ERMIQ 1305 Due in 24 Hours

human subject protection • summer 2019 213
The Journal of Law, Medicine & Ethics, 47 (2019): 213-231. © 2019 The Author(s)
DOI: 10.1177/1073110519857277

Implementing
Regulatory
Broad Consent
Under the
Revised
Common Rule:
Clarifying Key
Points and
the Need for
Evidence
Holly Fernandez Lynch, Leslie E.
Wolf, and Mark Barnes

F
or decades, researchers have relied on biospeci-
mens and data leftover after collection for other
purposes to make important scientific and med-

ical advances1 — and the law has afforded a number of
mechanisms to facilitate such “secondary” research,
often without consent from the human sources from
whom the specimens or data were derived. At the start
of the twenty-first century, however, the previously
arcane issue of aconsensual secondary research began
to gain public prominence. For example, in 2004,
members of the Havasupai Tribe brought a lawsuit
against Arizona State University alleging that blood
samples originally provided for research on diabetes
had been used without their knowledge or consent for
other types of genetic studies, including those expos-
ing tribe members to stigma regarding mental illness
and challenging their deeply held beliefs regarding
tribal ancestry.2 In 2009, parents in Texas filed suit
claiming research use of leftover blood spots from
their newborns’ mandatory public health screenings
was a violation of liberty and privacy rights, as well
as the right against unreasonable search and seizure;3
parents in other states have done the same.4 In both
the Havsupai and blood spot litigation, resulting
settlements entailed the removal of remaining speci-
mens from research use, either through destruction5
or return.6 The debate about newborn blood spots also
resulted in responsive legislation at both state and fed-
eral levels.7

These examples received national news coverage,
but the greatest public awakening regarding biospeci-
men research is probably traceable to the bestselling
book, The Immortal Life of Henrietta Lacks, published
in 2010.8 The book tells the story of a young African
American woman, Henrietta Lacks, who received
treatment for cervical cancer at Johns Hopkins in the
1950s, and died shortly thereafter. Cells collected from
a biopsy of Lacks’s tumor were cultured without her
knowledge or permission, and additional cells may
have been collected specifically for research purposes.
The cells were cultivated into a self-perpetuating cell
line, dubbed “HeLa,” which became the most valuable

Holly Fernandez Lynch, J.D., M.Be., is the John Russell
Dickson, MD Presidential Assistant Professor of Medical Eth-
ics and Assistant Faculty Director of Online Education in the
Department of Medical Ethics and Health Policy at the Perel-
man School of Medicine, University of Pennsylvania. Leslie
E. Wolf, J.D., M.P.H., is Professor of Law and Distinguished
University Professor at Georgia State University. She has ap-
pointments in the School of Public Health and College of Law,
where she directs the Center for Law, Health & Society. Mark
Barnes, J.D., LL.M., is Partner at Ropes & Gray LLP in
Boston, MA, and co-chair of the Multi-Regional Clinical Tri-
als Center of Harvard University and Brigham and Women’s
Hospital. He is also Visiting Lecturer at Yale Law School.

http://crossmark.crossref.org/dialog/?doi=10.1177%2F1073110519857277&domain=pdf&date_stamp=2019-07-12

214 journal of law, medicine & ethics

S Y M P O S I U M

The Journal of Law, Medicine & Ethics, 47 (2019): 213-231. © 2019 The Author(s)

cell line in history, leading to breakthroughs in can-
cer research and therapy, among many other scientific
and clinical advances. Lacks’s surviving family mem-
bers, however, shared neither recognition nor profits
from these advances. The story struck many reading
Skloot’s book as a grave injustice. Yet federal regula-
tions governing research use of biospecimens and data
do not require profit sharing and have long allowed —
and still allow — secondary research to be conducted
without consent so long as the researchers lack access
to identifying information, as well as in a number of
other circumstances.9

Importantly, increasing public awareness of biospec-
imen research has not occurred in a vacuum. Instead,
it has arisen in an era of both increasing deference to
individualism and patient autonomy and recognition
of concerns about the privacy of data collected on the

internet,10 in consumer settings, and in the context of
medical care. In addition to data breaches and misuse,
privacy limitations have been further demonstrated
by efforts in which researchers have been able to use
publicly available information to re-identify individu-
als from datasets that appeared, on first impression,
to have been de-identified by removal of typical iden-
tifiers, such as name, Social Security number, and
address.11

It was against this backdrop of controversial cases,
broader cultural developments, and technologi-
cal advances — alongside emerging empirical data
on public opinion regarding consent to secondary
research12 — that major changes were proposed to the
regulations governing secondary research with bio-
specimens and data, as described in detail below. Fol-
lowing a 2011 Advance Notice of Proposed Rulemak-
ing,13 the terms set forth in the 2015 Notice of Proposed

