Why the Common Rule Is Hard to Amend WHY THE COMMON RULE IS HARD TO AMEND BARBARA J. EVANS* ABSTRACT. ............................................. 366 I. INTRODUCTION ................................. ..... 366 II. SUMMARY OF THE 2011 PROPOSAL TO AMEND THE COMMON RULE ............................................. 371 A. Summary of the ANPRM's Reform Agenda ... .... 372 B. Existing and Proposed Consent Provisions for Data and Biospecimens ................................ 375 III. THE SUBSTANTIVE CHALLENGE OF MODERNIZING INFORMED CONSENT 380 REQUIREMENTS FOR DATA AND BIOSPECIMENS. ................................ .... 380 IV. FINDING AN APPROPRIATE PROCESS TO MODERNIZE THE COMMON RULE .............................. 390 A. Sources of HHS's Authority to Amend the Common Rule ............................. ....... 391 B. Why Congress Constrained HHS's Authority to Set Informed Consent Requirements...............394 1. Intelligible principles to guide agency rulemaking.394 2. Procedural formality to ensure an inclusive dialogue. ..................................... 399 3. Substantive policy concerns ............. ..... 400 C. Special Legal Status of the 1978 Regulatory Recommendations ............................. 403 D. Why the Common Rule's Consent Provisions Are Hard to Amend. ............................ ..... 406 V. CONCLUSION ................................... .... 412 * Professor of Law; Co-director, Health Law & Policy Institute; Director, Center on Biotechnology & Law, University of Houston Law Center, bjevans@central.uh.edu. J.D., Yale Law School; M.S., Ph.D. Stanford University; Post-doctoral Fellow, The University of Texas M.D. Anderson Cancer Center. This research has been supported by the Greenwall Foundation and the University of Houston Law Foundation. INDIANA HEALTH LAW REVIEW ABSTRACT Information-based studies that use people's health data and biospecimens are set to play an important role in 21lst- century biomedical discovery, public health, and healthcare system improvement. There is wide agreement that the Common Rule needs to be modernized to provide better protection for people whose data and biospecimens are used in such studies. Unfortunately, the Secretary of Health and Human Services (HHS) is in the position of trying to keep the Common Rule up to date using authorities granted by an outdated statute. This article explores statutory constraints that appear to limit the Secretary's authority to make some of the changes proposed in the July 2011 ANRPM. Some of the proposed revisions to the Common Rule seemingly would require legislative action to alter the Secretary's rulemaking authority. This does not, however, mean that it will be impossible to modernize the Common Rule in the absence of legislative action. As noted at the end of this article, the Secretary of HHS has significant discretion to make the Common Rule function better without amending the regulatory text itself. The Common Rule is hard to amend, but there are promising pathways for implementing improved policies within the framework of the existing regulation. Skillful use of these other approaches may avoid the need for hasty regulatory amendments that may, in the end, prove unlawful. I. INTRODUCTION Studies of health data and biospecimens are poised to play a major role in 21st-century biomedical discovery and healthcare system improvement.' Recent legislation 1 See, e.g., 21 U.S.C. § 355(o)(3)(D) (2012) (placing the U.S. Food and Drug Administration under a requirement to consider the use of observational studies and determine that they would be "not sufficient," before the agency can order a postmarketing clinical drug trial); see also INST. OF MED., THE LEARNING HEALTHCARE SYSTEM: WORKSHOP SUM1VIARY 128, 130 (LeighAnne Olsen et al. eds., 2007) [hereinafter IOM LEARNING HEALTHCARE] (discussing the growing use of observational methodologies); Fred D. Brenneman et al., Outcomes Research in 366 Vol. 10.2 WHY THE COMMON RULE IS HARD TO AMEND expands the use of such studies in postmarketing drug safety surveillance2 and comparative effectiveness research. 3 "[C]linical data are the resource most crucial to healthcare progress," declared a recent Institute of Medicine report that considered the role of health data in research, public health, quality improvement, and program evaluation studies.4 Methodologies that study existing data-including information derived from biospecimens-go by many names: informational5 studies, records6 research, Surgery, 23 WORLD J. SURGERY 1220 (1999) (discussing the growth of observational approaches after 1980); Outcomes Research Fact Sheet (2000), AGENCY FOR HEALTHCARE RESEARCH AND QUALITY, http://www.ahrq.gov/clinic/outfact.htm (last visited Oct. 12, 2011) [hereinafter AHRQ Fact Sheet]; Rina Hakimian & David Korn, Ownership and Use of Tissue Specimens for Research, 292 JAMA 2500, 2500 (2004) (noting the growing importance of research with biospecimens). 2 See Barbara J. Evans, Seven Pillars of a New Evidentiary Paradigm: The Food, Drug, and Cosmetic Act Enters the Genomic Era, 85 NOTRE DAME L. REV. 419, 476-85 (2010) (discussing the Food and Drug Administration's expanded authority to conduct active postmarketing drug safety surveillance, including observational (epidemiological) studies, under the Food and Drug Administration Amendments Act of 2007, Pub. L. No. 110-85, 121 Stat. 823 (2007) (codified as amended in scattered sections of 21 U.S.C.) [hereinafter FDAAA]); Efthimios Parasidis, Patients over Politics: Addressing Legislative Failure in the Regulation of Medical Products, 2011 WIS. L. REV. 929, 948-49 (2011). 3 See Richard S. Saver, Health Care Reform's Wild Card: The Uncertain Effectiveness of Comparative Effectiveness Research, 159 U. PA. L. REV. 2147 (2011) (discussing comparative effectiveness provisions of the American Recovery and Reinvestment Act, Pub. L. No. 111-5, 123 Stat. 115 (2009) and the Patient Protection and Affordable Care Act, Pub. L. No. 111-148, 124 Stat. 119 (2010)). 4 See, e.g., INST. OF MEDICINE, CLINICAL DATA AS THE BASIC STAPLE OF HEALTH LEARNING, CREATING AND PROTECTING A PUBLIC GOOD: WORKSHOP SUMMARY 1 (Claudia Grossmann et al. eds., 2010) [hereinafter IOM, CLINICAL DATA]. 5 Barbara J. Evans, Much Ado About Data Ownership, 25 HARV. J.L. & TECH. 69, 71 (2012). 6 See U.S. DEP'T OF HEALTH, EDUC., & WELFARE, PROTECTION OF HUMAN SUBJECTS, INSTITUTIONAL REVIEW BOARDS: REPORT AND RECOMMENDATIONS OF THE NATIONAL COMMISSION FOR THE PROTECTION OF HUMAN SUBJECTS OF BIOMEDICAL AND BEHAVIORAL RESEARCH (1978) [hereinafter HEW, 1978 REPORT] (using the phrase "research using . . 3672013 INDIANA HEALTH LAW REVIEW observational7 studies, epidemiologic 8 studies, or information-based 9 research. By whatever name, these methodologies will play a prominent role alongside clinical research that was the mainstay of late-20th-century biomedical evidence generation. 10 A major task facing health lawyers and policymakers in the next quarter century is to adapt our nation's laws and regulations to this reality. The difficulty, of course, is to enable socially beneficial studies to move forward while preserving strong ethical and privacy protections for the people whose data and biospecimens are used. Two important federal regulations affecting data and tissue access are the Health Insurance Portability and Accountability Act of 1996 ("HIPAA")11 Privacy Rule12 and the Federal Policy for the Protection of Human Subjects, 13 or "Common Rule."14 There is records" to refer to studies that use existing medical data). 7 BENGT D. FURBERG & CURT D. FURBERG, EVALUATING CLINICAL RESEARCH: ALL THAT GLITTERS Is NOT GOLD 29-37 (2nd ed. 2007) (using the term "observational" to refer to methodologies that study data). 8 DAVID CASARETT, JASON KARLAWISH, ELIZABETH ANDREWS & ARTHUR CAPLAN, BIOETHICAL ISSUES IN PHARMACOEPIDEMIOLOGIC RESEARCH 587, 588 (Brian L. Strom ed., 4th ed. 2005). 9 INST. OF MED., BEYOND THE HIPAA PRIVACY RULE: ENHANCING PRIVACY, IMPROVING HEALTH THROUGH RESEARCH 7 (Sharyl J. Nass, Laura A. Levit & Lawrence 0. Gostin eds., 2009) [hereinafter IOM, PRIVACY REPORT], available at http://www.nap.edu/catalog/l2458.html (last visited Mar. 22, 2013) (distinguishing "information-based" research from clinical research). 10 See, e.g., 21 U.S.C. § 355(o)(3)(D) (2012) (calling for the use of observational methodologies alongside clinical trials in regulating the safety of approved drugs); IOM, CLINICAL DATA, supra note 4; see also Evans, supra note 2, at 431-50 (discussing methodological limitations of traditional randomized, controlled clinical trials and advantages of emerging informational study methodologies for the purpose of generating evidence of the safety of approved drugs). 11 Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, 110 Stat. 1936 (codified as amended in scattered sections of 18, 26, 29 and 42 U.S.C.). 12 45 C.F.R. pts. 160, 164. 13 See U.S. Dep't of Health & Human Servs., Federal Policy for the Protection of Human Subjects ("Common Rule"), HHS.Gov, http://www. hhs.gov/ohrp/humansubjects/commonrule/index.html (last visited Mar. 18, 2013). 368 Vol. 10.2 WHY THE COMMON RULE IS HARD TO AMEND widespread sentiment that these regulations are outdated and need to be modernized15 to accommodate this "epochal shift"16 in how biomedical evidence will be generated in the future. This regulatory modernization process offers an example of why the next quarter century of health law is likely to be more complicated-and a bit more legalistic-than "HL Version 1.0" (that is, health law as it developed over the past four decades). A common task in first-generation health law was to perform normative legal analysis on a blank or nearly blank slate. Health lawyers frequently found themselves working to design ethically appropriate policies for contexts where the existing law was silent or 14 Id.; see also 45 C.F.R. §§ 46.101-46.124 (2010). 15 See HHS, Human Subjects Research Protections: Enhancing Protections for Research Subjects and Reducing Burden, Delay, and Ambiguity for Investigators, 76 Fed. Reg. 44,512, 44,523, 44,525 (July 26, 2011) (to be codified at 45 C.F.R. pts. 46, 160, 164 and 21 C.F.R. pts. 50, 56) [hereinafter HHS, ANPRM] (noting in connection with a proposal to amend the Common Rule that "[c]ritics of the existing rules have observed that the current requirements for informed consent for future research with pre-existing data and biospecimens are confusing and consume substantial amounts of researchers' and [Institutional Review Boards'] time and resources") ("[O]ther fundamental protections for research participants may be warranted beyond updating the requirements for independent review and informed consent currently provided by the Common Rule."); see also IOM, PRIVACY REPORT, supra note 9, at 66 (discussing concerns that the Privacy Rule impedes beneficial access to data and biospecimens while also noting that many members of the public feel the regulation inadequately protects their privacy); William Burman & Robert Daum, Grinding to a Halt: The Effects of the Increasing Regulatory Burden on Research and Quality Improvement Efforts, 49 CLINICAL INFECTIOUS DISEASES 328, 328 (2009) (noting that "the application of the Health Insurance Portability and Accountability Act to research has overburdened institutional review boards (IRBs), confused prospective research participants, and slowed research and increased its cost"); Fred H. Cate, Protecting Privacy in Health Research: The Limits of Individual Choice, 98 CALIF. L. REV. 1765, 1797 (2010) (noting that "[clonsent requirements [of the existing regulations] not only impede health research, but may actually undermine privacy interests"). 