The federal Human Subjects Research Regulations (subpart A of which is called the “Common Rule”) do not apply by default to all human research conducted in the United States. There are four broad categories in which the regulations apply:

1. If the investigator is conducting research using federal funding from a US Department or Agency that has adopted the regulations;
2. If the institution where the researcher works voluntarily requires all researchers follow the regulations;
3. If researchers use an investigational-only product which requires US Food and Drug Administration (FDA) authorization to ship and use in interstate commerce; or
4. If investigators wish to submit data derived from their research to FDA in support of an application for research or marketing.

If  research falls within one of these four categories, the next question is whether the health information or biospecimens that  will be used are “identifiable.”

Given the proliferation of health information and biospecimens from clinical care, research, and private industry,  enclaves or biobanks of de-identified health data and specimens may be available for research. If health data or specimens are “de-identified,” they are not covered by either the Health Insurance Portability and Accountability Act (HIPAA) or the Human Subjects Research Regulations. HIPAA offers a de-identification “Safe Harbor,” meaning that if covered entities strip data or specimens of 18 specific types of identifiers, the data will be considered de-identified under HIPAA. The Common Rule is not as specific, and simply states that “identified” information is information for which the “identity of the subject is or may readily be ascertained.” That said, many investigators and oversight bodies use the 18 HIPAA identifiers as a baseline de-identification standard for both.

There are many kinds of research that cannot be conducted fully with de-identified research and must – at least at some point – have traditional identifiers attached to data in order to track health interventions and outcomes over a period of time. Pragmatic clinical trials (PCTs) often fall into this category. If U.S. federally funded researchers use identified health information or specimens, they must follow the Common Rule requirements for obtaining informed consent, broad consent, or a waiver of consent.

1. Informed consent: Potential participants may be asked to provide full informed consent for research that is interventional, interactive, or involves the use of identified data or biospecimens. Requirements are described in full by in 45 CFR §46.116: General Requirements for Informed Consent. If the research will collect identifiable private information or biospecimens, researchers must also disclose:
   • Whether identifiers might be stripped from the data or specimens and used for future research studies (including with a different investigator) without additional informed consent;
   • Whether the potential participant's biospecimen(s) (even if identifiers are removed) may be used for commercial profit and whether the participant will or will not share in this commercial profit (note: this disclosure requirement does not apply to data); and
   • Whether the research might include whole genome sequencing of their biospecimen(s).
2. Broad consent: Potential participants may be asked to provide “broad consent for the storage, maintenance, and secondary research use of identifiable private information or identifiable biospecimens (collected for either research studies other than the proposed research or nonresearch purposes)” (§46.116)(d)). If the research will collect identifiable private information or biospecimens, researchers must disclose the three components listed above, as well as:
   • A general description of the types of research that may be conducted;
   • A description of the identifiable private information or biospecimens that might be used in research, whether sharing of identifiable private information or identifiable biospecimens might occur, and the types of institutions or researchers that might conduct research;
   • A description of the period of time that the data and biospecimens may be retained and used for research; and
   • A statement that they will not be informed of the details of any specific research studies and that results will not always be disclosed.
3. Waiver of consent: An IRB is allowed to grant a waiver of consent if the research meets the following criteria:
   • Involves no more than minimal risk to the participants;
   • Could not practicably be carried out without the requested waiver;
   • The waiver will not adversely affect the rights and welfare of the participants; and
   • Whenever appropriate, additional pertinent information will be provided after participation.

In addition, an Institutional Review Board (IRB) may not grant a waiver for research with identifiable data or biospecimens if the participant was asked to provide broad consent and refused.

PCTs that involve more than minimal risk (i.e.,  the PCT poses a greater magnitude of harm or discomfort than those encountered in ordinary life) will use a comprehensive informed consent process. However, many PCTs receive an authorized waiver of consent  (AWC) if the IRB determines that they  are minimal risk.