HHS overhauls human subjects protection regulations

Test tubes closeup medical glassware

FDA Alert

Life Sciences Alert


The Department of Health and Human Services recently issued a final rule updating the requirements for all clinical research conducted or supported by the US federal government, widely referred to as the "Common Rule." The proposed rule, issued in 2015, received more than 2,100 comments. Although the final rule is significantly more modest in scope, and did not adopt a number of changes that had been proposed, the final rule did make substantive modifications to the framework for protecting human subjects of research.  

The Common Rule has its roots in regulations first issued in the 1970s, following widely publicized abuses of vulnerable human subjects in the United States and elsewhere. Codified at 45 C.F.R. Part 46 and adopted by 16 federal departments and agencies,  the regulations have been little altered for more than two decades − a period that has seen substantial changes in how medical research is conducted. 

These changes, in turn, have sparked debate about whether existing protections for human subjects are at once over- and under-inclusive.  In particular, with the increased accessibility to large databases containing identifiable private information (e.g., in electronic medical records), and the ability to apply sophisticated analytical methods to biospecimens stored in biorepositories, there has been increased concern about protecting research participants from privacy risks.  At the same time, there has been recognition that seeking individualized consent for the use of stored data on a study-by-study basis would be infeasible.

As explained by HHS, the goal of the final rule was to both more thoroughly address the broader types of research now conducted or supported by the federal government, while at the same time eliminating requirements not well-tailored to the type of risks faced by today's research participants, thereby reducing unnecessary burdens and streamlining the conduct of research. 

To that end, the final rule mandates a number of changes to the content and format of information that must be included in "informed consent" documents in order to facilitate prospective subjects' comprehension of the risks and benefits of participation and enhance transparency regarding potential benefits of participation.

The Common Rule also makes explicit existing policy with respect to the use of deidentified biospecimens and information, while establishing new policy regarding the use of identifiable private information and identifiable biospecimens (IPI/IB).  The Common Rule defines "human subject" such that the use of previously collected, deidentified biospecimens is clearly excluded from the scope of human subjects research. Furthermore, the secondary research use of identifiable information and biospecimens is expressly exempt from most requirements of the Common Rule, although review by an institutional review board (IRB) may be required under specified circumstances.  Additionally, changes to informed consent give researchers a new option to seek "broad," i.e., one-time, consent for all future research uses of IPI/IB, provided certain information is included in the informed consent documents.  While subjects may decline to give broad consent, once consent is given, researchers are not required to seek additional consent for any future research use of the subject's IPI/IB.

The final rule also makes a number of IRB-related changes. In particular, it authorizes federal departments and agencies to take enforcement action against independent IRBs, and requires single-IRB review for most collaborative (i.e., multi-institution) research conducted in the United States.

Finally, the final rule requires that consent documents from clinical trials covered by the Common Rule be posted to a public database that will be established for this purpose.

The chart below highlights key changes that were made to the Common Rule in furtherance of these goals, along with their specific rationale and effect.

Who will be affected?

The Common Rule will most directly affect the activities and operations of institutions and individual researchers whose research activities are conducted at or supported by one of the 16 "Common Rule" agencies.  Although FDA is not a signatory to the Common Rule, life sciences companies should be aware that the 21st Century Cures Act, enacted in 2016, directs harmonization of FDA's separate regulatory framework for human subjects protection with those of the Common Rule by 2020.  A number of the changes − in particular those that facilitate the research use of biospecimens − could facilitate research by pharmaceutical and medical device companies if adopted by FDA.

The effective date of the final rule is January 19, 2018, except for the provision § __.114(b) governing cooperative research, which is January 19, 2020. Ongoing research studies that were initially approved by an IRB prior to that date, for which IRB review was waived, or that were determined to be exempt will not be required to comply with the new requirements, but institutions may choose, on a study-by-study basis, whether to comply with the final rule requirements.

Find out more about the Common Rule by contacting the author.

Key Changes to Common Rule

Section Number1




Common Rule departments and agencies may enforce compliance directly against independent IRBs (i.e., those IRBs that are not operated by an institution with a Federalwide Assurance)

Places responsibility for meeting relevant regulatory requirements on the IRB of record and protects institutions that rely on an IRB that they do not operate.


Implements new definition of "human subject" to include an individual from whom an investigator (1) obtains, uses, studies and analyzes "information or biospecimens" through intervention or interaction with the individual, or (2) obtains, uses, studies, analyzes, or generates "identifiable private information or identifiable biospecimens."

Defines "identifiable biospecimen" and "identifiable private information" as a biospecimen or private information "for which the identity of the subject is or may readily be ascertained by the investigator" or associated with the information or biospecimen. 

Requires Common Rule departments and agencies, collaboratively and in consultation with experts, to reexamine these definitions at least every four years.

The explicit reference to "information," "identifiable private information," "biospecimen" and "identifiable biospecimen" (as opposed to the prior rule's generic term "data") is intended to clarify existing policy with respect to research using information and biospecimens. The new rule makes explicit that an individual can be a "human subject," even in the absence of direct interaction with a researcher, if the individual's identifiable private information or identifiable biospecimen is used. 

The requirement to reexamine these definitions periodically takes into account the fact that new analytical technologies may enable reidentification of information and biospecimens currently considered nonidentifiable.





