NRPM: Standards for Privacy of Individually Identifiable Health Information. h. Need to assess the Common Rule.


In general, the Common Rule was designed to protect human subjects participating in research projects from physical harm. It was not specifically designed to protect an individual’s medical records when used for research. For research in which only the medical information of the human subject is used, i.e., records research, there are several ways in which the Common Rule protections could be enhanced.

In developing these proposed regulations, and in reviewing the comprehensive medical privacy legislation pending before Congress, it has become clear that the Department’s human subject regulations (45 CFR part 46, 21 CFR part 50, and 21 CFR part 56) may not contain all of the safeguards necessary to protect the privacy of research participants. Because the source of research funding should not dictate the level of privacy protection afforded to a research subject, the Secretary of HHS will immediately initiate plans to review the confidentiality provisions of the Common Rule.

To further that process, we solicit comments here on how Common Rule protections for the subjects of records review should be enhanced. For example, we will consider the adequacy of the Common Rule’s provisions regarding conflict of interest, expedited review, exemptions (such as the exemption for certain research on federal benefits programs), deceased subjects, and whether IRB’s should place greater emphasis on confidentiality issues when reviewing research protocols. We also seek comment on whether the Common Rule requirements for obtaining consent for records research should be modified to reflect the specific risks entailed in such research.

In addition, because seventeen other Departments and Agencies are signatories to the Common Rule and each has its own human subject regulations, the Secretary of HHS will consult with these Departments and Agencies regarding potential changes to the Common Rule.