The revised Common Rule effective date is January 21, 2019.

The key provisions and changes that researchers at Penn will be expected to comply with are related to:

  • New and revised definitions
  • New exemption categories regarding secondary research
  • Elimination of Continuing Review
  • Revised Informed Consent Requirements
  • Harmonization with other agency guidance
  • Guidance on application to clinical data registries
  • Cooperative Research Studies (Single IRB / Central IRB / Reliance Agreements)

Please see below for detailed information about how each of these provisions will be applied to new research reviewed after 1/21/2019. 

Please also review the separate section which details how these provisions will be applied to existing research in an ongoing fashion.


IRB staff have been trained to implement the new common rule based on the composition of your research and will either apply the new rule during a routine review, or inform study teams that revisions are required to meet new requirements.

If you have recieved notice in a recent IRB determination letter that your research may qualify for re-assessment under the revised common rule as it relates to elimination of continuing review, please CLICK HERE TO DOWNLOAD a guidance document and follow the instructions to request a re-assessment. Please note all re-assessment requests must be submitted via HSERA modification.


The final rule provides new and revised definitions, including: “clinical trial,” “human subject,” “intervention,” “private information,” “identifiable private information,” “identifiable biospecimen,” “minimal risk,” “research,” and “written or in writing” (to include electronic formats).  

  • Clinical Trial - The final rule added the definition of “clinical trial,” which was not defined in the previous version of the Common Rule.  A clinical trial is “a research study in which one or more human subjects are prospectively assigned to one or more interventions (which may include placebo or other control) to evaluate the effects of the interventions on biomedical or behavioral health-related outcomes.”
  • Human Subject - The final rule expanded the definition of “human subject” to cover the collection of biospecimens (this does not include non-identified biospecimens).  The new definition includes “a living individual about whom an investigator, whether professional or student conducting research: (1) obtains information or biospecimens through intervention or interaction with the individual, and uses, studies, or analyzes the information or biospecimens; or (2) obtains, uses, studies, analyzes, or generates identifiable private information or identifiable biospecimens.”
  • Activities deemed not to be research - The final rule amended the definition of “research” to include four new activities that are deemed to not be “research”

      - Scholarly and journalistic activities (e.g. oral history, journalism, biography, literary criticism, legal research, and historical scholarship);

      - Public health surveillance activities;

      - Collection and analysis of information, biospecimens, or records for criminal justice or criminal investigative purposes; and

      - Certain activities in support of intelligence, homeland, security, defense, or other national security missions.

Penn Researchers should continue to refer to the How To Submit - Initial page of this website and utilize the guidance documents associated with the topic "Is IRB Review Required?" for assistance with determining whether a project is considered human subjects research.


The final rule introduced new exemption categories from certain aspects of the Common Rule that relate to secondary research, if certain conditions are met. Secondary research for which consent is not required under the Common Rule:

  • Research using protected health information (“PHI”) conducted by “covered entities” for “health care operations,” “public health activities,” or “research,” as those terms are defined under the Health Insurance Portability and Accountability Act (“HIPAA”) Rules.(This change is intended to eliminate duplication between the Common Rule and HIPAA, so HIPAA requirements will apply in these circumstances).
  • Storage or maintenance for secondary research use of identifiable private information or identifiable biospecimens when broad consent is obtained and if an IRB conducts a limited IRB review.
  • Other exemption categories include educational, benign behavioral interventions, and surveys/interviews.

The new exemption categories will be available for selection in HSERA during creation of a new protocol after the final rule is implemented. However the IRB will continue to make the final determination of appropriate categories upon approval.


The final rule eliminated continuing review for many minimal risk studies (non-clinical research; benign behavioral interventions, consumer preference surveys and research). Unless an IRB determines otherwise, continuing review of research is not required if the research:

  • Is eligible for expedited review;
  • Is reviewed by the IRB in accordance with the limited IRB review (new IRB regulatory category) procedure; or
  • Only involves data analysis (including analysis of identifiable information or identifiable biospecimens) or access to follow-up clinical data from procedures that subjects would undergo as part of clinical care.

The IRB must document the rationale for conducting continuing review if any of the above conditions are met. FDA still requires annual continuing review for FDA-regulated studies.

Studies that qualify for approval with no continuing review are still required to submit modifications and reportable events to the IRB for review.


The Common Rule Update includes changes to the information being presented during the consent process. 

