Understanding the Common Rule allows healthcare organizations participating in research the assurance that their research is conducted ethically and in accordance with federal regulations.
What is the Common Rule?
The Common Rule's official title is the "Federal Policy for the Protection of Human Subjects." This helps ensure that research involving human subjects is conducted ethically, focusing on protecting participants' rights, welfare, and privacy. It promotes transparency, accountability, and responsible conduct of research across various disciplines and institutions in the United States.
The Common Rule and HIPAA
HIPAA's Privacy Rule and Security Rule govern the protection, use, and disclosure of PHI by covered entities, ensuring the privacy and security of individuals' health information. The Common Rule, on the other hand, applies to research involving human subjects and establishes ethical standards and regulatory requirements. When research activities involve the use or disclosure of PHI, researchers must comply with HIPAA's privacy and security requirements, obtain necessary authorizations from individuals, and implement safeguards to protect the confidentiality of health information.
Related: Who enforces HIPAA regulations?
Who does the Common Rule apply to?
Federal Agencies
The Common Rule applies to research conducted or supported by federal departments or agencies, such as the National Institutes of Health (NIH), the Department of Defense (DoD), or the Department of Health and Human Services (HHS).
Institutions Receiving Federal Funding
Institutions, including universities, hospitals, and research organizations, that receive federal funding for research involving human subjects must comply with the Common Rule. This includes studies funded by federal grants or conducted at federally funded facilities.
Institutional Review Boards (IRBs)
IRBs are responsible for reviewing and approving research protocols involving human subjects. The Common Rule outlines requirements for IRBs to ensure that studies meet ethical standards and adequately protect the rights and welfare of participants. IRB plays a role in ensuring compliance with both the Common Rule and HIPAA.
Researchers and Investigators
Individuals conducting research involving human subjects, whether employed by institutions or working independently, must adhere to the provisions of the Common Rule.
Requirements for researchers
- Informed consent: Researchers must obtain informed consent from participants, ensuring they have a clear understanding of the study's purpose, procedures, risks, benefits, and their rights as participants. Informed consent must be voluntary, documented, and obtained before participation.
- Minimization of risks: Researchers must minimize risks to participants by employing appropriate study design, monitoring participant safety, and ensuring that the potential benefits of the research outweigh the potential harms.
- Privacy and confidentiality: Measures must be in place to protect the privacy and confidentiality of participants' identifiable information and research data. Researchers must maintain the confidentiality of participants and use de-identification or anonymization techniques when possible.
- Protection of vulnerable populations: Additional protections are required for vulnerable populations, such as children, prisoners, pregnant women, and individuals with diminished decision-making capacity. Research involving these groups must meet specific ethical considerations and regulatory requirements.
Related: Addressing HIPAA and reproductive health research
Exemptions within the Common Rule
The Common Rule includes specific categories of research that may be exempt from certain provisions or have modified requirements. The exemptions and variations aim to streamline the review process for low-risk studies or research activities that do not involve vulnerable populations. For example, some research activities that involve minimal risk to participants, such as anonymous surveys, educational tests, or publicly available data analysis.
Some reviews are also permitted to have an expedited or limited review by the IRB instead of a full review, granted it poses minimal risk. Research involving the analysis of existing data or biospecimens may also be subject to modified requirements.
Related: HIPAA Compliant Email: The Definitive Guide
Kirsten Peremore
