I. Introduction
Ethical review of research with human subjects is required by Subpart A of the Federal Policy for the Protection of Human Subjects,1 also known as the Common Rule (“Common” because it has been adopted by 16 federal agencies). The existing Common Rule, referred to here as the 1981 Common Rule because it was last changed in 1981, was recently revised.Reference Nichols, Brako, Rivera, Tahmassian, Jones, Pierce and Bierer2 The Final Common Rule was published on January 19, 2017, with most provisions going into effect on July 19, 2018.3
The ethical foundation of the Common Rule is the Belmont Report, which established the principles of beneficence, justice, and autonomy as central to human subjects research.4 The Common Rule requires pre-review of human subjects research by Institutional Review Boards (IRBs), with more stringent requirements for projects with greater potential risks. Tailoring standards to the risks of research is ethical when more of the finite resources of investigators and IRBs are allocated to oversight of projects where subject protections are more needed.Reference Kopelman5
The authority of the federal government to regulate human subjects research follows the dollars; that is, the 16 federal agencies that have adopted the Common Rule all require complying with its provisions as a condition for receiving federal research support. The federal agencies require institutions to file a “Federal-Wide Assurance” (FWA) indicating their commitment to complying with the Common Rule for human subjects research that is conducted or supported by that federal agency. Institutions have been given the option to extend their FWAs to cover all human subjects research at their institution regardless of the source of support for the particular research activity; this has colloquially been termed “checking the box.” One notable change in the Final Common Rule is that the option to “check the box” will be removed from the FWA process: Institutions may still extend the Common Rule to all research, but this will be a matter of internal policy, not an assurance to the federal government.6
Institutions that do not “check the box” still impose requirements on all human subjects research conducted by their investigators. These requirements can be exactly the same as those for federally-supported research (with the exception of reporting certain events to the Office for Human Research Protections, OHRP), or can differ in any way that the institution decides. In addition, OHRP has long recognized that the federal regulations are the “floor,” rather than the ceiling,7 and expects that institutions will impose additional requirements for protecting human subjects even on federally-supported research. Exceeding some federal requirements is in fact mandatory for institutions seeking accreditation from the Association for Accreditation of Human Research Protection Programs (AAHRPP), such as independent review of exempt research.8 However, institutions may not go below the Common Rule “floor” for federally-supported research.
In early 2011, inspired by the flexibility initiatives started at University of Michigan in 2007 (for two-year approval periods for minimal risk research and exemption for analysis of identifiable data), Dr. Susan L. Rose of the University of Southern California founded the Flexibility Coalition, now consisting of over 100 institutions that have joined each other to find simpler ways to regulate low-risk non-federally-supported research where this is ethically justified because it will not decrease protections for human subjects.9 Also in 2011, OHRP began the rulemaking process for changing the Common Rule, including further reducing some requirements for low-risk research, to “uphold and better reflect the ethical principles upon which the Common Rule is based.”10
The changes in the Final Common Rule that relate to the goal “to better calibrate the level of review to the level of risk”11 consist of initiatives encouraged by the Flexibility Coalition:12 narrowly interpreting the definition of “research,” establishing additional exempt categories, modifying consent for screening activities, ceding IRB review of multi-site research, and reducing continuing review of low-risk research. In fact, OHRP indirectly alluded to the value of the Flexibility Coalition in pioneering areas for reducing unnecessary burdens in the discussion of the reason for eliminating the ability to “check the box”:
Importantly, institutions could, if they so desire, continue for purposes of their own internal rules to voluntarily extend the regulations to all research conducted by the institution, but this voluntary extension will no longer be part of the assurance process and such research will not be subject to OHRP oversight. We expect this change to have the beneficial effect of encouraging some institutions to explore a variety of flexible approaches to overseeing low-risk research that is not funded by a Common Rule department or agency, without reducing protection of human subjects, thus furthering the goal to decrease inappropriate administrative burdens.13
In early 2016, Boston Medical Center and Boston University Medical Campus (BMC/BU Medical Campus), through their joint Office of Human Research Affairs, began the process of adopting flexible policies for non-federally-supported research as part of an overhaul of their Human Research Protection Program in preparation for seeking AAHRPP accreditation. Proposed changes were reviewed by an advisory committee with extensive experience in human subjects protections (IRB chairs, legal counsels, community outreach experts, etc.) and approved by the Institutional Officials of BMC and BU Medical Campus. The ethical and practical issues considered during this process provide a case study that may be relevant to decisions that all institutions will be facing about implementing the changes in the Final Common Rule, both whether to “go above the floor” for all research, and whether to “go below the floor” for non-federally-supported research.
In early 2016, Boston Medical Center and Boston University Medical Campus (BMC/BU Medical Campus), through their joint Office of Human Research Affairs, began the process of adopting flexible policies for non-federally-supported research as part of an overhaul of their Human Research Protection Program in preparation for seeking AAHRPP accreditation.
In mid-2017, BMC/BU Medical Campus adjusted some of the 2016 flexibility policies to better align with the Final Common Rule, and also adopted a few additional changes in the Final Common Rule that had not been made in 2016. Some of these changes were in the direction of reducing burden (for example, defining human subject research to exclude journalism and oral history), and others at least potentially increased burden (for example, requiring that to qualify as exempt, educational research must not be likely to adversely impact learning). The remainder of this article addresses the changes that reduced burden, first considering those that do appear in the Final Common Rule (see Table 1) and then considering those that do not appear in the Final Common Rule (see Table 2).