Removes from the definition of "research" the following four additional categories of research:

1. Scholarly and journalistic activities − (e.g., oral history, journalism, biography, literary criticism, legal research, and historical scholarship) that collect and use information relating to specific individuals

2. Public health surveillance –includes collection and testing of information and biospecimens that is conducted, supported, requested, required, or authorized by a public health authority and that is necessary to allow such authority to identify, monitor, assess, or investigate potential public health signals, disease outbreaks, or conditions of public health importance

3. Criminal justice activities, including collection and analysis of information, biospecimens, or records by or for a criminal justice agency or activities authorized by law or court order solely for criminal justice/investigative purposes

4. Authorized operational activities (as determined by each agency) in support of intelligence, homeland security, defense, or other national security missions

Makes explicit that these activities are not considered research under the Common Rule, thereby resolving existing ambiguity about whether these activities must comply.


Modifies existing exemptions and expands the categories of research exempted from the Common Rule. In particular:

 - Differentiates between educational testing, interviews and behavioral observations that are conducted in "established or commonly accepted educational settings," and those that are not, and requires limited IRB review for such research when conducted in another setting if identifiable information is collected

 - Establishes new exemption for "benign behavioral interventions" in adults, and requires limited IRB if collected information is identifiable

- Establishes new exemptions from the Common Rule for secondary use of identifiable private information and identifiable biospecimens.  In some situations, no informed consent or IRB review is not required, while in others "broad consent" and limited IRB are required

- Informed consent is not required for the secondary use of identifiable private information or identifiable biospecimens  if one of the following criteria are met: (1) the information or biospecimens are publicly available; (2) the information is recorded in such a manner that identity cannot be readily ascertained directly or through identifiers linked to the subjects; (3) the secondary research activity is regulated under HIPAA; or (4) the secondary research activity is conducted by or on behalf of a federal entity and involves the use of federally generated nonresearch information, provided that the original collection was subject to specific federal privacy protections and continues to be protected

Expands exemptions from most Common Rule requirements for non-interventional or minimally-interventional research, thereby decreasing administrative burdens, while retaining the requirement for limited IRB review and broad consent when necessary to protect subjects from risks related to collection and use of identifiable information and biospecimens.


Requires any institution located in the US that is engaged in cooperative research (i.e., research that involves more than one institution) to rely on the approval by a single IRB for that portion of the research that is conducted in the US, unless more than single IRB review is required by law or the department or agency conducting or supporting the research determines and documents that the use of a single IRB would be inappropriate.

Intended to decrease administrative burdens and inefficiencies for investigators and institutions.


Adds specificity regarding the format and content of informed consent document.

Intended to enhance comprehension and ensure that prospective subject understands the risks and benefits of participation.


Expands the "basic" elements that must be included in informed consent documents to include information. For research involving collection of identifiable private information or identifiable biospecimens, consent must include either (1) a statement that identifiers might be removed and that deidentified information or biospecimens could subsequently be used by for future studies or distributed to another investigator without additional consent; OR (2) a statement that a subjects information or biospecimens, even if deidentified, will not be used or distributed for future research.  

Expansion of basic elements increases transparency and gives prospective subjects useful information about whether their identifiable private information or identifiable biospecimens might be stripped of identifiers and used for future research studies or distributed to another investigator for future research studies without additional informed consent.


Adds new "additional elements" that must be included in consent documents, to the extent applicable:

- a statement that subject's  biospecimens (whether or not identifiers are removed) may be used for commercial profit and whether they will share in that profit

- a statement regarding whether and under what conditions clinically-relevant research results will be returned and

- For research involving biospecimens, whether the research will or might include whole genome sequencing

Gives greater transparency to subjects regarding potential benefits of participation – specifically with respect to whether subject will benefit commercially from the research use of their biospecimens and whether they will be receive research results.

Additional disclosure regarding the use of whole genome sequencing is necessary because whole genome sequencing generates an extremely large amount of data that, when analyzed, can have implications for the subject and his or her family members.


Adds new provision permitting researchers to request "broad consent"(i.e., consent for future use in other research) not research project specific) for the secondary use of identifiable private information or identifiable biospecimens

Establishes 12 new elements (some of which overlap with the "additional elements" in subsections (b) and (c)) that should be included in informed consent document where broad consent is sought from subjects.  These include:

     -  A general description of the types of research that may be conducted with the IPI/IB

     - A description of the IPI/IB that might be used, whether sharing might occur, and the types of institutions or researchers that might conduct the research

     - A description of the period of time that that the IPI/IB may be stored, maintained, and used for research (which could be indefinite)

     - A statement (if applicable) that the subject will not be informed of the details of any specific research studies that might be conducted and that subject might have chosen not to consent to some of those studies

Where appropriate, the broad consent must state whether the research will or might include whole genome sequencing, and must include a general description of the types of research that may be conducted with the identifiable private information or identifiable biospecimens.

Broad consent gives researchers an option (additional to seeking a waiver of consent from an IRB) for the secondary use of identifiable private information and identifiable biospecimens, while ensuring that subjects are made aware of, and given the opportunity to decline consent, for such uses.


Requires IRB-approved informed consent documents from clinical trials conducted or supported by a Common Rule department or agency   to be posted to a publicly available federal website that will be established as a repository.

Requiring consent documents to be posted is intended to increase transparency and facilitate the development of more informative consent forms. 

1 Because multiple departments and agencies will codify the new rule into their own regulations, the volume number (Title) of the Code of Federal Regulations (CFR) will vary and, consistent with format used in the Federal Register, we have left the volume number blank in this table.