For decades, researchers have relied on biospeci-mens and data leftover after collection for other purposes to make important scientific and medical advancesReference Grady1 — and the law has afforded a number of mechanisms to facilitate such “secondary” research, often without consent from the human sources from whom the specimens or data were derived. At the start of the twenty-first century, however, the previously arcane issue of aconsensual secondary research began to gain public prominence. For example, in 2004, members of the Havasupai Tribe brought a lawsuit against Arizona State University alleging that blood samples originally provided for research on diabetes had been used without their knowledge or consent for other types of genetic studies, including those exposing tribe members to stigma regarding mental illness and challenging their deeply held beliefs regarding tribal ancestry.Reference Rubin and Garrison2 In 2009, parents in Texas filed suit claiming research use of leftover blood spots from their newborns' mandatory public health screenings was a violation of liberty and privacy rights, as well as the right against unreasonable search and seizure;Reference Doerr3 parents in other states have done the same.Reference Lewis4 In both the Havsupai and blood spot litigation, resulting settlements entailed the removal of remaining specimens from research use, either through destruction5 or return.6 The debate about newborn blood spots also resulted in responsive legislation at both state and federal levels.7
These examples received national news coverage, but the greatest public awakening regarding biospecimen research is probably traceable to the bestselling book, The Immortal Life of Henrietta Lacks, published in 2010.Reference Skloot8 The book tells the story of a young African American woman, Henrietta Lacks, who received treatment for cervical cancer at Johns Hopkins in the 1950s, and died shortly thereafter. Cells collected from a biopsy of Lacks's tumor were cultured without her knowledge or permission, and additional cells may have been collected specifically for research purposes. The cells were cultivated into a self-perpetuating cell line, dubbed “HeLa,” which became the most valuable cell line in history, leading to breakthroughs in cancer research and therapy, among many other scientific and clinical advances. Lacks's surviving family members, however, shared neither recognition nor profits from these advances. The story struck many reading Skloot's book as a grave injustice. Yet federal regulations governing research use of biospecimens and data do not require profit sharing and have long allowed — and still allow — secondary research to be conducted without consent so long as the researchers lack access to identifying information, as well as in a number of other circumstances.9
Importantly, increasing public awareness of biospecimen research has not occurred in a vacuum. Instead, it has arisen in an era of both increasing deference to individualism and patient autonomy and recognition of concerns about the privacy of data collected on the internet,Reference Singer10 in consumer settings, and in the context of medical care. In addition to data breaches and misuse, privacy limitations have been further demonstrated by efforts in which researchers have been able to use publicly available information to re-identify individuals from datasets that appeared, on first impression, to have been de-identified by removal of typical identifiers, such as name, Social Security number, and address.Reference Gymrek11
This article addresses the provenance of the revised Common Rule's regulatory broad consent option for secondary research with identifiable biospecimens and identifiable data, what it entails, and what questions the regulations leave unanswered. It then describes and analyzes recommendations offered by the U.S. Department of Health and Human Services Secretary's Advisory Committee on Human Research Protections (SACHRP) to clarify this new option, including the logistics that will need to be put into place in order to implement regulatory broad consent and how to clarify its meaning to those asked to provide it. Finally, the article concludes with the start of a research agenda around regulatory broad consent, outlining a number of questions about which we ought to seek robust empirical data.
It was against this backdrop of controversial cases, broader cultural developments, and technological advances — alongside emerging empirical data on public opinion regarding consent to secondary research12 — that major changes were proposed to the regulations governing secondary research with bio-specimens and data, as described in detail below. Following a 2011 Advance Notice of Proposed Rulemaking,13 the terms set forth in the 2015 Notice of Proposed Rule Making (NPRM) “to modernize, strengthen, and make more effective the Federal Policy for the Protection of Human Subjects,”14 i.e., to revise the “Common Rule,” would have severely limited the conditions in which biospecimens could be used in federally-funded research without consent from their human sources. The proposed changes were rooted in the regulators' perception that “people want to be asked for their permission” for such research and that consent is therefore essential to trust in the research enterprise.15 However, that proposal was met with piercing opposition from researchers, research institutions, and patients,16 fearful of what the change would mean for medical progress.
The final revised Common Rule stepped back from this precipice. Promulgated on the last day of President Obama's term in January 2017, with an effective date of July 21, 2018, and a general compliance date of January 21, 2019,17 the Final Rule largely retains the pre-2018 status quo allowing several approaches to secondary research use of biospecimens and data without consent from their human sources. It also adds to the regulatory repertoire a new consent option intended as a compromise to facilitate research using identifiable materials: “regulatory” broad consent.18 This new option — distinct from the “general” broad consent sometimes used under the pre-2018 rule, as described below — is rife with questions. Most importantly, will it be used, and if so, how can potential vulnerabilities be minimized? Will biospecimen and data sources — patients, research participants, others — understand what regulatory broad consent means, and will they ultimately be willing to provide it?
This article addresses the provenance of the revised Common Rule's regulatory broad consent option for secondary research with identifiable biospeci-mens and identifiable data, what it entails, and what questions the regulations leave unanswered. It then describes and analyzes recommendations offered by the U.S. Department of Health and Human Services Secretary's Advisory Committee on Human Research Protections (SACHRP) to clarify this new option,19 including the logistics that will need to be put into place in order to implement regulatory broad consent and how to clarify its meaning to those asked to provide it. Finally, the article concludes with the start of a research agenda around regulatory broad consent, outlining a number of questions about which we ought to seek robust empirical data.
Regulatory Revisions
When researchers carry out their studies, the data they collect from participants may also be useful for future, distinct analyses. They might also collect biospecimens for research purposes, either specifically for a research repository or for a hypothesis-driven protocol in which some specimens may be leftover once primary research uses are complete. Specimens collected in clinical care and left over after their clinical use also may be useful for research, and clinical data such as patient health records can offer insight into a range of research questions. There are also vast troves of data collected about us in everyday life,Reference Kircher20 which may be of interest to researchers: our Google searches, AppleWatch data, credit card transactions, geotracking, and much more. Importantly, it is only when entities use federal funding to conduct research with biospecimens and data that the uses might fall within the purview of the Common Rule;21 that will be our focus here.
The Old Rule
When data and specimens were originally collected for a purpose other than the present research, the present research use is described as secondary. Under the pre-2018 Common Rule (i.e., “the Old Rule”), whether secondary research with data and specimens was regulated as human subjects research depended entirely on whether the data and specimens were identifiable. The Old Rule defined “human subject” to include a “living individual about whom an investigator … conducting research obtains” either “data through intervention or interaction with the individual” or “identifiable private information.”22 Because secondary research involves no intervention or interaction with an individual, given that the data or specimens are leftover from other uses, it fell under the Old Rule only if the data or specimens included or were associated with identifiable private information about their source.