16 Barbara J. Evans, Institutional Competence to Balance Privacy and Competing Values: The Forgotten Third Prong of HIPAA Preemption Analysis, 46 U.C. DAVIS L. REV. 1175, 1184 (2013). 369'2013 INDIANA HEALTH LAW REVIEW mumbling. Successful outcomes of these efforts included (to list just a few examples) the widespread adoption of advance directive statutes granting patients greater control of their end-of-life healthcare decision-making;1 7 the transformation of rudimentary, informal 1960s-era National Institutes of Health ethics policies18 into today's Common Rule; and the recognition of a greater federal responsibility to protect medical privacy and data security,19 two matters previously relegated to the inconsistencies of state law.2 0 When writing on a blank legal slate, one often encounters a striking convergence of bioethical and legal analysis. If the question is, "What should the legal rules be?" then grounding them in ethical principles is a reasonable approach, and normative legal and bioethical studies often resemble one another. In HL Version 2.0- health law as it is developing in the new century-scholars 17 See, e.g., Rebecca Dresser, Symposium: Precommitment Theory in Bioethics and Constitutional Law: Bioethics: Precommitment: A Misguided Strategy for Securing Death with Dignity, 81 TEX. L. REV 1823 (2003) (discussing the adoption of advance directive statutes in the 1990s and ethical and practical problems surrounding the use of advance directives). 18 See U.S. Dep't of Health & Human Servs., Protection of Human Subjects, 39 Fed. Reg. 18,914 (May 30, 1974) (to be codified at 45 C.F.R. pt. 46) (tracing the Common Rule to an existing departmental policy set out in ch. 1 - 40 of the DHEW Grants Administration Manual). 19 See Pub. L. No. 104-191, Title II, subtitle F (codified primarily in Title 42, ch. 7 of the U.S. Code, as "Part C-Administrative Simplification" §§ 1320d - 1320d-8) (authorizing the Secretary of Health and Human Services to promulgate various interrelated H[PAA regulations). See, e.g., The HIPAA Privacy Rule, 45 C.F.R. pts. 160, 164; U.S. Dep't of Health & Human Servs., Off. of Sec'y, Health Insurance Reform: Standards for Electronic Transactions: Final Rule, 65 Fed. Reg. 50312 (Aug. 17, 2000) (to be codified at 45 C.F.R. pts. 160, 162); U.S. Dep't of Health & Human Servs., Off. of Sec'y, Health Insurance Reform: Security Standards: Final Rule, 68 Fed. Reg. 8334 (Feb. 20, 2003) (to be codified at 45 C.F.R. pts. 160, 162, 164). 20 See National Committee on Vital and Health Statistics Subcommittee on Privacy and Confidentiality: Hearing on Implementation of the Federal Standards for Privacy of Individually Identifiable Health Information § II (Oct. 30, 2002) (statement of Joy L. Pritts, Senior Counsel, Health Privacy Project), available at http://www.ncvhs.hhs.gov/021030p6.htm (discussing states' efforts over many years to refine medical privacy standards and adapt them for changes in the healthcare industry). Vol. 10. 2370 WHY THE COMMON RULE IS HARD TO AMEND less frequently will find themselves writing on a blank slate. Identifying ethically appropriate policies remains just as important today as it always was but it is only one part of the health lawyer's job. Sound policies, once identified, may have to be implemented on a cluttered slate-and the clutter includes old statutes that may have seemed an expedient way to proceed during the heady days of HL Version 1. In addition to a clear head for bioethical analysis, HL Version 2 requires basic lawyering. skills- such as statutory construction and a tactical grasp of rulemaking procedure-with which to chisel out a space for good policy on a cluttered legal landscape. Recent efforts to modernize the Common Rule display this phenomenon and this article uses them to demonstrate the point. Amending the Common Rule presents two distinct sub- problems. The first is to identify sound substantive policies - in other words, to decide what the Common Rule's informed consent requirements ought to be. This first task is in many respects a normative bioethical inquiry that turns on concerns about respect for individual autonomy, the impact of data disclosures on dignitary interests of the individual, and the extent (if any) to which individuals should be called upon to sacrifice their own interests to serve the public good. The second sub-problem is more legal in nature. When stakeholders hold widely divergent views, who gets to set policy and what procedures must be followed when making these decisions? Statutes are relevant insofar as they may define the process for debating and resolving the underlying bioethical dilemmas. The next quarter century of health law is strewn with problems that present bioethical dilemmas wrapped in statutory constraints. II. SUMMARY OF THE 2011 PROPOSAL TO AMEND THE COMMON RULE In July 2011, the U.S. Department of Health and Human Services (HHS) Office for Human Research Protections (OHRP) published an advance notice of proposed 2013 371 INDIANA HEALTH LAW REVIEW rulemaking (ANPRM)21 that envisioned changes to the Common Rule. 22 The ANPRM was an optional, preliminary step that simply put the public on notice that the agency was considering the possibility of amending its regulations. This section summarizes the policy changes discussed in the ANRPM and then compares its proposed consent scheme for data and biospecimens to the existing provisions of the Common Rule and HIPAA Privacy Rule. A. Summary of the ANPRM's Reform Agenda Consistent with its preliminary nature, the ANPRM did not include specific, proposed regulatory text for public comment, as a true notice of proposed rulemaking would have done. Instead, the ANPRM sketched a broad outline of possible reforms the agency was considering and sought public comment on 74 broad questions.23 The first item on the ANPRM's reform agenda was called "Ensuring Risk-Based Protections"24 and included several proposals, all aimed at achieving a better fit between how much risk a research project poses and how much regulatory oversight it receives. One of these proposals was to impose mandatory data security standards, possibly identical to the HIPAA standards, 25 after which Institutional Review Boards (IRBs) no longer would be responsible for reviewing "informational risks" (risks to data security and privacy of research subjects).26 Other proposals would clarify when expedited IRB review is allowed and when continuing review is required.27 The ANPRM also proposed to replace the Common Rule's existing exemptions 28 with a new "excused" category of 21 HHS, ANPRM, supra note 15. 22 45 C.F.R. §§ 46.101-46.124 (2010). 23 See HHS, ANRPM, supra note 15, at 44,517-29. 24 Id. at 44,514-21. 25 Id. at 44,515, col. 1. 26 Id. at 44,515, col. 3 - 44,516, col. 1. 27 Id. at 44,516, col. 1 - 44,518, col. 2. 28 See 45 C.F.R. § 46.101(b) (2010) (listing various exemptions- i.e., situations where activities are exempt from the Common Rule's requirements). 372 Vol. 10.2 WHY THE COMMON RULE IS HARD TO AMEND research. 29 The Common Rule presently treats certain activities-including research with de-identified data and biospecimenS30-as altogether exempt from the Common Rule's regulatory requirements. Exempt activities require neither an IRB review nor informed consent (although many institutions do, nevertheless, have their IRBs oversee the threshold determination of whether an activity properly fits into one of the Common Rule's exemptions). The ANPRM's new category of excused research, like the existing exemptions, would not require IRB review. 31 In some cases, however, excused research would require informed consent. 32 The ANPRM thus was proposing to add new consent requirements for studies that use de-identified data and specimens. 33 The second major item on the ANPRM's reform agenda was to streamline IRB review of multisite studies. 34 HHS sought public comment on whether domestic sites in such studies should be able to designate a single "IRB of record" to review the study in a centralized fashion on behalf of all participating sites.35 The third agenda item was to improve the informed consent process for all types of studies, including clinical research as well as informational research.36 These consent-related proposals included, for example, to simplify consent forms.37 These proposals also addressed, in a more general way than the ANPRM's earlier discussion of exempt research had done, the question of consent for data and biospecimens. 38 Once again, the ANPRM proposed to 29 HHS, ANPRM, supra note 15, at 44,518, col. 2 - 44,521, col. 3. 30 45 C.F.R. § 46.101(b)(4). 31 HHS, ANPRM, supra note 15, at 44,518, col. 2. 32 Id.; see also id. at 44,519, col. 2 - 44,520, col. 1. 33 See id. at 44,518-21, 44,527 tbl.1 (proposing to require consent for certain exempt uses of data and biospecimens that do not presently require consent under the Common Rule). 34 HHS, ANPRM, supra note 15, at 44,521-22. 35 Id. at 44,522. 36 Id. at 44,522 - 44,524. 37 Id. at 44,523. 38 Id. at 44,523 - 24. 373'2013 INDIANA HEALTH LAW REVIEW require consent in some circumstances where the existing Common Rule does not do so. 3 9 The ANPRM's fourth major agenda item was to reduce informational risks by strengthening data protections. 40 Here, the ANPRM proposed to conform the Common Rule's definitions of certain terms, such as "identifiable" and "de- identified," to the HIPAA Privacy Rule's definitions and to apply the HIPAA Security Rule to research regulated by the Common Rule. The fifth agenda item was to improve HHS's collection of data to monitor how well research oversight is working under the Common Rule. 41 The sixth agenda item was to extend the reach of the Common Rule.4 2 Institutions that receive any federal funding that makes them subject to the Common Rule would have to apply the Common Rule to all research (including privately funded research) at their sites. The final agenda item was to provide greater harmonization of guidance issued by the various federal agencies that administer versions of the Common Rule. 4 3 HHS extended the comment period once at the request of affected parties. 44 The period for comments closed on September 26, 2011. The ANPRM docket received about 1,100 comments, some of them extensive and detailed.45 One year later, as this article was written, HHS still had not taken the next step of publishing proposed regulatory text for public comment. Such a delay is not unusual in a major rulemaking process and can suggest any number of things. For example, executive agencies may be reluctant to press forward with major, controversial rule changes during election years; the preliminary policies in an ANPRM 39 See discussion infra Part II. B. 40 HHS, ANPRM, supra note 15, at 44, 524 - 27. 41 Id. at 44,527 - 28. 42 Id. at 44,528. 43 Id. 44 U.S. Dep't of Health & Human Servs., Human Subjects Research Protections: Enhancing Protections for Research Subjects and Reducing Burden, Delay, and Ambiguity for Investigators; Extension of Comment Period, 76 Fed. Reg. 54,408 (Sept. 1, 2011). 