Common Rule — Federal Protection of Human Research Subjects

The Common Rule is the informal name for the federal government's foundational policy protecting people who participate in research — governing what federal agencies can fund, what institutions must do before enrolling human subjects, and what information participants must receive before agreeing to take part. Formally codified as 45 CFR Part 46 (by HHS) and adopted identically or nearly identically by approximately 20 federal departments and agencies — including USDA (7 CFR Part 1c), DHS (6 CFR Part 46), and most cabinet-level research funders — the Common Rule requires any institution conducting or receiving federal support for human subjects research to operate an Institutional Review Board (IRB), obtain informed consent from participants, and classify research by risk level before proceeding. Originally formalized in 1991 and substantially revised in 2018, the Common Rule is the baseline standard for ethical human research practice in the United States, built on the principles of respect for persons, beneficence, and justice articulated in the Belmont Report (1979).

Current Rule (2026)

What This Rule Does

The Common Rule governs research involving living human beings — experiments, surveys, interviews, behavioral studies, and other investigations where human participation generates data about people. The rule is triggered whenever a federal agency funds, conducts, or regulates the research, and it applies to any institution that accepts federal research support, regardless of whether a particular project is federally funded. An institution that receives NIH grants, for example, must apply IRB review even to privately funded studies it conducts, because the institution as a whole accepted the federal assurance requirement.

The rule's architecture rests on three interlocking requirements. First, any institution conducting covered research must have a written assurance with the relevant federal agency — a formal commitment to operate an IRB and comply with the Common Rule. Second, every covered research project must receive IRB review before human subjects are enrolled; the IRB can approve, require modifications, or disapprove. Third, researchers must obtain legally effective informed consent from participants (or their representatives) before enrolling them, unless the IRB has waived or altered that requirement based on specific criteria.

The 2018 revision significantly updated the rule for the first time in decades, expanding the categories of exempt research (low-risk studies that need no IRB review), introducing a new category of "limited IRB review" for studies involving identifiable data with privacy protections, creating flexibility for single IRB review in multi-site studies, and streamlining the consent form requirements to make them more readable for participants.

Key Provisions

• § 1c.101 / § 46.101 — Scope: federal agencies must apply these protections to research they fund, run, or regulate; institutions conducting federally supported research must commit to compliance through a written assurance; the rule applies to all human subjects research at an institution that accepts a federal assurance, not just to projects receiving federal funds

• § 1c.103 / § 46.103 — Institutional assurance: institutions must file an assurance of compliance with the relevant federal agency before conducting any covered research; the assurance must establish an IRB, describe how the institution will implement the policy, and commit to applying it to all federally supported research; OHRP (HHS Office for Human Research Protections) registers assurances government-wide

• § 1c.104 / § 46.104 — Exempt research: eight categories of research that present low risk to participants are exempt from most IRB requirements — including: educational testing in normal educational settings, research using existing identifiable private information when disclosure could not reasonably harm participants, benign behavioral interventions (surveys, interviews) with minimal risk, food taste and quality evaluation, and certain secondary research using already-collected identifiable data under privacy protections; even exempt research must have someone determine that it qualifies for exemption

• § 1c.107 / § 46.107 — IRB membership: every IRB must have at least five members with diverse backgrounds sufficient to review the types of research the institution conducts; membership must include at least one scientist, one non-scientist, and one person who is not affiliated with the institution; no IRB may consist entirely of one sex or one professional group; members with conflicts of interest in a particular study must recuse themselves from that review

• § 1c.109 / § 46.109 — IRB review: IRBs may approve research, require modifications as a condition of approval, or disapprove research; approval requires a finding that all required criteria are met; most IRBs review research at regularly scheduled convened meetings, with approval requiring a majority of members present; any member may require full-board review even for studies that otherwise qualify for expedited review

