Proposed Revisions to the Common Rule for the Protection of Human Subjects in the Behavioral and Social Sciences (2014)

2

Rationales, Definitions, and Procedures Related to Research Not Involving Human Subjects and the Proposed Excused Category of Research

INTRODUCTION

Two important reviews of the evidence on institutional review boards (IRBs) that were published in 2011 have direct implications for revisions to the Common Rule. Abbott and Grady (2011) examined studies that evaluated different aspects of IRB functioning including structure, review costs, implementation processes, variation in outcomes or processes of IRB review of multicenter research, and outcome studies that examined IRB decisions and deliberation results. No studies were identified that evaluated the effect of IRBs on the human subjects’ protection. The studies reviewed covered a broad range of research as far back as 1975, but most studies were conducted in the 2000s. The authors commented that their results supported historical complaints about IRBs being inconsistent, inefficient, redundant in multisite reviews, and burdensome. Differences were found in how federal regulations were interpreted and implemented, in time to complete reviews, and in the decisions made. The authors concluded that measures or metrics are needed to demonstrate the results of IRBs and that research is needed to answer a host of intermediate questions leading to evaluating the effectiveness of IRBs. For example, research is needed to answer questions about how IRBs determine and minimize risk, the quality of IRB review, and the protective effects of IRBs (Abbott and Grady, 2011).

The second review was conducted by Silberman and Kahn (2011), who identified 52 health-related research studies that collected primary data on the costs of IRB review in terms of expenditures of time or money and constraints on the scope of research. The authors were also looking at IRB

performance factors that might be associated with burdens. Most studies were published after 1998. More than half of the studies were focused on multisite research. Similar to Abbott and Grady (2011), Silberman and Kahn (2011) found differences in levels of efficiency, decisions that diverge from regulations and from guidance from the Office for Human Research Protections (OHRP) in the U.S. Department of Health and Human Services (HHS), and lengthy and variable waiting times, often for the same protocol. They also underscored the gap in knowledge between the vitally important research conducted to improve personal and public health and how such research is regulated.

Both of these reviews of the evidence commented on the lack of standard data collected on IRB functioning and costs, which would provide feedback to improve the system. Although not national data sources, two organizations are collecting data from member IRBs across the United States on IRB performance. The Association for the Accreditation of Human Research Protection Programs (2013) collects metrics on institutional and IRB characteristics, types of research conducted, sponsors of research, IRB review times, disapproval of research, IRB resources, audits, protocol deviations, and noncompliance reported to the IRB. The 2013 report of the National Research Network, in which similar types of metrics are collected and reported, uses more of a benchmark structure comparing performance (e.g., turnaround time by type of IRB and level of IRB review). Both of these reports were based on fairly small numbers of IRBs: the Association for the Accreditation of Human Research Protection Programs has 183 member IRBs; the National Research Network reported on 100 randomly selected member IRBs.

The reviews by Abbott and Grady (2011) and by Silberman and Kahn (2011) support the need to revise the regulatory framework both to improve IRB functioning and to reduce burden. Although no generalization can be made about current IRB functioning in the United States based on the new and developing performance databases described above (Association for the Accreditation of Human Research Protection Programs, 2013; National Research Network, 2013), these are important sources of data that can over time provide feedback with implications for improving performance and can inform future policy decisions.

With this brief review of the evidence in mind, in this chapter the committee builds on the intent of HHS and the Office of Science and Technology Policy in issuing the Advance Notice of Proposed Rulemaking (ANPRM) “to enhance the effectiveness of the research oversight system by improving the protections for human subjects while also reducing burdens, delays, and ambiguity for investigators and research subjects” (76 Fed. Reg. 44,516). The ANPRM notes specifically the potential for overregulation of social and behavioral science research, since much of it involves only informational risk that is no more than minimal.

The ANPRM (76 Fed. Reg. 44,514-44,515) describes proposed changes to the Common Rule in the areas shown in Box 2-1. This chapter addresses the first point in the box, on refinements to the risk-based regulatory framework and specifically to the subitems on revising the regulations regarding studies currently considered exempt (subitem d) and establishing mandatory data protection and information security standards (subitem a). Subsequent chapters address these and other topics listed in Box 2-1.

With regard to the regulatory framework itself, the committee started by reexamining the definitions of “human subjects” and “research” upon which the Common Rule is based, and in this chapter we recommend combining the two terms to simplify determinations of whether IRB review is needed and of what type. Building on this base, the committee found that many types of research using publicly available information sources should actually be considered “not human-subjects research,” and we provide examples of these for cases where there is no reasonable expectation of privacy.

Exempt research is intended as a class of activities that falls outside of

the scope of the Federal Regulations for the protection of human subjects (45 C.F.R. § 46, Part A, hereafter referred to as “the Common Rule”). However, this term has been among the most confused and debated in the Common Rule with regard to what research is covered under this category and the process of determining what is exempt (Pritchard, 2001). The core dilemma has been that this category of research is considered to be exempt from IRB review, but guidance from OHRP has recommended some form of IRB review. Thus, in most institutions exempt research is considered to require IRB review.

The committee supports the ANPRM’s creation of a new category of “excused research” for research activities, formerly considered exempt, in which participants are primarily exposed to informational risk. In this chapter recommendations are offered for defining the new category and examples are provided of social and behavioral science research activities that would fall in the new category. As suggested in the ANPRM, the committee includes in the “excused” category examples of social and behavioral sciences research methods that are essentially benign interventions that would have previously required expedited review. The committee also clarifies the differences between research activities that are excused from IRB review and those that would require expedited IRB review—a topic taken up in more detail in Chapter 3. Although certain research activities are excused from IRB review, the ANPRM suggested procedures for registering excused research, requiring data protection plans, and auditing small samples of the research. The committee offers recommendations for how these types of procedures might be implemented in the context of social and behavioral sciences. Chapter 5 returns to the topic of excused research to address in more detail informational risk and data protection plans.

