HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Revised Common Rule Now Effective

The updated Federal Policy for the Protection of Human Subjects (45 CFR part 46), otherwise known as the Common Rule, is now in effect. The compliance date of the revised Common Rule was January 21, 2019.

The Common Rule governs federally funded research on human subjects and was introduced in 1991. The Common Rule was amended in 2015 and underwent a major revision in 2017 to improve protections for research subjects while easing the administrative burden on researchers, especially for low-risk research.

The compliance date of the revised Common Rule was initially January 19, 2018; however, two days before the compliance date, an interim final rule was published which delayed the compliance date initially for six months, and subsequently for another six months.

Regulated entities were required to comply with the pre-2018 version of the Common Rule until January 20, 2019, with the exception of three provisions of the revised Common Rule which aimed to reduce the administrative burden on researchers.

Please see the HIPAA Journal Privacy Policy

3 Steps To HIPAA Compliance

Please see HIPAA Journal
privacy policy

  • Step 1 : Download Checklist.
  • Step 2 : Review Your Business.
  • Step 3 : Get Compliant!

The HIPAA Journal compliance checklist provides the top priorities for your organization to become fully HIPAA compliant.

Those three provisions, which could be adopted between July 2019 and January 20, 2019, were:

  • A change to the definition of research, which exempted certain research activities such as public surveillance activities to monitor the spread of disease, journalistic activities, and criminal investigations.
  • Eliminating the requirement for continuing reviews of certain categories of research that are considered low-risk
  • Eliminating the requirement that institutional review boards (IRB) review grant applications or other funding proposals related to the research

Now that the compliance date has arrived, regulated entities that receive federal funding for research now need to work quickly to implement all of the changes to the Common Rule, including the above three principles if they have not already been adopted.

Notable changes in the revised Common Rule are detailed below:

Consent Forms

Consent forms can be long and complex, but the changes to the Common Rule will make it easier for voluntary research subjects to find the information they need.

Consent forms need to include a concise explanation at the start of the document in which all of the key information about the study is clearly explained, including the purpose of the study, the risks and benefits, and appropriate alternative treatments that may be beneficial to the research subject.

Future uses of research data must also be specified and a statement must also be included on the consent form which explains if and when the results of the study will be made available to the research subject.

A statement will need to be included, if applicable, explaining that biospecimens may be used for commercial profit and whether the research subject will receive a share of that profit.

IRBs do not need to obtain informed consent in cases of obtaining information or biospecimens for screening, recruiting, or determining eligibility of prospective subjects, under certain circumstances.

Consent forms for clinical trials that are conducted by or supported by a Federal department or agency require an approved consent form which must be posted online or made available on a federal website that serves as a depository for consent forms.

Broad Consent

The final rule allows for the optional use of broad consent for the storage and secondary use of identifiable private information and biospecimens in lieu of obtaining study-specific informed consent.

Study Reviews by Single IRB

One notable change for federally funded studies that require IRB approval is the requirement to have a single IRB oversee research studies that are conducted at multiple sites. Compliance with this aspect of the revised Common Rule is not mandatory until January 21, 2020.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.