Revised Human Research Regulations (2018 Requirements)

On January 21, 2019, the Harvard Longwood Campus (HLC) IRBs implemented the new (2018) requirements of the revised Common Rule as stipulated in the Federal Policy for the Protection of Human Subjects (45 CFR 46). The revised Common Rule is intended to add flexibility and to reduce regulatory burden.

Below we provide an overview of the most significant changes to the regulations that are most likely to affect the HLC research community. For more information about the revised Common Rule, including the full regulatory text, please see the Office for Human Research Protections (OHRP) website.

Highlights of the Revised Common Rule

Revised Human Subjects Research Definitions

New and Revised Exemption Categories

Limited IRB Review

Continuing Review

Informed Consent Requirements

Single IRB Review

Additional Resources

Frequently Asked Questions

What are these changes? Are they required or suggested guidance?

How will I know if the new federal regulations apply to my study?


Revised Human Subjects Research Definitions

  • The definition of “human subject” has been changed to include “identifiable biospecimens” as well as how data and/or biospecimens have been collected or will be used.
  • The definition of “research” has been expanded to list activities that are specifically deemed not to be research, i.e., oral history, journalism, public health surveillance, criminal justice or criminal investigative activities, and activities in support of intelligence, homeland security, defense, or other national security missions.

New and Revised Exemption Categories

  • Category #1 (Research conducted in established or commonly accepted educational settings, that specifically involve normal educational practices): Includes a statement that the research cannot “adversely impact students’ opportunity to learn required educational content or the assessment of educators who provide instruction.”
  • Category #2 (Research that only includes interactions involving educational tests, survey procedures, interview procedures, or observation of public behavior): Includes a clarification that the data may involve visual or audio recording. This category also allows for the collection of sensitive, identifiable data to be collected as long as “limited review” is conducted by the IRB.
  • New! Category #3 (Research involving benign behavioral interventions in conjunction with the collection of information from adult participants verbal or written responses): Includes research with benign behavior interventions, i.e., interventions that are brief in duration, harmless, painless, not physically invasive, not likely to have a significant adverse lasting impact on the subjects; subjects not likely to perceive them as offensive or embarrassing.
  • Category #4 (Secondary research for which consent is not required): Includes mention of biospecimens. It also removes the pre-2018 requirement that information and biospecimens must be pre-existing.
  • To see all categories 1-8, please see our Exemption Worksheet (HRP-312) or the OHRP website.

Limited IRB Review

Limited IRB Review is a new concept introduced by the Final Rule that is designed to ensure adequate privacy and confidentiality safeguards for identifiable private information and identifiable biospecimens. Limited review involves the IRB making and documenting a determination that adequate provisions are in place for protecting privacy and maintaining confidentiality. Limited review is required for exempt categories #2 and 3.

Continuing Review

Continuing review is no longer required under the following circumstances:

  • Research complies with 2018 regulatory requirements.
  • Research eligible for expedited review.
  • Research reviewed by the IRB in accordance with the limited IRB review.
  • Research that has progressed to the point that it only involves (a) data analysis, including analysis of identifiable private information or identifiable biospecimens, and/or (b) accessing follow-up clinical data from procedures that subjects would undergo as part of clinical care.

Of note, investigators are still responsible for submitting modifications for review/approval prior to implementation; reporting new information within 5 business days, and closing human research protocols, as appropriate.

Informed Consent Requirements

According to the Final Rule, the consent process (document/discussion) must first include a presentation of “key information,” i.e., information most likely to assist in understanding why to participate (or not) in the research. As per the Final Rule preamble, Key Information is understood to include the following:

  • The fact that consent is being sought for research and that participation is voluntary
  • The purpose(s), the expected duration of participation, and the procedures to be followed
  • The reasonably foreseeable risks or discomforts to the prospective subject
  • The benefits to subjects or others that may reasonably be expected
  • Appropriate alternatives, if any, that might be advantageous

New Basic and Additional Elements of Consent

  • If the research involves the collection of identifiable private information or identifiable biospecimens, a statement on whether the identifiers might be removed and information or biospecimens could be used for future research without additional informed consent.
  • When applicable:
    • A statement that biospecimens (even if identifiers are removed) may be used for commercial profit and whether the subject will or will not share in this commercial profit.
    • A statement about whether clinically relevant research results, including individual research results, will be disclosed to subjects.
    • A statement about whether the research project might include whole genome sequencing.