This chapter also suggests specific guidance that OHRP should provide in support of the regulatory revisions under the ANPRM. To make these recommendations more useful, the chapter includes examples of a wide variety of social and behavioral science research activities that could be used by OHRP to clarify what research comes under the category of “excused.”

The net effect of the ANPRM proposed changes to the Common Rule and the committee’s refinements to these changes for the social and behavioral sciences is to limit the scope of activities covered under the Common Rule. The framework recommended in this chapter places greater responsibility on investigators for the ethical conduct of research. However, it does so only with careful attention to what constitutes human-subjects research and to the kinds of social and behavioral science research reliably involving no greater than minimal informational risk for participants. It also proposes procedures for research registration and accountability for professional mistakes or misjudgments. Finally, this framework specifies circumstances when consultation or review by an IRB under expedited procedures would be appropriate.

Background on Exempt Research

For many years, ambiguity in the meaning of “exempt research” has been a source of confusion and inconsistent practices on the part of institutions and IRBs. One issue has been who can make the determination about what research is exempt from IRB review under 45 C.F.R. § 46.101(b). Regulations in place since the National Research Act of 1974 were revised and expanded between 1978 and 1981 in light of the Belmont Report (U.S. Department of Health and Human Services, 1979). Since 1981, HHS has recognized that IRBs need to focus their time and energy on research posing greater than a minimal risk and on magnitude of harms greater than those encountered in everyday life.

In January 1981, 6 months before the revised Common Rule went into effect, HHS explained the introduction of broad exemptions for educational, behavioral, and social science research that it described as normally presenting little or no risk of harm to subjects, as follows:

In taking this step, the Department anticipates that the work load of IRBs will be significantly reduced, as will the paperwork burden on those scientists whose research will be henceforth exempt. Also, since the IRB will be relieved of unnecessary work, research institutions are expected to have less difficulty in recruiting members of IRBs, and the IRBs will be able to concentrate more productively on projects which most deserve IRB attention.¹

The revised regulations, however, left to institutions to “adopt any administrative procedures relative to exempt categories of research, if they deem them appropriate” (46 Fed. Reg. 8,372). This helps to explain the uncertainty, ambiguity, and overregulation that have been observed in the ensuing years. For example, in 1995, the Office for Protection from Research Risks in HHS found it necessary to restate that there needs to be a policy in place at institutions concerning who can make the determination about what research is exempt from IRB review under 45 C.F.R. § 46.101(b) (U.S. Department of Health and Human Services and Office for Protection from Research Risks, 1995). OHRP, the successor to the Office for Protection from Research Risks, reaffirmed that guidance again in 2002, and it remains current OHRP policy and guidance.²

This guidance leaves to institutions the decision on how to make the exempt determination; while it does not rule out an institutional decision to have investigators make that determination themselves, it strongly advises

_________________

¹See the January 26, 1981, “Final Regulations Amending Basic HHS Policy for the Protection of Human Subjects Research,” at 46 Fed. Reg. 8,367-8,368.

²See “Exempt Research and Research That May Undergo Expedited Review,” under OHRP Policy & Guidance, at http://www.hhs.gov/ohrp/policy/hsdc95-02.html [October 2013].

against such a decision because of potential conflicts of interest around implementation. Operationally, most institutions delegate this responsibility to IRBs, which have the authority to determine how broadly or narrowly to use the exempt category or whether to use it at all. Since these determinations are referred to IRBs, there is functionally no scholarship about or involving people that a priori falls outside of IRB oversight or reduces the burden on IRBs to look at all research.

As recently as September 2008, the HHS Secretary’s Advisory Committee on Human Research Protections (SACHRP) issued a specific call for a “consolidated, comprehensive guidance document” that is general on the application of the exemption categories and specific for each of the six categories of exemptions.³ Over half of the SACHRP letter is devoted to the exempt category, with extensive advice for clarifications and guidance. In section IC(1) of that letter, SACHRP particularly emphasized the need for clarification of the relationship between the exemptions and the definitions of “human subject” and “research”:

Institutions and investigators are still confused about the decision steps for determining the applicability of the HHS regulations prior to making exemption determinations. Some activities that do not meet the regulatory definition of “research” (45 CFR 46.102[d]) or “human subject” (45 CFR 46.102[f]) are inappropriately reviewed through use of the exempt categories. The guidance should clearly state the sequence and interrelationships between the definitions of “research” and “human subject” with the exemptions.⁴

Background on Excused Research

The ANPRM offers the kind of fresh ideas called for in the SACHRP letter. In particular, the ANPRM has proposed a new category of “excused” research, applicable to human-subjects research.⁵ It is intended to cover research involving only informational risk either (a) where the risk of disclosure and the potential harm from it involve no risk or no greater than minimal risk or (b) where data protection plans and risk reduction mechanisms reduce the risk of disclosure to no greater than a minimal level.

_________________

³See the SACHRP Letter to HHS Secretary, September 18, 2008 at http://www.hhs.gov/ohrp/sachrp/sachrpletter091808.html [October 2013].

⁴See SACHRP letter at http://www.hhs.gov/ohrp/sachrp/sachrpletter091808.html (p. 1) [December 2013].

⁵The ANPRM introduced the term “excused” but questioned whether it was the best term for characterizing the research so classified. It suggested that “registered” might be a better way to describe these studies since they do come under a “variety of requirements to protect participants.” In particular, they are self-classified and registered by investigators and only subject to audit review (76 Fed. Reg. 44,518 and 44,520).

