Appendix: Emerging Regulatory Issues

Consent, Disclosure, and Non-Disclosure

Section 9

Appendix: Emerging Regulatory Issues


Kevin Weinfurt, PhD

Jeremy Sugarman, MD, MPH


Contributing Editor

Karen Staman, MS

Minimal Risk Research: Calibrating the Level of Review to the Level of Risk

Federally funded research involving human subjects is reviewed by a convened IRB or through an expedited review process that involves less than the full IRB. Research can qualify for expedited review if the research study conveys no more than minimal risk, or contains only minor changes in previously approved research in the previous year. Research must also fall into one of the research activities listed as eligible for expedited review.  Minimal risk means that the probability and magnitude of harm or discomfort anticipated in the research are not greater in and of themselves than those ordinarily encountered in daily life or during the performance of routine physical or psychological examinations or tests.

IRB Review of Multisite Studies

IRB review has been shown to be burdensome (Helfand et al. 2009), inefficient (Greene and Geiger 2006; Sherwood et al. 2006), and duplicative (Burman et al. 2001). For multisite research in which a single research study is conducted at numerous institutions, review by multiple IRBs can present a major impediment to the efficient conduct of this research (Hammatt et al. 2011) and may result in substantial delays and costs (Emanuel et al. 2004; Vick et al. 2005; Duley et al. 2008; Helfand et al. 2009), without conferring any countervailing benefit to patients.

For example, if one IRB requires changes to the research protocol of a multisite study, the investigators must re-submit the revised protocol to all of the reviewing IRBs (Department of Health and Human Services 2011). Additionally, the level of review required from IRB to IRB can differ substantially, even for identical studies (Dziak et al. 2005). In addition, local IRBs may lack expertise in evaluating issues created by certain study designs, such as a cluster-randomized trial (CRTs), while centralized IRBs (CIRB) may lack adequate context or knowledge relevant to local circumstances.

The Common Rule requires that each institution engaged in a multisite study obtain IRB approval of the study. However, it currently allows for joint review. Sites conducting multisite research currently have the option to utilize a CIRB for study review (Department of Health and Human Services 2011), but institutions have been reluctant to replace local review with centralized oversight (Emanuel et al. 2004; Jansen 2005).

To address this, the revised Common Rule will require single IRB review for cooperative, multisite research. §__.114”

  • Any institution located in the United States that is engaged in cooperative research must rely upon approval by a single IRB for that portion of the research that is conducted in the United States.” §__.114
  • Exemptions permitted if more than single IRB review is required by law and if a federal department or agency supporting or conducting the research determines and documents that the use of a single IRB is not appropriate for the particular study. §__.114.b

Read the Final NIH Policy on Use of a Single Institutional Review Board for Multi-Site Research.

“OHRP notes that multiple institutions may be engaged in the same non-exempt human subjects research project. For such cooperative research projects, institutions may enter into joint review arrangements, rely upon the review of another qualified IRB, or make similar arrangements to avoid duplication of effort, in accordance with HHS regulations at 45 CFR 46.114.”

Examples of Multisite Joint Review Models

  • The Research Centers in Minority Institutions (RCMI) Translational Research Network (RTRN) is developing a community-partnered approach to streamlining IRB review across its consortium of 18 RCMI grantee institutions (Hammatt et al. 2011).
  • Independent and commercial IRBs such as Western IRB, Copernicus, and ADVARRA offer centralized IRBs.
  • National Cancer Institute’s (NCI) Central IRB Initiative was designed to help reduce the administrative burden on local IRBs and enable efficient enrollment of patients into NCI-sponsored clinical trials.
  • Department of Veterans Affairs Central Institutional Review Board reviews selected multisite projects funded by the VA Office of Research and Development.
  • The Network for Excellence in Neuroscience Clinical Trials (NeuroNEXT) is designed to efficiently conduct Phase II Clinical Trials.
  • The SMART IRB system was developed to provide a roadmap for institutions to implement to NIH single IRB policy.

Global Regulatory Agencies and IRBs

When trials involve more than one country, separate approval is often required from multiple organizations in multiple countries, and this may create significant delays (Reith et al. 2013). See the list of global regulatory agencies.

The World Health Organization (WHO) Research Ethics Review Committee provides ethical review of all research that involves human participants and is funded or supported by WHO.

The WHO also provides guidance documents on global research ethics review committees:

The Strategic Initiative for Developing Capacity in Ethical Review (SIDCER) supports the implementation of the above WHO guidelines and accredits global Research Ethics Committees (RECs).

