21st Century Cures Act: Broad Revisions to the Federal Regulation of Medical Research

I. Introduction

On Dec. 13, 2016, President Barack Obama signed into law the 21st Century Cures Act (“the Act”) intended to promote, facilitate, and streamline clinical research subject to federal oversight. The law contains extensive changes to the drug and device development programs administered by the Food and Drug Administration (“FDA”), as well as the clinical research programs regulated by the Department of Health and Human Services (“HHS”). An overarching objective of the Act is to foster medical product innovation by minimizing unnecessary and redundant administrative layers of review and by making publicly available clinical research data with protections for security and privacy. The Act’s broad reforms will affect a wide range of clinical research stakeholders, including drug and device manufacturers, hospitals, academic medical centers, universities and medical schools, institutional review boards (“IRBs”), and contract research organizations (“CROs”).

This article provides a brief analysis of the key provisions of the Act related to medical research, as well as potential implications and practical recommendations for stakeholders.

II. Summary of Key Clinical Research Provisions of the Act

A. Harmonizing FDA Human Subject Regulations and the Common Rule (Section 3023)

Section 3023 of the Act directs the HHS Secretary to harmonize differences between the HHS Human Subject Regulations (the Common Rule) ¹45 C.F.R. Part 46. and FDA Human Subject Regulations, ²21 C.F.R. Parts 50, 56, 312, and 812. except as prohibited by existing statute. Hospitals and medical centers engaged in federally funded research of FDA-regulated medical products at present must ensure compliance with both sets of authorities, which often requires multiple and potentially duplicative administrative review processes. The administrative resources required to adhere to two overlapping regulatory schemes may delay the commencement or conduct of research involving human subjects. Under the Act, the HHS Secretary is required to make modifications to the regulations as necessary to (i) reduce regulatory duplication and unnecessary delays; (ii) modernize FDA regulations and the Common Rule for multi-site and cooperative research projects; and (iii) protect vulnerable populations, incorporate local considerations, and support community engagement through mechanisms such as consultations with local researchers.

Further, the Act directs HHS to ensure that federally funded research of FDA-regulated products may use IRB review processes to help minimize unnecessary duplication, such as joint IRB review, IRB reliance agreements, and central ³As discussed below, the Act also removes a previous statutory hurdle to the use of central IRBs for FDA-regulated medical device studies. and independent IRBs. When developing rulemaking and guidance to carry out the provisions of Section 3023 of the Act, HHS must consult with stakeholders, including researchers; academic organizations; hospitals; IRBs; pharmaceutical, biotechnology, and medical device developers; clinical research organizations; and patient groups. By streamlining federal oversight of clinical research subject to the Common Rule and FDA requirements, the Act seeks to ease certain administrative burdens, resources, and delays in federally funded FDA-regulated research and simplify the federal requirements applicable to drug and device sponsors, clinical investigators, and IRBs.

B. Waiver or Alteration of Informed Consent for Minimal Risk FDA-Regulated Studies (Section 3024)

Before this Act, the most significant, and often most disruptive, difference between FDA human subject regulations and the Common Rule was the inability of IRBs to waive or alter informed consent for FDA-regulated research involving no more than minimal risk. Sponsors, investigators, and IRBs could not rely on the Common Rule’s authority for IRBs to waive or alter informed consent for minimal risk research that also was subject to FDA jurisdiction. FDA did not allow for such waiver or alteration of informed consent because the Federal Food, Drug, and Cosmetic Act (“FD&C Act”) limited the exceptions from informed consent for research subject to the investigational new drug application (“IND”) ⁴Previous Section 505(i)(4) of the FD&C Act. or investigational device exemption (“IDE”) regulations. ⁵Previous Section 520(g)(3)(D) of the FD&C Act. For drug studies subject to FDA’s investigational new drug application (“IND”) requirements, informed consent could be waived or altered only when “it is not feasible or it is contrary to the best interests of such human beings”; ⁶Previous Section 505(i)(4) of the FD&C Act. whereas for device studies subject to FDA’s investigational device exemption (“IDE”) requirements, the FD&C Act set a narrower exception for informed consent, only allowing waiver or alteration when the subject faces a “life threatening situation” that “necessitates the use of such device and it is not feasible to obtain informed consent from the subject and there is not sufficient time to obtain such consent from his representative.” ⁷Previous Section 520(g)(3)(D) of the FD&C Act. Consistent with these statutory authorities, FDA promulgated regulations that only permit waiver for emergency research, ⁸See 21 C.F.R. §50.24. certain life-threatening situations, ⁹See 21 C.F.R. §50.23(a)-(c). military operations, ¹⁰See 21 C.F.R. §50.23(d). or public health emergencies. ¹¹See 21 C.F.R. §50.23(e).