This meant that if researchers stripped identifiers from the data or specimens they sought to use for secondary research, or received coded data or specimens without identifiers accessible to them,23 their secondary research would not be subject to regulatory requirements under the Old Rule at all, avoiding both the requirements for approval and oversight by an Institutional Review Board (IRB) and for informed consent. Researchers might also have avoided these requirements even if they retained identifiers, for example if their research satisfied the Old Rule's criteria for regulatory exemption by using existing publicly available data or specimens or not recording identifiers from identified materials.24 On a third pathway available under the Old Rule, non-exempt secondary research with identifiable data or identifiable specimens was subject to IRB review and approval, but the IRB could waive consent from the source under certain conditions — namely, that the research posed no greater than minimal risk, consent waiver would not adversely affect subject rights and welfare, the research could not practicably be carried out without a waiver of consent, and subjects would be debriefed as appropriate.25
The key takeaway here is that, under the Old Rule, IRB approval and informed consent would be required only if the secondary research with data or specimens involved the retention of identifiers accessible to the researchers, failed to satisfy the terms of any regulatory exemption, and failed to satisfy the criteria for consent waiver. In this case, the required consent could entail a specific new request for the subject to permit use of his or her data or specimens in the current research (i.e., “specific consent”). Alternatively, an IRB could determine that consent to future uses of identifiable data or specimens obtained at the time they were originally collected was sufficient to allow the secondary research use currently proposed, without any additional consent specific to that current use and without waiver of consent. This was a type of de facto general consent that we will refer to as “old broad consent” to distinguish it from the unique category of regulatory broad consent contemplated under the revised Common Rule and discussed below. Old broad consent was not explicitly recognized by the regulations, but it was widely used in practice, especially for data and specimens collected in previous research.
Considering Change
Ultimately, the Old Rule allowed secondary research to be carried out without consent under a wide range of circumstances. This approach promoted scientific advancement and public benefit26 by imposing few hurdles for researchers, acknowledging that it could be difficult or impossible to find the sources of specimens and data to seek their consent for secondary research if adequate old broad consent had not been previously secured, and that failure to reach all sources and secure new consent could lead to scientific bias. If risks to data and specimen sources from secondary research were substantial, requiring researchers to navigate these hurdles might be appropriate, but when identifiers are not retained, shared, or recorded, the privacy risks to data and specimen sources are low. Moreover, even if identifiers are retained, there are other ways to protect sources aside from seeking their consent, including IRB oversight and implementation of robust privacy and confidentiality protections. Given the high scientific value and low risk to sources, permitting secondary research without consent in the circumstances allowed by the Old Rule was supported by the principles of beneficence and justice, often appropriately outweighing potential autonomy interests.Reference Korn, Sachs, Lynch, Bierer, Cohen and Rivera27
Nonetheless, as a number of high-profile cases drew attention to the status quo, it became evident that some people were or would be surprised to learn that data and specimens derived from them were being used in research without first obtaining their specific permission. To the extent that people expect to be asked for permission for secondary research use, there was concern that the status quo could lead to mistrust in and reduced support for the research enterprise.28 In addition, some believe that autonomy interests should prevail over other values, asserting that sources should have the authority to control “their” data and specimens — even if the data and specimens are not identifiable and even if there are no physical risks and low privacy risks — on grounds that they ought to be able to direct their materials to research most important to them and refuse support to research that may run against their fundamental values.Reference Skloot29 Moreover, some reject the notion that risks are low, pointing to increasing possibilities that even de-identified data and specimens can be re-identified30 and noting that individually de-identified materials may nonetheless lead to harm for identified groups, such as stigmatization, as occurred for the Havasupai Tribe.31 There are also potential concerns regarding cultural and religious beliefs about the nature of specimens and their relation to the body.
Although considering public opinion in matters of research regulation is clearly important, the right approach to secondary research with data or specimens is not necessarily best determined by reference to public opinion, or at least to public opinion alone. This is true for several reasons. First, it may be difficult to discern what the public's opinion actually is. For example, based on a review of the empirical literature, Grady et al. concluded that people “want to decide whether or not their biospecimens are used for research.” However, they also concluded that most people do not care about the specific details of future research, such as the disease studied, technology used, study target, or product — although they may care in specific controversial contexts, including research involving human cloning, indigenous peoples, or commercial uses and profit.32 In contrast, Rivera and Aungst concluded on the basis of their literature review that “donors want control over their own specimens and results, while being ensured privacy and confidentiality … They either want to dictate up-front the specific types of research that can use their specimens, or they expect to be contacted and re-consented every time another study or researcher wants to use their samples.”33
Beskow examined the selected literature cited by the regulators in proposed changes to the Common Rule to support the contention that “a growing body of survey data show that many prospective participants want to be asked for their consent before their biospecimens are used in research.”34 She concluded that the data “actually provide a highly complex picture that does not necessarily fit the proposed regulations.”35 This is because the data represent perspectives from disparate stakeholders, asked about different kinds of bio-banks, and presented different options from which to select their preference — but often not exploring the option of “no consent.” With regard to other available literature regarding attitudes toward biobanking and consent, Beskow explains that “the same challenging picture emerges.”36
Part of the problem is that specifics matter. Public opinion probably would be vastly different if asked a question like “Can we use your data and specimens in the future for whatever we want?” versus “Can we used your data and specimens in a low risk way for future research that will be socially beneficial but that might not be feasible if we needed to seek your consent for each specific use?” This relates to the second problem, which is that the scientific research enterprise is complex, and a large proportion of the public lacks a robust understanding of how it works, including the potential trade-offs of a more stringent approach to secondary research.37 As Beskow notes, “[w]hat individuals might prefer … is not the same as what they might find acceptable, once they are aware of the risks, benefits, costs, and trade-offs at stake for the array of interests they would like to see advanced.”38 Public education on these issues should be an important priority,39 but in the face of misunderstandings or lack of awareness, public opinion should not be the exclusive driver of policy choices.
Third, and finally, “the public” is not homogenous. As we ultimately saw in public comments on Common Rule proposals, different types of people want different things from the regulation of secondary research.40 Even if one group prefers a more autonomy-centered approach, the preferences and interests of other groups, including patients who stand to benefit from streamlined approaches to secondary research, may matter more.41 Indeed, even though some defined groups may be more suspicious than the general public of unconsented secondary research due to fear of stigmatization and harm, other groups, such as disease advocacy and public health groups, may insist that aconsensual secondary research be widely deployed, to expedite disease treatments and address pressing public health problems.