Reduction of Regulatory Burden in the Final Common Rule

* Flexibility Coalition, Office for the Protection of Research Subjects, University of Southern California, “Creative Flexibility” available at <https://oprs.usc.edu/files/2017/04/Creative-Flexibility-Packet-2.29.16-1.pdf> (last visited February 2, 2018).
Reduction of Regulatory Burden Not in the Final Common Rule

* Flexibility Coalition, Office for the Protection of Research Subjects, University of Southern California, “Creative Flexibility” available at <https://oprs.usc.edu/files/2017/04/Creative-Flexibility-Packet-2.29.16-1.pdf> (last visited February 2, 2018).
II. Flexibility Policies at BMC/BU Medical Campus that DO Appear in the Final Common Rule
A. The Definition of What Constitutes Research
When research involves human subjects, those individuals are being used as means to an end, thus invoking an ethical obligation for increased protections, such as independent review, obtaining consent, and minimizing risks. The 1981 Common Rule defines research as “a systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge.”14 The flexibility initiatives encourage IRBs to strictly adhere to the definition and avoid imposing any requirements on projects that do not meet the definition of research.15 The ethical rationale is that special scrutiny is not required for activities that do not treat individuals as utilitarian objects used as a means to advancing science.
The 1981 Common Rule does not specify any examples of activities that are not considered research. The Final Common Rule specifies four types of activities that are deemed not to be research:
Scholarly and journalistic activities (e.g., oral history, journalism, biography, literary criticism, legal research, and historical scholarship), including the collection and use of information, that focus directly on the specific individuals about whom the information is collected.
Public health surveillance activities, including the collection and testing of information or biospecimens, conducted, supported, requested, ordered, required, or authorized by a public health authority. Such activities are limited to those necessary to allow a public health authority to identify, monitor, assess, or investigate potential public health signals, onsets of disease outbreaks, or conditions of public health importance (including trends, signals, risk factors, patterns in diseases, or increases in injuries from using consumer products). Such activities include those associated with providing timely situational awareness and priority setting during the course of an event or crisis that threatens public health (including natural or man-made disasters).
Collection and analysis of information, biospecimens, or records by or for a criminal justice agency for activities authorized by law or court order solely for criminal justice or criminal investigative purposes.
Authorized operational activities (as determined by each agency) in support of intelligence, homeland security, defense, or other national security missions.16
In mid-2017, BMC/BU Medical Campus added these four categories to the activities not considered to be research to be consistent with the Final Common Rule, although none of these activities commonly take place at BMC/BU Medical Campus. This did not constitute a change in policy, because none of these activities would have been considered research under the existing definition. Institutions where these four types of research are common may want to consider whether they might be justified in imposing any additional safeguards as institutional requirements. In particular, for category (1) (oral history, journalism, biography), ethical review may be appropriate to assess issues of consent and confidentiality, similar to those for interviews and surveys.
B. Exempt Categories
I. What it Means for Research to be “Exempt”
The 1981 Common Rule lists six categories of research that are “exempt from this policy”17 (see Table 3). Within the 1981 Common Rule, there are no additional requirements for research that qualifies as exempt, such as obtaining consent from subjects or submitting to the IRB for review. However, guidance from OHRP, first issued in 1995, recommends that institutions should have a mechanism for an individual (other than the researcher) who is well-acquainted with the interpretation of the regulations and the exemptions to be the one who determines that research is exempt, not the investigator proposing the project.18 AAHRPP accreditation also requires a mechanism for independent review of potentially exempt human subjects research, as well as policies and procedures for addressing protection of participants in exempt research; however, these protections are expected to be less extensive than those required for non-exempt research.19 Although an independent review in theory could be performed by any knowledgeable individual, in practice it is usually done through IRBs,Reference Loe, Winkelman and Robertson20 which have both experienced personnel and operational infrastructure for reviewing protocols. It will be interesting to see the responses to recent calls by some academics for allowing researchers to make their own exemption determinations.Reference Shweder and Nisbett21
Exempt Research Categories

BMC/BU Medical Campus requires that all human subjects research be submitted to the IRB. Experienced staff in the IRB Office evaluate whether the research fits the criteria for an exempt category and conforms with institutional requirements for the protection of participants. These requirements, which are not mandated by either the 1981 or the Final Common Rule, include: (i) investigators must complete training in human subjects protection; (ii) investigators must disclose Conflicts of Interest; (iii) abbreviated consent must be obtained from subjects where information or specimens are obtained by intervention or interaction; and (iv) investigators must have an appropriate plan to protect subject confidentiality.
Even though most institutions require IRB review of exempt research, the burden is lower than for non-exempt research, notably because the consent process is shorter, modifications to the research do not have to be submitted to the IRB prior to implementation unless the modification could change the exempt determination, and continuing review is not required.22 Expansion of exempt categories is one of the main ways that the Final Common Rule reduced regulatory burden.