The Act, however, has now broadened the FD&C Act provisions for IDE and IND studies to allow expressly an IRB to waive or alter informed consent requirements for clinical investigations involving no more than “minimal risk,” so long as appropriate safeguards are in effect to protect the rights, safety, and welfare of the subject. The Act does not identify the safeguards that must be promulgated, but FDA may adopt in whole, or in large part, the protections contained in the Common Rule. Those include: (i) the research involves no more than minimal risk to the subjects; (ii) the waiver or alteration will not adversely affect the rights and welfare of the subjects; (iii) the research could not practicably be carried out without the waiver or alteration; and (iv) whenever appropriate, the subjects will be provided with additional pertinent information after participation. ¹²45 C.F.R. §46.116(d).

The Act partially codifies FDA’s longstanding policy of exercising enforcement discretion with respect to informed consent requirements for research on in vitro diagnostic (“IVD”) tests using leftover de-identified human specimens. ¹³FDA Guidance on “Informed Consent for In Vitro Diagnostic Device Studies Using Leftover Human Specimens that are Not Individually Identifiable” (April 2006) (“Leftover Specimen Guidance”). Whereas FDA’s enforcement discretion policy applies only to previously collected specimens that have been de-identified, and does not require a finding that the study involve no more than minimal risk, ¹⁴FDA’s policy of enforcement discretion announced in the Leftover Specimen Guidance applies only when (i) the study is IDE-exempt under 21 C.F.R. §812.2(c)(3); (ii) the study uses leftover specimens, that is, remnants of specimens collected for routine clinical care or analysis that would have been discarded; (iii) the specimens are not individually identifiable, i.e., the identity of the subject is not known to and may not readily be ascertained by the investigator or any other individuals associated with the investigation, including the sponsor; (iv) the specimens may be accompanied by clinical information as long as this information does not make the specimen source identifiable to the investigator or any other individual associated with the investigation, including the sponsor; (v) the individuals caring for the patients are different from and do not share information about the patient with those conducting the investigation; (vi) the specimens are provided to the investigator(s) without identifiers and the supplier of the specimens has established policies and procedures to prevent the release of personal information; and (vii) the study has been reviewed by an IRB. IVD manufacturers and researchers may rely on the Act’s provision for prospective, identifiable biospecimen collection and IVD research that only presents minor informational risks to subjects.

C. Central IRBs for Medical Device Studies (Section 3056)

Section 3056 of the Act removes the statutory requirement in the FD&C Act that medical device clinical investigations be overseen by a “local” IRB. ¹⁵Section 520(g)(3)(A)(i) of the FD&C Act. By omitting the statutory mandate that FDA-regulated device studies be reviewed by a local IRB, the Act creates consistency among all FDA-regulated medical products to allow for central IRB review and approval of FDA-regulated multi-site research. In 2006, FDA issued a guidance to encourage central IRB use in drug and biological product studies, but device studies were excluded from the scope because of the prior statutory provision. ¹⁶See FDA Guidance on “Using a Centralized IRB Review Process in Multicenter Clinical Trials” (March 2006).

Oversight by a central IRB, in contrast to review and approval by multiple local IRBs, may minimize unnecessary administrative burdens, costs, and delays associated with multi-site clinical studies that may not enhance human subject protections. As described above in Section 3023, the Act affirms the role of community values and local input in the review and approval of multi-site research. Local IRBs may still provide the central IRB with input regarding local considerations, such as community values especially with respect to vulnerable populations. While the Act does not mandate the use of central IRBs, the National Institutes of Health (“NIH”) recently issued a final policy establishing the expectation that multi-site, non-exempt human subject research funded by NIH and carried out at more than one site in the United States use a single IRB. ¹⁷See “Final NIH Policy on the Use of a Single Institutional Review Board for Multi-Site Research,” Notice No. NOT-OD-16-094, effective May 25, 2017 (June 21, 2016).