The Proposed Rule
Despite limitations on the utility of public opinion in these contexts, the 2015 NPRM to amend the Common Rule proposed sweeping changes to the regulation of secondary research with data and specimens on the grounds that “people want to be asked their permission”42 and that “continuing to allow secondary research with biospecimens collected without consent for research places the publicly-funded research enterprise in an increasingly untenable position because it is not consistent with the majority of the public's wishes, which reflect legitimate autonomy interests.”43 Overall, the NPRM proposed to treat secondary research with data and secondary research with specimens divergently, largely making secondary research with data easier but imposing considerable constraints on secondary research with specimens, despite the fact that both raise similar issues of autonomy, beneficence, and justice.Reference Lynch, Bierer and Cohen44
Most importantly, the NPRM proposed to revise the Common Rule's definition of “human subject” to include all biospecimens, regardless of identifiability.45 If all biospecimens were human subjects, then it would no longer be possible to avoid Common Rule requirements by stripping specimens of identifiers before their use in secondary research. The proposed rule would have also eliminated the exemption applicable for certain types of research performed without recording identifiers.46 It proposed to retain the possibility of consent waiver in principle, but in practice waiver for secondary research with biospecimens would have become virtually impossible – intentionally “rare.”47 In addition to the Old Rule's standards for consent waiver, the proposed rule would have added new conditions, including that research with data or specimens could not practicably be conducted without identifiers, and for specimens only, that there be “compelling scientific reasons” for research use and that research could not be conducted with other specimens for which consent was or could be obtained.48 Although it seems reasonable to retain identifiers only when necessary, the proposal offered no definition of what might count as a “compelling” scientific reason for the research use of the specimens in question, creating concern that perhaps consent waiver would not be available for exploratory research. Even more concerning, adding a criterion that researchers somehow demonstrate that no other specimens exist for which consent was or could be obtained seemed to be an impossibly high standard, potentially demanding that researchers somehow be aware of all specimens in existence around the world and that those specimens actually be available for their research.49
With three of the Old Rule's options for secondary research with biospecimens essentially off the table — de-identification, exemption, and waiver of consent — how did the proposed rule envision such research occurring? One option would have been for researchers to seek specific consent from the specimen source for each secondary research use. However, as noted above, there are a number of drawbacks to this approach, including bias in which specimen sources will be possible to recontact. In addition, such recon-tact and reconsent is often intensely resource intensive and burdensome, most often to the point of infeasibility due to costs and manpower constraints. As an alternative, the proposed rule offered a new option for secondary research with biospecimens and identifiable data: regulatory broad consent.50
Rather than requiring that researchers obtain specific consent for each secondary research use as it occurs, regulatory broad consent as contemplated under the proposed rule would have been offered at some earlier point in time, typically when biospeci-mens or identifiable data were initially collected, for example in primary research or clinical care. It would include some but not all elements of traditional research consent and provide general (i.e., “broad”) information about possible future uses.51 Instead of an opt-out approach, regulatory broad consent under the proposed rule would have required the sources of specimens and identifiable data to make an affirmative decision to allow future research uses.
Under the NPRM's proposal, if regulatory broad consent was obtained, it could substitute for specific consent and be paired with traditional IRB review, or it could be paired with “limited” IRB review under a proposed new exemption.52 The proposed exemption would have been available for the storage or maintenance of specimens or identifiable data for secondary research use if broad consent had been obtained, and for secondary research use itself if specimens or identifiable data had been stored with broad consent, so long as the IRB made limited findings regarding the consent process and privacy protections.53 In contrast to traditional IRB review, limited IRB review would not require the IRB to evaluate the risks and benefits of the proposed secondary use, determine that risks had been minimized, or ensure other safeguards typically required for study approval.
Given the infeasibility of the other options for secondary research with specimens under the proposed rule, regulatory broad consent was set to become the de facto requirement to carry out such research, intended as a compromise between requiring specific informed consent for all specimen research and permitting certain specimen research to proceed without consent, as under the status quo. However, there were numerous concerns about the feasibility of broad consent, in particular about the resources required for tracking broad consent within institutions and whether some institutions would be willing to undertake the burden at all, especially those collecting specimens in clinical care outside the setting of major academic medical centers and research institutions.54 The difficulties with broad consent are described in detail below.
With regard to data, the proposed rule would have curiously retained the status quo allowing secondary research with de-identified data to remain outside the scope of the Common Rule. In addition, it would have offered a new “exclusion” from the Common Rule for certain types of research with identifiable data, retained certain exemptions (renamed “exclusions”), and retained the possibility of routine consent waiver. This exceptionalist approach to biospecimens compared to data made little sense. For example, why treat a full genome sequence differently from the specimen from which it was derived?55
Nearly 2,200 public comments were submitted on the proposed rule,56 most of which focused on the proposals regarding specimen research and regulatory broad consent. Overall, patients and the research community expressed opposition to the proposal based on concern that it would reduce the availability of specimens for research, thereby slowing medical advances and negatively affecting health.57 Important advisory committees were also opposed: President Obama's Commission for the Study of Bioethical Issues noted that de-identified specimen research poses no or low risk to sources and is unlikely to impact their autonomy interests,58 while SACHRP argued that the proposal would not effectively improve autonomy and that regulatory broad consent for secondary research could undermine subject welfare by allowing such research to proceed with only limited IRB review.59 Comments submitted by members of the general public, i.e., those not identifying as patients, researchers, or research institutions, were more divided, with some in favor of autonomy and control calling for the proposal to go even further toward specific consent and some worried about the proposal's adverse impact on medical advancement.60
Nearly 2,200 public comments were submitted on the proposed rule, most of which focused on the proposals regarding specimen research and regulatory broad consent. Overall, patients and the research community expressed opposition to the proposal based on concern that it would reduce the availability of specimens for research, thereby slowing medical advances and negatively affecting health.