• § 1c.110 / § 46.110 — Expedited review: the IRB chair (or designated experienced reviewer) may use an expedited procedure for research that poses no more than minimal risk and falls within categories of research the Secretary of HHS has published; expedited review is also available for minor changes to already-approved research; a single reviewer may approve under expedited procedures, but a single reviewer may not disapprove (disapproval requires full-board consideration)

• § 1c.111 / § 46.111 — Criteria for IRB approval: IRBs may only approve research when they find: risks are minimized through sound study design; risks are reasonable in relation to anticipated benefits; participant selection is equitable; informed consent will be sought and documented unless waived; adequate monitoring of data for participant safety; adequate privacy and confidentiality protections; and, when vulnerable populations are involved, additional safeguards

• § 1c.116 / § 46.116 — Informed consent requirements: researchers must obtain the legally effective informed consent of each participant (or their legal representative) before enrolling them; consent must disclose: the purpose of the research; foreseeable risks and discomforts; reasonably foreseeable benefits; alternative procedures or treatments; confidentiality protections; whether compensation is available for injury; whom to contact with questions; and that participation is voluntary and refusal will result in no penalty; the 2018 rule added a requirement that consent forms begin with a concise summary of key information most likely to influence a decision

• § 1c.117 / § 46.117 — Documentation of consent: consent must be documented on an IRB-approved written form signed (including electronic signature) by the participant or their representative; the participant receives a copy; IRBs may waive the written documentation requirement for research posing minimal risk where signing would constitute the only record linking the participant to the study and that link would be the principal risk

• § 1c.114 / § 46.114 — Cooperative research: when multiple institutions collaborate on a single research project, each must protect participants and comply with the rule; U.S. institutions in multi-site studies must rely on a single IRB for that portion of the research unless the agency or institution waives this requirement — a significant 2018 change designed to eliminate duplicative review of identical protocols

• § 1c.122 / § 46.122 — Federal funding prohibition: federal agencies cannot spend federal money on research involving human subjects unless the institution is complying with this policy; this funding prohibition is the primary enforcement mechanism — non-compliant institutions risk losing all federal research support, not just the funds for the specific study

• § 1c.123 / § 46.123 — Early termination of funding: agency heads may stop or suspend federal funding for any project where an institution has seriously failed to comply with this policy; this authority can be exercised immediately for serious violations without waiting for formal adjudication

How It Affects You

If you are a researcher at a university or research institution that receives federal funding: Any study involving living human beings requires IRB review before you can enroll participants, regardless of whether that particular study is federally funded. Your institution's IRB determines whether your protocol is exempt, qualifies for expedited review, or requires full-board review. Full-board approval is required before you can begin — not after your first subject, not after data collection starts. The timeline for IRB review varies by institution and protocol complexity; building 4–12 weeks into your project timeline for IRB review is standard. Failure to comply can result in suspension of your entire research program, not just the affected study.

If you are considering participating in a research study: Before you agree to participate in any federally funded research, the researcher must give you an informed consent form — and you must have the opportunity to ask questions and decline without penalty. The form should be written in language you can understand, must describe the real risks, and cannot be structured as a waiver of your legal rights. You can withdraw from any study at any time without penalty, even after you have signed a consent form. If something goes wrong during a study, the contact information for questions or complaints must be on the consent form.

If you work in research administration, sponsored programs, or IRB management: The 2018 Common Rule revision changed the exempt research categories, introduced new requirements for "broad consent" for secondary research using identifiable biospecimens, and requires single IRB review for most multi-site studies. If your institution has not updated its procedures for the 2018 revision, that is a compliance gap. OHRP (Office for Human Research Protections) conducts oversight of assurance compliance and may investigate complaints from research participants; findings of non-compliance can trigger corrective action plans and, in serious cases, suspension of an institution's federal research authorization.

If you work in a federal research-funding agency: Your agency is responsible for reviewing research applications and proposals involving human subjects; you cannot fund research that has not been reviewed by an IRB with an appropriate assurance on file (§ 1c.120). For research you conduct directly (not just fund), the same requirements apply to your own agency's research programs.