45 See REGULATIONS.GOV, www.regulations.gov (last visited Mar. 18, 2013) (using the docket identifier "HHS-OPHS-2011-0005"). Vol. 10.2374 WHY THE COMMON RULE Is HARD TO AMEND sometimes lose momentum and need to be rethought before advancing to the next stage of rulemaking; or it simply can take more than a year for an agency, even when it is working diligently, to analyze a large volume of public comments and develop specific, proposed language to amend its regulations. B. Existing and Proposed Consent Provisions for Data and Biospecimens Nonconsensual access to health information and biospecimens is lawful and regularly occurs under the existing Common Rule and the HIPAA Privacy Rule. 4 6 Before these regulations came into being, there were well- established legal traditions supporting unconsented access in various contexts such as public health practice.47 Surveys show that the public feels concerned about any unconsented use of their health information, 48 but the current regulations allow such uses and they have been happening for many years. As a baseline rule, the Common 46 See Evans, supra note 5, at 82-86 (describing the existing framework for nonconsensual access to data under the HIPAA Privacy Rule and Common Rule). 47 See Paul J. Amoroso & John P. Middaugh, Research vs. Public Health Practice:' When Does a Study Require IRB Review.', 36 PREVENTIVE MED. 250, 250 (2003) (providing as examples of public health activities mandatory reporting of communicable diseases, investigating disease outbreaks, and collecting confidential information by public health authorities to protect the public health); see also IAWRENCE 0. GosnN, PUGLIC HEALTH IAW 4 (2nd ed. 2008) (characterizing public health law as focusing on population-oriented (as opposed to patient- specific) efforts "to ensure the conditions for people to be healthy (to identify, prevent, and ameliorate risks to health in the population)" and "to pursue the highest possible level of physical and mental health in the population, consistent with the values of social justice"). 48 See, e.g., 1M, PRIVACY REPORT, supra note 9, at 66 (noting that, "[iln some surveys, the majority of respondents were not comfortable with their health information being provided for research except with notice and express consent"); see also 10M, PRIVACY REPORT, supra note 9, at 82 (reporting results of multiple surveys that found "[platients were much more comfortable with the use of anonymized data (e.g., where obvious identifiers have been removed) than fully identifiable data"). 2013 375 INDIANA HEALTH LAW REVIEW Rule and the HIPAA Privacy Rule call for a consensual scheme of access and require informed consent 49 and/or a privacy authorization50 before information can be disclosed to a data user. However, these regulations are rife with exemptions,5 1 exceptions, 52 and definitionS53 that place specific activities-such as uses of data in judicial proceedings and public health activities-outside the usual consent and authorization requirements. 54 Both of the existing regulations also allow nonconsensual access to data by researchers, subject to various conditions that aim to reduce privacy risks: for example, if the data are de-identified,55 coded,56 or reduced 49 45 C.F.R. § 46.116 (2010) (describing the Common Rule's basic informed consent requirements). 50 See 45 C.F.R. § 164.508 (2010) (describing the HIPAA Privacy Rule's basic authorization requirements). 51 See id. § 46.101(b)-(d) (providing exemptions to the Common Rule). 52 See id. § 164.512 (providing exceptions to the HIPAA Privacy Rule's authorization requirements). 53 See, e.g., id. § 46.102(d) and (f) (defining the terms "research" and "human subject"); see also U.S. Dep't of Health & Human Servs., OHRP Guidance on Research Involving Coded Private Information or Biological Specimens, HHS.GOV (Oct. 16, 2008), http://www.hhs.gov/ ohrp/policy/cdebiol.html (last visited Mar. 21, 2013) [hereinafter OHRP Guidance] (construing these definitions in a way that causes research with de-identified and coded data and biospecimens not to be regarded as human subject research and not too require informed consent under the Common Rule, provided certain conditions are met). 54 See Barbara J. Evans, Congress' New Infrastructural Model of Medical Privacy, 84 NOTRE DAME L. REV. 585, 597, 619-22, 625-30 (2009) (describing in more detail the provisions for nonconsensual data access under the HIPAA Privacy Rule and nonconsensual access to data under the Common Rule and under the Food & Drug Administration's human-subject protection regulations at 21 C.F.R. pts. 50, 56); see also KRISTEN RosATI, AN ANALYSIS OF LEGAL ISSUES RELATED TO STRUCTURING FDA SENTINEL INITIATIVE ACTIVITIES (2009), available at http://www.regulations.gov/#!documentDetail;D=FDA-2009-N-0192- 0003.2 (discussing provisions of the Privacy Rule, Common Rule, the Privacy Act, and other relevant laws that affect access to data in postmarketing drug safety surveillance activities). 55 See 45 C.F.R. § 164.514(b) (2010) (providing that data can be de- identified, under HIPAA, by stripping off eighteen types of identifiers or by having a statistician certify that the risk of re-identification is "very small"); 45 C.FR §46.102(0 (defining "human subject" and implying that Vol. 10.2376 WHY THE COMMON RULE IS HARD To AMEND to a limited data set.5 7 The waiver provisions5 8 of the Common Rule and HIPAA Privacy Rule are the major pathway for nonconsensual research use of identifiable data and biospecimens. These provisions empower Institutional Review Boards or privacy boards (collectively, "IRBs")69 to approve waivers of the usual consent and authorization requirements. Under HIPAA, data supplied under a waiver must meet "minimum necessary"60 requirements. In other words, data and biospecimens can be disclosed only to the extent necessary to support the intended research purpose. The regulations specify various criteria to be met before an IRB can approve a waiver.61 These criteria do not require de-identification or even coding, and it is theoretically possible to acquire identifiable information without consent pursuant to an IRB-approved waiver. 62 Many IRBs, in practice, resist such disclosures but the regulations technically would allow them. research uses of data are not human subject research if investigators receive no identifying information and have no interactions with the subjects). But see HHS, ANPRM, supra note 15, at 44,519, 44,523 (proposing to require consent for some uses of de-identified data that would not require it under the present Common Rule). 56 See 45 C.F.R. § 164.514(c) (2010) (providing that coded data can be treated as de-identified under the HIPAA Privacy Rule if the code key complies with various restrictions on derivation and access); OHRP Guidance, supra note 53 (discussing appropriate coding of data and biospecimens under the Common Rule). 57 45 C.F.R. § 164.514(e). 58 45 C.F.R. § 164.512(i) (2010) (HIPAA waiver provision); 45 C.F.R. § 46.116(d) (Common Rule waiver provision). 69 See 45 C.F.R. §§ 46.103(b), 46.107-108 (2010) (desaribing IRBs for purposes of the Common Rule); 45 C.F.R. § 164.512(i)(2)(iv) (providing that waivers of authorization under the HIPAA Privacy Rule may be approved by either a Common Rule-compliant IRB or by a HIPAA- compliant "privacy panel" that is structurally similar to an IRB). 60 45 C.F.R. § 164.514(d) (2010). 61 Id. § 164.512(i) (2010) (HIPAA waiver provision); id. § 46.116(d) (Common Rule waiver provision). 62 See BARBARA J. EvANs, PHARMACOGENOMICS: APPLICATIONS TO PATIENT CARE 313, 331 (Howard L. MacLeod et al. eds., 2nd ed. 2009). R1.2(a); R15 (this is one chapter that Evans authored in a book, I treated under R15) ,2013 377 INDIANA HEALTH LAW REVIEW The ANPRM proposed changing the Common Rule's consent requirements for research that uses de-identified data and biospecimens. There have been ongoing concerns about the potential to re-identify such data and tissue resources, particularly with respect to genetic information. The risk of re-identification had become something of a hot topic in the year leading up to the ANPRM's publication,63 and the ANPRM lavished a great deal of attention on this risk. The ANPRM proposed to require written consent for research with pre-existing biospecimens (that is, specimens that have been collected prior to the time a research project commences), even when the specimens are de-identified in the sense of having had names and other overt identifiers removed. 64 In effect, ANPRM would treat biospecimens as intrinsically identifiable because of the genetic information imbedded in them. This new consent requirement would only apply prospectively to specimens collected after the amended Common Rule goes into effect. 65 For secondary research uses of existing health data, the proposed consent requirements would vary depending on the context in which the data originally were gathered. 63 See FED. TRADE COMVI'N, PROTECTING CONSUMER PRIVACY IN AN ERA OF RAPID CHANGE: A PROPOSED FRAMEWORK FOR BUSINESSES AND POLICYMAKERS 35-38 (2010) (warning that the distinction between personally identifiable information and non-identifiable information is increasingly irrelevant in light of the potential for data to be re- identified); Paul Ohm, Broken Promises of Privacy.' Responding to the Surprising Failure of Anonymization, 57 UCLA L. REV. 1701, 1706 (2010) (discussing the risks to individual privacy if de-identified data were to be re-identified); Mark A. Rothstein, Is Deidentification Sufficient to Protect Health Privacy in Research .9 10 Am. J. BIOETHICS 3, 5 (2010) ("Despite using various measures to deidentify health records, it is possible to reidentify them in a surprisingly large number of cases . . . ."); But see Deven McGraw, Data Identifiability and Privacy, 10 Am. J. BIOETHICS 30, 30 (2010) ("Using information in less identifiable form greatly reduces risks to privacy. . . ."); Daniel A. Moros & Rosamond Rhodes, Privacy Overkill, 10 Am. J. BIOETHICS 12, 13 (2010) ("There is no evidence to suggest, and no obvious reason to suppose ... that the current protections of deidentified research information are inadequate."). 64 HHS, ANPRM, supra note 15, at 44,519, 44,527, tbl. 1. 65 Id. at 44,520. Vol. 10.2378 WHY THE COMMON RULE IS HARD TO AMEND Secondary use of data collected for non-research purposes would not require consent so long as the data are de- identified.66 Thus, data originally collected for treatment or administrative (for example, insurance) purposes could be used in de-identified form without consent, just as such data can be used under the present Common Rule. Here, the ANPRM proposed no change from existing policy. However, data originally collected for one research purpose could not be de-identified and redeployed for secondary use in a different research project.67 A fresh consent would be required for the secondary research use. This proposal sought to curtail a questionable practice that sometimes occurs today, in which researchers obtain informed consent to collect data for a disclosed research purpose and then, by de-identifying the data, are able to use it in additional, undisclosed research projects. 