The Final Rule
The Common Rule agencies published a final revised rule on January 19, 2017.61 After a number of delays, regulated entities could begin implementing certain provisions in July 2018, with a final implementation date of January 21, 2019. The final rule was dramatically different from what had been proposed in the NPRM, adopting an approach that nearly completely discounted complaints related to dignitary harm and autonomy that had ostensibly prompted the revisions in favor of other values and interests.Reference Goldstein62
Importantly, the agencies walked back the motivation that had led to proposing such substantial changes for specimen research, explaining that:
one of the core reasons for proposing that the rule be broadened to cover all biospecimens, regardless of identifiability, was based on the premise that continuing to allow secondary research with biospecimens collected without consent for research places the publicly funded research enterprise in an increasingly untenable position because it is not consistent with the majority of the public's wishes, which reflect legitimate autonomy interests. However, the public comments on this proposal raise sufficient questions about this premise such that we have determined that the proposal should not be adopted in this final rule.63
The Final Rule reverted to treating specimens and data consistently and dropped the proposal to define all biospecimens as human subjects, on the basis that “commenters in every category — institutions, researchers, people working in programs that protect research participants, and people with no employment connection to the research world — expressed concern that implementing this proposal could significantly harm the ability to do important research, without producing any substantial off-setting benefits.”Reference Menikoff, Kaneshiro and Pritchard64 Instead, regulators chose to retain the status quo of identifiability as the threshold for applying the Common Rule to secondary research with both data and specimens, now defining “human subject” to mean “a living individual about whom an investigator … conducting research: (i) [o]btains information or biospecimens through intervention or interaction with the individual, and uses, studies, or analyzes the information or biospecimens; or (ii) [o]btains, uses, studies, analyzes, or generates identifiable private information or identifiable biospecimens.”65
Accordingly, under the Final Rule, secondary research with de-identified data and de-identified specimens can still be performed without IRB review or consent from the human sources from which they were derived — at least so long as the data and specimens are deemed to be de-identified, which remains somewhat uncertain due to new requirements for periodic reconsideration of the definition of identifiability.Reference Lynch and Meyer66 However, as noted below, new requirements for research informed consent are intended to help clarify the possibility that data and specimens may be stripped of identifiers and used for future research without further consent.67 The Final Rule also dropped the most restrictive proposed criteria for consent waiver, but enacted the additional criterion that research must not be able to be carried out without using identifiers.68 Accordingly, consent waiver remains a reasonably available option for conducting secondary research with identifiable data and identifiable specimens.
In addition to preserving all of the pre-2018 regulatory options for secondary research both on paper and in practice, including somewhat expanded criteria for exemption in which no consent is required, the Final Rule adopted the proposed exemptions for regulatory broad consent plus limited IRB review as a new option that can be used to provide data and specimen sources with more control.69 Thus, rather than regulatory broad consent serving as the de facto exclusive option to permit secondary research with biospecimens (whether identifiable or not), as would have been the case under the proposed rule, the Final Rule instead expanded the universe of potential options. In other words, regulatory broad consent was initially proposed as a solution to a new problem that would have been created by (1) defining all biospecimens as “human subjects” and (2) simultaneously narrowing the permissible scope of waivers of consent. Because these two features were eliminated from the Final Rule, but regulatory broad consent survived, regulatory broad consent might now reasonably be seen as a solution in search of a problem, a relic of a regulatory innovation that went nowhere. For reasons described below, we suspect that this “solution” will typically be less attractive than de-identification, exemption, or consent waiver, useful in only very limited circumstances.
To take advantage of this new exemption for secondary research with identifiable data and identifiable biospecimens — which permits avoidance of both traditional IRB review, approval, and continuing oversight, as well as avoidance of the need to obtain specific informed consent to the current research use or waiver of consent — regulatory broad consent must be obtained at some point prior to secondary research use. If it has been, then “any subsequent storage, maintenance, and secondary research uses of the individual's identifiable biospecimens and data consistent with the broad consent would not require additional consent, so long as additional conditions are met, including limited review by an IRB.”70 The IRB must review only to ensure the adequacy of privacy and confidentiality protections, that the proposed research is in fact within the scope of broad consent that was properly obtained and documented, and that the study does not plan to return individual results to research participants (a condition of using this exemption).71 Under limited review, the IRB does not consider risks to subjects or their welfare, as they would if engaged in traditional research review or consideration of a request for consent waiver.
Regulatory broad consent can also be used for secondary research without taking advantage of the exemption, in which case it would be paired with traditional IRB review, analyzing all of the criteria for study approval found at 45 C.F.R. 46.111(a)(1) through (7): minimization of risk, reasonable risk/benefit ratio, equitable subject selection, informed consent and documentation, adequate data monitoring, and privacy and confidentiality protection. Traditional IRB review will also be required for data and specimens collected using some form of old broad consent that does not contain the full complement of new regulatory elements or that does not clearly apply to the currently proposed secondary research use.
Importantly, one condition of utilizing regulatory broad consent is that if it is offered and an individual refuses to provide it, the option for subsequent consent waiver is lost with regard to that individual;72 a new criterion for consent waiver under the Final Rule is that broad consent not have been refused, if it was offered (keeping in mind that it need not be offered at all). This does not mean that the refusing individual's data or specimens necessarily must be destroyed, however. In the face of a broad consent refusal, the option to de-identify data and specimens remains available, at least as a regulatory matter, as does the option to use data and specimens for non-research purposes, even with identifiers, such as for quality assurance or public health purposes. As discussed further below, these limitations should be made clear to the source who might otherwise imagine that refusal of broad consent would lead to no further secondary use. Note also that the option of retention with identifiers for non-research purposes would require a tracking system to ensure only compliant future use.73
The new regulatory requirements for broad consent are substantial. To be legally effective as a substitute for specific consent, regulatory broad consent disclosures must include the following traditional consent elements from the Old Rule:
A description of any reasonably foreseeable risks or discomforts to the subject;74
A description of any benefits to the subject or to others that may reasonably be expected from the research;75
A statement describing the extent, if any, to which confidentiality of records identifying the subject will be maintained;76
A statement that participation is voluntary, refusal to participate will involve no penalty or loss of benefits to which the subject is otherwise entitled, and the subject may discontinue participation at any time without penalty or loss of benefits to which the subject is otherwise entitled.77
In addition, the Final Rule requires new elements in traditional consent to primary research to help participants understand how their specimens may be used in the future, some of which must also be included in broad consent:
When appropriate, a statement that the subject's biospecimens (even if identifiers are removed) may be used for commercial profit and whether the subject will or will not share in this commercial profit;78
When appropriate, for research involving bio-specimens, whether the research will (if known) or might include whole genome sequencing (i.e., sequencing of a human germline or somatic specimen with the intent to generate the genome or exome sequence of that specimen).79
Finally, the revised rule requires several novel elements exclusive to broad consent:
A general description of the types of research that may be conducted with the identifiable private information or identifiable biospecimens. This description must include sufficient information such that a reasonable person would expect that the broad consent would permit the types of research conducted;80
A description of the identifiable private information or identifiable biospecimens that might be used in research, whether sharing of identifiable private information or identifiable biospecimens might occur, and the types of institutions or researchers that might conduct research with the identifiable private information or identifiable biospecimens;81
A description of the period of time that the identifiable private information or identifiable biospecimens may be stored and maintained (which period of time could be indefinite), and a description of the period of time that the identifiable private information or identifiable biospecimens may be used for research purposes (which period of time could be indefinite);82
Unless the subject or legally authorized representative will be provided details about specific research studies, a statement that they will not be informed of the details of any specific research studies that might be conducted using the subject's identifiable private information or identifiable biospecimens, including the purposes of the research, and that they might have chosen not to consent to some of those specific research studies;83
Unless it is known that clinically relevant research results, including individual research results, will be disclosed to the subject in all circumstances [which then precludes use of the broad consent exemption], a statement that such results may not be disclosed to the subject;84
An explanation of whom to contact for answers to questions about the subject's rights and about storage and use of the subject's identifiable private information or identifiable biospecimens, and whom to contact in the event of a research-related harm.85
Ultimately, the Final Rule resolved the most serious concerns about the approach to secondary research with specimens that had been proposed in the NPRM. Under the Final Rule, researchers still have many options to carry out secondary research with data and specimens in a streamlined fashion without IRB approval and/or consent (Figures 1 and 2), facilitating scientific advancement but leaving at least some members of the public chagrined. At the same time, the Final Rule takes steps to reduce surprise among the public about how their data and specimens might be used in future research by requiring that they be provided with more information in the context of consent to primary research.86 Finally, the option for regulatory broad consent provides a new approach that, with certain tradeoffs and limitations, can promote the autonomy of human sources of data and biospecimens. Yet whether regulatory broad consent will be utilized by the research community remains an open question.
