Human Subject Research Protections: BIO Comments on HHS ANPRM on Human Subjects Research Protections (Common Rule)

Dear Dr. Menikoff:    

The Biotechnology Industry Organization (BIO) thanks the Department of Health and Human Services (HHS) and the Food and Drug Administration (FDA) for the opportunity to submit comments on the Advanced Notice of Proposed Rulemaking (ANPRM) on "Human Subjects Research Protections: Enhancing Protections for Research Subjects and Reducing Burden, Delay, and Ambiguity for Investigators," published in The Federal Register on July 26, 2011. 

BIO represents more than 1,100 biotechnology companies, academic institutions, state biotechnology centers and related organizations across the United States and in more than 30 other nations.  BIO members are involved in the research and development of innovative healthcare, agricultural, industrial and environmental biotechnology products, thereby expanding the boundaries of science to benefit humanity by providing better healthcare, enhanced agriculture, and a cleaner and safer environment. 

BIO applauds HHS for undertaking this effort to modernize the "Common Rule," seeking to enhance protection of human subjects while promoting research.  We embrace many of the goals outlined in the ANPRM, especially changes that would help facilitate the critical medical research performed by BIO member companies.  Decades of responsible science under the Common Rule has shown that advancing research and strong human subject protections are mutually attainable goals.  BIO has advocated in the past for reexamining the Common Rule to ensure that it still provides the comprehensive protection for research participants that is integral to the conduct of high quality research.[1]

BIO believes that appropriate regulation of biotechnology is solidly rooted in values such as autonomy, privacy, beneficence, social justice, and intellectual freedom.  BIO's Statement of Ethical Principles articulates these values.[2]  BIO has long supported responsible and ethical testing, protection of individual privacy and genetic information, and regulatory systems that best serve humanity and advance research into new treatments for patients.  BIO recognizes that research participants are volunteers, and believes that decisions regarding whether and how to use medical products and technologies must always be made with profound respect for patients' rights. 

General Comments:

The ANPRM raises many challenging issues and complexities, particularly given the interface of other statutes and regulations with the Common Rule, including the Health Insurance Portability and Accountability Act (HIPAA)[3] and laws and regulations administered by the FDA.  BIO urges HHS to carefully consider how proposed changes to the Common Rule will align with these distinct regulatory frameworks.  HHS’ stated goals of streamlining requirements and facilitating research are laudable, and should be reflected in the end product of this effort to prevent establishment of a new oversight system that ultimately increases burdens on research.  To further HHS’ stated goal of reducing ambiguity for investigators, it is also critical that proposed and final regulations provide clarity to all participants in the research community to assure that regulatory advances can be adopted without confusion.   

BIO’s comments focus on several issues addressed in the ANPRM that would have significant impact on our biopharmaceutical company members.  These issues are: prospective application of proposals; consent for use of biospecimens and data; characterization of identifiable and de-identified data; Institutional Review Board (IRB) centralization; harmonization of rules; informed consent; and collection of safety data. 

BIO’s comments on these issues are discussed below, and our responses to certain specific questions raised in the ANPRM are included in the attached chart.

I.                   Prospective Application of Proposals

The ANPRM proposes significant changes that will impact the research use of biospecimens and data sets in several ways:

·         how, whether, and when informed consent shall be collected;

·         what security and information protection standards will apply;

·         and, ultimately, what biospecimens and data will be available for use in critical research, much of which seeks to develop new treatments and cures for serious and life-threatening diseases. 

The ANPRM suggests that any such changes to the Common Rule should be adopted prospectively only—so that such changes would apply only to biospecimens and data collected after the effective date of a final rule.  BIO wholeheartedly agrees with this aspect of the ANPRM, and believes that prospective application is necessary to assure that biospecimens and data existing at the time a regulation is finalized can continue to be used in research, not wasted or destroyed, and that current research efforts are not thwarted. 

