Some Thoughts on the New Common Rule for Human Subjects Research

On Jan. 18, 2017, in one of its last official acts, the outgoing Obama administration issued a final revised version of the Common Rule — the regulation that governs the treatment of human subjects in all federally funded research. This was the culmination of a process that began in 2011 when the Department of Health and Human Services  issued an Advance Notice of Proposed Rulemaking, or ANPRM, that envisioned major changes to the original 1991 Common Rule. Then, on Sept. 8, 2015, HHS and 15 other federal departments and agencies released a Notice of Proposed Rule Making (NPRM) that proposed specific changes to the Common Rule and opened a 90-day public comment period.

The NPRM’s proposed changes would have greatly altered the rules for human subjects research, especially regarding biospecimens. Among the most controversial of its proposals was the expansion of the definition of regulated “human subjects research” to include research using anonymous or deidentified human biospecimens. This is a critical point because research that does not involve human subjects at all is not subject to the Common Rule’s requirements. The comments from industry, research universities, and scientific and professional organizations were highly critical of some of the proposed changes. There was an evident division between (critical) hard science and (supportive) social science (anthropologists, for example) commenters; bioethicists were generally critical, but there were opinions on both sides. I previously reported on a withering critique of the biospecimen proposal from the National Academies of Sciences, Engineering, and Medicine, which argued that “continuing expansion of federal regulations on research is diminishing the effectiveness of the U.S. research enterprise.”

The Jan. 18 final version (the “Final Rule”) adopts some of the changes proposed in the NPRM and drops others, including the controversial expansion of the definition of “human subjects” to include non-identified biospecimens. The official text of the Final Rule appears here.

As you can see, this is a daunting 500-plus-page document. However, the complete text of the Final Rule appears at pp. 459-508, with an executive summary of the new provisions at pp. 360-362. The rest of the document consists of numerous tables (cost-benefit analyses and the like) required by law and a summary of and response to every public comment made in 2015.

There have already been numerous published summaries of the differences among the original Common Rule, the NPRM version and the Final Rule. The most comprehensive of these may be from the Council on Governmental Relations.  A second article, from the New England Journal of Medicine, summarizes and analyzes how the Final Rule differs from the NPRM from the medical research perspective. A third, from a higher education journal, focuses more on the social science perspective and links to several other analyses. A fourth piece, from Science, cites the bioethical critique of the new Final Rule.

Without trying to reinvent the wheel, here are some of the key provisions of the Final Rule that these sources point out:

• As I just noted, the Final Rule does not expand the definition of “human subjects research” covered by the Common Rule to include research using anonymous or deidentified human biospecimens.
• At the same time, the Final Rule allows the use of “broad consent” from a subject for storage of and secondary research on identifiable biospecimens.
• The Final Rule states an intent to streamline and simplify informed consent documents, though it does add some additional elements — including, interestingly, whether biospecimens will be used for commercial gain.
• The Final Rule expands the categories of research that are “exempt” from Common Rule regulation because of their low-risk profile — though, in something of an oxymoron, it provides that some of these exempt categories will now require limited review by an Institutional Review Board.

Is the Final Rule Really “Final”?

The answer here is a resounding “probably.” A 1996 law called the Congressional Review Act allows the House and Senate to eliminate new agency regulations by passing a joint resolution of disapproval within 60 days of being notified of a new rule. As with an ordinary bill, the resolution would be subject to presidential signature or veto. (President Obama vetoed five such resolutions — the only times the CRA has been used.) The 60-day period apparently expired on March 20 without any congressional action, though there is debate over what it means for Congress to be “notified.”

The new administration could announce yet another rulemaking — this one intended to modify or eliminate the Final Rule. The administration could also attempt to change the practical application of the Final Rule through informal “guidance.”

There is no reason to believe that any of these things will happen. The criticism of the NPRM did not follow partisan or ideological lines — just about everyone involved in research, from university medical centers to Big Pharma, opposed many of its provisions. The fixes reflected in the Final Rule seem pragmatic and not calculated to trigger political responses from either the legislative or executive branch. With the exception of some in the bioethics community, virtually all constituencies are supportive. And most importantly, no one in Congress or the administration has — as far as I can tell — expressed any interest or concern. So the prudent assumption is that the Final Rule really is final.

Why Are Some Bioethicists Unhappy?

Several prominent bioethicists have criticized the failure to require informed consent for research on anonymous or deidentified human biospecimens. Hank Greely of Stanford has called it “a predictable result of the disparity in lobbying power” between the research and subject communities. Another critic is Rebecca Skloot, the author of the best-selling “The Immortal Life of Henrietta Lacks,” about a poor African-American woman whose cells — without her knowledge or consent — gave rise to the HeLa cell line and, directly and indirectly, generated large amounts of money in which she and her descendants have never shared. A Lacks descendant has recently sued Johns Hopkins University in a belated effort to seek compensation. The suit faces many significant legal challenges — the biggest of which may be the statute of limitations.