Implementing Regulations

The HHS regulations implementing the Common Rule live at 45 CFR Part 46 — Protection of Human Subjects. The Part is organized into five subparts, each with distinct requirements:

• § 46.101 — Scope: applies to all research involving human subjects conducted, supported, or regulated by any federal department or agency adopting this policy; research conducted outside the U.S. may be covered; tribal research involving tribal members may be subject to additional tribal IRB review
• § 46.102 — Key definitions: "human subject" means a living individual about whom a researcher obtains data through intervention or interaction, or obtains, uses, studies, analyzes, or generates identifiable private information or biospecimens; "minimal risk" means risks no greater than those encountered in daily life or routine physical or psychological exams
• § 46.104 — Eight exempt categories: (1) normal educational practices; (2) certain surveys/interviews with no identifiable data; (3) benign behavioral interventions; (4) secondary research on existing data where subjects cannot be identified; (5) government-conducted benefit research; (6) food taste testing; (7) IRB-approved storage of identifiable biospecimens for secondary research (new in 2018); (8) secondary research using identifiable information with broad consent (new in 2018)
• § 46.110 — Expedited review categories: 9 categories published by HHS Secretary (biological specimens, data from existing records, individual interviews/surveys with no more than minimal risk, research on group characteristics)
• § 46.116(b) — Eight required basic consent elements, including the statement that participation is voluntary, foreseeable risks, benefits, confidentiality protections, and contact information for questions or injuries; plus six additional elements required when applicable (e.g., disclosure of commercial use of biospecimens)

Subpart B — Pregnant Women, Human Fetuses, Neonates (§§ 46.201–46.207): Research may involve pregnant women or fetuses only if preclinical and clinical studies support the reasonableness of the risk; research must hold out the prospect of direct benefit to the woman, the fetus, or neither (if risk is minimal and knowledge cannot be obtained otherwise); both the pregnant woman and the father must give consent for research offering no direct benefit to the pregnant woman — except consent of the father is not required when he cannot be contacted, pregnancy resulted from rape or incest, or the father is not reasonably available.

Subpart C — Prisoners (§§ 46.301–46.306): Prisoners may be research subjects only for research studying (1) the possible causes, effects, and processes of incarceration; (2) prisons as institutions or prisoners as incarcerated persons; (3) conditions particularly affecting prisoners; or (4) practices that may have the intent and reasonable probability of improving the health and well-being of the subject. At least one-third of IRB members for prisoner research must themselves be prisoners or prisoner representatives — ensuring the review body includes people who understand the coercive pressures of incarceration.

Subpart D — Children (§§ 46.401–46.409): Research involving children requires IRB findings about the level of risk and whether parental permission and child assent have been obtained. The four permissible categories track risk level: (§46.404) not greater than minimal risk — IRB may approve; (§46.405) greater than minimal risk but prospect of direct benefit — may be approved if benefit justifies risk; (§46.406) greater than minimal risk and no direct benefit — only if risk is a minor increase over minimal and the knowledge sought cannot be obtained otherwise; (§46.407) otherwise not approvable — requires HHS Secretary review. A child's informed assent must be obtained in addition to parental permission, unless the child lacks the capacity to assent or the research offers the prospect of direct benefit that is only available in the research context.

Recent rulemakings: The 2018 revision (83 FR 7149, effective January 2019) was the most significant update since 1991 — expanded exempt categories, added single-IRB mandate for multi-site studies, revised consent form structure, and created the broad consent pathway for biospecimen research.