II. Socio-Behavioral Research
The only exemption in the 1981 Common Rule for socio-behavioral research is 101(b)(2) for educational tests, surveys, interviews, and observation of public behavior, which only applies if the information collected is either anonymous (cannot be linked to the subject) or innocuous (would not harm the subject if revealed outside of the research context):
101(b)(2) Research involving the use of educational tests (cognitive, diagnostic, aptitude, achievement), survey procedures, interview procedures or observation of public behavior, unless: information obtained is recorded in such a manner that human subjects can be identified, directly or through identifiers linked to the subjects; and (ii) any disclosure of the human subjects' responses outside the research could reasonably place the subjects at risk of criminal or civil liability or be damaging to the subjects' financial standing, employability, or reputation.23
The excessive burden on socio-behavioral research imposed by the Common Rule has been widely recognized.24 Flexibility initiatives commonly have included creating a category of exempt research covering socio-behavioral research.25 The ethical rationale for this exemption is that such activities are generally low risk and no appreciable increase in human subjects protection is achieved by imposing the requirements for non-exempt research, particularly full consent, IRB pre-approval of any modification to the study, and annual continuing review.
After considering other's approaches in 2016, the BMC/BU Medical Campus created Exempt Category 7:
Research with adults able to consent for themselves investigating individual or group characteristics or behavior (including, but not limited to, research on perception, cognition, motivation, identity, language, communication, cultural beliefs or practices, and social behavior) or research employing survey, interview, oral history, focus group, program evaluation, human factors evaluation, or quality assurance methodologies.
Investigators are required to describe their confidentiality protections, to obtain abbreviated consent from subjects, and, if the research involves deception, to debrief the subjects at the end of their participation. Note that a subset of the socio-behavioral research that qualifies for this additional exemption category is surveys and interviews that collect identifiable and sensitive information, as long as the confidentiality protections are sufficient.
The Final Common Rule expanded the exemption of socio-behavioral research in two ways. First, the Final Common Rule expanded the exemption for educational tests, surveys, interviews, and observation of public behavior to include studies using information that is identifiable and sensitive, if an IRB determines data security is adequate:
104(d)(2)(iii) The information obtained is recorded by the investigator in such a manner that the identity of the human subjects can readily be ascertained, directly or through identifiers linked to the subjects, and an IRB conducts a limited IRB review to make the determination required by 111(a)(7).26
Second, the Final Common rule included a new 104(d) (3) exemption for research involving benign behavioral interventions:
104(d)(3)(i) Research involving benign behavioral interventions in conjunction with the collection of information from an adult subject through verbal or written responses (including data entry) or audiovisual recording if the subject prospectively agrees to the intervention and information collection and at least one of the following criteria is met:
(A) The information obtained is recorded by the investigator in such a manner that the identity of the human subjects cannot readily be ascertained, directly or through identifiers linked to the subjects;
(B) Any disclosure of the human subjects' responses outside the research would not reasonably place the subjects at risk of criminal or civil liability or be damaging to the subjects' financial standing, employability, educational advancement, or reputation; or
(C) The information obtained is recorded by the investigator in such a manner that the identity of the human subjects can readily be ascertained, directly or through identifiers linked to the subjects, and an IRB conducts a limited IRB review to make the determination required by 111(a)(7).
(ii) For the purpose of this provision, benign behavioral interventions are brief in duration, harmless, painless, not physically invasive, not likely to have a significant adverse lasting impact on the subjects, and the investigator has no reason to think the subjects will find the interventions offensive or embarrassing. Provided all such criteria are met, examples of such benign behavioral interventions would include having the subjects play an online game, having them solve puzzles under various noise conditions, or having them decide how to allocate a nominal amount of received cash between themselves and someone else.
(iii) If the research involves deceiving the subjects regarding the nature or purposes of the research, this exemption is not applicable unless the subject authorizes the deception through a prospective agreement to participate in research in circumstances in which the subject is informed that he or she will be unaware of or misled regarding the nature or purposes of the research.27
In mid-2017, BMC/BU Medical Campus changed the wording of their Exempt Category 7 to match 104(d) (3) in the Final Common Rule, because although the wording appears quite different, the types of research covered are essentially the same. The requirement for abbreviated consent that discloses any deception, as in the Final Common Rule, was adopted, and the requirement for debriefing, which was not mentioned in the Final Common Rule, was retained. In addition, since surveys and interviews are no longer mentioned in Exempt Category 7, a new Exempt Category 12 was added:
Research involving educational tests (cognitive, diagnostic, aptitude, achievement), survey procedures, interview procedures, or observation of public behavior (including visual or auditory recording) where the IRB determines that confidentiality procedures will be adequate to protect information that is recorded by the investigator in such a manner that the identity of the human subjects can readily be ascertained, directly or through identifiers linked to the subjects.
Exempt categories 7 and 12 will apply at BMC/BU Medical Campus before July 19, 2018 only to research that is not federally-supported, and to all research thereafter. It should be noted that research involving deception without disclosure during the consent process and/or without debriefing is not prohibited, it simply must go through a full approval process, including an assessment of whether risks are minimized, risks are reasonable in relation to benefits, and the rights and welfare of subjects are protected despite the deception.
Establishing exempt categories covering socio-behavioral research was considered ethical at BMC/BU Medical Campus because the safeguards provided by IRB review, required investigator training, and abbreviated consent and debriefing were considered sufficient to protect participants in socio-behavioral research.