What specific harms to subjects are the critics worried about? The possible harms seem to fall into three broad categories: privacy-related, emotional and financial. On the privacy issue, Skloot has noted that Lacks ultimately lost her anonymity, and that she and her family endured the public disclosure of personal medical information. That’s a rare event, as Skloot has acknowledged. In fact, it’s hard for me to see realistic invasion-of-privacy concerns in the current research environment, regardless of how the Common Rule treats biospecimens. When I ask the question — Is there a measurable probability that someone will have the means and motive to re-identify my DNA sample and then use that information to harm me? — my answer is no.

Skloot has also drawn on the Lacks family’s experience to catalogue the possible emotional harms, including “the shock of learning they were part of research” and being drawn into “debates over who controlled samples” and how those samples could be used. I wouldn’t judge someone else’s reaction to these consequences, but I would discount it by the current probability of similar things happening — and Skloot deserves much of the credit for bringing attention to the issue and thereby reducing that probability.

I think the most serious consequence is what Skloot has called “questions over profits.” A lot of people and institutions made money from Henrietta Lacks’s cells. She didn’t get any of it, and she was never told that the research was going on. The same thing has happened in a couple of other notorious cases, most infamously the 1990 California case of Moore v. Board of Regents. This bothers me. If I’m considering giving you a biospecimen and you think you might use it for money-making purposes, you should tell me. Some people might refuse your request outright; I would personally want the opportunity to negotiate for a piece of the action.

Curiously — to me — the research and bioethics communities have almost uniformly rejected the ideas that an informed consent document is a contract and, especially, that money can be used as an inducement to contribute a research biospecimen (though they do approve of token payments as compensation for the subject’s inconvenience). A few years ago, several colleagues and I published two articles advocating a contractual model for biospecimen contributions to biobanks. The key idea was a sliding scale of compensation: the more control over the sample that the subject ceded to the researcher, the more the subject would get paid.

The reaction, in print and at conferences where we presented the papers, was very negative. Allowing subjects to treat their DNA as a commodity seemed to be viewed as per se unethical. I remember one anonymous journal reviewer — who advocated rejecting the article — writing that we had totally ignored the lessons of the Henrietta Lacks case. We thought that we had come up with a way to prevent the same thing from happening in the future. The lesson I took away from the whole experience was that, to our critics, subject autonomy was little more than a rhetorical construct.

How Much Does the Final Shape of the Common Rule Really Matter?

At least with respect to research using biospecimens, the answer may be: not all that much. The reason is that many, many people are regularly consenting to the use of their biospecimens without ever becoming aware of it.

I owe this realization to Jean Cadigan, a medical anthropologist at UNC Medical School, who co-teaches my Biotechnology and Life Sciences course at UNC Law School. In a recent class, Jean led us through a fascinating exercise about consent to research in teaching and research hospitals (most use very similar forms, so these comments could apply to almost any university medical center). First, she showed us an elaborate, carefully crafted informed consent video used by a university-affiliated biobank. The biobank offers all the protections that the Common Rule requires and more. Then we looked at a specific consent for treatment form. By way of preamble, I should note that I and family members whom I’ve accompanied to various hospitals have had to sign this kind of document on several occasions in exigent circumstances. I’ve never read one — and I bet you haven’t either. I’m a lawyer and I teach this stuff, but the consent form is the last thing on my mind in the emergency room. I’ll scribble my name on anything they put in front of me just to get the treatment started.

But what would I find if I did read it? In the example we looked at, at the end of a long paragraph entitled “Consent for Use and Release of Information,” I’d see that the patient gives the hospital permission “to release any information about me, my health, the health services provided to me . . . (4) as otherwise described in the Notice of Privacy Practices and as permitted by law.” Then, if I dug up that Notice (as Jean did for our students), I’d find that the hospital (taking advantage of a HIPAA exception) asserts the right, “without [the patient’s] authorization or an opportunity to agree or object,” to use or disclose personal health information or “surplus specimens” (anything they take out of your body that they don’t put back in) as long as “the use and/or disclosure relates to research.”

The bottom line appears to be that, however the Common Rule treats biospecimens, the research world will still be awash in unwittingly donated — and not anonymized — tissue samples. This makes the anguish over the Final Rule, and the ethical aversion to our contractual model, seem like rearranging the deck chairs on the Titanic.