D. Beau Biden Cancer Moonshot and NIH Innovation Projects (Section 1001)

Under the Act, NIH will expand its funding of high-risk research that has the potential to lead to medical breakthroughs through approximately $4.8 billion in investment over the next ten years in certain initiatives (the “NIH Health Innovation Account”). Of the $4.8 billion, the Act designates $1.8 billion for Vice President Joe Biden’s Cancer Moonshot program to accelerate cancer research, including the development of cancer vaccines, more sensitive diagnostic tests for cancer, immunotherapy, and the development of combination therapies. The Act also allocates $1.5 billion for President Obama’s Precision Medicine Initiative, which focuses on individualized treatment approaches at the intersection of lifestyle, environment and genetics. Approximately $1.5 billion is designated for the Brain Research Through Advancing Innovative Neurotechnologies Initiative, which is a collaborative, public-private research initiative, to help support the development and application of innovative technologies that are intended to lead to breakthroughs in how brain disorders are prevented, treated, and cured. Further, $30 million is earmarked for NIH, in coordination with FDA, to award grants and contracts to clinical research to advance the field of regenerative medicine using adult stem cells, including autologous stem cells, on the condition that the recipient makes available non-federal contributions toward the cost of such research in an amount not less than one dollar for each dollar of federal funds provided in the award.

E. Reducing Administrative Burdens for Researchers (Section 2034)

The Act further aims to reduce federal regulatory burdens on researchers by directing the HHS Secretary to lead a review by research funding agencies of all regulations and policies related to the disclosure of financial conflicts of interest (“FCOIs”). Reporting of FCOIs is required for research funded by the National Science Foundation and U.S. Public Health Service (the “PHS”), which includes HHS and NIH under the PHS umbrella. ¹⁸60 Fed. Reg. 35,810 (July 11, 1995).^,
1942 C.F.R. Part 50, Subpart F. Under the FCOI rules, institutions that receive funding under grants or cooperative agreements must identify and report FCOIs in an effort to promote objectivity in research and establish standards that provide a reasonable expectation that the design, conduct, and reporting of research will be free of bias resulting from investigator FCOIs.

The Act mandates HHS revise, as appropriate, existing guidance and regulations to reduce administrative burdens on researchers associated with FCOI reporting while continuing to preserve the integrity and credibility of research findings and the protections of human subjects that these disclosures are intended to afford. To this end, it directs HHS to rethink various aspects of these requirements, including the minimum threshold for reporting FCOIs. In revising its policies, HHS must consider, in particular, (i) modifying the timelines for reporting FCOIs to “just-in-time” information by institutions receiving funding from NIH; (ii) ensuring that FCOI reporting requirements are appropriately aimed at awards that directly fund research, which may include modification of the definition of the term “investigator” (thereby altering the scope of who must make these disclosures); and (iii) updating applicable training modules of NIH related to FCOI disclosure. It may well be, under this directive of the Act, that at last there will be harmonization of the now widely divergent financial disclosure thresholds and standards of PHS (including NIH and the Centers for Disease Control and Prevention) on the one hand, and FDA, on the other.

In addition to alterations to the FCOI disclosure requirements, the Act further aims to reduce burdens on researchers by requiring the NIH Director to implement measures to reduce the monitoring obligations of primary NIH grant awardees. Primary awardees receiving NIH grant funding are responsible not only for monitoring and reporting of grant-supported activities under their own direct control, but also the grant activities of subrecipients if they use such entities to carry out some or all of their obligations under an NIH grant. ²⁰NIH Grants Policy Statement, Part II, Subpart B, Section 8.4. To reduce the administrative burden associated with the indirect monitoring of subrecipients, the Act requires the NIH Director to assess and implement measures like alternative grant structures that would remove the need for subrecipients altogether by replacing them with collaborative grant models that allow for multiple primary awardees. The NIH Director may also approve an exemption from subrecipient monitoring requirements altogether, provided that (i) the subrecipient is subject to Federal audit requirements pursuant to the Uniform Guidance, ²¹2 C.F.R. Part 200, Subpart F. and (ii) the primary awardee conducts a pre-award evaluation of each subrecipient’s risk of noncompliance. Any exemption, however, would not absolve the primary awardee of liability for misconduct by subrecipients. These provisions may have the greatest impact on primary awardees that operate internationally, with ex-U.S. subrecipients/subawardees that most often lack the FCOI infrastructure and internal policies required to receive PHS research funding.

Finally, the Act requires the FDA Commissioner, the HHS Secretary and the Secretary of Agriculture to review and revise regulations and policies governing the care and use of laboratory animals to reduce the administrative burden on investigators. To achieve these aims, the Act obligates the NIH Director to identify ways to ensure that regulations and policies are not inconsistent or unnecessarily duplicative, especially with respect to inspection and review requirements by Federal agencies and accrediting associations.