Figure 1. Approaches to research with data and specimens under the Final Rule.
Figure 2. Options for secondary research with data and specimens under the Final Rule.
Challenges to Implementing Broad Consent
In summarizing the public comments that had been received regarding the NPRM's proposed approach to research with specimens, the preamble to the Final Rule described numerous concerns, including:
the feasibility of obtaining broad consent in a clinical setting; the costs of obtaining, tagging, and tracking consents given the low risk nature of the research in question; … the fact that it would result in fewer specimens collected from fewer sources, with adverse implications for rare diseases and for justice; … and overall negative impacts on research. Many expressed concern about the number of biospecimens that might no longer be available for research, not out of concern that individuals would decline to have their leftover tissue used in research, but rather because many hospitals and medical providers might decline to enact the expensive consent and tracking system that the NPRM envisioned. Some commenters were concerned that this would then limit the heterogeneity of biospeci-mens obtained and stored, as community hospitals and clinics might opt out of participating in such collections.87
These concerns were particularly troubling when broad consent was proposed as the near-exclusive approach to secondary specimen research. Now that it has been made one option among many, however, these concerns — and others — may simply render the option unlikely to be used outside exceptional cases and/or unlikely to achieve its ethical goals. At the very least, whether to offer regulatory broad consent under the new rule deserves careful consideration.Reference Sugarman88
Offering Broad Consent
Under the Final Rule, regulatory broad consent is intended to be available for data and specimens collected in both research and clinical care. The process of offering broad consent for research data and specimens could be simple enough, with the required information provided as part of the research consent process (although it is unclear whether participation in the primary research should be contingent on willingness to provide broad consent to future research).Reference Pritchard, Kaneshiro, Lynch, Bierer, Cohen and Rivera89
For clinical data and specimens, however, the process may be more complicated. Broad consent may be sought by a health system on a “front door” basis, i.e., offered to all new patients upon their initial interaction with the system, either at their first in-person visit or perhaps through electronic correspondence when a patient signs up to access an electronic portal. Broad consent from existing patients could also be sought through similar mechanisms. Individual clinical departments within a system, or even individual clinicians, may also be interested in seeking broad consent from their patients, which could intensify the tracking difficulties described below.
Practically speaking, seeking broad consent for future research use in these clinical settings would mean that clinical administrative staff members will need to add this task to their lists of duties and be trained to respond to patient questions. Broad consent materials may be sandwiched between hosts of other forms and disclosures patients receive in clinical contexts, with an implied suggestion that they must be completed in full as a condition of receiving care and, thus, in a manner not at all conducive to a true informed consent process. Thus, if and when offered in clinical settings, regulatory broad consent seems likely to go the way of HIPAA authorizations, i.e., a routinized request to “SIGN HERE” with little genuine understanding or true consent.90 Compared to other approaches to educate the public about the use of data and specimens for research and to truly enhance autonomous decision making, this approach seems unlikely to be effective.
If broad consent is offered, in either research or clinical care, it will be important to help individuals situate the offer compared to alternatives, at least to the greatest extent possible. Given the general lack of public understanding regarding how leftover specimens and data may be used for research, it is possible that individuals offered the opportunity to provide broad consent for future research will mistakenly view this as limiting their autonomy rather than expanding it. For example, if an individual incorrectly assumed that his specimens and data would not be used for future research unless he granted his specific consent, he may refuse to provide broad consent in order to preserve this incorrectly presumed right to specific consent. However, this refusal may have the effect of avoiding future research with his identifiable data and specimens entirely, which might not have been his intention. In contrast, if he correctly understands that had broad consent not been offered at all, his specimens and data could be de-identified or his consent waived for future use of identified specimens and data, he may view the offer of broad consent as a “bonus,” i.e., an opportunity for control that would not otherwise be available. This perspective may make him more inclined to provide broad consent – although it is also possible that his trust in the research enterprise could be shaken by virtue of becoming aware of alternative approaches to aconsensual secondary research with data and specimens that remain available under the new rule, potentially leading to refusal. This is exactly the sort of question that cannot be answered without empirical data.
Although it is not yet clear how broad consent will be perceived by those to whom it is offered, it is essential that it be contextualized in such a way that individuals offered the option of regulatory broad consent are helped to understand both the status quo and the implication of the offer; only in this way can genuine informed consent be promoted. In the template for broad consent constructed by SACHRP, the committee took this need for contextualization seriously, beginning the form with an overview of the longstanding regulatory approach to secondary research with data and specimens, both de-identified and identifiable, even though there is no regulatory requirement to do so. The template specifically notes that “[r]esearchers can always use de-identified health information and de-identified biospecimens for research, without getting any person's consent and without asking an ethics committee for permission,” in order to clarify that the only option being presented to the individual is whether to provide broad consent to research with identifiable data and identifiable specimens.91
Importantly, the template also explains the social value of such research, explaining that “[r]esearch using personal health information (such as information about your health status, medical test results, and what medical conditions you have), and biospecimens (for example, blood or other body tissues) has led to important advances in medicine, science, and other areas” and that “[r]esearch with identifiable information and identifiable biospecimens can be even more helpful to science and medicine, because it allows researchers to put together a lot of information about a person and understand even more about medical conditions and if and how treatments work.” The template further states the intention that broad consent is being sought with the “hope to make it easier for researchers to use your information and biospecimens in the future.”92 Just as with traditional informed consent, it is appropriate to explain the potential community benefits associated with research participation, alongside any individual risks.