Rule Making (NPRM) “to modernize, strengthen, and
make more effective the Federal Policy for the Protec-
tion of Human Subjects,”14 i.e., to revise the “Common
Rule,” would have severely limited the conditions in
which biospecimens could be used in federally-funded
research without consent from their human sources.
The proposed changes were rooted in the regulators’
perception that “people want to be asked for their per-
mission” for such research and that consent is there-
fore essential to trust in the research enterprise.15
However, that proposal was met with piercing oppo-
sition from researchers, research institutions, and
patients,16 fearful of what the change would mean for
medical progress.

The final revised Common Rule stepped back from
this precipice. Promulgated on the last day of Presi-
dent Obama’s term in January 2017, with an effective

date of July 21, 2018, and a general compliance date
of January 21, 2019,17 the Final Rule largely retains
the pre-2018 status quo allowing several approaches
to secondary research use of biospecimens and data
without consent from their human sources. It also
adds to the regulatory repertoire a new consent option
intended as a compromise to facilitate research using
identifiable materials: “regulatory” broad consent.18
This new option — distinct from the “general” broad
consent sometimes used under the pre-2018 rule, as
described below — is rife with questions. Most impor-
tantly, will it be used, and if so, how can potential
vulnerabilities be minimized? Will biospecimen and
data sources — patients, research participants, others
— understand what regulatory broad consent means,
and will they ultimately be willing to provide it?

This article addresses the provenance of the revised
Common Rule’s regulatory broad consent option

This article addresses the provenance of the revised Common Rule’s regulatory
broad consent option for secondary research with identifiable biospecimens

and identifiable data, what it entails, and what questions the regulations
leave unanswered. It then describes and analyzes recommendations offered
by the U.S. Department of Health and Human Services Secretary’s Advisory
Committee on Human Research Protections (SACHRP) to clarify this new
option, including the logistics that will need to be put into place in order to

implement regulatory broad consent and how to clarify its meaning to those
asked to provide it. Finally, the article concludes with the start of a research
agenda around regulatory broad consent, outlining a number of questions

about which we ought to seek robust empirical data.

human subject protection • summer 2019 215

Lynch, Wolf, and Barnes

The Journal of Law, Medicine & Ethics, 47 (2019): 213-231. © 2019 The Author(s)

for secondary research with identifiable biospeci-
mens and identifiable data, what it entails, and what
questions the regulations leave unanswered. It then
describes and analyzes recommendations offered by
the U.S. Department of Health and Human Services
Secretary’s Advisory Committee on Human Research
Protections (SACHRP) to clarify this new option,19
including the logistics that will need to be put into
place in order to implement regulatory broad consent
and how to clarify its meaning to those asked to pro-
vide it. Finally, the article concludes with the start of
a research agenda around regulatory broad consent,
outlining a number of questions about which we ought
to seek robust empirical data.

Regulatory Revisions
When researchers carry out their studies, the data they
collect from participants may also be useful for future,
distinct analyses. They might also collect biospecimens
for research purposes, either specifically for a research
repository or for a hypothesis-driven protocol in which
some specimens may be leftover once primary research
uses are complete. Specimens collected in clinical care
and left over after their clinical use also may be useful
for research, and clinical data such as patient health
records can offer insight into a range of research
questions. There are also vast troves of data collected
about us in everyday life,20 which may be of interest
to researchers: our Google searches, AppleWatch data,
credit card transactions, geotracking, and much more.
Importantly, it is only when entities use federal fund-
ing to conduct research with biospecimens and data
that the uses might fall within the purview of the Com-
mon Rule;21 that will be our focus here.

The Old Rule
When data and specimens were originally collected for
a purpose other than the present research, the pres-
ent research use is described as secondary. Under the
pre-2018 Common Rule (i.e., “the Old Rule”), whether
secondary research with data and specimens was reg-
ulated as human subjects research depended entirely
on whether the data and specimens were identifiable.
The Old Rule defined “human subject” to include
a “living individual about whom an investigator …
conducting research obtains” either “data through
intervention or interaction with the individual” or
“identifiable private information.”22 Because second-
ary research involves no intervention or interaction
with an individual, given that the data or specimens
are leftover from other uses, it fell under the Old Rule
only if the data or specimens included or were associ-
ated with identifiable private information about their
source.