Navigating HIPAA Requirements

Although the HIPAA Privacy Rule was an important step in assuring patient protections, a number of unintended consequences resulted from its enactment (Littenberg and MacLean 2006). For example: before HIPAA, 89% of medical record and database research projects in Wisconsin went through an expedited review process (O’Herrin et al. 2004); after HIPAA (by 2002), this number dropped to 59%. In Michigan, researchers documented a substantial decline in the number of patients available for outcomes research, from 96% to 34% after HIPAA (Armstrong et al. 2005). Other studies documented post-HIPAA increases in the number of patients who drop out of studies and are not followed for major outcomes (Armitage et al. 2008; Fleming 2011). In addition, selection biases and increases in costs, both scientific (e.g., decreased enrollment) and monetary, have been reported (Tu et al. 2004; Littenberg and MacLean 2006).

Severe penalties for violating HIPAA provisions, such as fines and criminal prosecution, have led many covered entities to interpret the law in a relatively conservative and restrictive manner, and multiple conflicting interpretations of the law have been generated by differing regulatory bodies (Armitage et al. 2008). These interpretations are sent to overburdened investigators and institutional review boards, and add significant additional paperwork and complexity (Califf and Muhlbaier 2003).

The privacy rule requires a patient’s authorization for use of protected health information (PHI) for research unless the IRB or a privacy board grants a waiver, which can be a complex process (Kramer et al. 2012).

Protected health information (PHI) refers to any "individually identifiable health information including demographic data, that relates to:

  • the individual’s past, present or future physical or mental health or condition,
  • the provision of health care to the individual, or
  • the past, present, or future payment for the provision of health care to the individual
  • and data that identifies the individual or for which there is a reasonable basis to believe it can be used to identify the individual" (Department of Health and Human Services 2003)

Like the Common Rule, HIPAA allows for a waiver of informed consent if the risk to individual privacy is considered low, if the research cannot practicably be conducted without a waiver, and if access to PHI is required to address the research question (Department of Health and Human Services 2003). Some registries have used an “opt-out” procedure for delivering information on the privacy rule. For example, the Vermont Diabetes Information System mailed passive consent letters to 7,558 eligible subjects, and 210 (2.8%) requested to withdraw (Littenberg and MacLean 2006), demonstrating the feasibility of recruiting a broad, representative study population while maintaining appropriate protections for research subjects. Other provider-led registries have combined quality improvement and research practices to develop data registries that capture clinical information and allow patients to be tracked over the long term (Peterson 2007). Such registries use agreements that permit data gathering and sharing (without consent) for QI purposes, and the aggregated data is then de-identified and used for research. Public health operations, including activities such as reporting, surveillance, investigations and interventions have been largely exempted from HIPAA’s restrictions (Goldstein and Pewen 2013).

De-Identified Health Information. There are no restrictions on the use or disclosure of de-identified health information. De-identified health information neither identifies nor provides a reasonable basis to identify an individual. There are two ways to de-identify information; either: (1) a formal determination by a qualified statistician; or (2) the removal of specified identifiers of the individual and of the individual’s relatives, household members, and employers is required, and is adequate only if the covered entity has no actual knowledge that the remaining information could be used to identify the individual."—From Summary of the Privacy Rule (Department of Health and Human Services 2003)

The Omnibus Rule

In January 2013, HHS issued an “Omnibus Rule” intended to strengthen individual rights while facilitating greater access to health information for research and to implement provisions in the Health Information Technology for Economic and Clinical Health (HITECH) Act.

The Omnibus Rule includes two notable developments regarding the use of PHI in research. First, compound authorizations are now allowed as long as the participant has the option to opt in or out. Studies involving PHI that have been required to use multiple consent forms will now be permitted to use a single form, which may prove less confusing to participants (Goldstein and Pewen 2013). Second, authorizations no longer have to be study-specific and a more general “prospective consent” for future research is permissible, as long as the description of the future research uses is sufficiently clear.

Compound authorizations: Authorizations may be obtained for multiple research purposes using a single document as long as the research is adequately described.

This change may facilitate the use of broad authorizations that that encompass a range of future research projects, including analyzing biomarkers, genetic associations, and other uses that might not be apparent when a study is begun, but could help answer critical questions in the future (Goldstein and Pewen 2013). As long as patients receive an adequate description of the scope of potential future research so that they can reasonably anticipate how their PHI might be used, prospective authorizations are possible.




back to top

Armitage J, Souhami R, Friedman L, et al. 2008. The impact of privacy and confidentiality laws on the conduct of clinical trials. Clin Trials. 5:70–74. doi:10.1177/1740774507087602. PMID: 18283083.

Armstrong D, Kline-Rogers E, Jani SM, et al. 2005. Potential impact of the HIPAA privacy rule on data collection in a registry of patients with acute coronary syndrome. Arch Intern Med. 165:1125–1129. doi:10.1001/archinte.165.10.1125. PMID: 15911725.

Burman WJ, Reves RR, Cohn DL, Schooley RT. 2001. Breaking the camel’s back: multicenter clinical trials and local institutional review boards. Ann Intern Med. 134:152–157. PMID: 11177319.

