Public Health Practice and the Common Rule

For public health agencies, the struggle to apply federal requirements for human subjects research protections in the public health context emerged immediately following passage of the initial version of the Common Rule in 1981. By the mid-1990s — shortly after the implementation of the 1991 revision to the Common Rule (45 CFR 46) — the Centers for Disease Control and Prevention (CDC) and its public health partners at local and state health departments had already been feeling what CK Gunsalus and colleagues described in their 2006 Illinois White Paper as “IRB mission creep.”^{Reference Gunsalus, Bruner, Burbules, Dash, Finkin, Goldberg, Greenough, Miller and Pratt2} There was a sense that IRB regulatory requirements were being inappropriately applied to public health activities that were not research.

To help the public health enterprise remain compliant with the Common Rule while meeting its legal obligation to systematically collect and analyze information for the benefit of population health, CDC developed a guidance document in 1999 to help public health practitioners at the federal, state, and local levels make sense of how, when, and why the Common Rule (and thus IRB review and approval) applies to public health practice activities, including public health surveillance, outbreak investigations, and public health program evaluation.³ These three practice activities, as defined below, represent routine responsibilities of public health officials and are not considered research. Public health surveillance is defined as “the ongoing, systematic collection, analysis and interpretation of health-related data with the a priori purpose of preventing or controlling disease or injury and identifying unusual events of public health importance, followed by the dissemination and use of such information for public health action.”^{Reference Lee and Thacker4} A public health outbreak investigation, also called emergency response, is described as a set of activities designed to identify, characterize, and resolve acute threats to human, animal, or environmental health, directly benefitting the participants and communities involved in the activities.⁵ Public health program evaluation is defined as “the systematic collection of information about the activities, characteristics, and outcomes of programs to make judgments about the program, improve program effectiveness, and/or inform decisions about future program development.”^{Reference Patton6}

In 2005, CDC requested comments from the Office of Human Research Protections (OHRP) at the U.S. Department of Health and Human Services (HHS) on these guidelines for defining public health research and non-research. CDC research and practice leaders argued that these three public health activities are not research as envisioned by the Common Rule, but rather are foundational activities of public health practice. OHRP at the time, however, disagreed and stated that the activities described in the CDC guidelines were systematic collections of data designed to develop or contribute to generalizable knowledge — thus meeting the definition of research in the Common Rule.

The following year, in June 2006, OHRP sent an internal draft document, entitled “Guidance on Research,” to HHS agencies for review and comment, signaling, perhaps, that it was rethinking its interpretation of the regulatory definition of research.

With vigorous engagement from CDC, the National Institutes of Health (NIH), the Food and Drug Administration (FDA), the Agency for Healthcare Research and Quality (AHRQ), the Office of the Assistant Secretary for Planning and Evaluation (ASPE), the Substance Abuse and Mental Health Services Administration (SAMHSA), and the Centers for Medicare and Medicaid Services (CMS), agencies met numerous times with the HHS Secretary and Assistant Secretary for Health to work through several contentious issues related to what the agencies described as overreach of the regulatory definition of research. Following several months of discussions, a number of challenges remained.

Ultimately, CDC concluded that the definition of research — codified in the regulations as “a systematic investigation… designed to develop or contribute to generalizable knowledge”⁷ — relied on two key terms (“systematic” and “generalizable knowledge”) that are inadequate to differentiate research from nonresearch in the public health setting (and perhaps other settings as well).

With regard to the systematic nature of data collection, virtually all of the activities in which public health professionals engage are systematic. They follow a written plan or agreed-upon best practices; public health practice activities are not conducted willy-nilly. Public health personnel value accountability and valid conclusions in practice as well as in research, and we achieve these by using systematic methods. With respect to the generation of knowledge, nearly all public health activities result in knowledge that can be generalized to a community from a subset of that community. However, this learning, CDC and other agencies argued, occurs outside of the research enterprise. Sometimes the knowledge gained during public health practice is applicable in other contexts, to other individuals in the same community, or to other communities, but the purpose of the activity is to implement a public health practice.

The Common Rule's definition of research, CDC argued, has poor specificity — something akin to defining all things “four-legged” and “furry” as dogs. Those two terms, “systematic” and “generalizable knowledge,” do not help us differentiate public health research from public health practice. CDC argued that we needed to identify a word in the extant definition that would describe a characteristic that could differentiate between research and nonresearch, and suggested the term “designed.” The “design” — as in “purpose” — of the activity is still used today across public health organizations to help public health personnel distinguish between an activity as research or practice. An outbreak investigation of foodborne illness, for example, is a standard public health responsibility — a routine public health practice activity. The investigation might result in the identification of the source of contamination and expose a vulnerability in the food-handling process that could lead to changes in industry practices. The purpose or design of the investigation would be to stem the outbreak, not to test changes in food handling practices, yet such changes might well result.