Refusing Broad Consent
Even if it is possible to design a perfect broad consent process and template, there are other barriers to using this new pathway for secondary research. One obvious disincentive is that it is risky from a research perspective. As noted above, if an individual is asked and declines to provide regulatory broad consent, the opportunity to waive consent for research use of that person's identifiable specimens or identifiable data is lost. This makes sense: once they ask, researchers ought to be bound by the response or the offer of broad consent would be meaningless. But when researchers retain the alternative regulatory option to seek consent waiver in the first instance, without offering broad consent at all — as they do under the Final Rule — it seems probable that many will chose not to exercise the new regulatory broad consent pathway. Note that there is nothing devious about this choice; it simply selects one regulatory approach over another.
Nonetheless, some researchers and their institutions may be particularly concerned with advancing perceived source autonomy interests, even if such a perspective results in hindering certain types of research advancements, resulting in a preference for broad consent over consent waiver or even de-identification. More instrumentally, some may recognize that a particular population of interest is especially concerned with control over research uses of data and biospecimens, whether identified and/or de-identified, such that failure to acknowledge their preferences could lead to distrust and problems in carrying out future research regardless of technical regulatory compliance. For example, institutions that work with Native American populations may consider regulatory broad consent beneficial, despite its administrative burdens. Broad consent may also be attractive in circumstances where it is predicted that the required elements for waiver of consent may not be satisfied for future anticipated research. Examples of this would include (presumably uncommon) secondary research involving greater-than-minimal risk, perhaps due to substantial concerns about privacy or stigmatization, or (presumably more common) secondary research that could be practicably conducted even if consent was required, perhaps because the community of data or specimen sources is narrow and able to be recontacted. In each of these cases, researchers and their institutions may choose to offer the regulatory broad consent option, even if it means that some individuals may refuse to provide it. In these cases, it is essential to clarify what counts as refusal, as well as the scope and impact of refusal, in order to avoid inappropriately restricting the possibility of consent waiver for later research.
When someone is offered broad consent, they might affirmatively provide it, affirmatively refuse it, or remain silent or non-responsive. For example, they might fail to sign a broad consent form offered in person (especially if it is provided along with other forms or at an inconvenient time), ignore an electronic request, or not return a mailed broad consent document. It seems clear that none of these outcomes should be treated as affirmative provision of broad consent, but they may also not reflect an intention to refuse. As SACHRP noted, “[b]y failing to respond to a request for broad consent, an individual could be expressing indifference, inertia, ambivalence, uncertainty, or complete disinterest. In fact, an individual who strongly objects to a broad consent offer is likely to express affirmative declination on the form … ”93 Moreover, it is not costless to treat silence as refusal, since this would result in inability to waive informed consent. Therefore, in cases of non-response to an offer of broad consent, SACHRP concluded that the regulatory result should be the same as if broad consent had not been offered at all,94 including preservation of the status quo possibility of consent waiver and applicable exemptions. Another way to approach this question is to view availability of potential waiver of consent as the default, and refusal of broad consent (when offered) as a way to affirmatively opt-out from this default; silence leaves the default intact. Of course, the consequences of non-response should be made clear to all those who are offered broad consent, as they are in SACHRP template.95
It is also essential to clarify the consequences of affirmative refusal of an offer of broad consent with regard to the parties bound by such refusal. For example, if broad consent is offered and an individual unequivocally refuses to provide it, should the refusal apply only to the institution or investigator that sought broad consent, or to all institutions and investigators for all research with identifiable data and biospeci-mens from that individual until his or her death (also precluding all researchers from obtaining a waiver of consent for use of such materials)? It would be absurd to suggest that refusal of broad consent in one setting should cover all secondary research uses of identifiable data and specimens derived from that individual, regardless of whether they are collected at other institutions and by other investigators who will have no way of knowing that this person previously refused broad consent offered in a different/prior setting. A refusal of a broad consent can only reasonably bind those who are (or should be) aware of the declination, a category that certainly includes the individual who sought broad consent and also potentially others at his or her institution, but may not include others.
When an individual is offered broad consent and refuses, SACHRP acknowledged that the refusal could be influenced by a number of factors, including the nature of the primary research, the type of identifiable data or specimens under consideration, anticipated future uses, or trust in the specific researcher or institution, among other things.96 Thus, it may be unwar-ranted to suggest that refusal in one circumstance is uniformly intended to apply in any or all others, or that refusal to one party is intended to apply to all others. Yet, the precise scope of intended refusal may be unclear. One approach to deal with this uncertainty would be to narrow the terms of broad consent in order to avoid overly broad consequences of refusal. Of course, this entails the tradeoff of restricting the scope of future research covered by broad consent, which contradicts its purpose, i.e., breadth. Researchers and institutions offering broad consent should consider the tradeoffs of breadth versus specificity and tailor broad consent accordingly.
Whatever the balance, SACHRP concluded that it should be made clear to the individual from whom broad consent is being sought which parties will be permitted to use which identifiable data and specimens in future research if broad consent is granted and which parties will be restricted from which future research uses if broad consent is refused.97 The terms of the broad consent should also make clear whether refusal could be revisited through additional requests in the future, from whom, and how frequently. Refusal need not entail refusal in perpetuity, as an individual may change his or her mind in this regard, but continued requests should be reasonably spaced to avoid harassing or annoying the individual from whom regulatory broad consent is sought.
Overall, SACHRP recommended a common sense approach: broad consent requests should be deemed refused only if affirmatively refused, broad consent requests from separate entities should be viewed separately, and refusal of broad consent to one entity should not restrict others unless they are also specifically refused. The SACHRP template addresses these points in explicit paragraphs outlining what will happen if the individual being asked for broad consent says yes, says no, or says neither through a failure to respond.98
Tracking Broad Consent
It should go without saying that these details regarding who is bound by broad consent and its refusal, as well as the specific terms of broad consent, must actually be complied with, once the opportunity to provide broad consent has been presented to an individual. The complexity of systems necessary to track broad consent adequately and accurately should not be underestimated. When an individual is asked for and grants broad consent, the researcher and his or her institution must track the data and specimens to which the broad consent applies, the entities to which it applies, and its scope — which may include many types of research or may be specific to defined categories — so that IRBs in the future can ensure that new secondary uses fall within the relevant terms. When an individual refuses to provide broad consent, but identifiable data or specimens are retained for non-research use (or for research use not covered by the refusal), tracking will also be necessary as to what was specifically refused, i.e., which uses, which researchers, and which institutions.99 Moreover, both types of tracking must take place accurately over an individual's entire lifetime and throughout the health system. After an individual is deceased, their identifiable data and identifiable specimens will no longer be considered “human subjects” under the Common Rule, although the identifiable data may nevertheless remain covered by HIPAA restrictions until 50 years after death.