This meant that if researchers stripped identifiers
from the data or specimens they sought to use for
secondary research, or received coded data or speci-
mens without identifiers accessible to them,23 their
secondary research would not be subject to regula-
tory requirements under the Old Rule at all, avoiding
both the requirements for approval and oversight by
an Institutional Review Board (IRB) and for informed
consent. Researchers might also have avoided these
requirements even if they retained identifiers, for
example if their research satisfied the Old Rule’s crite-
ria for regulatory exemption by using existing publicly
available data or specimens or not recording identi-
fiers from identified materials.24 On a third pathway
available under the Old Rule, non-exempt secondary
research with identifiable data or identifiable speci-
mens was subject to IRB review and approval, but
the IRB could waive consent from the source under
certain conditions — namely, that the research posed
no greater than minimal risk, consent waiver would
not adversely affect subject rights and welfare, the
research could not practicably be carried out without
a waiver of consent, and subjects would be debriefed
as appropriate.25

The key takeaway here is that, under the Old Rule,
IRB approval and informed consent would be required
only if the secondary research with data or specimens
involved the retention of identifiers accessible to the
researchers, failed to satisfy the terms of any regulatory
exemption, and failed to satisfy the criteria for consent
waiver. In this case, the required consent could entail
a specific new request for the subject to permit use of
his or her data or specimens in the current research
(i.e., “specific consent”). Alternatively, an IRB could
determine that consent to future uses of identifiable
data or specimens obtained at the time they were orig-
inally collected was sufficient to allow the secondary
research use currently proposed, without any addi-
tional consent specific to that current use and without
waiver of consent. This was a type of de facto general
consent that we will refer to as “old broad consent” to
distinguish it from the unique category of regulatory
broad consent contemplated under the revised Com-
mon Rule and discussed below. Old broad consent was
not explicitly recognized by the regulations, but it was
widely used in practice, especially for data and speci-
mens collected in previous research.

Considering Change
Ultimately, the Old Rule allowed secondary research
to be carried out without consent under a wide range
of circumstances. This approach promoted scientific
advancement and public benefit26 by imposing few
hurdles for researchers, acknowledging that it could

216 journal of law, medicine & ethics

S Y M P O S I U M

The Journal of Law, Medicine & Ethics, 47 (2019): 213-231. © 2019 The Author(s)

be difficult or impossible to find the sources of speci-
mens and data to seek their consent for secondary
research if adequate old broad consent had not been
previously secured, and that failure to reach all sources
and secure new consent could lead to scientific bias.
If risks to data and specimen sources from second-
ary research were substantial, requiring researchers
to navigate these hurdles might be appropriate, but
when identifiers are not retained, shared, or recorded,
the privacy risks to data and specimen sources are low.
Moreover, even if identifiers are retained, there are
other ways to protect sources aside from seeking their
consent, including IRB oversight and implementa-
tion of robust privacy and confidentiality protections.
Given the high scientific value and low risk to sources,
permitting secondary research without consent in
the circumstances allowed by the Old Rule was sup-
ported by the principles of beneficence and justice,
often appropriately outweighing potential autonomy
interests.27

Nonetheless, as a number of high-profile cases drew
attention to the status quo, it became evident that
some people were or would be surprised to learn that
data and specimens derived from them were being
used in research without first obtaining their specific
permission. To the extent that people expect to be
asked for permission for secondary research use, there
was concern that the status quo could lead to mistrust
in and reduced support for the research enterprise.28
In addition, some believe that autonomy interests
should prevail over other values, asserting that sources
should have the authority to control “their” data and
specimens — even if the data and specimens are not
identifiable and even if there are no physical risks and
low privacy risks — on grounds that they ought to be
able to direct their materials to research most impor-
tant to them and refuse support to research that may
run against their fundamental values.29 Moreover,
some reject the notion that risks are low, pointing to
increasing possibilities that even de-identified data
and specimens can be re-identified30 and noting that
individually de-identified materials may nonetheless
lead to harm for identified groups, such as stigmatiza-
tion, as occurred for the Havasupai Tribe.31 There are
also potential concerns regarding cultural and reli-
gious beliefs about the nature of specimens and their
relation to the body.

Although considering public opinion in matters
of research regulation is clearly important, the right
approach to secondary research with data or speci-
mens is not necessarily best determined by reference
to public opinion, or at least to public opinion alone.
This is true for several reasons. First, it may be dif-
ficult to discern what the public’s opinion actually is.