Other Arguments

The national conversation about the applicability of the Common Rule to public health practice activities continued. Some practitioners proposed a clinical analogy for public health: As the individual is to the clinician, the community is to the public health practitioner. In a clinical setting, the patient is the individual. A typical practice that falls within the standard of care in a clinical setting is not subject to IRB review. For example, if a child arrives with what appears to be a fractured tibia, the health care provider would order an x-ray. We would not expect the provider to submit a protocol to the IRB and await approval to implement a standard-of-care practice. Similarly, it has been argued that, in the public health setting, the “patient” is the community. A typical standard-of-care practice in a public health setting should also not be subject to IRB review. For example, if an unknown pathogen is causing an outbreak of a polio-like illness in a community, a public health professional would develop and implement a surveillance system and begin an outbreak investigation as a diagnostic best practice. Analogous, then, to the clinical setting, we would not expect the public health practitioner to submit a protocol to the IRB and await its approval.

As these types of analogies and arguments were offered in the 1990s and early 2000s, persons opposing the analogy argued that it was incomplete due to the lack of analogous consequences for improper conduct. For example, if a health care provider responds to a patient's needs with an other-than-acceptable practice, there are professional consequences such as loss of licensure or medical board censure. However, if a public health practitioner responds inappropriately, there is no way to correct for a poor professional decision. Some argued that the IRB was the only option for identifying and adjudicating unethical behavior among public health practitioners. Opponents of that view argued that what public health professionals needed was not IRB oversight, but instead guidance on the profession's ethical expectations related to standard best practices. These calls for accountability and professional ethics in public health led to a number of developments in the field, including credentialing, codes of ethics, and ethical guidance for public health practice. We saw the development of individual-level credentialing (such as the Certified in Public Health [CPH] designation).^{Reference Gebbie, Goldstein and Gregorio8} We saw organization-level accreditation for public health agencies by the national Public Health Accreditation Board.^{Reference Bender, Kronstadt, Wilcox and Lee9} We saw the American Public Health Association (APHA) support a professional code of ethics for the public health workforce.^{Reference Thomas, Sage, Dillenberg and Guillory10} And we saw public health entities begin to explicitly state the ethical expectations of standard best practices. The World Health Organization (WHO) led this charge by convening a number of expert panels from across the globe to develop recommendations for the ethical conduct of infectious disease outbreak investigations¹¹ and public health surveillance.¹²

Risk in Public Health Practice

A major source of concern about research is that individuals generally take on risks not for their own benefit, but instead for the possible benefit of unknown others. This is a very different proposition from clinical encounters, when a person agrees to take on risks for their own potential benefit. A person might accept the risk of side effects for a particular medication if taking it is likely to relieve symptoms or discomfort. The risks might be worth the possible benefits. The individual takes risks, but also directly benefits. In public health, the analogy goes, communities take on risk or inconvenience for their own potential benefit. For example, when a public health agency intervenes with a community by asking them to practice social distancing during a pandemic influenza outbreak, the agency is impinging on the community members' autonomy for their own potential benefit, not to test if such a request will benefit a community in the future, or in another state.

The primary risk to individuals in the context of public health activities, especially public health surveillance, is related to social harms resulting from a breach of confidentiality. Some public health professionals suggested a logical way to reduce this risk is not IRB review, but rather the implementation of national privacy legislation that protects all public health data.^{Reference Lee and Gostin13} Unfortunately, comprehensive national privacy protections seem to be non-viable in the United States.

Formalizing the Determination of Research and Nonresearch in Public Health

Following several HHS-level discussions, CDC formalized its research/nonresearch guidance into agency policy in 2010.¹⁴ The Distinguishing Public Health Research and Public Health Nonresearch policy reflected the agency's understanding and interpretation of the ways that, while systematic and knowledge-generating, the purpose of public health activities differentiates them from research. From the 2010 policy:

In July 2011, 3 years after CDC submitted its final set of comments on OHRP's draft “Guidance on Research,” OHRP issued the advance notice of proposed rulemaking (ANPRM) announcing the first proposed revision to the Common Rule since 1991. Many public health professionals assumed that the revised rule would encompass the changes to the definition of research that we had been discussing over the previous years, and that these changes would assist public health practitioners in differentiating public health research and nonresearch. To our surprise, the ANPRM did not propose any changes to the definition of research. Instead, the final rule, published in 2017, included a number of clarifying statements that would eliminate several specific activities from the existing definition. One of those activities is public health surveillance.

