HHS Contemplates Extensive Changes to the “Common Rule” Governing Human Subjects Research

In the July 26, 2011, Federal Register, the U.S. Department of Health and Human Services (HHS), in coordination with the Office of Science and Technology Policy, published an advanced notice of proposed rulemaking (ANPRM): Human Subjects Research Protections: Enhancing Protections for Research Subjects and Reducing Burden, Delay and Ambiguity for Investigators.[1]  This ANPRM[2] proposes changes to the regulations governing research on human subjects, frequently referred to as the “Common Rule” because 15 federal departments and agencies have adopted these regulations as the uniform standards for the protection of human subjects.  HHS is proposing these changes in order to strengthen protections for human research subjects, particularly with regard to informed consent and the collection and protection of data.  Entities such as sponsors of clinical trials, investigators and institutional review boards (IRBs) will be most affected; however, even organizations that are only tangentially tied to human subjects research, such as firms that handle data analysis or storage and develop software used in clinical trials, will likely feel the impact as well.  The ANPRM process offers stakeholders a critical opportunity for dialogue with the agency regarding possible changes before a proposed rulemaking is issued.  Comments on the ANPRM are due by September 26, 2011

Evolution of the Common Rule

The Common Rule was initially adopted in 1991, when a research study was typically conducted at a single site, usually an academic medical center.  In the last 20 years, the volume of human research studies has grown dramatically, and the studies have undergone significant changes.   Many studies are now conducted across multiple sites and outside of academic medical centers at outpatient clinics, community hospitals and other nontraditional venues.  More numerous and varied entities, from clinical research organizations (CROs) to community organizations to data analysts, are now involved in human subjects research, which was previously handled only by sponsors and investigators.   Further, technological advances, such as the Internet, sophisticated computer programs, new research methods and mobile applications have exponentially increased the volume of data available and the possibility to manipulate, analyze and share that data.  

These changes have created ambiguities and raised questions of efficiency and effectiveness in the application of the Common Rule.  The Federal Register notice provides a brief history of federal regulation of human subjects research and how this research has now surpassed the Common Rule’s ability to effectively and efficiently regulate these kinds of studies. 

Proposed Categories of Revisions to the Common Rule


The ANPRM categorizes concerns about the Common Rule into seven key areas and considers changes in response to those concerns, working toward the goal of enhancing “the effectiveness of the research oversight system by improving the protections for human subjects while also reducing burdens, delays, and ambiguity for investigators and research subjects.”[3]  Specifically, HHS has proposed and is seeking feedback on making changes in these seven areas:

1. revising the existing risk-based framework to more accurately calibrate the level of review to the level of risk

2. using a single IRB for all domestic sites of multisite studies

3. improving the forms and processes used to obtain informed consent

4. establishing mandatory data security and information protection standards for all studies involving identifiable or
    potentially identifiable data

5. implementing a systematic approach to the collection and analysis of data on unanticipated problems and adverse events
    across all trials to harmonize the complicated array of definitions and reporting requirements and to make the collection of
    data more efficient

6. extending federal regulatory protections to apply to all research conducted at U.S. institutions receiving some funding
    from any Common Rule agency for research with human subjects

7. improving the harmonization of regulations and related guidance.

Each of these areas of concern is fleshed out in its own section of the ANPRM.  The ANPRM provides rationales to support the changes contemplated and poses an extensive series of specific questions—74 in all across the seven issue areas. 

Important impacts that revisions to the Common Rule in the contemplated areas of concern could have on human subjects research include—

  • A more rational, risk-based framework for IRB review would allow IRBs to focus on high-risk research while removing some requirements that do not appreciably contribute to protecting human subjects.  All U.S. sites in a study would have a single IRB of record.
  • Researchers could be required to obtain written consent from participants in order to use their biospecimens for any future research, and participants could exclude specific types of future research from that consent.
  • Standardized informed consent templates would help ensure research participants are more uniformly informed and facilitate IRB review of consent forms.
  • Adverse event reporting would be harmonized across all agencies, and research entities would report all adverse events electronically on a single Web site that would collect and store the data in a single database.
  • Many more studies may need to be conducted in compliance with the Common Rule, as HHS is considering extending Common Rule protections to all research studies conducted at any domestic institution that receives any federal funding for human subjects research from a Common Rule agency.

Significance of Efforts to Address Tensions Between the Common Rule and HIPAA

Efforts to harmonize the Common Rule with HIPAA[4] provide a good example of the lengths to which federal regulators seem willing to go to address fundamental and often philosophical concerns that have been simmering in the research community.