The tracking necessary for regulatory broad consent will require extensive, seamless IT system capacity and associated resources. These considerations led SACHRP to conclude that, “practically speaking, institutions or systems without interconnected, interfacing and fully interoperable medical records systems will not be able to implement and benefit from the broad consent regimen established in the Final Rule. A ‘confederated,’ non-IT-unified health system will simply not be able, without significant error, to track these consents and refusals to consent. These logistical barriers will greatly limit the utility of the broad consent option.”100 Note that it was precisely these concerns that led commenters to worry that the proposed rule's approach treating even de-identified biospecimens as “human subjects” would, as a practical matter, preclude the future research use of biospecimens collected in community hospitals, doctors' offices, nursing homes, and mental health facilities that carry out less research and have fewer resources, as well as in international settings — with concomitant impact on the nature of specimens available for research.101 Under the Final Rule, the difficulty of tracking, combined with the risk of losing the option to obtain waiver of consent, suggests that most health care and other service institutions simply will elect not to use broad consent, and instead will use de-identification, waiver of consent, or other regulatory options, as they did prior to the regulatory revisions.
At the same time, it is possible that well-resourced, integrated medical systems with a substantial interest in promoting research — including some academic medical centers — may see long-term value in implementing a system in which every patient is asked “at the front door” for broad consent for the future use of identifiable biospecimens and data collected during the course of clinical care or research at the institution. In fact, some already began this approach before the Final Rule was promulgated, viewing the resource investment to be worth it, although it is unclear how this calculation may change under the new regulations. Notably, an institution-wide request for broad consent may be easier to track than broad consent sought in the context of specific studies or linked to specific investigators because the scope of the broad consent would entail fewer limitations. However, the number of individuals involved on an institutional basis may still pose a challenge. SACHRP suggested that tracking may also be reasonable for “an identified biorepository or databank study, whose defined purpose is to collect biospecimens and associated data from a well-defined set of individuals and for which the broad consent elements can be included in the study consent[.]”102 This is because there would be a more limited and well-defined universe of individuals to track, and tracking could be done at the level of the repository or databank, rather than in a broader institutional setting covering many different types of data and specimen collections and uses.
Additional Concerns About Broad Consent
In addition to these various logistical hurdles to implementation, there is also at least one more reason to be concerned about regulatory broad consent under the Final Rule. Although this option was intended to enhance autonomy, it may sacrifice human subject protections when paired with limited IRB review. In the past, when old broad consent was used, an IRB would still engage in traditional review to assess not only whether the broad consent covered the newly proposed research uses of data or specimens, but also whether the newly proposed research uses were themselves approvable. Thus, if a particular use might have been especially risky or concerning to the individuals from whom the data or specimens were derived, the IRB had an opportunity to intervene to prevent it or to require specific consent to that use. Note that this sort of robust IRB oversight is also required for requests to waive consent.
Under limited IRB review, however, the IRB does not evaluate the ethical aspects of the proposed new research use, instead performing only a technical review to assess whether that use is plausibly covered by the terms of the regulatory broad consent and that selected other protections are in place. It is true that individuals who elect to provide broad consent have autonomously decided to agree to future research without knowing fully what it might entail and the Final Rule requires that they be informed that they might have chosen not to consent to some of the specific research studies that ultimately come to pass.103 Nonetheless, it is unclear that the scope of limited IRB review under the Final Rule is ethically sufficient.
To address this problem, SACHRP recommended that regulatory broad consent disclose examples of “controversial” areas of potential future use, such as those that may be morally objectionable or stigmatizing to data and specimen sources, in order to encourage individuals to consider them when agreeing or refusing to provide broad consent.104 SACHRP also encouraged IRBs carrying out limited review to go beyond the regulatory requirements to “assure that the proposed research would not be fundamentally shocking to or fundamentally inconsistent with prevailing community attitudes among those who have given their broad consent.”105 Finally, SACHRP recognized that researchers bear an ethical responsibility to respect the populations from whom broad consent has been obtained by not proposing secondary research likely to be perceived as disrespectful.106 Similar responsibilities lie with those charged with governance of biobanks and data repositories, who should (and often do) consider professional qualifications of those seeking access to research materials, the scientific value of the proposed secondary use, and the potential for harm to data and specimen sources.Reference Burke107
Moving Forward with Regulatory Broad Consent Under the Final Rule
SACHRP has taken important strides toward clarifying aspects of regulatory broad consent left open by the Final Rule. However, there are many outstanding questions in need of empirical data and conceptual analysis. Ideally this evidence would have been available prior to final rulemaking,Reference Nicholls108 but now that the regulatory revisions are effective, there is an even stronger need to execute a robust research agenda broad consent.
One of the most obvious empirical questions is whether researchers and institutions will in fact seek to offer regulatory broad consent under the new rule's parameters, given the various concerns described above. Will investigators view the possibility of limited IRB review as worth the risk of losing the possibility of waiver of consent, and if so, under what circumstances? Will institutions undertake to build the infrastructure to support broad consent for identifiable data and biospecimens collected in clinical care and/or research? What are the most helpful (and unhelpful) use cases? Which types of institutions plan to go — or are already going — down this path, which have no intention of doing so, and why? What are the implications for the sorts of data and specimens for which researchers will be able to take advantage of limited IRB review, and do the sorts left out raise any ethical concerns?
For those institutions planning to offer and track broad consent, we need to understand how they are building their systems and at what cost. What can they learn from each other and what approaches are potentially scalable? How are new approaches to regulatory broad consent being incorporated into systems already in place to track old broad consents? Do IRB offices plan to incorporate additional requirements beyond those imposed by the new regulations, for example in the context of limited review, as recommended by SACHRP? How do they plan to interpret new regulatory provisions for waiver of informed consent for secondary research, and descriptively, when are they in fact allowing waiver? Are institutions incorporating staff and researcher training to answer patient and participant questions about broad consent? In what settings will they offer regulatory broad consent and are these contexts conducive to understanding, for example online or in person, at the first interaction with an institution (i.e., at the “front door”) or in the context of specific clinical or research encounters? Are they following SACHRP recommendations or taking a different approach on matters such as what counts as broad consent refusal and who is bound by it, how to describe future research, and explaining the status quo?