Biospecimens have been collected, stored, and used for important biomedical research for decades.  As noted in the ANPRM, specimens and data collected for uses other than a particular research use are often an important source of information and material for investigators.  Such subsequent use is an efficient mechanism for conducting research without presenting additional physical or psychological risks to the research subject.[4]  A July 25, 2011, New England Journal of Medicine (NEJM) article authored by two of the primary participants in the process of reassessing the Common Rule further states that millions of biospecimens exist that have been collected under current rules.[5]  The potential loss of availability of such an enormous volume of biospecimens, as well as data sets could be devastating to ongoing research.  In many cases, the research subject may no longer be alive, or the biospecimen or information may be completely disassociated from identifying information, making it impossible to obtain informed consent from the prior subjects.  Eliminating the ability to conduct research involving the use of such existing materials—collected in compliance with rules that governed at that time—would have significant implications for both the quantity and quality of future research.  It could create a future research environment where many biospecimens collected over the past several decades would not be available for research.  Comparative research would be limited because there would be few existing biospecimens available to serve as a baseline or comparison to biospecimens collected in the future.  Researchers would face similar limitations when seeking to use data collected in the years prior to the effective date of a future final rule.  Accordingly, BIO strongly supports the ANPRM proposal that the rules governing collection and use of biospecimens and data instituted by new regulations only apply prospectively.

Additionally, in discussing the applicability of any future regulatory changes, it is important that the terms surrounding the grandfathering of previously collected biospecimens and data, as well as prospective application of new rules, be defined and used consistently.  The terms “primary and secondary" and “initial and future” appear to be used interchangeably in the ANPRM.  This creates confusion regarding exactly which activity or timeframe applies to the use of each of these terms.  For example, “primary” research can be conducted in the future.  BIO recommends the use of the terms “primary and secondary” research be employed to distinguish between the use of samples and data used for the purpose for which they were originally collected (primary), in contrast to the same samples and data used for a purpose other than that for which they were initially collected (secondary).  There is also some confusion regarding the use of the terms “existing” and “pre-existing.”  Clarity around the use of these terms is also necessary to provide specificity and consistency as to what term will be used to refer to samples or data collected prior to the effective date of a new rule.

II.                Consent Practices for Research Use of Biospecimens

Researchers often use biospecimens from patients.  Sometimes these are collected for clinical purposes, such as during a particular encounter with an institution (hospitalization), while other times they are explicitly collected for research purposes (excess pathological specimens).  The ANPRM proposes to require written consent for future research use of biospecimens regardless of whether the specimens were originally collected for a research or non-research purpose.  This consent, which can be a general consent obtained when the biospecimens are collected, can be for all future research, including developing treatments or research to learn about genetic diseases.

This would be a change from current rules, which allow research without consent when biospecimens are used for research under conditions where the researcher cannot identify the person whose biospecimen is being studied.  Current regulations allow for exemption from IRB review for research involving the collection or study of existing data, pathological specimens, or diagnostic specimens if these sources are publicly available, or if the information is recorded by the investigator in such a manner that the subjects cannot be identified.  The proposed revision is that research that only involves use of biospecimens collected for other purposes does not need IRB review if there is consent.  Thus, the proposal also envisions that consent is necessary, even if the biospecimen itself is not associated with any identifiers.

The ANPRM raises the question of whether biospecimens are inherently identifiable.  Some believe that DNA extracted from de-identified biospecimens can be sequenced and analyzed in other ways, with the results sometimes being linked to other available data that may allow a researcher to identify the persons whose specimens were being studied.  They point to the increasing number of DNA databases that are available (mostly for law enforcement).

BIO does not believe biospecimens are inherently identifiable; a researcher cannot tie the specimen to an individual without a database that specifically links biospecimens to individuals.  DNA is non-identifiable unless a reference database or similar available record source that links the DNA to individual identities exists and is accessible to the researcher.

BIO strongly supports the provision that would allow general consent at the time of collection because it strikes the right balance between protecting research subjects and facilitating research.  It is often impossible at the time of the initial biospecimen/data collection to understand the range of analyses that researchers may wish to perform on such biospecimens/data in the future.  Therefore, BIO supports the proposal's provisions permitting a general open-ended consent at the time a specimen is collected.  In addition, where consent was not obtained, research should be permitted if the researcher obtains a waiver from an IRB or privacy board.