68 Obviously, if the secondary uses are already contemplated when investigators are procuring the original consent, it is fraudulent not to disclose those uses to the research subject. The ANPRM would prevent such fraud by requiring investigators to obtain consent for all research studies that are being contemplated, even if those studies would only use the data in de-identified form. Unfortunately, this proposal also would require consent for future uses of de-identified data that were not contemplated at the time the original consent was procured. Quite often, future uses of de-identified data are not anticipated at the time of the original consent. Such uses may address scientific questions that arise long after the original research was completed. Secondary uses are not a fraud on the original consent if the investigators were not contemplating them when they procured that consent. There is a meaningful legal distinction between premeditated and unanticipated secondary uses of research data. Unfortunately, the ANPRM did not acknowledge this distinction and simply would ban all unconsented uses of de-identified data, even those involving no fraud. The 66 Id. at 44,520. 6 7 Id. 6 8 Id. 2013 379 INDIANA HEALTH LAW REVIEW ANPRM was seeking to address a real problem-fraud on the informed consent process-but its proposed solution was overbroad. The ANPRM posed questions but did not offer any specific proposals on two matters that are central to the debate about nonconsensual access to data and biospecimens: 1. Whether consent should be required for certain activities, such as quality improvement, public health, and program evaluation studies, that offer significant benefits to the general public,69 2. Under what circumstances it is appropriate to waive the requirement of informed consent.70 The search for sound policy on these matters requires a more fundamental rethinking of the Common Rule than the recent ANPRM offered.71 Part III explores why finding sound policy on these matters is one of the defining challenges of 21st-century health law and bioethics. Part IV then explores the challenge of fashioning an appropriate process for making any major changes to the consent provisions of the Common Rule. III. THE SUBSTANTIVE CHALLENGE OF MODERNIZING INFORMED CONSENT REQUIREMENTS FOR DATA AND BIOSPECIMENS The ANPRM offered a fairly detailed proposal for modernizing the consent rules for research that uses de- identified data and tissue resources, but scarcely touched 69 Id. at 44,521, question 24 (seeking public comment on whether certain high-valued uses of data, such as quality improvement and public health activities, should lie outside the Common Rule's consent requirements). 70 See id. at 44,523-25 (contemplating circumstances under which consent requirements could still be waived). 71 See, e.g., Evans, supra note 5, at 69 (criticizing the reform agenda outlined in the ANPRM). 380 Vol. 10.2 WHY THE COMMON RULE IS HARD TO AMEND the problem of access to identified data and biospecimens. De-identified data have only limited scientific utility,72 So the ANPRM evaded the pivotal issue in an age of large-scale informational studies. That pivotal issue is the framework for nonconsensual access to identifiable health information. Under existing regulations, this framework includes the provisions of the Common Rule and the HIPAA Privacy Rule that allow nonconsensual access to data and biospecimens for public health, quality improvement, and program evaluation activities and the provisions allowing waiver of consent for research. The epicenter of this problem is studies that require longitudinally linked health records. Such records allow patients' treatments and outcomes to be monitored on an ongoing basis across multiple encounters with the healthcare system.73 Creating longitudinal health records 72 Id. at 92-94 (discussing the scientific utility of various categories of health information and explaining why de-identified data are not a high-quality data resource for many types of scientific study); see also U.S. DEP'T OF HEALTH & HUMAN SERVS., FOOD AND DRUG ADMIN, REPORT TO CONGRESS: THE SENTINEL INITIATIVE--A NATIONAL STRATEGY FOR MONITORING MEDICAL PRODUCT SAFETY 11 (2011), available at http://www.fda.gov/downloads/Safety/FDAsSentinellnitiative/UCM2745 48.pdf ("As we have begun to grapple with the realities of conducting active medical product surveillance, however, we have come to understand that there may be infrequent occurrences when de- identified datasets may be insufficient to meet the needs of medical product surveillance."); see also Letter from Stanley H. Weiss, Chair, Joint Policy Committee of the Societies of Epidemiology, to Jerry Menikoff, Director, Office for Human Subject Protections (Oct. 26, 2011), available at www.regulations.gov (last visited Mar. 23, 2013) (referencing Document ID: HHS-OPHS-2011-0005-1066, at 4-5) (noting that in "[r]esearch on adverse drug events using computer-stored prescription data linked with hospital data . .. it is necessary to have information on identifiers in order to link the data that permits the research to be done"). 73 See U.S. Food & Drug Admin., Sentinel Network Public Meeting 51-56 (Mar. 7, 2007) (statement of Dr. Marc Overhage) [hereinafter FDA, March 7 Proceedings], available at http://www.fda.gov/ohrms/ dockets/dockets/07n0016/07n-0016-trO001.pdf (discussing importance of linking data longitudinally for use in observational studies of drug safety and noting that achieving longitudinal linkage requires at least some sharing of identifiable information); US Food & Drug Admin., Sentinel Network Public Meeting 73-74 (Mar. 8, 2007) (statement of Dr. 2013 381 INDIANA HEALTH LAW REVIEW requires at least some use of identifiable information to ensure that data received from various locations all pertain to the same person. 74 Because of this fact, access to de- identified data and biospecimens-even if the Common Rule continues in the future to allow it-will not answer the needs of studies that require longitudinal linkage of data from multiple insurers, healthcare providers, and biospecimen repositories. Moreover, consent bias is a genuine phenomenon in some research contexts: the subset of people who are willing to consent to research may not be reflective of the general population being studied.75 This fact implies a need for a suitably constrained mechanism allowing nonconsensual access in situations where the resulting bias would pose a problem. Conditioning access on patient consent can undermine the validity of some (although not all) types of scientific study.76 An important but poorly understood point is that shifting from an opt-in77 to an opt-out 7 8 consent Clement McDonald) [hereinafter FDA, March 8 Proceedings], available at http://www.fda.gov/ohrms/dockets/dockets/07n0016/07n-0016-trO002. pdf (discussing the importance of longitudinal population health data in drug safety research and noting the need to share identifiable information to link records from various data sources). 74 See 45 C.F.R. § 46.101(b) (2010); HHS, ANPRM, supra note 15, at 44,518, col. 2 - 44,521, col. 3. 75 See generally Brian Buckley et al., Selection Bias Resulting from the Requirement for Prior Consent in Observational Research A Community Cohort of People with Ischaemic Heart Disease, 93 HEART 1116 (2007); Casarett et al., supra note 8, at 593-94; IOM, PRIVACY REPORT, supra note 9, at 209-14 (surveying studies of consent and selection bias); Khaled El Emam et al., A Globally Optimal k-Anonymity Method for the De-identification of Health Data, 16 J. Am. MED. INFO. Ass'N 670, 670 (2009); Steven J. Jacobsen et al., Potential Effect of Authorization Bias on Medical Record Research, 74 MAYO CLINIC PROC. 330 (1999); Jack V. Tu et al., Impracticability of Informed Consent in the Registry of the Canadian Stroke Network, 350 NEW ENG. J. MED. 1414 (2004); Steven H. Woolf et al., Selection Bias from Requiring Patients to Give Consent to Examine Data for Health Services Research, 9 ARCHIVES FAm. MED. 1111 (2000). 76 Evans, supra note 5, at 92, 95-96. 77 See Mark A. Rothstein, Health Privacy in the Electronic Age, 28 J. LEGAL MED. 487, 490-91 (2007) (defining an opt-in consent framework as one that allows data to be used only if the patient affirmatively consents); see also 45 C.F.R. § 46.116 (2010) (adopting an Vol. 10. 2382 WHY THE COMMON RULE IS HARD TO AMEND framework cannot fully eliminate consent bias.79 These facts imply a need for an appropriate framework for approving and managing nonconsensual uses of identifiable data and biospecimens. The devil is in the details of defining procedures and protections that are "appropriate" when taking people's data and biospecimens without their consent. The existing Common Rule and HIPAA Privacy Rule already contain such a framework, so the notion of allowing nonconsensual access is not a radical departure from existing policies. However, it is probably fair to say that all sides are unhappy with the existing framework, which is criticized both for being too permissive and too parsimonious in granting access to data and biospecimens. Recent technological developments and legislation place further pressure on the existing regulatory framework. It is important to understand the sheer scale of data systems that are feasible from a technical point of view and which are necessary to achieve some of the objectives Congress has set in recent legislation. A good example is the Food and Drug Administration Amendments Act of 2007 (FDAAA),80 which calls for heavy use of observational (epidemiological) studies as a source of regulatory and scientific evidence for postmarketing drug safety regulation. In FDAAA, Congress authorized development of a 100-million-person postmarketing drug safety surveillance system.8' As of July, 2011, the Food and Drug Administration's (FDA's) opt-in consent scheme in the presently effective Common Rule); 45 C.F.R. § 164.508 (adopting opt-in consent in the HIPAA authorization requirements). 78 See, e.g., Michael Birnhack & Niva Elkin-Koren, Does Law Matter Online? Empirical Evidence on Privacy Law Compliance, 17 MICH. TELECOMM. & TECH. L. REV. 337, 339 (2011), available at http://papers.ssrn.com/sol3/papers.cfm?abstractid=1456968 (describing an opt-out consent scheme that presumes data can be used unless the data subject affirmatively objects). 79 Evans, supra note 5, at 96. 80 Pub. L. No. 110-85, 121 Stat. 823 (2007) (codified as amended in scattered sections of 21 U.S.C.). 81 See FDAAA, supra note 2, at § 905 (introducing a new § 505(k)(3) to the FFDCA) (codified at 21 U.S.C. § 355(k)(3)). 2013 383 INDIANA HEALTH LAW REVIEW Mini-Sentinel project, 82 which is the pilot phase of this system, 83 already held information for ninety-nine million health plan members, including sixty-three million people between the ages of twenty and sixty-four, and 8.1 million pediatric patients aged nine or under.84 There were 300 million person-years of data from 2.4 billion unique patient encounters with healthcare providers, including thirty-eight million acute inpatient stays and 2.9 billion dispensings of prescriptions, and all the data were being regularly updated.85 Similarly scaled drug safety networks are under development in Canada,86 the European Union,87 and Japan.88 82 See Richard Platt et al., The US. Food and Drug Administration's Mini-Sentinel program: status and direction, 21 PHARMACOEPIDEMIOLOGY AND DRUG SAFETY 1 (2012) (describing the Mini-Sentinel pilot project); see also Lesley Curtis et al., Design considerations, architecture, and use of the Mini-Sentinel distributed data system, 21 PHARMACOEPIDEMIOLOGY & DRUG SAFETY 23, 28 (2012) (discussing the types of data included in the system); Melissa Robb et al., The US. Food and Drug Administration's Sentinel Initiative: Expanding the horizons of medical product safety, 21 PHARMACOEPIDEMIOLOGY & DRUG SAFETY 9, 9-10 (discussing various applications of the system). 