F. Collaboration and Coordination to Enhance Research (Section 2038)

The Act encourages collaboration among NIH-funded clinical research projects to allow for larger and more diverse pools of subject data, particularly with respect to biological, social, and other determinants of health that contribute to health disparities. The Act directs NIH, when assessing research priorities, to consider data from studies funded or conducted at institutes and centers of NIH, which include study populations of women, minority groups, and relevant age categories (including pediatric subgroups). These data will be disaggregated by research area, condition, and disease category and made publicly available on an NIH website. This provision also modifies the reporting obligations for institutes and centers of NIH, requiring triennial (instead of biennial) reports prepared by an advisory council at each NIH institute, which must include information regarding the participation of women and minority groups in clinical research studies.

G. Accessing, Sharing, and Using Health Data for Research Purposes (Section 2063)

The Act requires HHS to issue guidance clarifying that the Health Insurance Portability and Accountability Act (“HIPAA”) Privacy Rule provision that prohibits the removal of protected health information (“PHI”) by a researcher ²²45 C.F.R. §164.512(i)(1)(ii)(B) (“No protected health information is to be removed from the covered entity by the researcher in the course of the review”). does not apply to a researcher’s remote access of health information for research purposes, so long as security and privacy safeguards, consistent with the HIPAA Privacy Rule, are maintained and the PHI is not copied or otherwise retained by the researcher. The Act also requires HHS to issue guidance to clarify the circumstances under which a HIPAA authorization for the use or disclosure of PHI for future research purposes contains a sufficient description of the use or disclosure. In particular, the guidance will include criteria for determining whether a HIPAA authorization for future research purposes is sufficient based on its (i) description of the purposes for which the PHI could be used or disclosed, (ii) statement that the authorization will expire on a particular date or on the occurrence of a particular event, and (iii) disclosure of how the individual may revoke authorization at any time.

The Act also requires HHS to convene a working group to study and report on whether the uses and disclosures of PHI for research purposes under HIPAA should be modified to allow greater availability of PHI while protecting individuals’ privacy rights.

H. Privacy Protection for Human Research Subjects (Section 2012)

The Act greatly strengthens and clarifies the granting, use, and effectiveness of certificates of confidentiality (“CoC”), whose exact legal effects have heretofore seemed elusive. ²³See Leslie E. Wolf et al., Certificates of Confidentiality: Protecting Human Subject Research Data in Law and Practice, 14:1 Minn. J. L. Sci. & Tech 11 (2013). To accomplish this, the Act creates a new category of PHI for “identifiable sensitive information” (“ISI”) collected in the course of biomedical, behavioral, clinical, or other research studies, including research on mental health and the use and effect of alcohol and psychoactive drugs. The Act defines ISI to mean information gathered in the course of research (1) through which an individual is identified, or (2) for which there is at least a very small risk, as determined by current scientific practices or statistical methods, that some combination of the information, a request for information, and other available data sources could be used to identify the individual. ²⁴The standard is similar to the expert determination method for de-identification of PHI under HIPAA (“A person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable: (i) Applying such principles and methods, determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual who is a subject of the information; and (ii) Documents the methods and results of the analysis that justify such determination” (45 C.F.R. §164.514(b)(1)). When federally funded research involves ISI, the Secretary of HHS will be required to issue a CoC, and may issue a CoC upon request to researchers engaged in non-federally funded research involving ISI. Researchers issued CoCs will be prohibited from disclosing ISI except in limited circumstances, including (i) when required by law; (ii) when necessary for the medical treatment of the individual; (iii) with consent of the individual; or (iv) for purposes of other scientific research in compliance with applicable federal regulations governing the protection of human subjects. Notably, under the Act, a CoC will prevent a researcher from disclosing ISI created or compiled for a research purpose in connection with any federal, state, or local civil, criminal, administrative, legislative, or other proceeding without the individual’s consent, and ISI will not be admissible as evidence or permitted to be used for any purpose in any lawsuit or other judicial, lawmaking, or administrative proceeding without the individual’s consent. The protections afforded by the Act extend indefinitely. The provision does not limit a research subject’s access to his or her information collected during participation in research. By enhancing the availability and legal force of the CoC, the Act is intended to increase data privacy protections and facilitate participation in research involving the collection of sensitive information.