The ANPRM also asks for comment about whether patients/research subjects should have the ability to "opt out" of certain types of future research.  In BIO's view, tracking different consents for different types of future research would be burdensome.  The advantage of permitting general consent for future research is that it provides needed flexibility for researchers.  This benefit would be mitigated were patients given the option to opt out of certain future studies.  Of course, the consent obtained for future research would be voluntary.  At the time of collection and request for consent research, subjects/patients would have the option to refuse to allow researchers access to their biospecimens.

III.             Consent Practices for Research Use of Data

The ANPRM also proposes changes in the rules for use of patient data.  For data originally collected for non-research purposes, as is currently the rule, written consent would only be required if the researcher obtains information that identifies the subjects.  If the data were originally collected for research purposes, consent is required regardless of whether the researcher obtains identifiers.  As a practical matter, that means a researcher will not be able to strip identifiers from the data and then use the information for future research without consent.

BIO supports the ANPRM’s proposal to require consent to use data originally collected for research purposes.  As with biospecimens, this can be a general consent obtained when the information is originally collected, and it can provide consent for future research.  Also consistent with BIO’s views regarding biospecimens, if consent is not obtained, a researcher can use the data if he or she obtains a waiver from the IRB.

Regarding research use of data originally collected for non-research purposes, BIO believes consent should only be required if the researcher obtains information that identifies the research subjects or is identifiable.  Thus, no consent would be required if the data is not identifiable or has been de-identified.   

IV.             Consistently Characterizing Information with Respect to Potential for Identification of Data

BIO believes that a clear definition of what constitutes identifiable and de-identified information is necessary.  Currently, the HIPAA Privacy Rule's standards for identifiable and de-identified information held by covered entities and business associates are not aligned with what is considered private and non-private information under the Common Rule.  Under these two sets of rules, some information that is not considered identifiable under the Common Rule may be considered identifiable for purposes of the HIPAA Privacy Rule.  It is important to keep in mind that HIPAA and the Common Rule have distinct goals:  HIPAA is intended to protect personal medical information obtained or used in the course of medical care; the Common Rule is intended to protect human research subjects.  The proposal to superimpose the HIPAA definitions of what constitutes identifiable data on the entire research community fails to accommodate investigators’ need to access and share certain data elements that directly facilitate accurate understanding of research outcomes.

Under the Common Rule, information is not considered private (i.e., identifiable) if the identity of the subject is or may not be “readily ascertained” by the investigator from the information.  Thus, information such as dates of service or zip codes are generally not considered private information. 

Under HIPAA, de-indentified health information is health information that does not identify an individual and to which there is no reasonable basis to believe that the information can be used to identify an individual.  One of the two options[6] for creating de-identified data requires the removal of eighteen specified identifiers, including information regarding dates of service and zip code.  Because certain identifiers such as these are essential for research, HIPAA also allows the creation of a limited data set.  A limited data set requires the removal of sixteen specified identifiers, but permits date of service and zip codes to be maintained.  Once the sixteen identifiers are stripped from the data, the data may be disclosed for the purposes of research, public health, or health care operations.  However, disclosure is only permitted if the parties enter into a data use agreement, which limits use and provides for additional privacy protections, such as prohibiting re-identification of data.

BIO applauds the Agency’s focus on data security and information protection in its effort to enhance protections of human research subjects.  At the same time, we think it is important to recognize that the HIPAA definitions and the Common Rule definitions of identifiable information are meant to serve different goals, and, accordingly, provide access to and the sharing of different types of information.  Toward that end, BIO believes that “de-identified” should be defined less strictly under the Common Rule in comparison to HIPAA.  BIO would support a definition more in line with the current HIPAA definition of “limited-data set” without the data sharing agreement provisions.  We believe that such a definition, in conjunction with the broader proposed changes to enhance data security, would serve the two goals of the Common Rule and HIPAA—protecting human research subjects while facilitating and advancing scientific research and ensuring the privacy and protection of patient and consumer data.

V.                Streamlining IRB Review of Multi-Site Studies  

BIO believes strongly in protecting the rights and welfare of human subjects involved in biomedical research, and recognizes the critical role of IRBs.  As recognized in the ANPRM, multi-site studies have become increasingly common in research, and this is particularly true for clinical trials of biopharmaceuticals.  Unfortunately for multi-site studies, current rules and practice entail getting approval from multiple IRBs, which is inefficient and burdensome to clinical trial sponsors.  Obtaining approval by multiple IRBs can delay research that otherwise could make new treatments available to patients more quickly.

