25% off all training courses Offer ends May 8, 2026
View HIPAA Courses
25% off all training courses
View HIPAA Courses
Offer ends May 8, 2026

The HIPAA Journal is the leading provider of HIPAA training, news, regulatory updates, and independent compliance advice.

Common Rule Compliance Date Delayed Until January 2019

On June 19, 2018, the federal government published the final rule for the Federal Policy for the Protection of Human Subjects – The Common Rule.

The aim of the Common Rule is to protect individuals who voluntarily participate in research, while also reducing the administrative and regulatory burdens for low-risk research.

A revised Common Rule was due to take effect on January 19, 2018 with an effective compliance date on the same date. However, an interim final rule was published on January 17, 2018 delaying the effective date for six months – The new compliance date was due to be July 19, 2018.

On April 20, 2018, a notice of proposed rulemaking was published seeking comments about whether the new Common Rule requirements should be delayed for a further six months. After assessing the comments received on the notice of proposed rulemaking, the proposals made in that NPRM have been adopted and the compliance date has now been extended until January 21, 2019.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

In the final rule it was noted, “We acknowledge that the timing of the interim final rule was not ideal and led to frustration within the regulated community. We believe that the 2018 NPRM and this final rule to delay the general compliance date for the 2018 Requirements while permitting the use of three burden-reducing provisions of the 2018 Requirements provides the regulated community with sufficient notice about when the 2018 Requirements will go into effect, and when regulated entities will be required to comply with the 2018 Requirements.”

Regulated entities will be required to continue to comply with the pre-2018 version of the Common Rule until the new January 2019 compliance date. However, institutions will be permitted to implement, for certain research studies, three of the burden-reducing principles in the 2018 Common Rule between July 19, 2018 and January 20, 2019, although adoption of those principles is not mandatory.

Those three provisions are:

  • A revised definition of research in which certain research activities are no longer covered by the Common Rule – such as public health surveillance activities to monitor the spread of disease
  • The elimination of the requirement for annual continuing review with respect to certain categories of research
  • The elimination of the requirement that institutional review boards (IRBs) review grant applications or other funding proposals related to the research

If those three principles are implemented for studies initiated during the delay period, full compliance with the 2018 Common Rule requirements is required from January 21, 2019 until the study ends.

The Revised Common Rule will enable more secondary research of EHR data. Certain low-risk studies, such as observational studies to find patterns in patient records that will help to improve how certain medical procedures are performed, will be exempted if conducted by certain HIPAA-covered entities.

Changes are also made to how consent must be obtained. Important information about a study must be explained clearly and concisely in a way that would allow a reasonable person to understand how their data will be used. It is also possible for broad consent to be obtained, which will help to ensure that biospecimens and patient-reported data are made available for secondary research.

A new option is also included to assist with screening potential research participants to help ensure that patients who could potentially benefit from new treatments will be likely to hear about those treatments.

Author: Steve Alder is the editor-in-chief of The HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered in The HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has 10 years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics. Steve shapes the editorial policy of The HIPAA Journal, ensuring its comprehensive coverage of critical topics. Steve Alder is considered an authority in the healthcare industry on HIPAA. The HIPAA Journal has evolved into the leading independent authority on HIPAA under Steve’s editorial leadership. Steve manages a team of writers and is responsible for the factual and legal accuracy of all content published on The HIPAA Journal. Steve holds a Bachelor’s of Science degree from the University of Liverpool. You can connect with Steve via LinkedIn or email via stevealder(at)hipaajournal.com

x

Is Your Organization HIPAA Compliant?

Find Out With Our Free HIPAA Compliance Checklist

Get Free Checklist