WPF Files Comments on Federal Proposal for Human Subject Research (Common Rule)

The Nuremberg Code, an extraordinary document around ethics and research on human subjects written after the research abuses that took place during World War II, is akin to a global Emancipation Proclamation for human research subjects. The Nuremberg Code’s 10 principles remain a timeless rendering of thought on what should be in place prior to any entity conducting research on human subjects, and this code forms the philosophical foundation of a regulation in the US known as the Common Rule.

In the United States, the Common Rule determines what specific, actionable federal protections and rights people who undergo human subject research have. The rules apply to federally-funded entities, but the impact of the Common Rule reaches much further than the entities it regulates. It has an overall influence on thinking in medical research and beyond. As such, any revisions and updates to the Common Rule are vitally important.

Today, the World Privacy Forum filed extensive comments about the new Federal proposal for Human Subject Research Protections, which updates the Common Rule, with the US Department of Health and Human Services, the US Department of Education, and other agencies. In our comments, we support several changes in the proposal. We also make substantive recommendations for improvements.

Key areas where we are requesting improvements include:

Data Risks

The proposal defines data risks as primarily related to unauthorized access. We have urged the agencies to broaden this idea to informational risks, which is an updated and much more appropriate approach to the issue of data risk today.

Data Fusion

In our comments we discuss data fusion and how it interacts with human subject research protections. We present our researched understanding of how data is no longer separable — online and offline have merged, as have sensor and biodata, geolocation data, and many other data types. Financial and medical data, once clearly delineated and  segregated, now overlap and interact in novel and inextricable ways, as do many other aspects of data. An updated approach to human subject research protection needs to take these kinds of data changes into account in order to remain as effective as possible.

Existing Standards 

We urged the agencies to retain a very high bar for human subject protections. Specifically, we commented about what the role of The Privacy Act of 1974 and the Family Educational Rights and Privacy Act (FERPA) should be in constraining human subject research, as well as HIPAA. We recommended that the agencies should set a higher standard for human subject research protection than is afforded in the Privacy Act,  FERPA, or HIPAA.

We wrote about many additional items, in detail, commenting on places where the proposal could be strengthened. We invite all to read our comments, which are available here.

Read the WPF Comments on the US Common Rule proposal (PDF, 30 pages)


The Nuremberg Code (10 principles)

Declaration of Helsinki, from the World Medical Association, 32 principles.

Read background on the Nuremberg Code from the New England Journal of Medicine. This is a very good overview of the code and its impact. The article is brief, and is available online free of charge.