Single IRB Review

When more than one institution is involved in a research study, the regulations define this as a “cooperative research project.” The Final Rule requires the use of one IRB for cooperative research (“Single IRB” or “sIRB”).  Of note, the effective date for this change isn’t until January 19, 2020; however, the NIH Policy on sIRB, which requires a single IRB for NIH-funded human research, went into effect January 25, 2018.  

Additional Resources

What are these changes? Are they required or suggested guidance?

The changes reflected in the revisions to the Federal Policy for the Protection of Human Subjects (also known as “the Common Rule,” “the Revised Common Rule,” “2018 Requirements,” and/or 45 CFR 46) are federal regulation. These regulations are required and are not suggestions or guidance. Researchers conducting human subjects research must comply with the regulations on/after 1/21/2019.

How will I know if the new federal regulations apply to my study?

The revisions are extensive – however, the majority of the changes will impact IRB operations rather than researchers. Briefly, the new changes expand Exemption categories, eliminate Continuing Review for minimal risk studies, and require new elements to the Informed Consent (e.g., addition of a “Key Information” section). The HLMA IRB has been preparing for these changes for over two years and our consent form templates and Research Protocol already include information and language that complies with the new regulations.

For more specific information on the changes, please feel free to educate your study team with the materials on our website, attend one of our training sessions, or reach out to your department-assigned IRB Review Specialist or QIP if you have any questions.

Your IRB Review Specialist will be responsible for ensuring that your project satisfies all of the revised federal regulation requirements and receives the correct regulatory determinations. All of this information will be conveyed in your IRB determination letter, which we encourage you to read carefully upon receipt.

What happens to my application that’s currently in the queue and hasn’t been approved yet?

Any IRB application that has not yet been granted an IRB determination/approval before January 21, 2019 will be subject to the new regulations. If you have an application in queue at that time, your IRB Review Specialist will revisit the application to ensure that all of the new regulations and requirements are satisfied. If they have additional questions or requests for you, they will communicate them via ESTR, as usual.

What do I need to do differently when submitting a new IRB application?

Broadly speaking, nothing! New IRB applications will still need to be completed on the HLMA IRB templates and submitted via ESTR. The HLMA IRB has already implemented a consent form template that has all of the required elements as stipulated in the revised regulation (e.g. “Key Information”). These templates are available here. If there is something specific needed in addition to what you have submitted, your IRB Review Specialist will communicate those requests via ESTR.

Why do I have some grandfathered projects and some that are subject to the new regulations?

It all depends on when IRB approval was granted, and for that reason it is possible that a researcher will have both kinds of studies in their portfolio.

  • All studies that were approved or determined to be exempt before January 21, 2019 are considered “grandfathered” and will remain under the “Pre-2018” regulations. The IRB can voluntarily transition a grandfathered to the revised regulations, if/when it may be an ideal candidate, e.g., when the transition will reduce administrative burden. Your IRB Review Specialist will identify if this is the case and communicate that to you. Feel free to reach out to your IRB Review Specialist if you have any questions about this.
  • All new studies approved or determined to be exempt on or after January 21, 2019 will automatically be reviewed using the new “2018” regulations.
  • The IRB was able to implement three federal provisions between July 19, 2018 – January 20, 2019 that took advantage of a subset of the revised regulations. Those studies will be reviewed using the new “2018” regulations.

See “Will ESTR look different?” question below for more on how to tell “Pre-2018” and “2018” studies apart in ESTR.

Will ESTR look different?

No. The changes to the federal regulations mainly impact IRB staff, the changes to ESTR will largely be seen on the IRB side, rather than the researcher side, of the system.

That said, there are two ESTR items that researchers should be mindful of:

  1. The formal IRB determination letter will continue to be your guide on how your project was reviewed and what is required of the PI.
  2. You can quickly see on the main study workspace which version of the federal regulations apply to your project by looking at the line that says Regulatory authority:

How do the regulation changes impact my international research study?