FDA's parallel IRB regulations — 21 CFR Part 56: The Common Rule (45 CFR Part 46) is the HHS/federally-funded research framework. FDA has its own, separately codified IRB requirements that apply specifically to clinical investigations of FDA-regulated products — drugs, biologics, medical devices, food ingredients with health claims, and others — regardless of whether federal funding is involved. The two frameworks are largely harmonized but differ in important ways:

• § 56.101 — Scope: covers any clinical investigation submitted to FDA in support of a research or marketing permit, including INDs (new drug applications) and IDEs (investigational device exemptions); this is broader than the Common Rule's federally-funded trigger — an entirely privately funded Phase III drug trial still falls under 21 CFR Part 56
• § 56.106 — Mandatory IRB registration: every U.S. IRB that reviews FDA-regulated clinical investigations must register with OHRP's IRB registration system; registration is a condition of validity — FDA will not accept data from an unregistered IRB
• § 56.107 — IRB membership: same 5-member minimum, diversity, non-scientist, non-affiliated member requirements as the Common Rule; members with conflicting interests must be excluded from deliberations
• § 56.111 — Approval criteria: the same seven approval criteria as 45 CFR Part 46 — risk minimization, risk/benefit balance, equitable selection, informed consent, adequate monitoring, confidentiality, and additional safeguards for vulnerable populations; this parallel structure was intentional — FDA and HHS negotiated harmonization from the beginning
• § 56.109 — Continuing review: FDA-regulated research requires ongoing IRB review (initial approval plus periodic re-review, typically annually); the IRB must approve each continuing review with access to current progress reports and adverse event data — unlike the 2018 Common Rule, which eliminated continuing review for some minimal-risk studies, FDA's regulations still require it for all IND/IDE research
• §§ 56.120–56.124 — FDA disqualification authority: the most significant distinction from the Common Rule — FDA has authority to disqualify an IRB or institution from reviewing FDA-regulated clinical investigations if the IRB has failed to comply; disqualification means no clinical investigation reviewed by that IRB can be submitted to FDA in support of a marketing application; FDA may also pursue judicial proceedings independent of disqualification; OHRP (under Common Rule authority) can suspend federal assurances, but lacks FDA's power to bar product applications

In practice, most clinical research at U.S. research institutions simultaneously satisfies both the Common Rule (because of federal funding or federal institutional assurance) and 21 CFR Part 56 (because the study involves an investigational drug or device). IRBs operating in an academic medical center context typically run a single review that checks both regulatory frameworks in parallel. The compliance implications differ if federal funding is lost but the trial continues — Part 56 applies regardless of funding source, so the IRB review obligation persists.

FDA's informed consent regulations — 21 CFR Part 50: Alongside 21 CFR Part 56 (IRB requirements), FDA also maintains its own informed consent regulations at 21 CFR Part 50 — Protection of Human Subjects. Part 50 applies to the same universe of FDA-regulated clinical investigations as Part 56, and specifies the specific elements of consent that investigators must obtain:

• § 50.20 — General informed consent requirement: no investigator may involve a human subject in FDA-regulated research without first obtaining legally effective informed consent; consent must be voluntary, without coercion or undue influence, and must give the subject sufficient opportunity to consider whether to participate
• § 50.25 — Elements of informed consent: the consent form must include eight basic elements: (1) explanation of the study and its purpose; (2) description of foreseeable risks and discomforts; (3) description of expected benefits; (4) disclosure of alternatives to participation; (5) extent of confidentiality of records; (6) explanation of compensation and treatment for research injuries; (7) who to contact for questions; and (8) statement that participation is voluntary and may be discontinued without penalty; six additional elements are required when applicable (e.g., unforeseeable risks, research stopped early, number of subjects, costs, consequences of withdrawal, new findings disclosure)
• § 50.24 — Emergency research exception: the most distinctive Part 50 provision — for research involving emergency interventions (acute MI, stroke, cardiac arrest, severe trauma) where the condition itself prevents obtaining consent, an IRB may waive the consent requirement if specific criteria are met; the exception requires community consultation and public disclosure before the trial begins, a Data Safety Monitoring Board, efforts to locate legally authorized representatives, a short consent window, and notification procedures to inform subjects after regaining capacity; this provision makes FDA's consent framework more operationally flexible than the Common Rule for emergency medicine research, though the procedural requirements are demanding
• §§ 50.50–50.56 — Pediatric research: FDA's pediatric protections mirror the four-category risk framework of 45 CFR Part 46 Subpart D — the same minimal risk/direct benefit/minor increment/Secretary review structure applies to FDA-regulated pediatric studies; FDA's pediatric provisions are separately required because significant FDA-regulated pediatric research is funded privately and would not be subject to the HHS Common Rule at all without Part 50