III. Use of Data/Specimens not Collected for Research Purposes
The 1981 Common Rule's exempt category for research involving data/specimens only applies to data/specimens that have already been obtained when the research begins:
101(b)(4) Research involving the collection or study of existing data, documents, records, pathological specimens, or diagnostic specimens, if these sources are publicly available or if the information is recorded by the investigator in such a manner that subjects cannot be identified, directly or through identifiers linked to the subjects.28
Research using such data/specimens is not exempt if the data/specimens do not already exist when the study begins or if the investigator maintains identifiers (for example, in order to link the individuals to their data obtained from a different source). Flexibility initiatives have commonly included creating a category of exempt research covering the analysis of identifiable data/specimens that will be collected in the future for non-research purposes (prospective collection of data/specimens for research purposes would be reviewed by the regular non-exempt process).29 The ethical rationale for this exemption is that the only risk is that information may be released outside of the research context, that this risk can be minimized by ensuring that confidentiality protections are adequate, and that this risk and its minimization do not depend on whether the data/specimens have been collected before or after the IRB reviews the research.
In 2016, the BMC/BU Medical Campus created Exempt Category 9:
Research involving the study of materials (data, documents, records, or specimens) that have been or will be collected solely for non-research purposes (such as medical treatment or diagnosis).
Investigators are required to submit an application to the IRB explaining the purpose of the research and describing their confidentiality protections when the data are identifiable, but are not required to obtain consent from the subjects because the subjects' rights and welfare are protected by keeping the data confidential and because contacting them to obtain consent would be impractical and potentially a breach of privacy. At BMC/BU Medical Campus, this exemption has most commonly been used for chart reviews.
In the Final Common Rule, the exemption for use of data/specimens has been expanded to include future data/specimens and identifiable information that is protected by other regulations (health information and government-generated or government-collected information):
104(d)(4) Secondary research for which consent is not required: Secondary research uses of identifiable private information or identifiable bio-specimens, if at least one of the following criteria is met:
(i) The identifiable private information or identifiable biospecimens are publicly available;
(ii) Information, which may include information about biospecimens, is recorded by the investigator in such a manner that the identity of the human subjects cannot readily be ascertained directly or through identifiers linked to the subjects, the investigator does not contact the subjects, and the investigator will not re-identify subjects;
(iii) The research involves only information collection and analysis involving the investigator's use of identifiable health information when that use is regulated under 45 CFR parts 160 and 164, subparts A and E, for the purposes of “health care operations” or “research” as those terms are defined at 45 CFR 164.501 or for “public health activities and purposes” as described under 45 CFR 164.512(b); or
(iv) The research is conducted by, or on behalf of, a Federal department or agency using government-generated or government-collected information obtained for nonresearch activities, if the research generates identifiable private information that is or will be maintained on information technology that is subject to and in compliance with section 208(b) of the E-Government Act of 2002, 44 U.S.C. 3501 note, if all of the identifiable private information collected, used, or generated as part of the activity will be maintained in systems of records subject to the Privacy Act of 1974, 5 U.S.C. 552a, and, if applicable, the information used in the research was collected subject to the Paperwork Reduction Act of 1995, 44 U.S.C. 3501 et seq.30
BMC/BU Medical Campus has not made any changes to Exempt Category 9 as the result of the changes in the Final Common Rule, because all research that will be exempt under 104(d)(4) qualifies for Exempt Category 9. It is likely that Exempt Category 9 will continue to be used for non-federally-supported research even after July 19, 2018 because it allows the IRB to determine that confidentiality protections are adequate even if the research analyzes identifiable data/specimens that are not covered by health or government confidentiality regulations.
Establishing an exempt category for research using identifiable data/specimens collected for non-research purposes was considered ethical at BMC/BU Medical Campus because of the safeguards provided by IRB review of data protections, which is required by the Final Common Rule, and of the purpose of the research, which is not required by the Final Common Rule but is appropriate to avoid research that could cause group harms.Reference Hausman31
IV. Secondary use of Data/Specimens Collected with Informed Consent
Secondary use refers to later analysis of data/specimens collected during the course of a research study for a purpose other than that of the original study. The 1981 Common Rule would allow exemption of research involving secondary use of data/specimens collected for research purposes only if the data were recorded by the investigator in such a manner that subjects could not be identified. Flexibility initiatives to establish an exempt category for identifiable data/specimens collected during a previous research study32 have been adopted by at least one institution.33 The ethical rationale for this exemption is similar to that for exempting the use of data/specimens collected for non-research purposes, with the additional protection that informed consent has already been obtained in the original research study.
In 2016, the BMC/BU Medical Campus created Exempt Category 10:
Research involving the study of materials (data, documents, records, or specimens) that have been collected for research purposes when the consent for the research does not preclude such additional research.
Investigators are required to submit an application to the IRB explaining the purpose of the research and describing their confidentiality protections when the data are identifiable, but are not required to obtain consent from the subjects because the subjects' rights and welfare are protected by keeping the data confidential and because contacting them to obtain consent for the secondary use of their data/specimens would be impractical and potentially surprising or offensive to the subjects.
In the Final Common Rule, two new exemptions are created for secondary storage/maintenance and for use of identifiable data/specimens obtained using “broad” consent, 104(d)(7) and 104(d)(8).34 BMC/BU Medical Campus, like other institutions, will have to consider a number of operational and logistical issues before implementing broad consent and the new exempt categories 104(d)(7) and (8). Implementation could occur at any time after July 19, 2018, because research involving the storage/maintenance and use of identifiable data/specimens can still be approved, including research eligible for a waiver or alteration of consent, even in the absence of such exempt categories.
BMC/BU Medical Campus is likely to retain Exempt Category 10 for non-federally-supported research to decrease the regulatory burden on secondary use of research data/specimens when the original study consent form did not preclude future use.