These questions should be addressed through both qualitative and quantitative research. Investigators in different settings and disciplines could be engaged in focus groups, interviews, and surveys to better understand what they understand regarding broad consent, their perspectives on its utility under the Final Rule, and any concerns, both practical and ethical. Different types of institutions should be surveyed to understand whether and how they are approaching regulatory broad consent and how it relates to their approach to consent waiver, from academic medical centers to community hospitals to physician offices to biobanks and repositories. Case studies might be a particularly valuable approach in this context to facilitate deep understanding of the practical challenges of undertaking this new regulatory option.
Another central empirical question is how the human sources of data and biospecimens will view broad consent under the Final Rule. There is a fair amount of data on preferences regarding the acceptability of broad consent compared to specific consent, but as noted above, the meaning of the previous findings is not entirely clear.109 We know that many individuals self-identifying as patients and submitting public comments on the proposed rule disfavored an approach that would have required some type of consent for all biospecimen research,110 but now that broad consent is only one regulatory option among many, would they encourage its use or favor waiver of consent where applicable? Moreover, we also know that members of the public who did not identify as patients — but who likely interact with the health system and whose data and specimens could be used for secondary research — had more mixed reactions regarding various approaches to consent.111 Analysis of public comments is helpful, but not scientifically sound as an empirical matter, given lack of representativeness among those who submit comments; motivation to submit suggests views at the relative extreme ends of the spectrum rather than the presumably vast body of individuals in the middle who do not particularly care how secondary research is carried out with data and specimens derived from them, or perhaps who do not know enough to care.
Overall, there is no sense of how individuals are likely to respond to broad consent with the specific elements enumerated in the Final Rule paired with limited IRB review. Will they value the opportunity to provide regulatory broad consent under these terms and be inclined to say yes, will they be concerned about the lack of protection that would have been offered by traditional IRB review, will they be upset by the fact that they still cannot withhold consent to the use of their de-identified data and specimens? How will different types of individuals differ in these views? For example, will their perspectives depend on whether data and specimens were collected from them in the context of clinical care, research, or some other setting? Can their perspectives be shaped through education and understanding regarding the public value of research with data and specimens, and if so, how can we be confident that such public value will accrue if IRBs conducting limited review are not considering it?
Overall, there is no sense of how individuals are likely to respond to broad consent with the specific elements enumerated in the Final Rule paired with limited IRB review. Will they value the opportunity to provide regulatory broad consent under these terms and be inclined to say yes, will they be concerned about the lack of protection that would have been offered by traditional IRB review, will they be upset by the fact that they still cannot withhold consent to the use of their de-identified data and specimens?
In addition to these questions, it will be informative to understand how institutions formulate regulatory broad consent templates under the new rule compared to approaches they may have taken in the past, and how these templates are viewed and understood by data and specimen sources. The SACHRP template was intended as one possible approach rather than the exclusive one; like many consent forms, the SACHRP template has shortcomings with regard to length, reading level, and other factors relevant to understanding, and that form may not adequately incorporate existing knowledge gleaned from various approaches to broad consent used in biobank research.Reference Beskow112 Nonetheless, given SACHRP's prominence in the research community and the anticipated attention to its suggested template within this community, that form may provide a useful starting point for a host of empirical research with different populations in different settings.
What do patients and research participants think of this template or others that meet the new regulatory requirements for broad consent? Do they understand the messages that are intended to be conveyed? What do they know about secondary research going into the process, what misconceptions do they have, are they better informed after reading the form, and what questions arise? What concerns do they have about research use of their identifiable data and bio-specimens and are they allayed by the form? Which components do they find most and least important to understand from an ethical perspective and which are most material to their ultimate decision? Are there any important points of information missing? Does the template raise fears, encourage broad consent, or simply reinforce prior beliefs? What influence will it have on trust in research? While many of these questions have already been the subject of some empirical study, SACHRP's approach of putting the broad consent decision into the context of other permissible regulatory approaches to secondary research may shed new and different light. Moreover, given that the specific regulatory disclosures required for broad consent under the Final Rule are new, additional empirical analysis will be important.
Overall, it is important to understand how likely people are to say yes – or no – when presented with a template of this nature. Data from cognitive interviews, focus groups, and surveys of patients and research participants from different demographic groups and institutional settings, paired with analysis of existing knowledge regarding both effective informed consent in general and for biobanks and data repositories specifically,Reference Flory and Emanuel113 could facilitate development of the best broad consent template most likely to support comprehension of relevant information, including adjustments for different contexts.
It is now a critical time to study these pressing research questions, as the regulated community is working to implement the Final Rule and momentum is strong. Empirical bioethicists and research funders should collaborate to facilitate evidence-based policy and practice around broad consent. NIH and other federal research funding agencies, as well as foundations and research institutions themselves, should consider earmarking money for research on the many questions surrounding the revised Common Rule and regulatory broad consent specifically, and should solicit proposals from the scientific community to carry out this work. These questions are not disease-or agency-specific, and grant and contract opportunities therefore optimally would be collaborative across institutions and wide-ranging. It is often difficult to secure funding for research on research and research oversight, especially when proposals must compete with clinical research that is probably more directly or immediately translatable to patient care. Nonetheless, research to support the research infrastructure and to promote trust in the research enterprise is essential in the sense that it can deliver benefits that will be multiplied across the many studies that rely on this system.
Conclusion
Nearly a decade in the making, the revised Common Rule is now a reality. Upon the brink of disaster for secondary research with specimens, regulators were convinced to leave the status quo largely intact, still permitting secondary research with de-identified data and specimens to continue outside the scope of Common Rule oversight and retaining a feasible option to waive consent for secondary research with identifiable data and biospecimens. Regulatory broad consent was, as described above, originally proposed as a replacement for de-identification, exemption, and consent waiver, intended to become the de facto required approach to secondary research with all biospecimens, prioritizing individual autonomy over more communitarian values. Under the Final Rule, however, regulatory broad consent is offered as a truly optional approach in the secondary research toolbox.
Whether broad consent ought to be used, with or without limited IRB review, is an important question. Given the potential public benefits of secondary research, the capacity to protect against risks using mechanisms other than consent, and the resources needed to implement a system of broad consent, should patients and research participants get to control how data and specimens derived from them will be used, simply because those data and specimens retain identifiers? Yet this normative question may be rendered moot if researchers and their institutions will not in fact offer broad consent due to practical and other considerations. Thus, in addition to clarifying what broad consent will actually entail within somewhat ambiguous regulatory parameters, it is important to examine what the research enterprise plans to do – and then to evaluate broad consent empirically from the perspective of key stakeholders: patients, research participants, researchers, health care institutions, and others. Reliance on evidence does not just make for good medicine, it makes for good policy.