83 Rachel E. Behrman et al., Developing the Sentinel System - A National Resource for Evidence Development, 364 NEW ENG. J. MED. 498, 498 (2011); see also U.S. FOOD & DRUG ADMIN., THE SENTINEL INITIATIVE (2008), available at http://www.fda.gov/downloads/Safety/ FDAsSentinellnitiative/UCM124701.pdf (discussing the goals and structure of the Sentinel data network); see also FDA's Sentinel Initiative, U.S. FOOD & DRUG ADMIN., http://www.fda.gov/Safety/ FDAsSentinellnitiative/default.htm (last visited Mar. 22, 2013) (discussing recent progress toward implementation of the Sentinel System). 84 Curtis et al., supra note 82, at 28. 85 Platt et al., supra note 82, at 4. 86 See In Brief The Drug Safety and Effectiveness Network (DSEN), CAN. INSTS. OF HEALTH RES., http://www.cihr- irsc.gc.ca/e/39389.html (last visited Mar. 9, 2013) 0; Medicines that Work for Canadians: Business Plan for a Drug Effectiveness and Safety Network, HEALTH CANADA (2007), http://www.hc-sc.gc.ca/hcs-sss/alt_ formats/hpb-dgps/pdf/pubs/pharma/2007-med-workeff/2007-med-work- eff-eng-final.pdf (last visited Mar. 9, 2013) (describing Canada's DSEN network). 87 See Press Release, European Medicines Agency, EMEA- Coordinated PROTECT Project Has Been Accepted for Funding by the Vol. 10.2384 WHY THE COMMON RULE 18 HARD To AMEND Multi-million person health data networks are a necessary resource, if the goal is to detect emerging drug safety problems significantly faster than the 65 months that it took for the FDA to confirm that rofecoxib (Vioxx) was causing cardiovascular problems and needed to be removed from the market. 89 Six months before Congress passed FDAAA, the FDA heard testimony 90 that the time it took to confirm the safety problem with Vioxx could have been cut almost in half-to 34 months-had the agency been conducting pharmacoepidemiological surveillance studies using insurance claims data for seven million persons. With data for 100 million people, the problem could have been confirmed within 3 months. 91 Innovative Medicines Initiative Joint Undertaking (Apr. 30, 2009), http://www.ema.europa.eu/ema/index.jsp?curl=pages/newsandevents/ news/2009/11/news detail 000096.jsp&jsenabled=true (last visited Mar. 9, 2013) (describing the PROTECT network); Implementation of the Action Plan to Further Progress the European Risk Management Strategy Rolling Two-Year Work Programme (2008-2009), EUROPEAN MEDICINES AGENCY (Dec. 24, 2007), http://www.emea.europa.eu/pdfs/ human/phv/28008907en.pdf (last visited Mar. 9, 2013) (describing the ENCePP data network); EUROPEAN NETWORK OF CENTRES FOR PHARMACOEPIDEMIOLOGY AND PHARMACOVIGILANCE ("ENCePP"), http://encepp.eu (last visited Mar. 9, 2013); EU-ADR, http://www.alert- project.org/ (last visited Mar. 9, 2013) (describing the European Union adverse drug reactions data network). 88 Kaoru Misawa, Dir., Office of Safety, Pharm. & Med. Devices Agency, Address at the 9th Kitasato University-Harvard School of Public Health Symposium: Sentinel Initiative in Japan: Utilization of Electronic Health Information in Pharmacovigilance 7-14 (Sept. 11-12, 2009), http://www.pharm.kitasato-u.ac.jp/biostatis/khsympo2009O9/doc/ misawa.pdf (last visited Mar. 16, 2013). 89 Evans, supra note 2, at 456. 90 U.S. FOOD & DRUG ADMIN., U.S. DEP'T OF HEALTH & HUMAN SERVS., PROCEEDINGS, SENTINEL NETWORK PUBLIC MEETING 67-68 (2007) (statement of Dr. Richard Platt) [hereinafter FDA, March7Proceedings], avalable at http://www.fda.gov/downloads/Safety/FDAsSentinellnitiative/ ucm116513.pdf. 91 Id. at 70. Note that this three-month figure was counted from the time data became available for analysis. In practice, it takes several months for insurance claims data to stabilize after patients receive healthcare, so in practice it might take six or seven months rather than the three months reported. 2013 385 INDIANA HEALTH LAW REVIEW Such findings underscore a feature of the 21st century research environment: some of the emerging-and very promising-types of informational study are inherently collective in their nature.92 Unlike the randomized, controlled clinical trials for which the Common Rule was primarily designed, these new methodologies sometimes require extremely large, inclusive datasets free of the biases that can creep in if people self-select for research participation. Restricting the use of data to protect privacy could actually leave people to die. This does not necessarily mean there is a "research imperative" 93 that compels us to allow such studies merely because they could save other people from death or serious injury. It merely means that if we want to save those lives, some nonconsensual access to identifiable data will be required. Perhaps we as a society do not want to save those lives. Perhaps we are at a moment in history where there are so many excess people in the world, and so many embarrassing medical facts in storage, and so much risk of malicious or inadvertent disclosure of those facts that, in the greater balance of things, protecting people's medical secrets has become a higher priority than saving a few thousand human lives. It is true that soldiers nobly sacrifice their lives for abstract ideas like "freedom" and "liberty," and Americans have some degree of comfort with those sacrifices. Are they equally comfortable with the notion that abstract ideas of ''patient autonomy" and "data privacy" and "patient control over medical data" are worth a few thousand or tens of thousands of preventable deaths (so long as it is someone else)? That may be a legitimate question to ask; it is possible, after all, to entertain an idea without accepting 92 See Evans, supra note 5, at 76 (discussing why large-scale informational research is an inherently collective enterprise). 93 See DANIEL CALLAHAN, WHAT PRICE BETTER HEALTH? (2006) (challenging the notion that medical research is inherently good and should be pursued without regard to the burdens it places on competing values); but see Mildred Z. Solomon & Ann C. Bonham, Ethical Oversight of Learning Health Care Systems: Ethical Oversight of Research on Patient Care, 43 HASTINGS CENTER REP. S2 (2013) (suggesting that patients may have a "moral imperative" to participate in a learning healthcare system). 386 Vol. 10.2 WHY THE COMMON RULE IS HARD TO AMEND it.94 By way of disclosing personal biases, however, I too can entertain the idea that privacy may be worth the cost of human life, but I personally do not accept that idea. Like- I suspect-many Americans, I want a great deal of personal control over what is done with my data and biospecimens, but in the final analysis I am not prepared to insist that my medical secrets be protected at the cost of other people's lives. Others are free to value things differently, and their valuations deserve respect. What many Americans want, perhaps, is not so much the right to consent to each and every use of our data and biospecimens, but a strong assurance that every unconsented use of these resources will, in fact, serve a vital, life-saving objective. The waiver provisions of HIPAA and the Common Rule presently lack a meaningful "public use" criterion to assure us that unconsented uses of our data and biospecimens will serve a socially beneficial purpose. 95 On those terms, unconsented use of our data and biospecimens is indeed objectionable. Obtaining consent from 100 million people raises obvious questions of practicability and, indeed, the large pharmacoepidemiological networks described earlier do not rely on consent as the mechanism for privacy protection. Nonconsensual access to data for use in the FDA's postmarketing drug safety surveillance is possible because this a public health use,96 which can occur nonconsensually 94 See "It is the mark of an educated mind to be able to entertain a thought without accepting it" attributed to Aristotle, QUOTES.NET, http://www.quotes.nte/quote/1979 (last visited Mar. 9, 2013). 95 See Evans, supra note 5, at 119 - 24 (discussing the lack of criteria in the HIPAA and Common Rule waiver provisions to ensure that unconsented disclosures of data and biospecimens will serve socially beneficial objectives). 96 See Letter from Rachel Behrman, Sentinel Initiative Executive Sponsor, to Dr. Richard Platt, Harvard Medical School and Harvard Pilgrim Health Care (July 19, 2010), in KRISTEN ROSATI , BARBARA EVANS & DEVEN MCGRAW, HIPAA AND COMMON RULE COMPLIANCE IN THE MINI-SENTINEL PILOT 12-14 (2010), available at http://mini- sentinel.org/work-products/AboutUs/HIPAAandCommonRuleCompli ance in theMini-SentinelPilot.pdf (emphasizing that all presently planned uses of the Mini-Sentinel System constitute public health activities by the FDA). 3872013 INDIANA HEALTH LAW REVIEW under the Common Rule and HIPAA Privacy Rule. 9 7 Whether a consent requirement actually protects privacy has been the subject of considerable debate,98 and there have been many calls for alternative protections, for example, strict data security arrangements and fair information practices. 99 The FDA adopted this latter approach for its Mini-Sentinel system. It employs a distributed networked architecture that leaves identifiable data sequestered behind the privacy firewalls of the healthcare providers and insurers who already hold the data,100 and it implements a special framework of privacy and operating policies that Congress required the FDA to develop, and which are now in place. 101 Achieving access for public health applications is, however, just one small part of the problem. Many socially beneficial data uses will be privately sponsored, particularly in an era of intense pressure on government budgets. There has been a tendency, in recent legislation, to blur traditional lines between "private" and "public" and between "research" and "public health." Once again, FDAAA supplies an example. It added a new § 505(o)(3)102 to the Federal Food, Drug, and Cosmetic Act ("FFDCA"),103 which allows the FDA to order pharmaceutical companies to 97 See, e.g., Letter from Jerry Menikoff, Director, Office for Human Research Protections, to Rachel E. Behrman, Acting Assoc. Dir. of Med. Policy, Center for Drug Evaluation and Research, U.S. Food & Drug Admin. (Jan 19, 2010), in ROSATI ET AL., supra note 96, at 10 (deeming Sentinel activities not to be regulated by the Common Rule). 98 See, e.g., Fred H. Cate, Protecting Privacy in Health Research: The Limits of Individual Choice, 98 CALIF. L. REV. 1765, 1797 (2010) ("Consent requirements not only impede health research, but may actually undermine privacy interests."). 99 IOM, PRIVAcY REPORT, supra note 9, at 4-5. 100 See Curtis, supra note 82 (discussing Mini-Sentinel's distributed architecture). 101 See Mini-Sentinel:. Principles and Policies, MINI-SENTINEL.ORG (August 2012), http://mini-sentinel.org/work-products/AboutUs/Mini- Sentinel-Principles-and-Policies-August- 2012.pdf#page=27 (last visited Mar. 16, 2013). 102 21 U.S.C. § 355(o)(3) (2012). 103 Federal Food, Drug, and Cosmetic Act of 1938, Pub. L. No. 75- 717, 52 Stat. 1040 (1938) (codified as amended at 21 U.S.C. §§ 301-399 (2006)). 