C. Continuing Review
Continuing review is the process by which the IRB determines that a project still meets all the criteria for approval.35 Besides being a “check-in” to remind investigators of their obligations, the periodic review provides the opportunity for the IRB to consider whether new scientific information indicates an alteration in the risk/benefit ratio of the study, such as a newly-available standard treatment for the condition under investigation.36
The 1981 Common Rule has a maximum one-year approval period, with IRBs allowed to impose shorter approval periods if appropriate to the degree of risk.37 Most flexibility initiatives have included extending the period of approval to two or three years for minimal risk studies.38 The ethical rationale is that the slight possibility that risks to subjects would be identified by continuing review of minimal risk studies is not enough to justify the time and effort from investigators and the IRB for annual review.
In 2016, BMC/BU Medical Campus established a three-year approval period for minimal risk studies without federal oversight. This includes studies in three categories: (1) Studies initially approved by the expedited procedure (which is only used for minimal risk studies). (2) Studies initially approved by the convened IRB when the convened IRB determines that the study is no greater than minimal risk, which can happen, for example, when the study was greater than minimal risk or otherwise problematic as submitted, but became no greater than minimal risk after the investigator responded to changes requested by the convened IRB. (3) Studies that were previously approved by the convened IRB but that have progressed to the stage where all subjects have completed all research-related interventions and the only remaining research activities are long-term follow-up of subjects or data analysis.
Investigators on studies approved for three years are sent an annual reminder of their obligations, including the requirement to obtain IRB approval before making any changes to the research.
The Final Common Rule went further than any flexibility institution by completely eliminating continuing review for most minimal risk research:
109(f)(1) Unless an IRB determines otherwise, continuing review of research is not required in the following circumstances:
(i) Research eligible for expedited review in accordance with §110;
(ii) Research reviewed by the IRB in accordance with the limited IRB review described in §104(d)(2)(iii), (d)(3)(i)(C), or (d)(7) or (8);
(iii) Research that has progressed to the point that it involves only one or both of the following, which are part of the IRB-approved study:
(A) Data analysis, including analysis of identifiable private information or identifiable biospecimens, or
(B) Accessing follow-up clinical data from procedures that subjects would undergo as part of clinical care.39
What is eliminated in the Final Common Rule is the requirement for the IRB to re-determine that all criteria for approval continue to be met. Researchers are still obligated to report any unanticipated problems or proposed changes in the study to the IRB, and institutions are not prohibited from requiring some kind of an administrative check-in, as acknowledged in the preamble to the Final Common Rule: “Institutions that choose to require some accounting of ongoing research not subject to continuing review have significant flexibility in how they implement their own requirements.”40
BMC/BU Medical Campus has not yet made a final decision about providing oversight of minimal risk human subjects research when continuing review is no longer mandated starting in July 2018. It is likely to use a combination of sending reminders to investigators of their obligations once a year and requiring a status report every three years. The status report is likely to be briefer than the continuing review application, and to be processed administratively rather than going through the approval process.
Establishing a three-year approval period for minimal risk research was considered ethical at BMC/BU Medical Campus because of the lack of reported problems at other institutions using two- or three-year continuing review. Changing from a re-review to a check-in process is not likely to diminish human subjects protection. Institutions may even consider dropping ongoing oversight altogether, depending on future actual experience in the frequency and severity of problems uncovered in relation to the burden of periodic check-ins.
D. Consent for Screening
The activities involved in screening individuals to see if they are eligible for a study meets the definition of human subjects research, but obtaining consent can be either impractical (if the screening involves access to existing medical records) or cumbersome and confusing (if the screening involves asking an individual only a few questions). Under OHRP guidance for the existing Common Rule, IRBs are expected to make the determinations required for a waiver or alteration of consent if screening activities do not involve obtaining full consent.41 Most IRBs will grant a waiver of consent for obtaining information from medical records without contact with subjects (in addition to a waiver of authorization under HIPAA), but the flexibility initiatives encourage IRBs to allow a briefer consent process that does not contain all of the required elements before obtaining information from prospective subjects.42
In 2016, BMC/BU Medical Campus clarified the following screening requirements: consent was not expected if screening will only involve access to medical records, modified consent was expected if screening will involve obtaining information from individuals by intervention or interaction, and full consent was expected if screening will involve any clinical procedure or if identifiable sensitive information will be retained after the information is used to determine eligibility. The ethical rationale for not requiring consent for screening that only involves access to medical records is that the risk is limited to loss of confidentiality, which can be minimized by appropriate data security. The ethical rationale for allowing modified consent for screening (consisting of a short summary of the study, a description of the screening tests and their foreseeable risks, and how the data will be used and kept confidential) is that requiring all of the elements of consent at the initiation of the screening would be time-consuming and confusing to potential subjects, but requiring no consent process at all is disrespectful to potential subjects. The ethical rationale for requiring full consent from potential subjects where clinical procedures will be performed or identifiable sensitive information will be retained is that this respects the rights of individuals who are excluded from the study after screening.