In the typical academic medical center environment, both Part 50 (consent elements and requirements) and Part 56 (IRB structure and review) are checked simultaneously during IRB review of FDA-regulated studies. The two Parts together constitute FDA's complete human research protection framework, working alongside the NIH-funded research protections of 45 CFR Part 46.

• 42 CFR Part 2a — Certificates of Confidentiality for Research Subjects: HHS regulations implementing the authority (42 U.S.C. § 241(d)) under which the HHS Secretary may authorize researchers to protect the privacy of research subjects by withholding their identities from any civil, criminal, administrative, legislative, or other proceeding. Key provisions:

  • § 2a.1 — Applicability: certificates of confidentiality may be issued to persons engaged in biomedical, behavioral, clinical, or other research — including mental health research, substance abuse research, and HIV/AIDS research — in which subjects are identified and where the disclosure of identifying information could damage their financial standing, employability, or reputation, or could subject them to criminal liability
  • § 2a.2 — Scope of protection: a certificate authorizes the holder to withhold the names and other identifying characteristics of research subjects; the protection applies against compelled disclosure in any federal, state, or local civil, criminal, administrative, legislative, or other proceeding demanding disclosure; the certificate does not prevent voluntary disclosure authorized by the subject
  • § 2a.3 — Application requirements: each certificate is issued for a specific research project; the application must describe the research, including any administration of a drug or controlled substance; a separate certificate is required for each project — blanket institutional certificates covering all research are not permitted
  • § 2a.4 — Issuance criteria: HHS evaluates whether the research involves sensitive information (identifiable data on substance use, mental health, sexual behavior, genetic information, illegal conduct) and whether confidentiality protection is necessary to conduct the research; approval of an IRB-reviewed protocol is a prerequisite

  Certificates of Confidentiality are a critical protection for research on stigmatized or legally sensitive behaviors — drug use, HIV status, sexual conduct, mental illness. Without a certificate, a researcher could be subpoenaed and forced to reveal which subjects admitted to drug use or participated in criminal behavior during a study. NIH began issuing Certificates of Confidentiality automatically to all NIH-funded research involving identifiable, sensitive data in 2017 following the 21st Century Cures Act (which made the certificate statutory and expanded coverage); before that expansion, researchers had to affirmatively apply. The 21st Century Cures Act also made it illegal for the researcher to voluntarily disclose protected research data to law enforcement absent subject consent — transforming the Certificate from a privilege into a prohibition on disclosure, significantly strengthening the protection.

Agency-specific Common Rule implementations: The 2018 Revised Common Rule was adopted identically by approximately 20 federal departments. Each agency codified the Rule in its own CFR title; the substantive requirements (IRB structure, informed consent elements, exempt research categories, expedited review procedures) are identical across implementations. Notable agency-specific versions include:

• 34 CFR Part 97 — U.S. Department of Education: applies the Common Rule to research funded or conducted by the Department of Education — including research in elementary and secondary education, higher education, vocational rehabilitation, and educational data systems. Education-funded research often involves students as subjects; the Part 97 implementation coordinates with the Family Educational Rights and Privacy Act (FERPA), which provides independent privacy protections for student records used in research. Research using identifiable student records under FERPA is often subject to FERPA's research exception (34 CFR 99.31(a)(6)) in addition to the IRB review requirements of Part 97. The 83 FR 28516 (2018) amendment updated Part 97 to conform with the 2018 Common Rule revision

