Governance & Risk Management , HIPAA/HITECH , Privacy

What's the Impact of 'Common Rule' Compliance Delay?

Deadline for Medical Research Regulation Extended Six Months; Will It Be Moved Again?
What's the Impact of 'Common Rule' Compliance Delay?

The Department of Health and Human Services, along with 15 other federal departments and agencies, recently gave medical research organizations and others an extra six months - until July 19 - to comply with most provisions of the updated "Common Rule" regulations that aim to protect human subjects in research, including ensuring their privacy.

See Also: Panel Discussion | Accelerate HITRUST certification for faster time-to-market and improved ROI

The Common Rule contains principles about how data can be obtained for research and disclosed. Some of the updated provisions related to privacy are aimed to better align with the HIPAA Privacy Rule (see HIPAA Enforcement Under Trump: A Forecast).

Aside from an updated Common Rule provision related to "cooperative research," which still has a compliance date of Jan. 20, 2020, all other regulations of the updated Common Rule originally were slated to go into effect on Jan. 19, 2018.

But an interim final rule recently published in the Federal Register now pushes the general compliance date for the updated Common Rule until July 19.

The compliance date for the cooperative research provision remains at Jan. 20, 2020. However, HHS and the other Common Rule agencies are accepting comment on the interim final rule until March 23. The interim final rule also notes that HHS and the other agencies are also considering further implementation delays.

Shortly after President Trump took office on Jan. 20, 2017, the administration applied the brakes on new rules and regulations going into effect. That included Trump signing an executive order that requires two regulations to be eliminated for every new regulation issued by an executive branch department or agency.

Creating Confusion?

One regulatory expert says the delayed deadline for implementing the updated Common Rule potentially creates confusion and disruptions for some research organizations that had planned to comply with the earlier Jan. 19 deadline.

"The change the interim rule makes is to delay the effective date, but it may create some complexities for organizations that were prepared to comply with the revised Common Rule in January 2018 because they likely changed policies and procedures in anticipation of the former January 19, 2018, effective date," says attorney Marti Arvin, vice president of audit strategy at security consulting firm CynergisTek.

"Now [research entities] must follow the 'old' Common Rule to the extent it conflicts with the revised Common Rule. So they must revert back to former policies and procedures for the six-month extension in any area that conflicts," she says.

Extra Time for Guidance

The American Medical Informatics Association, a healthcare informatics professional organization, says the six-month delay in the effective date gives federal agencies more time to prepare and issue guidance to potentially help researchers implementing the updated Common Rule regulations.

AMIA stresses, however, that it opposes further delays. "It will be important that Common Rule provisions meant to improve the availability of data for secondary research, while strengthening protections for research participants, proceed in a timely fashion," it notes in a statement.

AMIA says that several key provisions of the updated Common Rule will improve the availability of health data for secondary research by:

  • Permitting researchers to seek broad consent, which will greatly improve the availability of biospecimens and patient-reported data, including real-time data from mobile applications and devices;
  • Enabling certain low-risk studies to be conducted by HIPAA covered entities using electronic health records data, such as observational studies meant to find patterns in patient records to improve how joint replacements are performed;
  • Clarifying that certain public health surveillance activities are explicitly outside the scope of the Common Rule, so that the spread of disease can be more easily monitored;
  • Providing a new option meant to help screening of potential participants, so patients who qualify for new treatments are more likely to learn about them.

Common Rule Background

On Jan. 19, 2017 -the last day of the Obama administration - HHS along with other agencies, including the departments of agriculture, defense and veterans affairs - issued a final rule update to the Common Rule - also known as the Federal Policy for the Protection of Human Subjects - which was originally promulgated in 1991.

HHS notes on its website that the current Common Rule regulations in place since 1991 "were developed at a time when research was conducted predominantly at universities and medical institutions, and each study generally took place at a single site. Since then, research with human participants has grown in scale and become more diverse and data has become digital."

In September 2015, HHS and the other Common Rule agencies published a Notice of Proposed Rulemaking, which drew more than 2,100 comments, HHS notes.

In response to the comments, the updated Common Rule issued in January 2017 contained a number of significant changes from the proposed rule, including the removal of a provision that would have required researchers to obtain consent before using a study participant's non-identified biospecimens, HHS notes.

HHS notes that the updated final rule issued in January 2017 "generally expects consent forms to include a concise explanation - at the beginning of the document - of the key information that would be most important to individuals contemplating participation in a particular study, including the purpose of the research, the risks and benefits, and appropriate alternative treatments that might be beneficial to the prospective subject."

The new rule "strengthens protections for people who volunteer to participate in research, while ensuring that the oversight system does not add inappropriate administrative burdens, particularly to low-risk research. It also allows more flexibility in keeping with today's dynamic research environment," HHS said in January 2017, when the final rule was issued.

About the Author

Marianne Kolbasuk McGee

Marianne Kolbasuk McGee

Executive Editor, HealthcareInfoSecurity, ISMG

McGee is executive editor of Information Security Media Group's media site. She has about 30 years of IT journalism experience, with a focus on healthcare information technology issues for more than 15 years. Before joining ISMG in 2012, she was a reporter at InformationWeek magazine and news site and played a lead role in the launch of InformationWeek's healthcare IT media site.

Around the Network

Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing, you agree to our use of cookies.