BIO enthusiastically supports the ANPRM proposal that a single IRB could provide approval of a multi-site study.  Use of a single IRB for a study would represent a significant advance in public health and research and enhance a sponsor’s ability to conduct such studies.  It would maintain important oversight and protections for research subjects, but be less burdensome, more efficient, and minimize delays and inconsistencies in conducting research.  As noted in the ANPRM, there has been a positive trend towards use of a centralized IRB.  The proposal can further increase acceptability of this practice by institutions and advance this positive trend. 

In response to the question raised in the ANPRM, BIO believes that use of a single IRB to oversee domestic multi-site research should be mandatory, rather than voluntary.  A voluntary scenario is likely to have less impact on the system overall, whereas mandatory use of a central IRB will ensure compliance from all institutions and serve to advance the goals of simplification and consistency.  BIO also suggests that the approval of informed consent forms for a particular study be part of the role of the central IRB to further promote consistency and efficiency in a study.  To the extent that this raises questions regarding compliance with state and local laws, BIO believes that Federal preemption would be a valuable means of achieving consistency and furthering the role of a centralized IRB. 

Given that a requirement that a central IRB be used in multi-site research would require changes to current practice, BIO would be pleased to work with HHS and relevant stakeholders on implementation of the new system.

VI.             Improving Research Oversight by Aligning and Coordinating Regulatory Regimes  

As noted in our general comments above, the issues raised in the ANPRM are further complicated by the overlapping sets of rules applicable to various stakeholders.  It is important that these systems be aligned to the extent that can be accomplished reasonably, without overly burdening investigators and study sponsors.  Moreover, any changes should be consistent with the distinct goals of each regulatory framework, and the applicability of each set of rules should be clarified. 

BIO believes that HHS should seek to assure that Common Rule provisions are largely aligned with FDA rules governing informed consent and IRBs.  Biopharmaceutical companies, which sponsor most of the important research leading to new medical treatments and cures, are regulated by the FDA and follow the Agency's rules on these issues.  As discussed above, prospective alignment of Common Rule requirements with FDA rules would provide consistency, minimize confusion, and avoid overlapping requirements.

The proposal also raises questions about whether and how HIPAA rules should be harmonized with the Common Rule.  According to the ANPRM, HHS is considering adopting the HIPAA standards regarding what constitutes individually identifiable information, a limited data set, and de-identified information.

As noted in our comments above, HIPAA's standards for "identifiable" and "de-identified" information are currently not aligned with human subjects research under the Common Rule. 

BIO believes HIPAA rules regarding de-identification of data should not overrule the Common Rule (or FDA rules).  For example, as discussed above, for data to be considered "de-identified" under HIPAA, the date of collection of a biospecimen or data would need to be stripped.  Yet, date of collection could provide important information to researchers.  If rules governing identifiers such as dates of collection/service and zip codes are carried over from HIPAA (the researcher cannot use the information without a data use agreement or developing security policies), that would significantly inhibit research and be an undue burden on researchers. 

An HHS "Blue Ribbon Panel" agreed.  In 2004, the Secretary’s Advisory Committee on Human Research Protections (SACHRP) recommended that HHS review its HIPAA de-identification standard to more closely align it with the Common Rule interpretation of identifiability to ease the burden on researchers:  “The Department should review the standards for de-identification of data in order to reduce the number of data categories that must be eliminated for data to be regarded as de-identified.  Among those data categories that should be strongly considered for deletion from the de-identification standards are zip codes, geographic subdivisions, and dates.  While the specific addresses of persons should not be included in de-identified information, more general areas of residence, work or origin may, in fact, be essential to epidemiologic and other studies of, for example, disease incidence.  Additionally, most dates, including admission and discharge dates, provide essential endpoints for much research without directly identifying the individual.”[7]

Moreover, the HIPAA de-identification standard is now influencing many IRBs’ interpretation of identifiability under the Common Rule.  HIPAA has not been interpreted to permit general authorizations for future unspecified research uses of health information, and therefore requires authorizations for research be study specific if identifiers have not been removed.