• 7 CFR Part 1c (USDA), 6 CFR Part 46 (DHS), 10 CFR Part 745 (DOE), 14 CFR Part 1230 (NASA), 15 CFR Part 27 (Commerce), 22 CFR Part 225 (DOS), 24 CFR Part 60 (HUD), 28 CFR Part 46 (DOJ), 40 CFR Part 26 (EPA) — all are substantively identical to the HHS baseline (45 CFR Part 46) and cover research funded or conducted by their respective departments

• 38 CFR Part 16 — Department of Veterans Affairs Protection of Human Subjects (21 sections): VA's implementation of the Common Rule, applying to all research involving human subjects conducted, funded, or supported by VA — including research at VA medical centers, VA-funded research at universities, and collaborations between VA and non-VA investigators. VA's version is substantively identical to 45 CFR Part 46 but operates within a distinctive institutional context:

  • § 16.101 — Scope: covers all research involving human subjects conducted or supported by VA; includes research by VA employees in their official capacity, VA-funded grants to outside researchers, and cooperative agreements; research involving VA medical records or VA patient data is covered even if conducted at a university
  • § 16.103 — Assurances: each VA facility conducting covered research must maintain an institutional assurance with the VA Office of Research Oversight (ORO) — the VA equivalent of OHRP; VA facilities must maintain a VA-registered IRB or rely on an external IRB with an approved agreement
  • § 16.104 — Exempt research: the eight standard Common Rule exemptions apply; VA practice requires that any exemption determination be reviewed and concurred by a senior VA official — given the population served (veterans who may be experiencing service-connected disabilities, PTSD, or other conditions), VA applies heightened scrutiny to exemption claims involving psychological research or records access
  • § 16.107 — IRB membership: VA IRBs must include a veterans' advocate — a member who represents the perspective of veteran research participants — a VA-specific addition to the standard Common Rule IRB membership requirements (which require a member from outside the institution but do not specify a participant-advocate role)
  • § 16.116 — Informed consent: VA applies the standard informed consent elements; VA's IRBs have historically required clear disclosure of the participant's voluntary status even in research conducted in VA clinical settings where the patient-provider relationship might create subtle pressure to participate

  VA conducts or funds research at approximately 200 VA medical centers and affiliated universities, including large-scale epidemiological studies using the VA's unique electronic health record system (Million Veteran Program biobank, with over 1 million veteran participants). The VA Office of Research Oversight conducts compliance monitoring and education for all VA research programs. Recent rulemakings: 83 FR 11823 (2018) — conformed Part 16 to the 2018 Common Rule revision.

• 32 CFR Part 219 — Department of Defense Protection of Human Subjects (21 sections): DoD's implementation of the Common Rule, applying to all research involving human subjects conducted or supported by any DoD component — the Army, Navy, Air Force, Marine Corps, and DoD agencies including DARPA, DIA, NSA, and the military medical commands. The substantive requirements are identical to 45 CFR Part 46 (HHS) with key DoD-specific provisions:

  • § 219.101 — Scope: covers research conducted, supported, or regulated by DoD; research performed by DoD contractors is subject to Part 219 when DoD funds or provides oversight; research involving military personnel as subjects is specifically covered — military members cannot be pressured or ordered to participate as research subjects (a protection reflecting post-WWII reforms following the Nuremberg Code)
  • § 219.104 — Exempt research: the eight standard Common Rule exemptions apply; DoD practice requires that a senior DoD human research protection official — not just the PI — concur in any exemption determination for research involving military personnel, given the inherent power differential between commanders and subordinate service members
  • § 219.107 — IRB membership: DoD IRBs must include members with varying backgrounds; for research involving military personnel, DoD guidance (DoD Instruction 3216.02) recommends including a member who is familiar with the military research environment and the unique pressures on military subjects
  • §§ 219.109–219.111 — IRB review and approval criteria: identical to 45 CFR Part 46 — full IRB review, expedited review, or exempt determination; DoD's additional layer is the Human Research Protection Program (HRPP) accreditation requirement — all DoD research sites are expected to maintain AAHRPP accreditation, a private quality certification for IRB programs
  • § 219.114 — Cooperative research: DoD's adoption of the Common Rule's single-IRB mandate (added 2018) means multi-site DoD-funded research must designate a single reviewing IRB — particularly significant for multi-service military medical research conducted at Army, Navy, and Air Force medical centers simultaneously