In this chapter, the committee addresses how the addition of an “excused” category can be structured and defined to handle these kinds of minimal-risk research, thereby reducing IRB and investigator burden in research that would come within the definition of human-subjects research.

The recommendations developed in the sections below depart from those of the ANPRM in three important respects: First, whereas the ANPRM rolls all of the former exempt categories into the new excused category, the committee carves out certain types of research activities that could be categorized as “not human-subjects research.” Second, the committee recommends that the revised Common Rule not require investigators using pre-existing data (whether collected for non-research or research purposes) to obtain consent, as long as they adhere to the original terms of consent and use the data with appropriate data protection plans in place.⁶ Third, although the committee supports the aims of the ANPRM to reduce informational risk through data protection mechanisms, we believe the ANPRM’s reliance on the Health Insurance Portability and Accountability Act of 1996 (HIPAA) is misguided. Consonant with the consensus in the public commentaries on the ANPRM from social and behavioral science professional organizations,⁷ the committee has concerns about the use of HIPAA as an appropriate data protection mechanism.

The Privacy Rule under HIPAA aims to protect personally identifiable health information held by covered entities and to specify patients’ rights; the Security Rule aims to safeguard the confidentiality, integrity, and availability of electronically protected health information.⁸ These rules are directed to protecting and securing administrative health records obtained for non-research purposes. They are not intended to offer a data security and protection structure for the confidentiality of private information while also allowing for appropriate scientific research involving human subjects. The committee therefore outlines a modification that would enable a system for excusal appropriate for research in the social and behavioral sciences while still protecting human subjects of research from greater than minimal informational risk.⁹

Overall, however, the committee’s recommendations are consistent with the approach and aims of the ANPRM. Like the ANPRM, the committee outlines a plan that would include in the “excused” category a large

_________________

⁶See 76 Fed. Reg. 44,519-44,520. The ANPRM recommends consent as the default, noting that consent requirements may be waived and that generally subjects will have signed a consent form “allowing for broad, future research.”

⁷See http://www.regulations.gov/#!searchResults;rpp=50;po=0;s=HHS-OPHS-2011-0005;dct=PS [December 2013].

⁸Further information on these rules can be found at http://www.hhs.gov/ocr/privacy/hipaa/understanding/index.html [December 2013].

⁹Chapter 5 discusses HIPAA and data protection plans in greater detail.

proportion of research that previously came under the “exempt” category. Further, consistent with the thinking in the ANPRM, the committee’s plan includes as excused research those types of social and behavioral research that are essentially benign interactions or interventions that are commonly used, involve no risk to subjects, and are essentially informational in nature, through verbal or similar methods familiar to people (76 Fed. Reg. 44,518-44,519). Under this plan, excused research would no longer be reviewed by IRBs. Instead, it would be registered and required to have a data protection plan appropriate to the level of informational risk it poses.

The committee fully supports the ANPRM’s underlying objectives— first enunciated by HHS in 1981—namely, to focus IRB review on issues requiring human research protection, to address informational risk more effectively, and to better understand and define the different types of research covered by different levels of IRB oversight or review. The dual aims of the ANPRM are to promote human subjects protection while advancing research and reducing the administrative burden on IRBs so that their time and expertise can be devoted to research that involves forms and levels of risk that would most benefit from their review. The committee shares these goals and offers the recommendations that follow as a better way to achieve them.

CLARIFYING THE SCOPE OF THE REGULATIONS

Redefining Human-Subjects Research

The current regulatory definitions present “research” (45 C.F.R. § 46.102(d)) and “human subject” (45 C.F.R. § 46.101(f)) as distinct. Linking the two so that “human subject” explicitly qualifies “research” would clarify which kinds of research activities are outside the scope of the Common Rule and which are within its scope. Because the Common Rule nowhere explicitly defines “human-subjects research” as a particular kind of research, the committee recommends that it be revised to explicitly take this into account.

Recommendation 2.1: HHS should revise the Federal Regulations so as to combine explicitly the definition of “research” (45 C.F.R. § 46.102(d)) and the definition of “human subject” (45 C.F.R. § 46.102(f)). “Human-subjects research” is systematic investigation designed to develop or contribute to generalizable knowledge by obtaining data about a living individual directly through interaction or intervention or by obtaining identifiable private information about an individual. HHS should revise

the Common Rule to clarify that only “human-subjects research” falls within the scope of this regulation.

Having recommended how to redefine human-subjects research, the next two sections discuss two types of activities that should be considered as “not human-subjects research.” These include (1) scholarship activities and (2) gathering or analyzing publicly available information. Box 2-2 provides definitions of terms used to refer to different types of data or data sources as the chapter proceeds.

Activities Outside of Human-Subjects Research

Scholarship Activities

The framework for this chapter’s recommendations follows from the fundamental point that the Common Rule was intended to apply to human-subjects research specifically in the biomedical, behavioral, and social sciences. From that perspective, the Common Rule does not apply to scientific research that does not meet the definition of human-subjects research. Also, it does not apply to scholarly or investigative activities that are not conventionally considered to be scientific research, even if they involve interaction with people.

Recommendation 2.2: HHS should revise the Federal Regulations to clarify that many forms of scholarship that are widely labeled “research” should be considered as “not human-subjects research” because they are not covered by the intent or spirit of the term “human-subjects research” (see Box 2-3).

Guidance Recommended: OHRP should provide guidance offering examples of forms of scholarship that conventionally fall outside of the definition of human-subjects research, which could help researchers and IRBs in determining whether research activities would be considered as not human-subjects research. For example, historians or nonfiction writers speaking to sources about particular events, or organizations collecting information about preferred benefits packages or studying internal process improvement (that is, self-study) are not engaged in human-subjects research, and such activities are not intended to be covered by 45 C.F.R. § 46.