The regulation changes apply to all research overseen by the Harvard Longwood Medical Area IRBs; it is not specific to any kind of research. That said, international research is unique in that local IRB/ethics committee approval is required in addition to Harvard IRB approval. This will not change; no human subjects research can be implemented in an international country without local approval.

One consideration researchers will need to make is how to fulfill the new consent form regulatory requirements. It is common that international research studies use a local consent form template, rather than Harvard’s consent form template. This is still acceptable with proper justification however, the new required elements of consent (e.g., Key Information and specific language for collection and use of private identifiable information and biospecimens) must be incorporated into all consent forms enrolling participants. In lieu of using Harvard’s templates, which have the new requirements incorporated already, you can review the new consent form requirements on our website and add them in to your consent form.

I have a continuing review coming up but I heard I don’t have to submit these any more. Is that true?

It may be true, but you will need to first receive formal notification from the IRB which explicitly states you no longer need to submit continuing review. This information will appear in either your initial approval letter (if you have submitted a new project), or your most recent continuing review approval letter (if you have an existing project). If you have not yet been notified by the IRB that your project no longer requires continuing review, you must submit a continuing review application. In addition to your approval letter, another easy way to tell if you need to submit a CR application is if you have received an ESTR notification reminding you of the study expiration date. These notifications are sent via email from ESTR 60, 30, and 5 days prior to expiry. If you receive a notification, you must submit a continuing review application.

If my study is in data analysis, or long term follow up only, do I need to complete a continuing review application?

Existing projects that have reached the point where the only study activities are data analysis (including analysis of identifiable information) and long-term follow up of participants will be transitioned to the new 2018 regulations at the time of the next Continuing Review. Per OHRP guidance, long-term follow up includes “research interactions that are minimal risk such as quality of life questionnaires and/or the collection of follow-up data from procedures or interventions that would have been done during routine clinical practice to monitor a subject for disease progression or recurrence.” Long-term follow up does not include “research interventions that would not have been performed for clinical purposes, even if the research interventions involve no more than minimal risk.”

Once the IRB has given a formal notification (via a final Continuing Review approval letter), continuing review will no longer be required for that study. You will know that your project has been transitioned when you read your CR approval letter.

How does Data Security Level impact IRB review under the new regulations?

Data Security Level (DSL) is determined by the IRB based on the institutional Harvard Research Data Security Policy (HRDSP); it is not specific to a certain type of federal regulation. That said, certain DSLs require IT certification prior to IRB approval (some DSL 3, all DSL 4 & 5). For example, a project that is determined to be Exempt, but that has a DSL 3, will require IT certification of DSL 3 before final IRB approval can be granted. If the project were reviewed under an Expedited review process, a DSL 3 would require a continuing review for the first year to ensure that the DSL 3 approval was obtained. Any project that is assessed as a DSL 4 or 5 would require IT certification before initial approval.

Will my sponsor/funder/collaborators/data provider/Harvard SPA-OSP representative/[fill in the blank] know about the regulation changes?

They should. The U.S. Department of Health and Human Services and 16 other federal departments and agencies have codified the regulations and are signed on to the revised Common Rule. A list of these agencies can be found here. As such, the regulatory changes that go in to effect on January 21, 2019 are widely known among these departments/agencies, and the institutions/organizations they fund, support, and educate. Some agencies have provided guidance on the implementation of the revised common rule. To see NIH guidance on the implementation of the revised common rule, please see their website.

If my current research portfolio is primarily Expedited research, or research reviewed by the Convened IRB, and I am not familiar with Exempt research – what do I need to know or do differently?

Broadly speaking, not much! You are still required to submit an application in ESTR using the HLMA Research Protocol template. If your project falls under an Exempt category, you can use our Exempt consent form template which is much shorter and does not require participant signature. Additionally, if you are unsure if your project might now be Exempt, simply submit an application in ESTR the way you normally would (using the Research Protocol and Consent template). Your IRB Review Specialist will verify if your project fits under an Exempt category and will recommend the use of the Exempt consent template, if applicable.