The activities involved in screening individuals to see if they are eligible for a study meets the definition of human subjects research, but obtaining consent can be either impractical (if the screening involves access to existing medical records) or cumbersome and confusing (if the screening involves asking an individual only a few questions). Under OHRP guidance for the existing Common Rule, IRBs are expected to make the determinations required for a waiver or alteration of consent if screening activities do not involve obtaining full consent. Most IRBs will grant a waiver of consent for obtaining information from medical records without contact with subjects (in addition to a waiver of authorization under HIPAA), but the flexibility initiatives encourage IRBs to allow a briefer consent process that does not contain all of the required elements before obtaining information from prospective subjects.
The flexibility for screening adopted by BMC/BU Medical Campus in 2016 did not change what investigators were required to do for screening, but did affect IRB operations: formal findings for an alteration of informed consent did not need to be documented for the modified screening consent process for non-federally-supported research. Formal findings of a waiver of informed consent are still documented for screening involving access to medical records, because such screening requires justification for a waiver of HIPAA authorization, which is quite similar to the justification for a waiver of consent.
In the Final Common Rule, consent is not required for screening unless new clinical specimens are obtained:
116(g) Screening, recruiting, or determining eligibility. An IRB may approve a research proposal in which an investigator will obtain information or biospecimens for the purpose of screening, recruiting, or determining the eligibility of prospective subjects without the informed consent of the prospective subject or the subject's legally authorized representative, if either of the following conditions are met:
(1) The investigator will obtain information through oral or written communication with the prospective subject or legally authorized representative, or
(2) The investigator will obtain identifiable private information or identifiable biospecimens by accessing records or stored identifiable biospecimens.43
BMC/BU Medical Campus has decided to continue to require modified consent for screening when information is obtained directly from prospective subjects, despite the changes in the Final Common Rule, based on concluding that eliminating this requirement does not show sufficient respect for persons. Other institutions may want to consider whether the somewhat more rigorous BMC/BU Medical Campus approach to requiring modified consent for certain screening might provide appropriate protections for subjects.
E. Single IRB Review
An increasing number of research studies are conducted at more than one site. Under the 1981 Common Rule, each site engaged in the research may choose to review the research locally or may rely on the review by another IRB (termed “ceding” review). It is generally agreed that multiple IRB reviews of the same project contribute to regulatory burden, with less agreement about the magnitude the resulting increase in the protection of human subjects.Reference Millum and Menikoff44 In 2016, the National Institutes of Health (NIH) adopted a policy requiring that only a single IRB may review NIH-supported research starting on January 25, 2018.45 The flexibility initiatives encourage IRBs to cede review whenever appropriate.46
In 2016, BMC/BU Medical Campus clarified their institutional obligations and process for relying on another IRB. For all requests to cede review, the BMC/BU Medical Campus IRB checks that BMC/BU Medical Campus investigators have fulfilled requirements for training and disclosure of financial interests, and the IRB Director assesses evidence for the quality of the proposed reviewing IRB, such as being accredited, being in the process of obtaining accreditation, or having performed a QA self-assessment. If no interactions with subjects will occur at BMC or BU Medical Campus (typically, when the local human subjects research activities are limited to analysis of identifiable data/specimens), no additional evaluation is needed. Otherwise, a member of the IRB office staff evaluates the submission for accuracy and consistency, including required special routing such as use of medical resources and radiation safety, and for compliance with or a justification for a deviation from the following local policies (which focus on the special considerations for our ethnically diverse, medically underserved subject population): obtaining consent from limited- and non-readers and subjects unable to consent for themselves; recruitment of students, trainees, and employees; recruitment of wards of the State of Massachusetts; and translation and interpretation for non-English speaking subjects. In addition, an IRB Chair evaluates the submission to assess whether it is appropriate given the local context for the conduct of research at BMC/BU Medical Campus, and if not, what changes in the local or study-wide procedures are needed. If the recommended changes are not made or not sufficient, the convened IRB will consider whether to permit the study to occur at BMC/BU Medical Campus. The ethical rationale for this evaluation process is that a local Chair has the experience to identify potential problems with the research that are specific to the local research population and that may be missed by the reviewing IRB.
BMC/BU Medical Campus has not made any changes to the processes for ceding review as the result of the changes in the Final Common Rule, because the requirement for single IRB review does not go into effect until January 19, 2020, providing time for additional guidance from OHRP and additional experience with ceding reviews. BMC/BU Medical Campus, like other institutions, will have to consider whether to make single IRB review required or optional for non-federally-supported multi-center research.
III. Flexibility Policies at BMC/BU Medical Campus that Do NOT Appear in the Final Common Rule
A. The Definition of What Constitutes Research
As described above, the Final Common Rule specified four types of activities that are deemed not to be research. These categories did not include two activities that BMC/BU Medical Campus specified in 2016 as not meeting the definition of research because they were not considered to be systematic investigations designed to contribute to generalizable knowledge: case reports/case series on three or fewer patients and Quality Improvement/Quality Assurance (QI/QA) activities that meet several specific standards (including no additional risks to patients, no suppression of standard of care, and no over-riding of clinical decision-making).
BMC/BU Medical Campus did not make any changes in the exclusion of case series and QI/QA activities from being considered research, even though neither was covered in the Final Common Rule. Other institutions may consider whether adding these exclusions to their definition of human subjects research is appropriate if they have not already done so.
B. An Additional Exempt Category for Quality Improvement/Quality Assurance (QI/QA) Activities
In evaluating QI/QA activities that do not meet the definition of research (see above), BMC/BU Medical Campus also established criteria for when QI/QA activities do meet the definition of research but can be considered exempt. The ethical justification is that subjects in QI/QA research meeting the specified criteria will be sufficiently protected by IRB review and abbreviated consent as required for exempt research at BMC/BU Medical Campus.