Publicly Available Information

Also shown in Box 2-3 are examples of publicly available information. While gathering and analysis of publicly available information may meet the definition of research, use of such information, even if identifiable, does not constitute human-subjects research because it does not involve direct intervention or interaction and because the information is not private. The committee therefore concludes that, to clarify its scope, the Common Rule should explicitly classify as “not human-subjects research” those research activities that involve the use or gathering of publicly available information, including observation in public places, whether the information is identifiable or not, recorded or not, or accessible or not through any public medium (virtual, or otherwise). Further discussion follows regarding two

types of publicly available data: (1) those which are obtained through non-research venues (e.g., the Internet, administrative records) and (2) those which are obtained through certified public-use research files.

Expansion of Publicly Available Non-Research Data. The ANPRM, at 76 Fed. Reg. 44,519, distinguishes between data originally collected for non-research purposes and data collected for research purposes. There has been a dramatic explosion in the availability of non-research data for public consumption, profit and nonprofit sector purposes, and research use. In this report, the committee uses the term “publicly available non-research

data” to refer to data, including contents of record systems, on individual humans that can be freely accessed by anyone or can be purchased by non-researchers.

The rise of the Internet and, more generally, the digitization of information have greatly increased the volume of public non-research data available to social and behavioral scientists. Increasingly these researchers are using “found data” or “harvested data” from existing sets of information that were collected by entities in the private and government sectors and that are publicly available. These data have scientific value because they (a) offer timely (often real-time) documentation of behavior; (b) are collected on large populations of individuals or organizations, yielding massive datasets; (c) are relatively inexpensive to acquire; and (d) are relevant to behaviors that are often of interest to social scientists.

Two forces have led to an explosion in digital data on human populations. First, the rise of management information systems (e.g., electronic transaction records for customers and clients, service-sector tracking of client contacts, targeted marketing) and a host of related business practices have led businesses to create and use large amounts of person-level data in their day-to-day activities. Second, the rise of modern information and networking technologies has spawned a wide array of ways to document the behavior of billions of people as they proceed through their daily activities.

For instance, World Wide Web browsers now capture the behavior of people performing search, purchasing, and information-gathering activities on their computers and mobile phones every day throughout the world. Moreover, the Internet has produced an ever-growing collection of platforms for social media networking, which reveal personal information on individuals, their friends, and relatives. New industries have multiplied based on the modern networked society, and many of these businesses actively collect detailed attributes about their customers. Indeed, for many of these businesses the personal data resource is their business. Box 2-4 provides a listing of various types of digital data and the technologies that enable their gathering.

With these new data sources has come a new culture regarding what is private and what is public. Details of personal lives are shared publicly on Facebook, MySpace, MeetMe, Twitter, and other social media platforms. However, the rise of digital data being delivered in near real time has created important changes in all persons’ lives and makes new forms of data available for research.

Rich research discoveries are now possible with pre-existing data sources available for public use. These same data systems have changed the risks of everyday life for all people, arising from non-research uses of the data. Individuals can be inundated with sales marketing calls and junk mail about products based on their records in commercial datasets sold to

businesses. People’s past life can be fully investigated by purchase of records from financial credit firms. Past relationships can be revealed to those who were unaware of that past. Internet users’ past web-based behaviors are used to change what they see on the web.

These features of current life exist irrespective of whether the information is small in scale or enormous in size and scope; whether it is public through administrative databases, Internet interactions or transactions, innovative recording technologies, or place-based image or locational capture; or whether it is collected or harvested at a single point in time or rapidly and continuously. The richness and openness of the world of digital data has as a basic property that it is public, and this digital world has fundamentally changed our everyday lives. At the same time the ethical challenges posed by these new forms of data will demand attention to the ethical obligations of researchers and IRBs. In a report specifically addressing ethical decision making and Internet research, the Association of Internet Researchers describes the tensions between the notions of public and private:

Individual and cultural definitions and expectations of privacy are ambiguous, contested, and changing. People may operate in public spaces but maintain strong perceptions or expectations of privacy. Or, they may acknowledge that the substance of their communication is public, but that the specific context in which it appears implies restrictions on how that information is—or ought to be—used by other parties. Data aggregators or search tools make information accessible to a wider public than what

might have been originally intended. In mediated contexts, as Nissenbaum points out, “what people care most about is not simply restricting the flow of information but ensuring that it flows appropriately” (2010, p. 2). As noted in the 2002 version of these AoIR [Association of Internet Researchers] ethics guidelines, privacy is a concept that must include a consideration of expectations and consensus. Social, academic, or regulatory delineations of public and private as a clearly recognizable binary no longer holds in everyday practice. When conducting research within such shifting terrains, when there is no consensus, or even assumption of consensus, Nissenbaum’s concept of contextual integrity (2010) is a valuable construct. (Association of Internet Researchers, 2012, p. 6)

Most simply, contextual integrity refers to considering the social norms of privacy in different contexts. How are they different or the same in person, over the telephone, or on the Internet? The report from the Association of Internet Researchers encourages researchers to engage in an informed and collaborative ethical decision-making process in planning the research from design through dissemination phases. For example when studying special interest forums on the Internet, a question that needs to be considered is: what are community and individual norms and expectations for privacy? This process can assist researchers in dealing with the challenges of trying to decide what is a reasonable expectation of privacy. Many of the points related to gathering data from the Internet can apply to other digital data. The issue of when information is public and private has also been addressed in other spheres. For example, in 2003, the Urban and Regional Information Systems Association adopted a code of ethics regarding the use of spatial data available from geographic information systems (Levine and Sieber, 2007).