Public Health Surveillance and Outbreak Investigation in the Revised Common Rule

The definition of public health surveillance in the revised Common Rule is different from the definition used by CDC and the U.S. state and local public health infrastructure, but it captures the spirit of the activity. The Common Rule definition rightly includes both the collection of data (though it does not specify that data collection must be “systematic”) and, importantly, the use of data for public health action. The definition specifies that the activity must be “conducted, supported, requested, ordered, required, or authorized by a public health authority,” which should assuage the fear that once this provision is in effect, many researchers will begin reframing their work as “public health surveillance” to avoid IRB review.

The revised Rule's definition of public health surveillance lists a number of allowable activities, including “those necessary to allow a public health authority to identify, monitor, assess, or investigate potential public health signals, onsets of disease outbreaks, or conditions of public health importance.” This language seems to allow another mainstay of public health practice, that is, emergency (or outbreak) response. While in public health, we tend to think about surveillance and emergency response as two different, but related activities, the inclusion of outbreak response in the definition of surveillance is likely a welcome sight to public health agencies. Here we see a nod to the conversation of the early days when CDC (and others) argued that while investigating outbreaks, injuries, or risk factors is done systematically and can generate generalizable knowledge, these activities are designed to address an urgent or important public health problem, not to ask some members of the community to take on risk for the benefit of some unknown others. Similar to the clinical argument, where individuals take on risk for their own benefit, in these public health contexts, communities take on any risk for the benefit of themselves.

Public Health Program Evaluation and the Revised Common Rule

One area of routine public health practice that is not included in the carve-out for public health surveil-lance is public health program evaluation, which broadly construed includes quality assurance and quality improvement. For public health program evaluation, the revised Common Rule appears to allow an exemption category.

Before I opine on whether public health program evaluation fits tidily into the revised Rule's exempt research category 5, I would like to contrast what it means for a project to be excluded from the definition of research (as is now the case for public health surveillance) on the one hand, and what it means for a project to be considered exempt research on the other. In the case of being excluded from the definition of research, the activity is not under the jurisdiction of the IRB. One moves forward with activities according to best practices. No IRB protocol, no research determination, no consideration at all of 45 CFR 46. On the other hand, in the case when a project is deemed “exempt research,” it is still considered research, but it is exempt from IRB review. To make the exempt determination, a qualified person unaffiliated with the research (usually a Human Research Protections Program [HRPP] professional) must have enough information to determine whether a project is research involving human subjects, what specific activities will be conducted, and how the activities qualify for which exemption category. In other words, the HRPP needs the same kind of information contained in a protocol. And that protocol or project summary is reviewed — not by the IRB, but by an HRPP staff person with sufficient knowledge of the regulations, and with sufficient details about the project. Exempt, therefore, does not mean that a project is exempt from review, just that the IRB is not the one reviewing it. HRPPs maintain a record of such projects and associated determinations, as OHRP rightly recommends that the person making an exempt determination document the specific exemption category in the study record, and that the HRPP maintains the information for oversight and audit purposes.¹⁶

While a project might be exempt from IRB review, it still requires that the investigator submit a document with sufficient detail so that the HRPP professional can make a determination. That submission is still subject to typical HRPP delays. In many institutions, the review process for an exempt protocol is nearly the same as it is for a protocol that must be reviewed by the IRB itself.^{Reference Loe, Winkelman and Robertson17} To the investigator, “exempt” is a misnomer. This distinction is important because classifying something as “exempt” from review gives the impression that not much needs to be done. That is not always the case when “exempt” is operationalized. This point is important as we try to manage expectations and help public health practitioners understand why some fundamental practice activities require a protocol and an HRPP review, while others do not require any engagement at all with HRPP or the IRB.

The full text of the program evaluation exemption in the revised Common Rule can be viewed at 45 CFR 46.104(d)5, and reads in part:

If public health programs can be construed as a “public benefit or service program,” evaluating them could fit in this exemption category.

In its 2010 research/nonresearch policy, CDC defines evaluation as “the systematic use of scientific methods to measure efficacy, implementation, utility, and other characteristics of a program or its components.”¹⁹ The policy acknowledges that a program evaluation might or might not be research, depending not on whether it uses systematic investigation, nor whether it creates knowledge, but rather on the purpose of the evaluation. From the policy:

The language in exempt research category 5 exempts from IRB review, “research… projects… that are designed to study, evaluate, improve, or otherwise examine public benefit or service programs.” Unlike the CDC policy, however, the revised Common Rule deems such projects to be research, but does not require them to undergo IRB review.