388 Vol. 10.2 WHY THE COMMON RULE Is HARD To AMEND conduct postmarketing observational studies of drug safety.104 In some respects these § 505(o)(3) observational studies do resemble a public health activity: the FDA, acting in its capacity as a public health agency, can order the studies only in response to a narrow set of statutorily defined public health concerns about the safety of approved drugs.105 Yet these studies also have attributes of commercial research, because they are likely to produce generalizable knowledge about drug safety and will be conducted or at least sponsored by private-sector pharmaceutical companies. 106 Unfortunately, it appears unlikely that any data actually will be available to use in these studies. IRBs, in their role of approving HIPAA waivers for access to data held by insurers and healthcare providers, are likely to balk at characterizing these studies as a public health activity for which nonconsensual access to data would be allowed.107 These IRBs also may be reluctant to approve HIPAA waivers allowing the release of data to commercial pharmaceutical companies that, ordinarily, are not subject to the HIPAA Rule and the Common Rule.108 FDA's own human subject protections apply to clinical studies and do not even appear to cover observational studies that use data.109 This resulting lack of data access could have several bad consequences. These include requiring the FDA 104 See U.S. DEP'T OF HEALTH & HUMAN SERVS., U.S. FOOD AND DRUG ADMIN., CTR. FOR DRUG EvAL., AND RES. & CTR. FOR BIOLOGICS EvAL. AND RES., GUIDANCE FOR INDUSTRY: POSTMARKETING STUDIES AND CLINICAL TRIALS -- IMPLEMENTATION OF SECTION 505(o)(3) OF THE FEDERAL FOOD, DRUG, AND COSMETIC ACT (2011) [hereinafter, "FDA, April 2011 Guidance"], available at http://www.fda.gov/downloads/ Drugs/GuidanceComplianceRegulatorylnformation/Guidances/UCM172 001.pdf (describing how the FDA plans to use its powers to order postmarketing studies and clinical trials). 105 Id. at 4 (referencing § 355(o)(3)(B)). 106 Barbara J. Evans, The Ethics of Postmarketing Observational Studies of Drug Safety Under Section 505(o)(3) of the Food, Drug, and Cosmetic Act, 38 AM. J.L. & MED. 577, 585 (2012). 107 See id. at 587-94 (discussing barriers to access to data for sec. 505(o)(3) studies). 108 Id. at 592-93. 109 Id. at 593. 3892013 INDIANA HEALTH LAW REVIEW (in other words, taxpayers) to fund drug safety studies that could have been financed by pharmaceutical companies if data had been available; subjecting human subjects to the very real risks of postmarketing safety-related clinical trials to answer questions that might have been answered less intrusively via observational studies; and leaving injury- producing drugs on the market because of delays in generating sound evidence with which the FDA could act to manage their risks. 110 The incapacity of old, 20th-century regulations, such as the Common Rule, to accommodate these novel "hybrid" (public/private) data uses is another major factor fueling pressure for reform. Deciding what to do is a normative bioethical problem: what should policy be? The normative problem is indeed an important problem but it is not the only problem. IV. FINDING AN APPROPRIATE PROCESS TO MODERNIZE THE COMMON RULE The ANPRM111 presumed that it is lawful to amend the informed consent provisions of the Common Rule by means of informal, or notice-and-comment, rulemaking. Informal rulemaking under the Administrative Procedure Act ("APA")112 is the familiar process through which a federal agency develops a proposed regulation, publishes notice of the proposed rulemaking in the Federal Register, and allows a period for the public to submit written comments, after which the agency may withdraw its proposal, revise it, or promulgate a final regulation accompanied by a statement explaining the agency's action. 113 The process is "informal" in that the agency may, 114 but is not required to, hold a formal evidentiary hearing at which interested 110 Id. at 595-598. 111 See HHS, ANPRM, supra note 15. 112 The Administrative Procedure Act of 1946, Ch. 324, 60 Stat. 237 (1946) (codified as amended at scattered sections of 5 U.S.C.); see 5 U.S.C. § 553 (2012). 113 5 U.S.C. § 553 (2012). 114 5 U.S.C. § 553(c); Vermont Yankee Nuclear Power Corp. v. NRDC, 435 U.S. 519, 524 (1978) (dictum). 390 Vol. 10.2 WHY THE COMMON RULE IS HARD TO AMEND parties can appear and challenge the evidence on which the agency will base its decision. Informal rulemaking has been an important way for agencies to promulgate and amend regulations in the seventy or so years since the APA was enacted.115 It is not sufficient, however, when Congress has enacted a statute that requires an agency to employ some other procedure when making or amending its rules. This section explores special procedures that Congress imposed by statute at the inception of efforts to develop the Common Rule. The relevant statutes are still in effect today and they constrain HHS's power to amend the Common Rule's informed consent requirements for data and biospecimens. For major, substantive amendments of the type contemplated in the ANPRM, ordinary informal rulemaking procedures may not be lawful. This raises the possibility that the agency may need to follow different procedures or even seek additional authority from Congress to make some of the changes it proposed in the ANRPM. A. Sources of HHS's Authority to Amend the Common Rule Any amendments to the Common Rule must be consistent with the statutes that authorize HHS to regulate in the area of human subject protections. The Common Rule cites its three sources of statutory authority as 5 U.S.C. § 301; 42 U.S.C. § 289 and in particular, § 289(a); and 42 U.S.C. § 300v-1(b).116 These statutes empowered HHS and its precursor, the Department of Health, Education, and Welfare (HEW) to promulgate the Common Rule in its present form. In the absence of subsequent statutes altering HHS's authority to regulate in this area, these same three statutes define the scope of HHS's power to amend the Common Rule. 115 See, e.g., James V. DeLong, Informal Rulemaking and the Integration of Law and Policy, 65 VA. L. REV. 257, 257 - 260 (1979) (commenting on the widespread use of informal rulemaking). 116 See 45 C.F.R. pt. 46, subpt. A (citing, at the end of each section of the Common Rule, the statutes that authorized promulgation of the respective sections of the regulation). 3912013 INDIANA HEALTH LAW REVIEW The statute at 5 U.S.C. § 301 is a generally applicable "housekeeping" statute that authorizes the head of any federal agency to set regulations to govern the agency's own operations. This statute undergirds those parts of the Common Rule that define roles that HHS, OHRP, and their personnel are to play in administering the overall framework of research oversight. The authority conferred by this statute supports some of the ANPRM's proposed initiatives, such as the proposal to improve HHS's collection of data to monitor how well the Common Rule is working.117 This statute provides no authority, however, to set substantive standards of human subject protection, such as informed consent requirements and other standards that define the rights and duties of human research subjects, investigators, and research institutions. 118 The statute at 42 U.S.C. § 289(a)119 is part of the Public Health Service Act's subchapter governing the National Institutes of Health. It grants the Secretary of HHS ongoing power to prescribe regulations governing the establishment of Institutional Review Boards (IRBs) that review research funded by the NIH. 120 Under this statute, HHS can require grant applicants to have an IRB and can set rules (such as IRB membership and registration requirements) that govern how to establish an IRB. This statute supports some of the ANPRM's initiatives, such as the proposal to recognize a single IRB of record for multisite studies. 121 As worded, 122 however, 42 U.S.C. § 289(a) does 117 HHS, ANPRM, supra note 15, at 44,527-28. 118 See 5 U.S.C. § 301 (2012). 119 See 42 U.S.C. § 289(a) (2012) ("The Secretary [of HHS] shall by regulation require that each entity which applies for a grant, contract, or cooperative agreement under this chapter for any project or program which involves the conduct of biomedical or behavioral research involving human subjects submit in or with its application for such grant, contract, or cooperative agreement assurances satisfactory to the Secretary that it has established (in accordance with regulations which the Secretary shall prescribe) a board (to be known as an "Institutional Review Board") to review biomedical and behavioral research involving human subjects conducted at or supported by such entity in order to protect the rights of the human subjects of such research."). 120 Id 121 HHS, ANPRM, supra note 15, at 44,521-22. 392 Vol. 10. 2 WHY THE COMMON RULE IS HARD TO AMEND not grant HHS any power to set the substantive standards of human subject protection that guide IRBs, once they are established, in their oversight of research. A separate statute, 42 U.S.C. § 300v-1, defines the process for developing the Common Rule's substantive standards including "the requirements for informed consent to participation in research projects."123 Part of this statute, § 300v-1(b), authorizes the Secretary of HHS to regulate in this area, and the Common Rule relies on § 300v-1(b) as its third source of statutory authority. Congress imposed special procedural requirements that HHS must follow when establishing informed consent requirements. This statute is thus quite different from the two just discussed, 5 U.S.C. § 301 and 42 U.S.C. § 289(a), which impose no special procedural requirements. HHS is free to employ default A.P.A. procedures, including informal rulemaking, when making or amending regulations under those two statutes. Unfortunately, U.S.C. § 301 and 42 U.S.C. § 289(a) do not authorize HHS to amend the Common Rule's informed consent requirements. Legal authority for HHS to amend the informed consent requirements, if it exists at all, arises under 42 U.S.C. § 300v-1 and requires special procedures in addition to the usual APA informal rulemaking requirements. 122 See 42 U.S.C. § 289(a) (providing that grant applicants must show that they have "established (in accordance with regulations which the Secretary shall prescribe) a board (to be known as an 'Institutional Review Board') . . ."). The placement of the parenthetical phrase, "(in accordance with regulations which the Secretary shall prescribe)" clearly relates it to the establishment of IRBs, rather than to the substantive standards that they apply in reviewing research. This interpretation is consistent with the fact that Congress saw a need to enact a separate statute, 42 U.S.C. § 300v-1, which does supply authority to establish substantive standards of human subject protection. 123 42 U.S.C. § 300v-1(a)(1)(A) (2012). 3932013 INDIANA HEALTH LAw REVIEW B. Why Congress Constrained HHS's Authority to Set Informed Consent Requirements The statute at 42 U.S.C. § 300v-1 was enacted as part of the National Research Act of 1978 ("1978 Act").124 § 300v-1 replaced an earlier-and in many respects similar-statute enacted in the National Research Service Award Act of 1974 ("1974 Act"). 125 A consistent theme in both statutes was that Congress was hesitant to grant the Secretary of HEW/HHS unfettered discretion to set informed consent requirements and other substantive standards of human subject protection. Congress imposed special procedures that constrain the Secretary's authority to make and amend provisions of the Common Rule that establish substantive standards. Several factors may explain these constraints. 