OHRP briefs FDA CDRH staff on Revised Common Rule, exemptions and surveillance carve-out

Yvonne Lau of the Office for Human Research Protections, speaking to staff from the FDA Center for Devices and Radiological Health’s Office of Science and Engineering Laboratories, reviewed how the Revised Common Rule defines research and human subjects, explained exemptions most relevant to device work, and described when institutions must hold federal-wide assurances to receive HHS funds.

Lau opened with a formal disclaimer: “the opinions expressed here are mine and do not necessarily represent those of the U.S. Department of Health and Human Services.” She outlined three diagnostic questions — is an activity research, does it involve human subjects, and is it exempt — and stressed investigators and institutions must apply the regulatory definitions in that order.

Why it matters: the answers determine whether projects trigger IRB review, informed-consent requirements and the need for an active federal-wide assurance (FWA) when HHS funds support nonexempt human-subjects research. Lau noted the revised Common Rule’s general compliance date was Jan. 21, 2019, meaning institutions may still be operating under pre-2018 rules for studies initiated earlier.

Key points Lau emphasized include the central role of identifiability: materials or data that investigators can “readily” link to individuals are human-subjects data; facial images and voice recordings are generally treated as identifiable, while some unique identifiers (she cited fingerprints as a conceptual example) may not be. She defined secondary research as use of data or biospecimens originally collected for clinical or other nonresearch purposes and explained when that secondary use is not human-subjects research (e.g., when the dataset is nonidentifiable).

Lau drew particular attention to two exemptions that frequently affect CDRH-funded work. Exemption 4 covers many secondary uses of identifiable information when data are recorded so identities cannot readily be ascertained and investigators will not reidentify or contact subjects; one of its provisions also covers uses governed by HIPAA. Exemption 2 covers educational tests, surveys, interviews and observations of public behavior, but it does not apply to surveys or interviews of children and may require a limited IRB review focused on privacy protections for sensitive identifiable data.

She also discussed the "public-health-surveillance" carve-out in the revised rule, which applies to activities “conducted, supported, requested, ordered, required, or authorized by a public health authority” when the activity directly informs public-health decisionmaking. Lau warned the carve-out’s scope is often ambiguous in practice and said agencies should develop internal policies before broadly applying it to CDRH work.

On institutional obligations, Lau said institutions receiving HHS funds for nonexempt human-subjects research must maintain an active FWA filed with OHRP; contractors conducting nonexempt research typically require their own FWA. She contrasted NIH intramural research (which is engaged and requires FWA) with some CDRH-funded projects that OHRP currently views as largely outside the Common Rule because of limited CDRH staff involvement or because data are nonidentifiable or otherwise exempt.

Practical guidance: Lau cited a 2006 OHRP guidance (interpreting 21 CFR 50.23(e)) and an OHRP draft guidance on surveillance (Nov. 2018) and pointed attendees to free OHRP training resources. She advised staff with questions to contact OHRP via the mailbox (ohrp@hhs.gov) or to consult FDA’s human-subjects protection executive (Bridget Foltz) and in-house counsel (Minerva) for harmonization and interpretation.

Following the briefing, CDRH staff thanked Lau, said they would distribute the recording and follow up internally before invoking the public-health-surveillance carve-out or altering procedures. The briefing concluded with no formal decisions or policies adopted during the meeting.