Healthcare Information Security

HIPAA and Compliance News

Common Rule’s Final Version Exempts Certain HIPAA Covered Entities

The federal government has issued the final rule for the Federal Policy for the Protection of Human Subjects, known as the Common Rule, that allows more secondary research of EHR data by exempting low-risk studies conducted by certain HIPAA covered entities.

Data Research

Source: Thinkstock

By Fred Donovan

- The federal government has issued the final rule for the Federal Policy for the Protection of Human Subjects, known as the Common Rule, that allows, among other things, more secondary research of EHR data by exempting low-risk studies conducted by certain HIPAA covered entities.

The revised Common Rule is designed to protect individuals who volunteer to participate in research, while reducing regulatory and administrative burdens for low-risk research.

In January of this year, the federal government issued an interim final rule delaying the date for the rule to take effect from January 19, 2018, to July 19, 2018. The delay was intended to give federal agencies more time to get additional input from interested stakeholders and to enable greater cooperation between the federal government and clinical research community

“While the additional time will allow federal officials and the clinical research community to develop a coordinated implementation strategy and much-needed guidance, it will be important that Common Rule provisions meant to improve the availability of data for secondary research, while strengthening protections for research participants proceed in a timely fashion,” commented Douglas Fridsma, president of the American Medical Informatics Association.

On April 20, 2018,  the federal government published a notice of proposed rulemaking seeking comments on whether to delay the compliance date another six months to January 21, 2019. The final rule issued June 19 adopts this additional delay. Federal departments and agencies are required to comply with the pre-2018 version of the Common Rule until then.

“The one exception to this general rule is that institutions will be permitted (but not required) to implement, for certain research, three burden-reducing provisions of the 2018 Requirements during the delay period (July 19, 2018, through January 20, 2019),” the final rule noted.

“Those three provisions are: the revised definition of ‘research,’ which deems certain activities not to be research covered by the Common Rule; the elimination of the requirement for annual continuing review with respect to certain categories of research; and the elimination of the requirement that institutional review boards (IRBs) review grant applications or other funding proposals related to the research,” the final rule added.

These provisions can be implemented during the delay period only for studies begun prior to January 21, 2019 that will transition to compliance with the revised requirements.

The changes to the Common Rule for secondary research enable low-risk medical studies, such as observational studies designed to find patterns in patient record to improve how procedures are performed.

Fridsma identified several changes that will benefit the clinical research community. The revised Common Rule:

• Makes changes to consent by requiring the most important information regarding a study to be explained clearly and concisely, and in a way that a “reasonable person” could understand

• Permits researchers to seek broad consent, which will help improve the availability of biospecimens and patient-reported data (including real-time data from mobile applications and devices) for secondary research

• Enables more secondary research of EHR data by exempting certain low-risk studies conducted by HIPAA covered entities

• Clarifies that certain public health surveillance activities are outside the scope of the Common Rule, so that the spread of disease can be more easily monitored

• Eliminates the need for continuing review for many studies, reducing administrative burden

• Provides a new option meant to help screening of potential participants, so patients who qualify for new treatments are more likely to learn about them.

The “compliance delay is a necessary step towards getting this critical research rule back on track,” said Fridsma.

The Secretary’s Advisory Committee on Human Research Protections (SACHRP) sent an April 11 letter to HHS Secretary Alex Azar directing two of its subcommittee to implement recommendations regarding the revised Common Rule.

The SACHRP Subcommittee on Harmonization is directed to identify and prioritize areas in which regulations or guidelines for human subject research adopted by HHS would benefit from “harmonization, consistency, clarity, simplification and/or coordination.”

The SACHRP Subpart A Subcommittee is directed to review and assess provisions of the Common Rule and related guidance documents issued by the Office for Human Research Protections.

The goals of the review and assessment are “(1) to enhance the protection of human subjects; (2) to reduce, where possible, regulatory burdens that do not contribute to the protection of subjects in a meaningful way; and (3) to promote scientifically and ethically valid research,” the letter explained.


SIGN UP and gain free access to articles, white papers, webcasts and exclusive interviews on

HIPAA Compliance
Data Breaches

Our privacy policy

no, thanks

Continue to site...