Private information as defined by the Common Rule means “information about behavior that occurs in a context in which an individual can reasonably expect that no observation or recording is taking place and information which has been provided for specific purposes by an individual and which the individual can reasonably expect will not be made public (for example a medical record)” (45 C.F.R. 46.102(f)). In providing guidance concerning Internet research and human subjects regulations, SACHRP advises that

If individuals intentionally post or otherwise provide information on the internet, such information should be considered public unless existing law and the privacy policies and /or terms of service of the entities receiving or hosting the information indicate that the information should be considered “private.” (Secretary’s Advisory Committee on Human Research Protections (2013, p. 5)

The committee makes the following recommendation, taking into consideration the various ethical, regulatory, and legal aspects of the questions of privacy and use of publicly available information in research.

Recommendation 2.3: HHS should revise the Federal Regulations to make clear that investigator use of only publicly available information, information in the public domain, or information that can be observed in public contexts is “not human-subjects research” and thus is outside of 45 C.F.R. § 46, whether or not the information is identifiable, as long as individuals whose information is obtained have no reasonable expectation of privacy. New forms of large-scale data should be included as “not human-subjects research” if all information is publicly available to anyone (including for purchase), if persons providing or producing the information have no reasonable belief that their private behaviors or interactions are revealed by the data, and if investigators using the data have no interaction or intervention with individuals. Investigators must observe the ethical standards for handling such information that guide research in their fields and in the particular research context.

Public-Use Data Files from Research Data. Information that is extracted from research data to provide public-use data files for investigators is also considered to be “not human-subjects research” as long as the public-use data files do not allow for the identification of human subjects and have been certified as such for public use. Investigators using such secondary data have no direct contact with or knowledge of human subjects. Public-use data files may be provided by government agencies, by research investigators seeking to share data from their projects, or by organizations dedicated to distributing data collected by others.

The committee endorses the recommendations of the National Research Council’s Panel on Institutional Review Boards, Surveys, and Social Science Research (National Research Council, 2003) and Panel on Data Access for Research Purposes (National Research Council, 2005) and proposes to classify as not human-subjects research public-use datasets that have been certified by statistical agencies or by participating archives as sufficiently protected against the disclosure of human subjects to be acceptable for public access and use.¹⁰ We further recommend that researchers who

_________________

¹⁰Recommendation 2.4 is derived from the recommendation on public-use data files approved by the National Human Subjects Protection Advisory Committee at its January 28-29, 2002, meeting. Public-use data files are data files prepared by investigators or data providers (e.g., data repositories, the federal government) with the intent of making them available for public use. Such files do not contain records that are individually identifiable or maintained in a readily identifiable form.

originally collected the data may release them in public-use form as long as they have similarly met that standard in accord with their IRB.

Recommendation 2.4: HHS should revise the Federal Regulations to classify as not human-subjects research public-use data files that have been extracted from research data as long as the data files have been de-identified and certified as protected against disclosure.

Guidance Recommended: OHRP guidance should be provided to clarify for investigators that, if they use more than one public-use dataset, they should protect against the very rare circumstance when simultaneous use or linkage could lead to re-identification.

Several examples of research that apply under Recommendations 2.2, 2.3, and 2.4, and the associated Guidance Recommended, are provided in Boxes 2-3 and 2-4. The examples were chosen to represent the key ideas embodied in the recommendations.

EXCUSED RESEARCH

Scope of Excused Research

This section builds on the ANPRM proposals for creating a new category of human-subjects research that is excused from IRB determination or review. Consistent with the ANPRM, the scope of excused research covers studies that have minimal informational risk and that involve interaction or intervention with human subjects or use of pre-existing research or non-research data that include private information. The category is tailored to a swath of human-subjects research where the research procedures themselves involve informational risk, but where that risk of disclosure is no more than minimal when appropriate data security and protection plans are in place.

As noted earlier, the committee’s recommendations vary in some specifics from the ANPRM. Nevertheless, we support the vision of excusal from IRB review set forth in the ANPRM under the headings of “Ensuring Risk-Based Protections,” “Moving Away from the Concept of Exempt,” and “Types of Research that Qualify for the Excused Category” (76 Fed. Reg. 44,514-44,520). The committee strongly recommends that a category of excused research be added to 45 C.F.R. § 46.

Recommendation 2.5: HHS should expand the Federal Regulations to include a new category of human-subjects research termed “excused” that would (a) not be reviewed by an IRB or any other form of human-subjects research review, except in the limited oversight function to be

specified in the revised regulation, and (b) require the investigator to register the study with an IRB. Research should qualify as excused if the only risks of harm to participants posed by the study procedures themselves are informational (that is, the only plausible harm posed by the study procedures themselves involve the possible disclosure of personally identifiable information) and such risks are not at a greater than minimal level (defined as risks of disclosure of personal information not exceeding those encountered in daily life).

The following three recommendations describe the scope of excused research, general types of research that would fit into this category, and expectations related to the consent process for these types of research. Additional guidance is provided in Chapter 3 on key elements that need to be considered in determining whether research requires expedited review.

Recommendation 2.6: HHS should specify in the revised Federal Regulations that excused research covers studies where the research procedures involve informational risk that is no more than minimal (when appropriate data security and information protection plans are in place).The revised regulations should explicitly state that the excused category includes use of pre-existing research and non-research data that contains private information¹¹ or “benign interactions or interventions”¹² that involve methodologies or activities that are very familiar to people in everyday life and in which verbal, behavioral, or physiological responses would be the research data collected, such as educational tests, surveys, focus groups, interviews, and similar procedures.

