Improved regulations to protect human research subjects would better protecting study participants

Last updated in 1991, the Federal Policy for the Protection of Human Subjects, popularly known as the Common Rule, outlines basic regulations for participation of human subjects in biomedical and behavioral research. Since that update, however, rapid advances in technology and the increasing volume of data available on individuals have changed the landscape for investigators and Institutional Review Boards (IRBs). The ANPRM addresses how the Common Rule may need to be revised to more effectively protect research subjects and promote important research.

To first determine if research activities fall within the scope of the Common Rule, the report recommends that HHS define "human subjects research" as a systematic investigation designed to develop or contribute to generalizable knowledge that involves direct interaction or intervention with a living individual or that involves obtaining identifiable private information about an individual. Only research that fits this definition should be subject to IRB procedures and the Common Rule.

Building on this definition, HHS should also clarify that research which relies on publicly available information, information in the public domain, or information that can be observed in public contexts does not meet the definition of human subjects research -- regardless of whether the information is personally identifiable -- as long as individuals whose information is used have no reasonable expectation of privacy. This includes digital data, some types of administrative records, and public-use data files that have been certified as protected against disclosure.

Once defined as "human subjects research," studies should be put in one of three review categories -- excused research, expedited review, or full review -- already outlined in the ANPRM.

Excused research.

The committee that wrote the report supported the ANPRM's proposal for a new "excused" category, where studies do not require IRB review if they involve only informational risk that is no more than minimal. Examples of excused research could include use of pre-existing data with private information, or benign interventions or interactions that involve activities familiar to people in everyday life, such as educational tests, surveys, and focus groups. The report notes that because the primary risk in most social and behavioral research is informational, much of this research would qualify as excused under the new regulations. In line with an ANPRM suggestion, the committee recommended that excused research remain subject to some oversight; investigators should register their study with an IRB, describe consent procedures, and provide a data protection plan. A very small sample of excused studies could be audited, to provide accountability. After it is registered, an excused study could begin within a week.

Expedited review.

As outlined in the ANPRM, research that might otherwise qualify as excused may be subject to expedited review if the study requires more consideration of human subjects protections because of the nature of the research procedures combined with the characteristics of the subject population. HHS should specify that studies with the potential for causing psychological or physical harm to participants but whose risk can be minimized by additional procedures can be subject to expedited review, the report says. The committee recommended that HHS define minimal risk as the probability and magnitude of physical or psychological harm that does not exceed that which is ordinarily encountered in daily life or in the routine medical, psychological, or educational examinations or tests of the general population. Expedited review would be recommended to take no more than two weeks.

Full review.

If the probability is high that participants will experience a greater than minimal risk of harm and that risk cannot be mitigated by risk-minimizing procedures, a full IRB review is required, the report says. Neither the committee nor the ANPRM propose major changes to the category of full review. However, to avoid overestimation of risk, expedited review should be considered the default procedure for social and behavioral science research that is not in the excused category. Full board reviews will occur monthly, and IRBs will provide feedback within 10 days of the meeting.

The committee did not support the ANPRM suggestion to use the Health Insurance Portability and Accountability Act (HIPAA) as the standard for specifying data protection plans with respect to social and behavioral research. It argues that neither the privacy nor the security rules outlined in HIPAA is sufficient to maintain the confidentiality of research participants' information beyond limiting access to authorized users. HIPAA fails to strike the balance between protecting data and promoting worthwhile research, and also fails to protect some forms of de-identified data, to accurately quantify risk, and to account for the value of social and behavioral research. However, the committee agreed with the ANPRM in stating that the best way to protect human subjects while minimizing regulatory burden on IRBs and researchers is by using protection against disclosure that is appropriate to the level of risk. It recommended an array of data protection approaches to fit the specific needs of the research.

The committee supported the ANPRM's efforts to improve comprehension of the informed consent process, but HHS should afford greater flexibility to investigators and IRBs. For example, consent forms should be shortened so that participants better understand to what they are consenting, but HHS should eliminate regulations that favor written informed consent. Oral or implied consent (if a participant reads through a letter outlining consent provisions, for example, and proceeds with a questionnaire) should be acceptable if appropriate to the study context. Similarly, obtaining consent from adults with limited decision-making capabilities should not necessarily require more oversight, as it does under the ANPRM. Instead, HHS should provide guidance for investigators on how to make the informed consent process appropriate for this population. The report also recommends HHS remove any requirement for re-consent for future use of existing research or publicly available data that does not identify an individual. Consent should only be obtained when investigators wish to link pre-existing identifiable data to the collection of new data.

More research is needed on how best to implement these regulations, including additional research to better measure physical, psychological, and disclosure risks and to determine new methods for limiting these risks. The committee also recognized the need for federal investment in research by science and federal statistical agencies, directed to such issues as data innovation and collection.

Access to the report can be found at: http://www.nap.edu/catalog.php?record_id=18614