1. Informed consent must begin with a focused presentation of key information. A link is provided below for our guidance template for developing a concise summary that meets the new regulatory requirements

2. For all studies that involve the collection of identifiable private information and/or identifiable biospecimens, a statement about whether or not there are any plans for future use of this information and/or specimens must be included. One of the following statements must be included:

  • A statement that data and, if applicable, specimens will not be stored or distributed for future research studies;


  • A statement that data and, if applicable, specimens will be de-identified, and could be stored and distributed for future research studies without additional informed consent;


  • A statement that identifiable data and, if applicable, specimens will be stored and distributed for future research studies without additional informed consent. If identifiable data/ specimens will be stored and shared, the following additional elements are required:

     - A statement about which identifiers will be retained with data/specimens.

     - A description of the period of time that the data/ biospecimens may be stored, maintained, and used for research purposes.If indefinite, please state this.

     - A general description of the types of research that may be conducted with the data/ specimens

     - The types of institutions or researchers that might conduct research with the data/specimens.

     - A statement regarding whether subjects will or will not be informed of the details of any subsequent research

     - Specifically related to the future use: A description of how confidentiality will be maintained during storage/ sharing, reasonably foreseeable risks and benefits of future research use, who to contact about future use/storage.

3. New element of consent for research involving diagnostic devices and/or testing of biospecimens

  • A statement regarding whether clinically relevant research results, including individual research results, will be disclosed to subjects, and if so, under what conditions;

4. Other new additional elements of consent for research involving the collection of identifiable biospecimens:

  • A statement that subject’s biospecimens (even if identifiers are removed) may be used for commercial profit and whether the subject will or will not share in this commercial profit;
  • For research involving biospecimens, whether the research will (if known) or might include whole genome sequencing (i.e. sequencing of a human germline or somatic specimen with the intent to generate the genome or exome sequence of that specimen)

The Penn IRB Biomedical and Social Behavioral Science consent form templates have been updated to include a section that outlines these new requirements. Additionally the Short Form Consent template in English has been updated to include the new required elements. Unfortunately, due to these changes, the foreign language short form templates are no longer available. Study teams will be responsible for obtaining their own translated versions of the short form based on the English version.

Penn Researchers are encouraged to utilize the IRB developed templates. Please see below to down load the new templates or visit the Forms and Templates page of this website to download these and other available templates;

5. Clinical Trial Informed Consent Form Posting

The revised Common Rule requires that for any clinical trial conducted or supported by a Common Rule department or agency, one consent form be posted on a publicly available federal website within a specific time frame.  The consent form must have been used in enrolling participants in order to satisfy this new provision. As of 2/15/19, OHRP has posted new preliminary guidance regarding publicly available websites for posting consent forms.

Please visit for information about consent form posting.

The Penn Human Research Protections Program will be working to develop a mechanism for confirming the posting of consent forms after more specific information, materials and guidance is provided from OHRP. 



The Common Rule previously did not require that agencies harmonize their guidance on application of the Common Rule. The final rule states that guidance can only be issued after consultation with the other sixteen Federal departments and agencies that adopted the Common Rule, unless the consultation is not feasible.The final rule requires the Secretary of HHS to issue guidance to assist IRBs in assessing privacy and confidentiality protections.


Section 511 of the Medicare Access and CHIP Reauthorization Act of 2015 (“MACRA”) requires HHS to provide guidance on how the Common Rule applies to clinical data registries. In an effort to provide such guidance, the preamble to the final rule states that the final rule does not apply to clinical data registry activities in the following circumstances:

  • Activities not conducted or supported by a Common Rule department or agency;
  • Activities that do not meet the definition of research, such as many quality improvement activities (for example, the creation of a registry designed to provide information about the performance quality of providers, and whose design is not influenced or altered to facilitate research, is not covered by the final rule even if it is known that the registry will be used for research studies);
  • Research studies that only involve obtaining and analyzing nonidentified information because it would not involve a “human subject”;
  • Activities that qualify for an exemption; or
  • Institutions that release identifiable private information obtained in the course of patient clinical care to a clinical data registry for research because it is not engaged in “human subjects” research.


A single IRB must approve cooperative studies for research (projects that involve more than one institution) conducted in the United States, except where:

  • More than a single IRB review is required by law (including tribal law); or
  • Research for which any Federal department or agency supporting or conducting the research determines and documents that the use of a single IRB is not appropriate.

The reviewing IRB ("IRB of Record") will be identified by the Federal department or agency supporting or conducting the research or proposed by the lead institution subject to the acceptance of such Federal department or agency.

The effective date for this provision is January 19, 2020. The NIH Single IRB (sIRB) requirement was effective as of January 25, 2018.

Please continue to refer to the How to Submit - Reliance Agreements page of this website for complete information about the process for requesting that the Penn IRB serve as the single IRB or requesting that the Penn IRB rely on another single IRB.