Recommendation 2.7: HHS should make clear in the revised Federal Regulations that excused research includes research that has no more than minimal risk, even if the information being gathered addresses questions about human subjects’ physical or psychological well-being.

Recommendation 2.8: HHS should explicitly address in the revised Federal Regulations the relationship between the consent of human subjects and excused research, with consent required in all excused research that directly involves human subjects through interaction or intervention.

_________________

¹¹This category (except for observation in public places) is currently categorized as “exempt” at 45 C.F.R. § 46.101(b)(2).

¹²See 76 Fed. Reg. 44,519.

Guidance Recommended: OHRP should issue guidance that includes a list of types of research excused from IRB review under the revised Common Rule, as OHRP already provides in its guidance on expedited research. The list should include illustrations of research using pre-existing research and non-research data that include private information, including linked data; and benign interactions or interventions that involve methodologies or activities that are very familiar to people in everyday life and in which the data consist of verbal, behavioral, or physiological responses, such as educational tests, surveys, focus groups, interviews, and similar procedures. The list of excused studies should include methods that involve withholding or modifying information, but do not induce physical or psychological discomfort.¹³

The list of research activities eligible to be excused from IRB review should set forth examples that embrace the full range of studies contemplated under the excused categories. OHRP guidance should explicitly indicate that such a list is illustrative and not exhaustive of the types of excused research that fit the regulatory definition.

Examples of Excused Research

As stated in Recommendation 2.6, excused research covers studies where the research procedures involve informational risk that is no more than minimal and includes

•   use of pre-existing research and non-research data that include private information, including use of extant research data under restricted use provisions or use of non-research data that are accessible but include private information about individuals that they may not expect to be public; or

•   benign interactions and interventions¹⁴ that involve methodologies that are very familiar to people in everyday life and in which verbal, behavioral, or physiological responses would be the research data collected.

Although research designated as “excused” would not, under the committee’s proposed approach, need to be reviewed by an IRB, the research would be registered and subject to audit; consent procedures would be in

_________________

¹³See example #8 in the following section, “Examples of Excused Research”; and for information on deceptive techniques that should receive expedited IRB review, see the section, “Ensuring Adequate Classification of Excused and Expedited Categories,” in Chapter 3.

¹⁴See 76 Fed. Reg. 44,519.

place to inform people about the research and invite them to participate; and a data protection plan would be in place to ensure that the informational risk was no more than minimal. Examples of these two types of excused research follow.

Pre-existing Data with Private Information

One example of data in this category is “restricted-use data.” This refers to existing survey and research data containing individually identifiable information, which is confidential and protected by federal law. Special procedures and licensing to use these data files are instituted by providers such as the Inter-university Consortium for Political and Social Research, National Center for Education Statistics, Centers for Disease Control and Prevention, and the U.S. Census Bureau. Examples of these types of data files follow

•   Measures of Effective Teaching¹⁵

•   National Survey on Drug Use and Health¹⁶

•   American Community Survey¹⁷

•   Promise Neighborhoods¹⁸

Benign Interactions or Interventions

The following are examples of studies, predicated on informed consent, which could be designated as “excused” because they primarily involve informational risk that is no more than minimal and the research does not introduce or involve harm by virtue of the study procedures. Examples like these might instead be designated as expedited if the specific nature of the research procedures and/or the characteristics of the subject population suggest a need for special expertise to determine modifications to ensure that harm or discomfort created solely by the research procedures are not greater than minimal risk. These examples are not intended to be exhaustive but merely to illustrate the research methods used in a substantial amount of research that is conducted in the social and behavioral sciences.

1.   A study on the nature of price formation in markets and how the prices are influenced by market rules and conditions (number of traders and markets, uncertainty, etc.). Offers, prices, and contracts

_________________

¹⁵See http://www.icpsr.umich.edu/icpsrweb/METLDB/ [December 2013].

¹⁶See http://www.icpsr.umich.edu/icpsrweb/SAMHDA/[December 2013].

¹⁷See https://www.census.gov/acs/www/ [December 2013].

¹⁸See http://www.urban.org/publications/412909.html [December 2013].

      are displayed to adult volunteers who, by computer, select from among various options.

2.   A study of the strategic choices of individual adults. Divergent objectives are created with small financial incentives. Strategies available to individuals are dictated by the rules of the game through networked computers.

3.   A study of the influence of voting rules in which adult volunteers are asked to choose one option by vote from among a set of options (e.g., letters of the alphabet). Small financial incentives are employed to create divergent interests. The choice resulting from different voting rules are compared.

4.   A study of preference for bets that seeks to understand how people balance risks and rewards. Bets of various kinds are described, and adult volunteers say which they would prefer to deal with the uncertainty.

5.   A study of learning and distraction in which adult volunteers are asked to memorize nonsense syllables while being distracted by, for example, having to flag particular words among a string of words rapidly presented over earphones.

6.   A study of traits characterizing executives in different types of businesses by administering an anonymous standardized test such as the Five Factor Model Personality Test. Feedback to the subjects about their scores would not be provided.

7.   A study comparing extrinsic and intrinsic motivation asks adult volunteers to use a new technology typical of one they might use on the job; some are rewarded for using it and some are not. Follow-up questionnaires are administered to see how much they have used the technology on the job.

8.   A study in which a healthy adult volunteer plays a cooperative/competition game and is told that a partner in the game is another person, when in fact the participant is playing the game with a computer. Debriefing may be provided.

9.   A study of intergroup interactions in which members of two different teams of adult volunteers engage in cooperative or competitive activities and afterward report their impressions of each other. Reactions are not reported back to the groups.

