key information as the first section of the consent template.
  3. §46.116(a)(5)(ii): Informed consent must present information in sufficient detail, and must be organized and presented in a way that facilitates understanding of why one may or may not want to participate.

New Required Basic Element of Consent [§46.116(b)]

First, it is important for researchers to be on the same page as the IRB in terms of identifiability, biospecimen, and "private" definitions to ensure compliance with the consent regulations.

Relevant Definitions

Private: Information that is recorded/collected in a context underwhich an individual can reasonably expect that no observation or recording is taking place, OR the information or specimen has been provided for specific purposes by an individual and that the individual can reasonably expect it will not be made public (e.g., a medical record /clinical specimen archives).

Biospecimen: biopsy, tissue resection, blood, sputum, urine, bone marrow, buccal swab, hair, sweat, fingernails, etc.

Identifiability

Not Identifiable

  • Anonymous: The data/specimen sample was collected without knowing the identity of the participant. There is no chance of re-identification because identifiers are or were never collected. 
  • De-identified: The data/specimen sample was originally collected knowing the identity of the participant; however, identifiers were either 1) destroyed or 2) are received from another entity without identifiers. There is no chance of re-identification.

Identifiable

  • Coded: The data/specimen sample is assigned a unique random identifier that is stored separately and linked to participant identifiers. Re-identification is possible by using the link. Coded data / specimen samples are not de-identified until the link has been destroyed. 
  • Identified: The data/specimen sample will be directly identified with participant identifiers (e.g., name, medical record number, etc.)

New Element of Future Use

"All studies that involve the collection of identifiable private information and/or identifiable biospecimens must include a statement about whether or not there are any plans for future use of this information and/or specimens must be included." The consent form may not be silent on future use. Given this, one of the following statements must be included:

No future use: A statement that data, and if applicable specimens, will not be stored or distributed for future research studies; OR

Data / Specimens stored / shared without any link to identifiers: A statement that data, and if applicable specimens, will be de-identified, and could be stored and distributed for future research studies without additional informed consent; OR

Data / Specimens stored / shared with a link to identifiers: A statement that identifiable data, and if applicable specimens, will be stored and distributed for future research studies without additional informed consent. If identifiable data, and if applicable specimens, will be stored and shared the following additional elements of Broad Consent are required:

  • A statement about which identifiers will be retained and shared with data/specimens.
  • The types of institutions or researchers that might conduct research with the data/specimens.
  • A description of the period of time that the data/ biospecimens may be stored, maintained, and used for research purposes. If indefinite, this should be stated.
  • A general description of the types of research that may be conducted with the data/ specimens.
  • A statement regarding whether subjects will or will not be informed of the details of any subsequent research, and that they may not have chosen to consent to the future research.
  • A statement regarding whether clinically relevant research results, will be disclosed to subjects, and if so, under what conditions.
  • Specifically related to the future use: A description of: how confidentiality will be maintained during storage/ sharing, reasonably foreseeable risks and benefits of future research use, and who to contact with any questions about future use/storage and research related harms.

 

Additional Elements of Informed Consent [§46.116(c)]

New element for research involving diagnostic devices or testing 

  • A statement regarding whether clinically relevant research results, including individual research results, will be disclosed to subjects, and if so, under what conditions;

This applies to the any type of testing where individual results may be expected. This may include, but is not limited to, diagnostic psychological or neurological testing, testing of specimens using assays or other in vitro diagnostic tests, diagnostic imaging, results other diagnostic devices, etc. This section is applicable to all Penn schools and centers that may conduct testing that leads to clinically relevant results.

New element for research involving commercial profit

  • A statement that subject’s biospecimens (even if identifiers are removed) may be used for commercial profit and whether the subject will or will not share in this commercial profit;

The IRB recommends that this language specify that use of specimens may lead to commercial profit regardless of primary intent because it is often not known whether or not commercial profit could happen at some point in the future. For more information please read this article. This section may not include exculpatory language through which the subject is made to waive or appear to waive legal rights or the researchers from liability. For examples, see: www.hhs.gov/ohrp/regulations-and-policy/guidance/exculpatory-language-in-informed-consentdocuments/index.html

New element for research involving whole genome sequencing

  • For research involving biospecimens, whether the research will (if known) or might include whole genome sequencing (i.e. sequencing of a human germline or somatic specimen with the intent to generate the genome or exome sequence of that specimen)

The regulations specify "whole genome sequencing;" therefore, simply stating "genetic testing" does not meet the requirement set forth in the regulations. Whole genome sequencing involves analyzing a person's entire genetic code. 