While both the Common Rule and HIPAA seek to protect individual rights, problems stemming largely from coverage gaps, use of inconsistent terms and constructs, and struggles to keep pace with changes in technology have frustrated researchers as well as individual research participants.  HIPAA applies to some—but not all—researchers.  HIPAA constructs for determining when information is de-identified differ from those historically applied in the human subjects research setting.  With changes in technology, data and biospecimens previously considered anonymized are actually identifiable.  The two regimes were often particularly at odds with respect to requirements concerning future research:  The Common Rule analysis might yield the conclusion the effort would not even constitute human subjects research, while the HIPAA privacy rule might call for authorization from the individual. 

Through the ANPRM, as well as a notice of proposed rulemaking issued in summer 2010 to update the HIPAA regime consistent with the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009, HHS is engaging directly on a number of key issues in hopes of easing tensions between the Common Rule and HIPAA.  For example, HHS posits—

  • Question 45:  Under what circumstances should future research use of data initially collected for non-research purposes require informed consent?  Should consent requirements vary based on the likelihood of identifying a research subject?  Are there other circumstances in which it should not be necessary to obtain additional consent for the research use of currently available data that were collected for a purpose other than the currently proposed research?
  • Question 47:  Should there be a change in the current practice of allowing research on biospecimens that have been collected outside of a research study (i.e., “left-over” tissue following surgery) without consent, as long as the subject’s identity is never disclosed to the investigator?
  • Question 49:  Is it desirable to implement the use of a standardized, general consent form to permit future research on biospecimens and data?  Are there other options that should be considered, such as a public education campaign combined with a notification and opt-out process?
  • Question 55:  Will use of the HIPAA Privacy Rule’s standards for identifiable and de-identified information, and limited data sets, facilitate the implementation of the data security and information protection provisions being considered? Are the HIPAA standards, which were designed for dealing with health information, appropriate for use in all types of research studies, including social and behavioral research? If the HIPAA standards are not appropriate for all studies, what standards would be more appropriate?
  • Question 62:If investigators are subject to data security and information protection requirements modeled on the HIPAA Rules, is it then acceptable for HIPAA covered entities to disclose limited data sets to investigators for research purposes without obtaining data use agreements?
  • Question 63: Given the concerns raised by some that even with the removal of the 18 HIPAA identifiers, re-identification of de-identified datasets is possible, should there be an absolute prohibition against re-identifying de-identified data?

Through this ANPRM, HHS is expanding the dialogue in hopes of improving alignment between the Common Rule and HIPAA. 


Material changes to the Common Rule could have a serious impact on entities engaged in human subjects research.  Further, any changes to the Common Rule have the potential to trickle down to entities that must comply with HIPAA regulations or related Food and Drug Administration (FDA) regulations, which, as the ANPRM notes, will likely need to be harmonized with any revisions to the Common Rule. 

This ANPRM is part of a larger debate.  In addition to comments received in response to this ANPRM, HHS will take into account the Presidential Commission for the Study of Bioethical Issues and consider the comments received earlier this year in response to the Commission’s request for comments on the current federal and international standards for protecting the health and well-being of participants in the scientific studies supported by the federal government.[5]  Once HHS has considered these sources, it will then propose specific revisions to the Common Rule in a notice of proposed rulemaking and seek additional public comment before issuing a final rule.  Those affected by the contemplated changes to the Common Rule should engage in this debate, and this ANPRM provides an important forum for voicing concerns.


[1] 76 Fed. Reg. 44,512 (July 26, 2011).

[2] An ANPRM can precede a Notice of Proposed Rulemaking when an agency needs input from the public on various issues before issuing a proposed rule.  As such, this ANPRM presents possible changes to the Common Rule and seeks comments on those changes and other related issues.  The agency will then respond with a proposed rule with its own comment period before issuing a final rule.

[3] 76 Fed. Reg. at 44,514.

[4] The Health Insurance Portability and Accountability Act of 1996 (HIPAA) protects individually identifiable health information and sets national standards for the security of electronic protected health information.  HIPAA regulations are found at 45 CFR 160, 162 and 164.

[5] 76 Fed. Reg. 11,482 (March 2, 2011) available at http://www.gpo.gov/fdsys/granule/FR-2011-03-02/2011-4658.

Contact Information

If you have any questions regarding this alert, please contact— 

Jo-Ellyn Sakowitz Klein
Washington, D.C. 

Elizabeth H. Goldman
Washington, D.C. 

Emily K. Strunk
Washington, D.C. 

Anna Dolinsky
Washington, D.C.