For example, based on a review of the empirical lit-
erature, Grady et al. concluded that people “want to
decide whether or not their biospecimens are used
for research.” However, they also concluded that most
people do not care about the specific details of future
research, such as the disease studied, technology used,
study target, or product — although they may care
in specific controversial contexts, including research
involving human cloning, indigenous peoples, or
commercial uses and profit.32 In contrast, Rivera
and Aungst concluded on the basis of their literature
review that “donors want control over their own speci-
mens and results, while being ensured privacy and
confidentiality … They either want to dictate up-front
the specific types of research that can use their speci-
mens, or they expect to be contacted and re-consented
every time another study or researcher wants to use
their samples.”33

Beskow examined the selected literature cited by the
regulators in proposed changes to the Common Rule to
support the contention that “a growing body of survey
data show that many prospective participants want to
be asked for their consent before their biospecimens
are used in research.”34 She concluded that the data
“actually provide a highly complex picture that does
not necessarily fit the proposed regulations.”35 This is
because the data represent perspectives from dispa-
rate stakeholders, asked about different kinds of bio-
banks, and presented different options from which to
select their preference — but often not exploring the
option of “no consent.” With regard to other available
literature regarding attitudes toward biobanking and
consent, Beskow explains that “the same challenging
picture emerges.”36

Part of the problem is that specifics matter. Public
opinion probably would be vastly different if asked a
question like “Can we use your data and specimens in
the future for whatever we want?” versus “Can we used
your data and specimens in a low risk way for future
research that will be socially beneficial but that might
not be feasible if we needed to seek your consent for
each specific use?” This relates to the second prob-
lem, which is that the scientific research enterprise is
complex, and a large proportion of the public lacks a
robust understanding of how it works, including the
potential trade-offs of a more stringent approach to
secondary research.37 As Beskow notes, “[w]hat indi-
viduals might prefer … is not the same as what they
might find acceptable, once they are aware of the risks,
benefits, costs, and trade-offs at stake for the array of
interests they would like to see advanced.”38 Public
education on these issues should be an important pri-
ority,39 but in the face of misunderstandings or lack of

human subject protection • summer 2019 217

Lynch, Wolf, and Barnes

The Journal of Law, Medicine & Ethics, 47 (2019): 213-231. © 2019 The Author(s)

awareness, public opinion should not be the exclusive
driver of policy choices.

Third, and finally, “the public” is not homogenous.
As we ultimately saw in public comments on Com-
mon Rule proposals, different types of people want
different things from the regulation of secondary
research.40 Even if one group prefers a more auton-
omy-centered approach, the preferences and inter-
ests of other groups, including patients who stand to
benefit from streamlined approaches to secondary
research, may matter more.41 Indeed, even though
some defined groups may be more suspicious than the
general public of unconsented secondary research due
to fear of stigmatization and harm, other groups, such
as disease advocacy and public health groups, may
insist that aconsensual secondary research be widely
deployed, to expedite disease treatments and address
pressing public health problems.

The Proposed Rule
Despite limitations on the utility of public opinion in
these contexts, the 2015 NPRM to amend the Com-
mon Rule proposed sweeping changes to the regula-
tion of secondary research with data and specimens
on the grounds that “people want to be asked their
permission”42 and that “continuing to allow second-
ary research with biospecimens collected without con-
sent for research places the publicly-funded research
enterprise in an increasingly untenable position
because it is not consistent with the majority of the
public’s wishes, which reflect legitimate autonomy
interests.”43 Overall, the NPRM proposed to treat sec-
ondary research with data and secondary research
with specimens divergently, largely making secondary
research with data easier but imposing considerable
constraints on secondary research with specimens,
despite the fact that both raise similar issues of auton-
omy, beneficence, and justice.44

Most importantly, the NPRM proposed to revise
the Common Rule’s definition of “human subject” to
include all biospecimens, regardless of identifiabil-
ity.45 If all biospecimens were human subjects, then it
would no longer be possible to avoid Common Rule
requirements by stripping specimens of identifiers
before their use in secondary research. The proposed
rule would have also eliminated the exemption appli-
cable for certain types of research performed without
recording identifiers.46 It proposed to retain the pos-
sibility of consent waiver in principle, but in practice
waiver for secondary research with biospecimens
would have become virtually impossible – intention-
ally “rare.”47 In addition to the Old Rule’s standards for
consent waiver, the proposed rule would have added
new conditions, including that research with data or

specimens could not practicably be conducted with-
out identifiers, and for specimens only, that there be
“compelling scientific reasons” for research use and
that research could not be conducted with other speci-
mens for which consent was or could be obtained.48
Although it seems reasonable to retain identifiers only
when necessary, the proposal offered no definition
of what might count as a “compelling” scientific rea-
son for the research use of the specimens in question,
creating concern that perhaps consent waiver would
not be available for exploratory research. Even more
concerning, adding a criterion that researchers some-
how demonstrate that no other specimens exist for
which consent was or could be obtained seemed to be
an impossibly high standard, potentially demanding
that researchers somehow be aware of all specimens in
existence around the world and that those specimens
actually be available for their research.49