Clinical Trial Informed Consent Form Posting [§46.116(h)]

The revised Common Rule requires posting of an unsigned clinical trial consent form for any research supported by federal funding. This applies to all clinical, educational, and social-behavioral research meeting the NIH Definition of a Clinical Trial. The prime awardee is responsible for compliance. The purpose of this requirement is to be more transparent about the consent forms being used and, over time, improve the quality of consent forms.

Requirements

For each clinical trial conducted or supported by a Federal department or agency, one IRB-approved [unsigned] informed consent form used to enroll subjects must be posted by the awardee or the Federal department or agency component conducting the trial on a publicly available Federal Website. The informed consent form must be posted on the Federal Website, after the clinical trial is closed to recruitment, and no later than 60 days after the last study visit by any subject, as required by the protocol.

If the Federal department or agency supporting or conducting the clinical trial determines that certain information should not be made publicly available on a Federal Web site (e.g. confidential commercial information), such Federal department or agency may permit or require redactions to the information posted.

Please visit https://www.hhs.gov/ohrp/regulations-and-policy/informed-consent-posting/index.html for information about consent form posting.

The Penn HRPP recommends posting unsigned, IRB-approved stamped copy on either ClinicalTrials.gov or Regulations.gov.

FEDERAL AGENCY HARMONIZATION

The Pre-2018 Common Rule did not require that agencies harmonize their guidance on application of the Common Rule.

The 2018 Common Rule states that guidance can only be issued after consultation with the other Federal departments and agencies that adopted the Common Rule, unless the consultation is not feasible.The final rule requires the Secretary of HHS to issue guidance to assist IRBs in assessing privacy and confidentiality protections.

The U.S. Department of Health and Human Services and fifteen other Federal Departments and Agencies have issued final revisions to the Federal Policy for the Protection of Human Subjects (the Common Rule).  

The Food and Drug Administration (FDA) has not yet revised its regulations, and the Department of Justice (DOJ) has not signed onto the revised Common Rule. Thus, the Pre-2018 Requirements currently apply to research that is FDA-regulated or DOJ-supported. For more information please click here

GUIDANCE ON APPLICATION TO CLINICAL DATA REGISTRIES

Section 511 of the Medicare Access and CHIP Reauthorization Act of 2015 (“MACRA”) requires HHS to provide guidance on how the Common Rule applies to clinical data registries. In an effort to provide such guidance, the preamble to the final rule states that the final rule does not apply to clinical data registry activities in the following circumstances:

  • Activities not conducted or supported by a Common Rule department or agency;
  • Activities that do not meet the definition of research, such as many quality improvement activities (for example, the creation of a registry designed to provide information about the performance quality of providers, and whose design is not influenced or altered to facilitate research, is not covered by the final rule even if it is known that the registry will be used for research studies);
  • Research studies that only involve obtaining and analyzing nonidentified information because it would not involve a “human subject”;
  • Activities that qualify for an exemption; or
  • Institutions that release identifiable private information obtained in the course of patient clinical care to a clinical data registry for research because it is not engaged in “human subjects” research.

COOPERATIVE RESEARCH STUDIES (SINGLE IRB / CENTRAL IRB / RELIANCE AGREEMENTS) - Effective January 19, 2020

A single IRB must approve cooperative studies for research (projects that involve more than one institution) conducted in the United States, except where:

  • More than a single IRB review is required by law (including tribal law); or
  • Research for which any Federal department or agency supporting or conducting the research determines and documents that the use of a single IRB is not appropriate.

The reviewing IRB ("IRB of Record") will be identified by the Federal department or agency supporting or conducting the research or proposed by the lead institution subject to the acceptance of such Federal department or agency.

The effective date for this provision is January 19, 2020. The NIH Single IRB (sIRB) requirement was effective as of January 25, 2018.

Please continue to refer to the How to Submit - Reliance Agreements page of this website for complete information about the process for requesting that the Penn IRB serve as the single IRB or requesting that the Penn IRB rely on another single IRB.

ELIMINATION OF GRANT REVIEW

The 2018 Requirements eliminate the requirement in the pre-2018 Requirements that grant applications or proposals for research undergo IRB review and approval for the purpose of certification. Certain sections of the grant may be requested by the IRB, however, if deemed necessary. Elimination of this requirement is not expected to reduce protections for human subjects because the research study (e.g. a research protocol) would remain subject to the requirement for IRB review and approval.

The 2018 Requirements at 45 CFR 46.103(d) require certification when the research is supported by HHS and undergoes expedited or convened IRB review. Under no condition shall research covered by 45 CFR 46.103 be initiated prior to receipt by HHS of the certification that the research has been reviewed and approved by the IRB.

Thus, for research to which the 2018 Requirements apply, the IRB must review and approve such research (e.g., a research protocol) for certification; however, the IRB no longer is required to review and approve the research grant application or proposal.