1. Inteligible principles to guide agency rulemaking. Congress may have been concerned about using bioethical principles as a standard to guide delegated lawmaking authority because of their unintelligibility. On various occasions, the U.S. Supreme Court has expressed concern that delegation of lawmaking authority to an administrative agency is unconstitutional unless Congress provides an intelligible principle to guide the agency. 126 In practice, the Court has been very permissive in what it considers intelligible, 127 but bioethical principles press the outer limits of intelligibility. In a different legal context- qualification of expert witnesses-" [c]ommentators have 124 Community Mental Health Centers Extension Act of 1978, Pub. L. No. 95-622, 92 Stat 3412 (1978); see id. § 301 (establishing the President's Commission for the Study of Ethical Problems in Medicine and Biomedical and Behavioral Research). 125 National Research Act of 1974, Pub. L. No. 93-348, §§ 201-02, 88 Stat. 342 (codified as amended in scattered sections of 42 U.S.C.). 126 See, e.g., Whitman v. American Trucking Ass'ns, 531 U.S. 457, 472 (2001) (citing J.W. Hampton, Jr., & Co. v. United States, 276 U.S. 394, 409 (1928)). 127 See Jeffrey A. Wertkin, Reintroducing Compromise to the Nondelegation Doctrine, 90 GEO. L. J. 1055 (2002) (noting a "disconnect between legal principle and application"). 394 Vol. 10.2 WHY THE COMMON RULE IS HARD TO AMEND been highly skeptical about the reliability of bioethics testimony" 128 out of concern that ethics experts "disagree so much and so radically that we hesitate to say that they are experts."1'2 Certain types of ethical testimony do satisfy the standards of admissibility. This is true of descriptive ethics (for example, describing the ethical beliefs or ethical practices of a group of people) and metaethical analysis (for example, identifying the ethical dimensions of an issue).130 Normative ethics-testimony about "[w]hat ought to be the practice?" 131 - is so slippery and debatable that there is ongoing controversy about whether it is worthy of being treated as a source of legal evidence.132 A grant of rulemaking authority to define what the practice of informed consent should be is, in essence, a license to give normative bioethical principles the force of law. Ethicists disagree "so much and so radically"133 that this would amount to delegation without standards if the task were left to the discretion of an individual, such as the Secretary of HHS. One Secretary might view patient control of data as paramount while another might emphasize public benefits that might flow from wider access to data. Congress refused to make such a delegation and instead empowered two statutorily created commissions to enunciate standards to guide future rulemaking. Title II of the 1974 Act authorized creation of a National Commission for the Study of Ethical Problems in Medicine and Biomedicine (the "National Commission").134 Congress 128 Bethany Spielman & George Agich, The Future of Bioethics Testimony: Guidelines for Determining Qualifications, Reliability, and Helpfulness, 36 SAN DIEGO L. REV. 1043, 1055 (1999). 129 Id. (citing J.R. Bambrough, Plato's Political Analogies, in PLATO, POPPER AND POLITICS 152, 158 (R. Bambrough ed., 1967). 130 Edward J. Imwinkelried, Expert Testimony by Ethicists, 76 TEMP. L. REV. 91, 96-98, 99 (2003). 131 Id. at 98. 132 Id. at 105-106. 133 Spielman, supra note 128, at 1055 (citing Bambrough). 134 See National Research Act of 1974, Pub. L. No. 93-348, §§ 201- 02, 88 Stat 342 (1974) (enacting 42 U.S.C. § 2891-1, the precursor of today's § 300v-1, creating the National Commission and describing its role in developing substantive standards of human subject protection); see also HEW, 1978 REPORT, supra note 6 (discussing the National 3952013 INDIANA HEALTH LAW REVIEW ordered the National Commission to "conduct a comprehensive investigation and study to identify the basic ethical principles, which should underlie the conduct of biomedical and behavioral research involving human subjects." 135 This mandate authorized work on the Belmont Report,136 which is still widely recognized and cited by bioethicists. Many bioethicists today are less aware that Congress prescribed additional duties for the National Commission. The resulting work product has an enduring legal significance. Congress called for the National Commission to be directly involved in efforts to specify the substantive content of regulations at 45 C.F.R. pt. 46, which translate the Belmont Report's broad ethical principles into legally enforceable requirements. Congress ordered the National Commission to "develop guidelines which should be followed in such research"137 and to "make recommendations to the Secretary . . . for such administrative action as may be appropriate to apply such guidelines to biomedical and behavioral research conducted under programs administered by the Secretary."138 In a detailed 1978 report,13 9 the National Commission issued its recommendations on the informed consent provisions and other substantive protections that should be included in the Common Rule. These recommendations (hereafter, "the regulatory recommendations"), along with the Belmont Report, set the parameters of human subject protection under the Common Rule. Congress itself provided close oversight of the Common Rule as it developed. The 1974 Act required the National Commission to make periodic reports and recommendations to Congress.140 Congress held multiple hearings throughout Commission's work and reporting its findings). 135 National Research Act §202(A)(1)(A)(I). 136 See Protection of Human Subjects; Belmont Report: Ethical Principles and Guidelines for the Protection of Human Subjects of Research, 44 Fed. Reg. 23,192 (1979) [hereinafter BELMONT REPORT]. 137 National Research Act § 202(A)(1)(A)(II). 138 National Research Act § 202(A)(1)(A)(III). 139 See HEW, 1978 REPORT, supra note 6. 140 National Research Act of 1974, Pub. L. No. 93-348, §§ 202(C)(3), 396 Vol. 10.2 WHY THE COMMON RULE IS HARD TO AMEND the 1970s to explore issues related to human subject protection. Although satisfied with the National Commission's work, Congress concluded that its mandate to focus on HHS-funded research programs was too narrow and should be broadened to address human subject protection problems at other federal agencies.141 The 1978 Act replaced the National Commission with a new President's Commission 42 to address human subject protections for all federal agencies. This began the effort to arrive at a truly "Common" Rule.143 202(D), 204(D), 88 Stat 342 (1974). 141 See S. REP. No. 95-852 (1978) ("Although the Committee believes that the National Commission for the Protection of Human Subjects of Biomedical and Behavioral Research [the 1974 Commission] has been functioning very successfully, as oversight hearings in this area have continued, it has become increasingly clear to the Committee that the jurisdiction of the National Commission is too limited. . . . "). 142 Community Mental Health Centers Extension Act of 1978, Pub. L. No. 95-622, § 301, 92 Stat 3412, (enacting 42 U.S.C. §§ 300v, 300v-1 to establish a President's Commission for the Study of Ethical Problems in Medicine and Biomedical and Behavioral Research). 143 A total of 18 federal agencies now follow the Common Rule, which has been codified in the federal regulations at 15 locations that regulate 16 federal agencies. In addition, the Central Intelligence Agency follows the Common Rule, Exec. Order No. 12,333, 46 Fed. Reg. 59,941, 59,952 (Dec. 4, 1981), and the Social Security Administration follows the Common Rule, Social Security Independence and Program Improvements Act of 1994, Pub. L. No. 103-296, §106(b), 108 Stat. 1464, 1476 (1994). The 15 regulations are: 45 C.F.R. pt. 46 (HHS); 7 C.F.R. pt. 1 (2005) (Department of Agriculture); 10 C.F.R. pt. 745 (2005) (Department of Energy); 14 C.F.R. pt. 1230 (2005) (National Aeronautics and Space Administration); 15 C.F.R. pt. 27 (2005) (Department of Commerce); 16 C.F.R. pt. 1028 (2005) (Consumer Product Safety Commission); 22 C.F.R. pt. 225 (2005) (International Development Cooperation Agency; Agency for International Development); 24 C.F.R. pt. 60 (2005) (Department of Housing and Urban Development); 28 C.F.R. pt. 46 (2005) (Department of Justice); 32 C.F.R. pt. 219 (2005) (Department of Defense); 34 C.F.R. pt. 97 (2005) (Department of Education); 38 C.F.R. pt. 16 (2005) (Department of Veterans Affairs); 40 C.F.R. pt. 26 (2005) (Environmental Protection Agency); 45 C.F.R. pt. 690 (2005) (National Science Foundation); 49 C.F.R. pt. 40 (2004) (Department of Transportation). The Office of Science Technology Policy, because it does not conduct or sponsor research, has not codified the Common Rule even though it signed the Federal Policy that supplied the text of the Common Rule. The U.S. 3972013 INDIANA HEALTH LAW REVIEW Congress already had received the National Commission's regulatory recommendations1 44 when it enacted the 1978 Act. Congress stressed the need for continuity: The [Senate] Committee [on Human Resources] intends that the President's Commission complete any of the duties of the existing National Commission for the Protection of Human Subjects of Biomedical and Behavioral Research, as set forth in Section 202 of Public Law 93-348 [the 1974 Act] . . . . It is not the Committee's intent, however, for the President's Commission to repeat completed studies.145 The President's Commission heeded Congress' call to avoid duplicative effort 46 and endorsed the National Commission's 1978 regulatory recommendations.147 As a result, those recommendations have ongoing vitality today. When Congress delegated rulemaking authority to the Secretary of HHS, this delegation was subject to a requirement that the Secretary must conform future informed-consent-related proposals to the Commission's recommendations.148 Doing so sidestepped a potential constitutional problem. The power to give normative bioethical principles the force of law could be seen as a delegation lacking an intelligible principle. The 1978 regulatory recommendations supplied the necessary set of principles. Food and Drug Administration does not implement the Common Rule, instead implementing its own framework of human-subject protections (21 C.F.R. pts. 50, 56 (2001)) which, while similar to the Common Rule, differ in important respects that bear on the regulation of research with biospecimens and data. 144 See HEW, 1978 REPORT, supra note 6. 145 See S. REP. No. 95-852, supra note 141, at 17. 146 42 U.S.C. § 300v-1(a)(2)(3) (2012). 147 Id. 148 42 U.S.C. § 300v-1(b)(2) (2012). 398 Vol. 10.2 WHY THE COMMON RULE IS HARD TO AMEND 2. Procedural formality to ensure an inclusive dialogue. Setting substantive standards for human subject protection implicates important interests of many stakeholders. The 1974 and 1978 Acts reflect a congressional determination that ordinary, informal rulemaking does not provide an adequate opportunity for stakeholders to appear and challenge one another's views. Informal rulemaking also may fail to mobilize the diverse forms of expertise that need to be brought to bear on such decisions. To ensure that the National Commission would reach reasoned decisions based on high-quality evidence from a wide variety of experts and stakeholders, the 1974 Act authorized the Commission to pay its members and cover their travel expenses, hire staff, and procure the services of consultants and other contractors.149 Regulatory scholars consider adequate professional staffing and funding essential to the "attributes of organizational autonomy" that enable regulatory decision-makers "to foster the requisite expertise" to make valid, legitimate decisions. 