10. A study in which a sociocultural anthropologist lives for 2 years in an East Asian city, focusing on how ordinary rail users, transportation technicians, and transport officials talk about their experiences with high-speed rail travel.

11. A study in which a sociolinguist studying new forms of “reported speech” (that is, phrases in which someone reports what someone said) observes conversational interactions among friends, with

      their informed consent, paying special attention to use of certain phrases.

12. A group of college students are given an anonymous survey about their mental health history and beliefs and attitudes toward school health policies.

13. A nationwide random sample of adults is asked about household income, spending practices, and savings for retirement. The data are de-identified following collection.

Procedures for Handling Excused Research

As set forth in the ANPRM, research categorized as excused would not be reviewed by IRBs. Excused research, however, needs to be registered by the investigator. Also, the investigator needs to file a data protection plan as part of the registration process. These plans need to be calibrated to the type and level of informational risk in order to avoid inadvertent disclosure and to reduce the level of any potential risk to no more than minimal. Investigators using restricted data files need to provide approval of use and the conditions under which use is granted as part of the registration process.

Adoption of this new category of research excused from IRB review makes investigators accountable for responsible use of research in the excused category. It could be that some researchers may misclassify research as excused that should instead be classified as expedited. To counter this possibility, the committee recommends that OHRP provide guidance in clarifying these researcher responsibilities (see detailed example of Guidance Recommended on page 54). Universities would likely provide additional clarification and training in distinguishing between research that can be excused versus expedited. (The committee provides examples of excused research in this chapter and then elaborates on the difference between the two categories in Chapter 3.) As stated in the paragraph above, protections are built into the category through requirements for registration of the research and development of data protection plans. In addition, prospective and retrospective audits of small proportions of the registered excused research would also protect against misclassification of research as excused when it should have had expedited review. Finally, this report has underscored the importance of professional ethics as another critical foundation for the protection of human subjects. Although introducing new procedures with the new category of excused research could create some new challenges and workload, the committee views this new category as a viable strategy for reducing IRB burden in the future.

The committee concurs with the ANPRM that IRBs should continue to be responsible for general oversight of the process, but we recommend regulatory safeguards to ensure that IRBs do not lapse into hyper-regulation

that undercuts the very value and purpose of the excused category for IRBs and for investigators.

For excused research, the ANPRM proposes a retrospective audit process for a percentage of the excused studies (76 Fed. Reg. 44,520). The ANPRM also states that IRBs “could choose to review some of the submissions at the time they are filed.” While the ANPRM “contemplate[s] that this would only be done in a relatively small percentage of the filings” and suggests limiting the time period for review to 1 week (76 Fed. Reg. 44,519-44,520), the committee strongly believes that, to avert the IRB tendency to increase the level of review, the revised regulations should stipulate the procedures under which review and audit of excused research would occur. We therefore offer the following procedural recommendation for excused research, which allows for monitoring research in the excused category, setting forth the steps required by investigators who undertake excused research, and facilitating the excusal of such research from IRB review. The steps in Recommendation 2.9, combined with the associated Guidance Recommended, outline a plan for setting up a system to manage excusals.

Recommendation 2.9: HHS should revise the Federal Regulations to include the procedures under which research is excused from IRB review. The revised regulations should stipulate that such research can begin 1 week after registering a form that briefly describes the purpose of the research, the activities to be engaged in by research subjects, the subject population, consent procedures, and a data protection plan. During (and only during) that 1-week period, IRBs may review a small proportion of registrations to determine whether investigators have properly classified their study as excused or should instead have submitted it for an expedited or full board review. Finally, each year, a random audit of a small proportion of registrations should be performed by a designated institutional office to ensure that investigators meet the standards for research that should properly be excused. Investigators should be informed when their research is part of an examination or audit sample and, if issues are identified, they should be granted an appropriate period of time to make adjustments or submit a protocol for IRB review.

Guidance Recommended: OHRP should provide guidance in clarifying the responsibilities of investigators in the conduct of excused research and the oversight role and related parameters for IRBs with respect to excused research. This guidance should include

•   Explanation and instructions for the completion of an online form for registration of excused research. The information entered in the form should (a) set forth the consent procedures if the research

     involves primary data collection, (b) describe briefly what is being studied and what methods will be employed, (c) describe the subject population, (d) indicate that the research procedures only involve informational risk, (e) indicate that the research meets the definition of minimal risk, and (f) describe the data and specify the data protection plan appropriate to the research, if identifiable information is to be retained or recorded. (Annex 2.1 at the end of this chapter contains a possible template for a registration form.)

•   Statement that excused research may include several data collections, including a series of studies, whether or not with the same subjects, as long as the entire program of research involves only informational risk and does not introduce risk of harm greater than described in the initial registration.

•   Examples of strong data protection plans that do not rely on privacy protection statute such as HIPAA or the Federal Educational Rights and Privacy Act and that were designed to protect access to identifiable private information (such as medical records). Instead, provide guidance and examples that are appropriate to a system that is designed for research in the social and behavioral sciences and that allows for investigator use of private information while protecting its confidentiality and security. (This topic is taken up in greater detail in Chapter 5, which specifically addresses data protection and security while providing for data sharing and data use.)

•   Explanation of the penalties for flagrantly misclassifying research as excused.