VII.          Informed Consent of Research Subjects

Voluntary informed consent from research subjects is a bedrock principle of research in the United States.  Federal regulations specify many rules to ensure that research subjects cannot be coerced into participating in a study, and that they can withdraw from a study in which they are participating at any time.  BIO has long supported the need for research subjects to provide voluntary informed consent.  BIO's Statement of Ethical Principles articulates this clear view, and BIO members adhere to the informed consent rules enforced by the FDA, National Institutes of Health (NIH), and other agencies. 

The ANPRM discusses the importance of using clear and understandable informed consent forms, and suggests use of templates or model informed consent language.  BIO continues to support the principle that consent documents must be written as clearly as possible so potential research subjects understand the nature of the study as well as its potential risks and benefits, and BIO supports creation of model language or templates for optional use by study sponsors as guidance and a resource for what a “user friendly" informed consent might consist of.  However, BIO does not support mandating the use of specific model language or templates.  Individual studies are unique situations that require writing consent documents specific to that study.  Further, it is important to recognize that informed consent is a process that involves more than just a form.  The written form is, of course, significant, but it should supplement the discussion between a researcher and a possible research subject—a valuable discussion is a critical part of enhancing that comprehension. 

VIII.       Collection of Adverse Event Data

The ANPRM notes that the collection of safety data from human clinical trials varies between agencies and is stored and maintained in different datasets.  The ANPRM seeks comment on whether these varying reporting systems should be harmonized and consolidated into a single Web-based repository.  BIO believes that the proposal to create a new database is misguided, and would duplicate extensive ongoing efforts to track and evaluate adverse events. 

The FDA comprehensively regulates the reporting of adverse events related to both marketed products and products being tested in clinical trials.  FDA’s reporting standards, procedures, and systems have been developed through years of Agency experience, and have been enhanced and strengthened over time.  BIO’s biopharmaceutical company members have complex systems in place to assure compliance with these requirements so that adverse events are reported, as appropriate, to the FDA, clinical investigators, and IRBs in a timely manner.  Additionally, FDA has the necessary experience in managing and maintaining confidential commercial information which might be implicated in an adverse event.  Involvement of other agencies that may not have restrictions on, or experience with, maintaining data as confidential could present significant concerns and lead to publication or release of confidential trade secret information.  Moreover, as the agency that has all the relevant scientific data from a clinical trial, FDA has the ability to provide a contextual framework for the information in an adverse event report, as well as the regulatory authority to protect research participants.  Should patients or clinical trial participants be at risk, the FDA has the authority to notify those patients or halt the trial.   

FDA’s safety reporting systems are continually being expanded and upgraded.  FDA and NIH launched an electronic safety reporting portal in 2010 that is intended to eventually include safety problems arising from products regulated by a broad array of federal agencies.  Adopting a life-cycle approach to product evaluation, industry user fees under the Prescription Drug User Fee Act (PDUFA) program have supported the modernization of FDA’s post-market surveillance systems.  FDA is also shepherding the Sentinel Initiative launched in 2008 to develop and implement a system of active surveillance methodologies, using data from diverse automated healthcare data holders to build on and complement the existing adverse event tracking systems.  The biopharmaceutical industry has also devoted considerable resources to develop new methodologies for actively monitoring drug safety through the Observational Medical Outcomes Partnership, which will advance the goals of the Sentinel Initiative.  Industry’s financial commitment to the Sentinel program will be expanded under PDUFA V.  These efforts are challenging and laborious, and any additional resources available should be used to support these ongoing efforts, rather than duplicate or address these issues in parallel.  

CONCLUSION:

BIO appreciates this opportunity to comment on the ANPRM on "Human Subjects Research Protections: Enhancing Protections for Research Subjects and Reducing Burden, Delay, and Ambiguity for Investigators."  Comments specific to certain questions listed in the ANPRM are included in the following chart. 

We appreciate the complexity of the issues raised in the ANPRM and that the process of evaluating stakeholder comment and determining how to proceed will be challenging.  We would be pleased to provide further input or clarification of our comments, as needed.  In addition, given the significant impact changes in rules may have on research conducted in the United States, BIO suggests that a public hearing on these issues be held following the collection of comments on the ANPRM.  A hearing would enable further discussion and input on these important issues.