With three of the Old Rule’s options for second-
ary research with biospecimens essentially off the
table — de-identification, exemption, and waiver of
consent — how did the proposed rule envision such
research occurring? One option would have been for
researchers to seek specific consent from the specimen
source for each secondary research use. However, as
noted above, there are a number of drawbacks to this
approach, including bias in which specimen sources
will be possible to recontact. In addition, such recon-
tact and reconsent is often intensely resource inten-
sive and burdensome, most often to the point of infea-
sibility due to costs and manpower constraints. As an
alternative, the proposed rule offered a new option for
secondary research with biospecimens and identifi-
able data: regulatory broad consent.50

Rather than requiring that researchers obtain spe-
cific consent for each secondary research use as it
occurs, regulatory broad consent as contemplated
under the proposed rule would have been offered at
some earlier point in time, typically when biospeci-
mens or identifiable data were initially collected,
for example in primary research or clinical care. It
would include some but not all elements of traditional
research consent and provide general (i.e., “broad”)
information about possible future uses.51 Instead of
an opt-out approach, regulatory broad consent under
the proposed rule would have required the sources of
specimens and identifiable data to make an affirma-
tive decision to allow future research uses.

Under the NPRM’s proposal, if regulatory broad
consent was obtained, it could substitute for specific
consent and be paired with traditional IRB review, or
it could be paired with “limited” IRB review under a
proposed new exemption.52 The proposed exemption
would have been available for the storage or mainte-

218 journal of law, medicine & ethics

S Y M P O S I U M

The Journal of Law, Medicine & Ethics, 47 (2019): 213-231. © 2019 The Author(s)

nance of specimens or identifiable data for secondary
research use if broad consent had been obtained, and
for secondary research use itself if specimens or iden-
tifiable data had been stored with broad consent, so
long as the IRB made limited findings regarding the
consent process and privacy protections.53 In contrast
to traditional IRB review, limited IRB review would
not require the IRB to evaluate the risks and benefits
of the proposed secondary use, determine that risks
had been minimized, or ensure other safeguards typi-
cally required for study approval.

Given the infeasibility of the other options for sec-
ondary research with specimens under the proposed
rule, regulatory broad consent was set to become the de

facto requirement to carry out such research, intended
as a compromise between requiring specific informed
consent for all specimen research and permitting cer-
tain specimen research to proceed without consent, as
under the status quo. However, there were numerous
concerns about the feasibility of broad consent, in par-
ticular about the resources required for tracking broad
consent within institutions and whether some institu-
tions would be willing to undertake the burden at all,
especially those collecting specimens in clinical care
outside the setting of major academic medical centers
and research institutions.54 The difficulties with broad
consent are described in detail below.

With regard to data, the proposed rule would have
curiously retained the status quo allowing secondary
research with de-identified data to remain outside
the scope of the Common Rule. In addition, it would
have offered a new “exclusion” from the Common Rule
for certain types of research with identifiable data,
retained certain exemptions (renamed “exclusions”),
and retained the possibility of routine consent waiver.
This exceptionalist approach to biospecimens com-

pared to data made little sense. For example, why treat
a full genome sequence differently from the specimen
from which it was derived?55

Nearly 2,200 public comments were submitted on
the proposed rule,56 most of which focused on the pro-
posals regarding specimen research and regulatory
broad consent. Overall, patients and the research com-
munity expressed opposition to the proposal based on
concern that it would reduce the availability of speci-
mens for research, thereby slowing medical advances
and negatively affecting health.57 Important advisory
committees were also opposed: President Obama’s
Commission for the Study of Bioethical Issues noted
that de-identified specimen research poses no or

low risk to sources and is unlikely to
impact their autonomy interests,58 while
SACHRP argued that the proposal would
not effectively improve autonomy and
that regulatory broad consent for sec-
ondary research could undermine sub-
ject welfare by allowing such research to
proceed with only limited IRB review.59
Comments submitted by members of the
general public, i.e., those not identifying
as patients, researchers, or research insti-
tutions, were more divided, with some in
favor of autonomy and control calling for
the proposal to go even further toward
specific consent and some worried about
the proposal’s adverse impact on medical
advancement.60

The Final Rule
The Common Rule agencies published a final revised
rule on January 19, 2017.61 After a number of delays,
regulated entities could begin implementing certain
provisions in July 2018, with a final implementation
date of January 21, 2019. The final rule was dramati-
cally different from what had been proposed in the
NPRM, adopting an approach that nearly completely
discounted complaints related to dignitary harm and
autonomy that had …