CLARIFYING THE DISTINCTION BETWEEN EXCUSED AND EXPEDITED RESEARCH

Chapter 2 has thus far focused on categories of activities that the committee proposes should not be reviewed by an IRB either because they are not human-subjects research, and thus outside the scope of the Common Rule, or because they are excused from IRB consideration. Chapter 3 takes up the category of expedited review by IRBs. Adapting a central proposal from the ANPRM, the committee’s position is that a key element of excused research is that it presents no, or no greater than minimal, informational risk, even if research subjects are asked about physical or psychological well-being. Thus, whereas excused activities are those that primarily pose no greater than minimal informational risks to human subjects (either by virtue of the research activities themselves or by virtue of adequate mitigation of risk via a data protection plan), expedited activities are those that, because of the specific nature of the research procedures and/or the

characteristics of the subject population, require consideration through IRB review to ensure that harm or discomfort created solely by the research procedures are not greater than minimal risk. Under such circumstances, the investigator would submit the research protocol to the IRB for review.

Chapter 3 discusses the expedited category in much detail and provides criteria to consider when deciding if research can be excused or should receive expedited review by an IRB. Appendix B at the end of the report provides a summary table showing the differences between the categories of “not human-subjects research,” research that is “excused” from IRB review, and research that would receive “expedited” IRB review in terms of characteristics of the research, how they would be handled procedurally, and types of studies in each category.

ANNEX 2.1
DRAFT MODEL FOR AN EXCUSED RESEARCH REGISTRATION FORM

The following outline lists suggested information to be included in a registration form for excused research.

1.   Name of principal investigator. E-mail address and phone number.

2.   Name(s) of primary individual(s) charged with collecting data.

3.   Paragraph describing:

(a)   the question(s) being examined by the research,

(b)   the dataset if using pre-existing data,

(c)   the nature of the subject population, and

(d)   the range of tasks in which subjects will be engaged.

4.   Manner in which consent is to be obtained (oral or written). If written, provide the consent form. If oral, describe the process. If consent is not required (as in the case of use of pre-existing private data where access has been provided under restricted conditions), the registration form needs to include this information.

5.   Is subject identity or other personal identifiable information to be obtained? If so, describe the data protection plan and, even if subjects’ identity is not retained, describe how other information will be handled by the investigator (including under restricted access provisions for others’ use) to protect any private information from disclosure. The proposed data protection plan must be provided as part of the registration submission.

6.   Identify nature of any risks or harms to participants.

7.   Provide a starting date and expected date for completion.

Records of personnel and procedures must be maintained in the form of laboratory notes or computer records and will be available for audit.

REFERENCES

Abbott, L., and Grady, C. (2011). A systematic review of the empirical literature evaluating IRBs: What we know and what we still need to learn. Journal of Empirical Research on Human Research Ethics, 6(2):3-19.

Association for the Accreditation of Human Research Protection Programs. (2013). 2012 Metrics on Human Research Protection Program Performance. Available: https://admin.share.aahrpp.org/Website%20Documents/2012%20Metrics%20(2).pdf [December 2013].

Association of Internet Researchers. (2012). Ethical Decision-making and Internet Research. Recommendations from the AoIR Ethics Working Committee (Version 2). Available: http://www.aoir.org/reports/ethics2.pdf [December 2013].

Levine, F., and Sieber, J. (2007). Ethical issues related to linked social-spatial data. Appendix B. In National Research Council, M.P. Gutmann and P.C. Stern (Eds.), Putting People on the Map: Protecting Confidentiality with Linked Social-spatial Data. Panel on Confidentiality Issues Arising from the Integration of Remotely Sensed and Self-Identifying Data. Committee on the Human Dimensions of Global Change. Division of Behavioral and Social Sciences and Education. Washington, DC: The National Academies Press.

National Research Council. (2003). Protecting Participants and Facilitating Social and Behavioral Sciences Research. Panel on Institutional Review Boards, Surveys, and Social Science Research. C.F. Citro, D.R. Ilgen, and C.B. Marrett (Eds.). Committee on National Statistics and Board on Behavioral, Cognitive, and Sensory Sciences. Division of Behavioral and Social Sciences and Education. Washington, DC: The National Academies Press. National Research Council. (2005). Expanding Access to Research Data: Reconciling Risks and Opportunities. Panel on Data Access for Research Purposes. Committee on National Statistics, Division of Behavioral and Social Sciences and Education. Washington, DC: The National Academies Press.

National Research Network. (2013). National Research Network: 2012 Benchmark Report. Available: http://www.irbnetresources.org/news/nrnbenchmark_2012.pdf [May 2013].

Nissenbaum, H. (2010). Privacy in Context: Technology, Policy, and the Integrity of Social Life. Stanford: Stanford University Press.

Pritchard, I.A. (2001). Searching for “Research Involving Human Subjects”: What is examined? What is exempt? What is exasperating? IRB: Ethics and Human Research, 23(3):5-13.

Secretary’s Advisory Committee on Human Research Protections. (2013). Considerations and Recommendations Concerning Internet Research and Human Subjects Research Regulations, with Revisions. Paper prepared for the SACHRP meeting, Washington, DC, March 12-13, U.S. Department of Health and Human Services. Available: http://www.hhs.gov/ohrp/sachrp/commsec/attachmentbsecletter20.pdf [December 2013].

Silberman, G., and Kahn, K.L. (2011). Burdens on research imposed by institutional review boards: The state of the evidence and its implications for regulatory reform. The Milbank Quarterly, 89(4):599-627.

U.S. Department of Health and Human Services. (1979). The Belmont Report: Ethical Principles and Guidelines for the Protection of Human Subjects of Research. The National Commission for the Protection of Human Subjects of Biomedical and Behavioral Research. Washington, DC: U.S. Department of Health and Human Services. Available: http://www.hhs.gov/ohrp/humansubjects/guidance/belmont.html [October 2013].

U.S. Department of Health and Human Services and Office for Protection from Research Risks. (1995). Exempt Research and Research That May Undergo Expedited Review. Number 95-02. Available: http://www.hhs.gov/ohrp/policy/hsdc95-02.html [October 2013].

This page intentionally left blank.