Califf RM, Muhlbaier LH. 2003. Health Insurance Portability and Accountability Act (HIPAA): must there be a trade-off between privacy and quality of health care, or can we advance both? Circulation. 108:915–918. doi:10.1161/01.CIR.0000085720.65685.90. PMID: 12939241.

Department of Health and Human Services. 2003. Summary of the Privacy Rule.

Department of Health and Human Services. 2011. Human Subjects Research Protections: Enhancing Protections for Research Subjects and Reducing Burden, Delay, and Ambiguity for Investigators.

Duley L, Antman K, Arena J, et al. 2008. Specific barriers to the conduct of randomized trials. Clin Trials. 5:40–48. doi:10.1177/1740774507087704. PMID: 18283079.

Dziak K, Anderson R, Sevick MA, Weisman CS, Levine DW, Scholle SH. 2005. Variations among Institutional Review Board reviews in a multisite health services research study. Health Serv Res. 40:279–290. doi:10.1111/j.1475-6773.2005.00353.x. PMID: 15663713.

Emanuel EJ, Wood A, Fleischman A, et al. 2004. Oversight of human participants research: identifying problems to evaluate reform proposals. Ann Intern Med. 141:282–291. PMID: 15313744.

Fleming TR. 2011. Addressing missing data in clinical trials. Ann Intern Med. 154:113–117. doi:10.7326/0003-4819-154-2-201101180-00010. PMID: 21242367.

Goldstein MM, Pewen WF. 2013. The HIPAA Omnibus Rule: implications for public health policy and practice. Public Health Rep. 128:554–558. DOI: 10.1177/003335491312800615. PMID: 24179268.

Greene SM, Geiger AM. 2006. A review finds that multicenter studies face substantial challenges but strategies exist to achieve Institutional Review Board approval. J Clin Epidemiol. 59:784–790. doi:10.1016/j.jclinepi.2005.11.018. PMID: 16828670.

Hammatt ZH, Nishitani J, Heslin KC, et al. 2011. Partnering to harmonize IRBs for community-engaged research to reduce health disparities. J Health Care Poor Underserved. 22:8–15. doi:10.1353/hpu.2011.0157. PMID: 22102302.

Helfand BT, Mongiu AK, Roehrborn CG, et al. 2009. Variation in institutional review board responses to a standard protocol for a multicenter randomized, controlled surgical trial. J Urol. 181:2674–2679. doi:10.1016/j.juro.2009.02.032. PMID: 19375101.

Jansen LA. 2005. Local IRBs, multicenter trials, and the ethics of internal amendments. IRB. 27:7–11. PMID: 16220628.

Kramer JM, Smith PB, Califf RM. 2012. Impediments to clinical research in the United States. Clin Pharmacol Ther. 91:535–541. doi:10.1038/clpt.2011.341. PMID: 22318614.

Littenberg B, MacLean CD. 2006. Passive consent for clinical research in the age of HIPAA. J Gen Intern Med. 21:207–211. doi:10.1111/j.1525-1497.2006.00339.x. PMID: 16637821.

Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act; Other Modifications to the HIPAA Rules. 2013. Fed Regist. 78:5565–5702. PMID: 23476971.

O’Herrin JK, Fost N, Kudsk KA. 2004. Health Insurance Portability Accountability Act (HIPAA) regulations: effect on medical record research. Ann Surg. 239:772-776-778. doi:  10.1097/01.sla.0000128307.98274.dc. PMID: 15166956.

Peterson E. 2007. Research methods to speed the development of better evidence—the registries example. Washington, DC: National Academies Press.

Reith C, Landray M, Devereaux PJ, et al. 2013. Randomized clinical trials—removing unnecessary obstacles. N Engl J Med. 369:1061–1065. doi:10.1056/NEJMsb1300760. PMID: 24024845.

Sherwood ML, Buchinsky FJ, Quigley MR, et al. 2006. Unique challenges of obtaining regulatory approval for a multicenter protocol to study the genetics of RRP and suggested remedies. Otolaryngol Head Neck Surg. 135:189–196. doi:10.1016/j.otohns.2006.03.028. PMID: 16890066.

Tu JV, Willison DJ, Silver FL, et al. 2004. Impracticability of informed consent in the Registry of the Canadian Stroke Network. N Engl J Med. 350:1414–1421. doi:10.1056/NEJMsa031697. PMID: 15070791.

Vick CC, Finan KR, Kiefe C, Neumayer L, Hawn MT. 2005. Variation in Institutional Review processes for a multisite observational study. Am J Surg. 190:805–809. doi:10.1016/j.amjsurg.2005.07.024. PMID: 16226962.

Version History

Published August 25, 2017


Weinfurt K, Sugarman J. Consent, Disclosure, and Non-Disclosure: Appendix: Emerging Regulatory Issues. In: Rethinking Clinical Trials: A Living Textbook of Pragmatic Clinical Trials. Bethesda, MD: NIH Health Care Systems Research Collaboratory. Available at: Updated November 13, 2018. DOI: 10.28929/029.