For compliance purposes, institutions receiving federal funding must comply with the specific department's version of the Common Rule for that department's awards — in practice, because the requirements are identical, an IRB protocol that satisfies any one agency's implementing regulation satisfies all others for the same research. OHRP (under HHS) provides governmentwide guidance and complaint investigation even for research funded by non-HHS agencies that have adopted the Common Rule.

Statutory Authority

This rule implements:

• 42 U.S.C. § 289 — National Research Act (1974): requires HHS to establish IRB requirements for federally funded biomedical and behavioral research; the original statutory basis for 45 CFR Part 46 (HHS) and the policy origin of the Common Rule
• 5 U.S.C. § 301 — Housekeeping statute: the primary authority cited by non-HHS agencies (USDA, DHS, and others) for adopting their parallel versions of the Common Rule; grants agency heads authority to prescribe regulations for the conduct of their agencies' work

Recent Rulemakings

• 2018 (83 FR 7149, effective January 21, 2019): the "Revised Common Rule" — the first major overhaul since 1991; expanded exempt categories (added categories for broad consent to secondary research, benign behavioral interventions); introduced single-IRB mandate for cooperative research; added requirement for concise consent form summary; created new "limited IRB review" pathway for identifiable private information studies; removed requirement for ongoing review of minimal-risk approved studies; updated definitions of key terms including "research" and "identifiable biospecimen"

Recent Developments

• No major revision since the 2018 Revised Common Rule: The Revised Common Rule (effective January 2019) remains the operative framework. No additional comprehensive revision has been finalized as of 2026. The 2018 revision's provisions — especially the single-IRB mandate for cooperative research and the new exempt categories — have been fully phased in.
• Single-IRB mandate in effect: The requirement that domestic multi-site studies funded by a Common Rule agency use a single IRB of record (rather than one per institution) has reshaped the research coordination landscape. Commercial IRBs (WIRB, Advarra, Copernicus) have grown substantially as institutions route multi-site studies through centralized review.
• COVID-19 and emergency research review: During the COVID-19 pandemic, FDA and OHRP issued guidance permitting expedited IRB review and electronic informed consent to accelerate clinical research. These emergency accommodations demonstrated flexibility in the consent framework and prompted calls for permanent reforms to remote consent procedures.
• DOGE-related federal research funding disruptions (2025): The Trump administration's DOGE-driven review of federal research funding in 2025 — including NIH and NSF grant freezes and terminations — disrupted thousands of IRB-approved studies. When federal funding is terminated mid-study, IRBs face procedural questions about consent obligations to already-enrolled participants and study continuation obligations to investigators.
• Biospecimen and data re-identification concerns: Advances in genomics and AI-assisted data analysis have intensified debates about whether the Common Rule's privacy protections remain adequate for biospecimen repositories and large health data sets. The 2018 rule updated some definitions, but calls for further revision to address modern re-identification risks continue in the bioethics literature.

Pending Action

OHRP has identified biospecimen research and large-scale health data studies as areas where the 2018 Common Rule may need further revision. No proposed rule is currently on the unified regulatory agenda, but OHRP has published advance notices and requests for information on re-identification risks, the adequacy of the broad consent framework for biospecimen repositories, and whether secondary data use exemptions are sufficiently protective. Watch for a proposed rule addressing these gaps in 2026–2027. The NIH Single IRB mandate for multi-site studies is fully implemented; any future revision would address remaining challenges around jurisdictional IRB disputes and institutional liability in centralized review.