QI/QA research qualifies for Exempt Category 11 if it is not federally-supported and meets all of the following criteria: (a) All patients who get an intervention are expected to benefit. (b) All measurements that are collected are to determine the effect of the process change. (c) All patients involved in the intervention receive standard care at a minimum. (d) The intervention meets evidence-based or consensus-based quality standards. (e) Confidentiality protections are appropriate to the sensitivity of the data collected. (f) Obtaining consent from the patients is not practicable because the change or intervention will be carried out in a clinical setting where there is no meaningful way for patients to opt out of receiving the intervention.
In addition, abbreviated consent must be obtained from subjects (including healthcare professionals) participating in interviews, focus groups, surveys, or training (but not for patients affected by the QI/QA intervention).
BMC/BU Medical Campus is likely to retain this exemption for QI/QA research. Institutions evaluating whether to apply the federal rules to all of their research may want to consider whether similar flexibility provides the right balance between protection and regulatory burden.
C. Additional Expedited Categories
An IRB can grant approval of research in two ways: at a convened meeting or using the “expedited” process. The difference is that a convened meeting must adhere to numerous requirements for composition, quorum, and record-keeping, while expedited review can be done by a single Chair or experienced IRB member. Under the Common Rule, expedited review can be used for minimal risk research in categories that are specified in a separate Federal Register publication, and also for minor changes in previously approved research.47 Flexibility initiatives commonly have included expanding the categories of research eligible for expedited review.48 The ethical rationale is that the increased scrutiny resulting from review by multiple IRB members is unlikely to generate meaningful improvements in the protection of human subjects for most minimal risk research.
In 2016, BMC/BU Medical Campus established three additional categories of non-federally-supported research eligible for review by the expedited process. Two were minor expansions of existing expedited category: collecting blood more frequently than 2 times per week (with no increase in the total amount of blood collected) and collecting biological specimens by minimally invasive methods in addition to noninvasive methods. The third new category allowed expedited review for research involving a single exposure of adults to ionizing radiation with an effective dose not exceeding 0.1 mSv (the dose typically associated with a chest xray).
The Final Common Rule did not affect the list of categories eligible for expedited review, although it did include a new requirement that the list (which has not been modified since 1998) be evaluated at least every 8 years and amended as appropriate, with a revised list to be published in the Federal Register for public comment before being finalized.49 The Secretary's Advisory Committee on Human Research Protections (SACHRP) is developing recommend changes in the categories to OHRP.50
BMC/BU Medical Campus is likely to retain the additional categories of research eligible for expedited review for non-federally-supported research at least until the existing federal list is revised. Institutions evaluating whether to apply the federal rules to all of their research may want to consider temporarily adopting additional expedited categories for non-federally-supported research to decrease the burden on investigators and IRBs with little chance of decreasing protection of human subjects.
D. Additional Flexibility for Research with Pregnant Women and Fetuses, Prisoners, and Children
I. Subparts Addressing Additional Protections
The Federal Policy for the Protection of Human Subjects contains, in addition to Subpart A (the Common Rule), three sections relating to additional protections for pregnant women and fetuses (“Subpart B”), prisoners (“Subpart C”), and children (“Subpart D”), as well as one section addressing registration of IRBs (“Subpart E”).51 None of these sections was changed during the revisions to the Common Rule, although the preamble states that “the intent is to eventually amend the other subparts of the HHS human subjects protection regulations in 45 CFR part 46 (subparts B, C, D, and E).”52 In the section on exempt research, the Final Common Rule does incorporate language from existing Subparts B and D on how the exemptions apply (all exemptions apply to pregnant women and fetuses; most exemptions apply to children, except for interviews/surveys and observations of public behavior when the investigators participate in the activities being observed).53 Existing Subpart C does not specify the applicability of the exemptions for prisoners, but the Final Common Rule now includes that none of the exemptions apply, “except for research aimed at involving a broader subject population that only incidentally includes prisoners.”54
In 2016, BMC/BU Medical Campus established several policies for increased flexibility in applying the requirements of Subparts B, C, and D.
II. Applicability of Requirements for Pregnant Women and Fetuses
The current Subpart B requirements apply to all non-exempt research, and mostly address minimizing and communicating risks to the pregnant woman and/or fetus. Some of the requirements are challenging to apply to minimal risk research that may incidentally involve pregnant women, particularly that “the purpose of the research is the development of important biomedical knowledge which cannot be obtained by any other means”55 and that “individuals engaged in research must have no part in any decisions as to the timing, method, or procedures used to terminate the pregnancy.”56 Most IRBs have developed standard language to satisfy the requirement for documenting how these and the other criteria are met for minimal risk research involving pregnant women, but adhering to this process does not reflect any additional protections. In 2016, BMC/BU Medical Campus eliminated the requirement that the IRB must record findings under Subpart B for minimal risk research that is not supported by a federal agency that has adopted Subpart B. The ethical justification is that minimal risk research already meets the criteria in Subpart B, and additional documentation requirements are a burden on IRBs without any associated increase in protections.