I. Protection from FOIA Disclosure of Identifiable Research Information (Section 2013)

The Act strengthens privacy protections by allowing HHS to exempt from disclosure under the Freedom of Information Act (“FOIA”) ²⁵5 U.S.C. §552(b)(3). certain biomedical information about an individual collected or used during medical research. The exemption from FOIA disclosure would apply to information that identifies an individual or for which there is even a “very small risk” that the data could be used to identify the individual. Any HHS determination to exempt identifiable research information from disclosure must be made in writing, be accompanied by a statement of the basis for the determination, and be made available to the public in response to a FOIA request.

J. Promoting Research Data Sharing (Section 2014)

To facilitate greater sharing of research data generated from federal funding, the Act allows NIH to require grant recipients to share, to the extent feasible, scientific data generated from NIH grants. Such data sharing must be consistent with all applicable federal laws and regulations, including laws protecting human research participants with respect to privacy, security, informed consent, and PHI, as well as protecting proprietary interests, confidential commercial information, and intellectual property rights of the funding recipient. The data sharing provision is consistent with the broader federal initiative to make clinical research results publicly available, for example, through reporting certain study data on www.clinicaltrials.gov. ²⁶See, e.g., 42 C.F.R. Part 11 Subpart C.

K. Increased Inclusion of Underrepresented Populations in Clinical Trials (Section 2044)

The Act encourages the National Institute on Minority Health and Health Disparities to include within its strategic plan ways to increase enrollment of underrepresented populations in clinical research. FDA also has been heavily involved in efforts to increase diversity in clinical trials, including issuing a report on the inclusion of demographic subgroups in clinical trials supporting medical product applications ²⁷See FDA Report on the Collection, Analysis, and Availability of Demographic Subgroup Data for FDA-Approved Medical Products (August 2013) (available at http://www.fda.gov/downloads/RegulatoryInformation/Legislation/SignificantAmendmentstotheFDCAct/FDASIA/UCM365544.pdf). and bolstering programs administered by FDA’s Office of Minority Health and Office of Women’s Health. ²⁸See, e.g., FDA’s Webpage on Diversity in Clinical Trial Participation (available at http://www.fda.gov/ForPatients/ClinicalTrials/ucm407817.htm).

L. Novel Clinical Trial Designs (Section 3021)

The Act requires FDA to issue guidance addressing the use of complex adaptive and other novel trial designs in the development and approval of drugs or licensure for biological products. The guidance will address how novel trial designs help to satisfy the new drug application (“NDA”) substantial evidence standard, ²⁹Section 505 of the FD&C Act. how sponsors may obtain feedback on technical issues related to modeling and simulations, the types of quantitative and qualitative information that should be submitted for review, and recommended methodologies. This provision, which builds on FDA’s 2010 draft guidance on “Adaptive Design Clinical Trials for Drugs and Biologics,” is consistent with the Act’s intent to modernize and make more efficient clinical trials to support FDA’s regulatory decision-making.

M. Posting Expanded Access Policies for Investigational Drugs (Section 3032)

The Act also requires manufacturers and distributors of investigational drugs intended to diagnose, monitor, or treat a serious disease or condition to post publicly their expanded access policy. The public posting must be readily available, such as on an Internet website. The posting must include, among other information, the firm’s contact information, requesting procedures, and the criteria used to evaluate requests. However, the posting does not guarantee a patient access to an investigational product under the firm’s policy. The Act would broaden recent legislation that required expanded access policies to be posted on www.clinicaltrials.gov for certain studies. ³⁰See 42 U.S.C. §282(j)(2)(A)(ii)(II)(gg).

III. Conclusion

Broadly, the Act aims to foster and facilitate medical product innovation through numerous changes to laws that govern FDA programs, clinical research regulations, and Medicare coverage and reimbursement rules. The Act’s research-related provisions likely will reduce administrative overlap and inconsistency in the rules governing federally funded, FDA-regulated medical research. Through encouragement of central IRBs, streamlined investigator responsibilities, and harmonized federal oversight schemes, most importantly regarding researcher financial conflicts of interest, the Act is expected to minimize administrative delays and unnecessary resource burdens. The Act also seeks to promote participation in clinical research by establishing protections for sensitive and identifiable health information, as well as understanding ways to increase enrollment for diverse study subjects. Overall, we anticipate that once implemented, the Act should confer significant benefits on drug and device sponsors, researchers, IRBs, institutions, and CROs in conducting clinical trials with more efficiency and allowing for more focus on data integrity and human subject protections, including privacy safeguards.