One additional change made in 2016, suggested by the flexibility initiative,57 was to allow the IRB to determine, for research not supported by a federal agency that has adopted Subpart B, that the consent of only the mother of the fetus could be allowed for research that holds out the prospect of directly benefiting the fetus, in contrast to Subpart B which also requires the consent of the father of the fetus for such research (unless he is unable to consent because of unavailability, incompetence, or temporary incapacity or the pregnancy resulted from rape or incest). The ethical justification is that a mother would be able to weigh the advantages and disadvantages of participating and make the decision on her own.
Revisions to Subpart B are likely to address the applicability for minimal risk research, and may address the requirement for the father's consent for research holding out the prospect of direct benefit to the fetus. BMC/BU Medical Campus will re-evaluate the need for flexibility after the revisions are final.
III. An Additional Exempt Category for Surveys and Interviews with Children
Existing Subpart D and the Final Common Rule do not allow surveys and interviews with children to be exempt, “because protections, including IRB review and parental permission, are appropriate for research involving children.”58 The Final Common Rule does not include a mechanism for requiring parental permission for exempt research nor for IRB review except for review of data protection or broad consent for certain specific exempt categories. However, BMC/BU Medical Campus does require IRB review and assent/parental permission for exempt research, providing the ethical justification for establishing Exempt Category 8 for non-federally-supported research in 2016, as suggested by AAHRPP59 and adopted by at least one flexibility institution:60
Research with children involving survey procedures, interview procedures, or observation of public behavior where the investigators or research staff participate in the activities being observed.
BMC/BU Medical Campus is likely to retain this exemption, even after Subpart D is revised, unless it incorporates a similar mechanism to reduce the requirements for surveys and interviews with children. Institutions evaluating whether to apply the federal rules to all of their research, if they have established IRB review and permission/assent requirements for exempt research, may want to consider whether allowing surveys and interviews with children to be exempt provides sufficient protections.
The advantage of this exempt category is that the parental permission form can meet the requirements for abbreviated consent, and therefore be briefer and easier to understand. If the investigator does not plan to obtain parental permission, then the study does not qualify for Exempt Category 8 and instead must meet all of the criteria for approval, including for the waiver of parental permission.
BMC/BU Medical Campus is likely to retain this exemption, even after Subpart D is revised, unless it incorporates a similar mechanism to reduce the requirements for surveys and interviews with children. Institutions evaluating whether to apply the federal rules to all of their research, if they have established IRB review and permission/assent requirements for exempt research, may want to consider whether allowing surveys and interviews with children to be exempt provides sufficient protections.
IV. Allowing the Signature of Only one Parent if Justified
Subpart D requires that investigators obtain the signature of two parents (unless one of the two parents is deceased, unknown, incompetent, or not reasonably available, or only one parent has legal responsibility for the care and custody of the child) for research in child category 3: minor increase over minimal risk with no prospect of direct benefit to the child.61 In 2016, as suggested by the flexibility initiative,62 BMC/BU Medical Campus established the ability of the convened IRB to determine for non-federally-supported research that the permission of only one parent is required for research in child category 3, based on the risks, benefits, and best interests of the children. The ethical justification for this flexibility is that an investigator may be able to justify why the requirement for the signature of two parents imposes a burden on the research without any commensurate improvement in protection of the children.
BMC/BU Medical Campus is likely to retain this exemption, even after Subpart D is revised, unless it incorporates a similar mechanism for modifying the signature requirements for research in child category 3. Institutions evaluating whether to apply the federal rules to all of their research may want to consider whether similar flexibility in parental signature requirements is appropriate.
V. Applicability of Prisoner Requirements
The additional protections in Subpart C primarily apply to enrolling and consenting prisoners, in order to prevent coercion and undue influence to participate and to ensure that consent is truly informed and voluntary. However, research supported by federal agencies that have adopted Subpart C is required to apply Subpart C even when a subject that has already enrolled in a research study that was not approved for the inclusion of prisoners becomes incarcerated. All study related activities must cease (including collection and analysis of identifiable information) until the continued participation of the subject has been approved by the IRB.63 In 2016, as suggested by the flexibility initiative,64 BMC/BU Medical Campus eliminated the requirement that all study related activities must cease when a subject becomes incarcerated after enrolling in a non-federally-supported study. The ethical justification is that the protections in Subpart C are not applicable after the subject has enrolled in a nonincarcerated setting, except for the requirement for appropriate follow-up care after release from incarceration. The requirement to cease all study activities prior to IRB review does not provide any additional protection for the subject's rights and welfare.
BMC/BU Medical Campus is likely to retain the exclusion of ceasing study activities for subjects who become incarcerated after enrollment, even after Subpart C is revised, unless a similar change is incorporated. Institutions evaluating whether to apply the federal rules to all of their research may want to consider whether similar flexibility provides appropriate protection for subjects.
IV. Conclusions
Reducing unnecessary burdens on research is ethical when protections for human subjects are not diminished, because investigators and IRBs can devote their efforts to more productive activities.65 The key is to properly evaluate which burdens are unnecessary. BMC/BU Medical Campus had the advantage of the experience of the experience of flexibility initiative institutions as well as the proposed changes to the Common Rule in making decisions about altering its requirements for human subjects research. In the first year plus since the new policies were implemented, no major complaints or incidents have arisen. As outlined in this article, the approaches taken at BMC/BU Medical Campus may be useful to other institutions as they determine how to proceed with changes in response to the Final Common Rule.
Acknowledgements
Tracy Battaglia, John Ennever, Thomas J. Moore, and two anonymous reviewers provided helpful comments on this manuscript.