50 Congress also gave the Commission authority to collect data and evidence from any federal agency.151 The 1978 Act ventured farther and authorized the President's Commission to conduct hearings, take testimony, and receive such evidence as it deemed advisable.152 In other words, Congress prescribed a process that took on features of APA formal rulemaking procedures. Throughout the 1970s, informal rulemaking by the newly created single-value agencies had been the subject of numerous court challenges. In a series of cases during that decade, federal courts had transformed informal rulemaking by imposing special procedural requirements in excess of ordinary APA informal rulemaking procedures.153 This 149 National Research Act of 1974, Pub. L. No. 93-348, § 201, 88 Stat. 342 (1974). 150 Warrick Smith, Note No. 127; Utility Regulators-The Independence Debate, PUB. POL'Y FOR PRIV. SECTOR, Oct. 1997, at 1, available at http://www.ictregulationtoolkit.org/en/Document.1454.pdf. 151 National Research Act § 204(B). 152 42 U.S.C. § 300v-2 (2012). 153 See Richard Stewart, Vermont Yankee and the Evolution of 3992013 INDIANA HEALTH LAW REVIEW trend had gradually converted informal rulemaking "into a new kind of on-the-record proceeding" 154-that is, into a proceeding that bore increasing similarity to A.P.A.'s formal rulemaking procedures that include evidentiary hearings and create a formal record to guide the regulator's decision. In the Vermont Yankee case,15 5 decided in April 1978, the Supreme Court ended this trend and sharply limited the role federal courts could play in overseeing agency rulemaking activities. The impact of this decision likely was on Congress's mind as it finalized the 1978 Act in November of 1978. Congress may have felt it needed to impose special statutory procedural requirements for rulemakings related to the Common Rule's substantive provisions. After Vermont Yankee, it was clear that the federal courts would no longer be able to provide vigorous judicial oversight of agencies' informal rulemaking activities. 3. Substantive policy concerns Although the term is rarely heard today, there was much concern in the 1970s about non-neutral decision-making by "single-value" regulatory agencies. 156 In the late 1960s and 1970s, Congress created a number of new regulatory agencies-including the Occupational Safety and Health Administration, the Consumer Product Safety Commission, and the Environmental Protection Agency-with narrow mandates to protect the public from one specific type of harm (for example, safety hazards in the workplace, dangerous products, or environmental contamination).157 The statutes creating these agencies gave regulators a single-value mandate to pursue one type of public benefit (such as worker safety) with no offsetting responsibility to Administrative Procedure, 91 HARV. L. REV. 1805, 1812-14 (1978). 154 DeLong, supra note 115, at 260. 155 Vermont Yankee Nuclear Power Corp. v. Natural Resources Defense Council, Inc., 435 U.S. 519 (1978). 156 DeLong, supra note 115, at 278-79. 157 Id. 400 Vol. 10.2 WHY THE COMMON RULE IS HARD To AMEND protect competing interests (such as industrial efficiency and economic growth). The 1974 and 1978 Acts fell into this pattern of single- value legislation. Both statutes created a mandate to protect human research subjects, with no offsetting responsibility to ensure the progress of the sciences. In the past, "delegations from Congress to administrative bodies were presumed broad delegations to neutral experts under a general mandate to evaluate the public values involved in the same fashion as would the congress if it had the time and technical expertise of the administrative body."15 8 In contrast, the new single-value agencies were seen as inherently susceptible to bias because of their one-sided legislative mandates to pursue one value without regard to others. There was growing concern as the 1970s wore on that single-value agencies were prone to over-zealotry. By the late 1970s it was common for Congress, when enacting single-value regulatory mandates, to impose special procedural constraints on agencies' rulemaking authority. "[Tihe statutes granting power to such agencies, unlike the broader delegations to older agencies, are full of hedges and restrictions placing substantive or procedural limitations on the zeal with which the agency can pursue its reason for being."159 These constraints often included the formation of special-purpose commissions to ensure that countervailing interests would have a meaningful influence on the agencies' regulations. Congress's use of the National Commission and the President's Commission exemplify this approach. Congress closely controlled the interests that would be represented in this body. The 1974 Act required five of the eleven posts on the National Commission to be held by people who either were or had been involved in biomedical and behavioral research.160 Congress thus gave an influential voice to persons likely to appreciate the benefits of research. By 158 DeLong, supra note 115, at 278. 159 Id. at 279 (internal citations omitted). 160 National Research Act of 1974, Pub. L. No. 93-348, § 201, 88 Stat 342 (1974) (enacting 42 U.S.C. §§ 2891-1(B)(1)). 4012013 INDIANA HEALTH LAW REVIEW voting as a block and persuading just one other "non- research" member to join them, these five "pro-research" members would be able to muster a majority to support specific policy recommendations. The President's Commission under the 1978 Act continued in this vein. Six of its eleven positions were reserved for persons with research experience or medical practice experience, with the five remaining positions set aside for ethicists, theologians, lawyers, natural and social scientists, public affairs specialists, and other non-research/non- medical personnel. 161 The President was to appoint one member to serve as Chairman with the advice and consent of the Senate. This again displayed Congress's wish to stay involved in setting directions for the commission. The quorum requirement for the President's Commission was set at seven, 162 presumably to ensure that at least one non- researcher/non-medical member would need to be present in order to conduct business. In our system of law, a duly elected legislature is empowered to set policy and strike a balance between competing interests. It was well within Congress's power to tip the balance in a way that would limit the potential for research regulations to impede the progress of scientific research. The heavy representation of "pro-research" interests on the two commissions should be seen as a deliberate congressional decision to limit the potential for over-zealotry by a regulator that had been given a single- value mandate to protect human research subjects. Carried to its logical extreme, this mandate might well imply not doing any research at all. That was not the balance Congress intended to strike. Rather than trust the regulator to strike an appropriate balance, Congress struck a balance that gave significant weight to the social benefits of biomedical research. 163 The procedural constraints 161 42 U.S.C. § 300v (a) (2012). 162 Id. at § 300v(d)(1). 163 See S. REP. NO. 95-852, supra note 141, at 14 (reviewing the work of the National Commission and noting that the Senate Committee on Human Resources was "particularly pleased that the Commission has been successful in gaining the confidence and respect 402 Vol. 10. 2 WHY THE COMMON RULE IS HARD TO AMEND embedded in the 1974 and 1978 Acts were a way of implementing and preserving that balance. C Special Legal Status of the 1978 Regulatory Recommendations The National Commission's 1978 regulatory recommendations enjoy a special legal status even today. Congress did not require the Secretary of HEW to implement all of these recommendations. To have done so may have raised concerns about inappropriate delegation of rulemaking authority to the private actors serving on the Commission. 164 Instead, the statute required the Secretary to publish the National Commission's regulatory recommendations in the Federal Register, to seek public comments, and to consider and formally respond to them.165 The statute gave the Secretary two options for this response. The first option was that the Secretary could deem the National Commission's regulatory recommendations to be appropriate.166 If the Secretary did so, then the Secretary must, "as expeditiously as possible" take any administrative actions (such as promulgating a new regulation) the commission had recommended." 67 In other words, if the Secretary deemed the recommendations appropriate, then the Secretary was obliged to incorporate them into the Common Rule. The second option allowed the Secretary to reject some or all of the commission's recommendations. The statute prescribed a process for doing so: the secretary must publish, in the Federal Register, a formal determination that the National Commission's not only of the research community, but also of research-intensive industries such as the pharmaceutical industry"). 164 See, e.g., Cospito v. Heckler, 742 F.2d 72 (3rd Cir. 1984) (finding no nondelegation problem in a situation where the Secretary of HHS possessed final discretion to set standards, even though the standards had been informed by a private advisory body). 165 National Research Act of 1974, Pub. L. No. 93-348, § 205, 88 Stat 342 (1974). 166 Id. 167 Id. 4032013 INDIANA HEALTH LAW REVIEW recommendations are not appropriate "together with an adequate statement of the reasons" for this determination. 168 HEW initiated proceedings in 1979 to incorporate the National Commission's recommendations into its preexisting regulations at 45 C.F.R. pt. 46.169 These recommendations had a major impact on the Common Rule's substantive human subject protections and, in particular, influenced its framework of access to data and biospecimens. The following are several examples of how the recommendations influenced the Common Rule: (1) HEW had not initially included a waiver provision in its proposed regulations, but- based on the National Commission's findings 170-added one to the final regulation promulgated in 1981.171 That waiver provision was identical to the one that still exists in the Common Rule, 172 which has become an important pathway for unconsented access to data and biospecimens for research. (2) The National Commission had focused mainly on ethical issues in clinical and behavioral research 73 but appointed a Privacy Protection Study Commission to examine research that uses existing documents, records, or biospecimens. 174 The National Commission incorporated the Privacy Commission's 168 Id. 169 Proposed Regulations Amending Basic HEW Policy for Protection of Human Research Subjects, 44 Fed. Reg. 47,688 (proposed Aug. 14, 1979) (to be codified at 45 C.F.R. pt. 46). 170 HEW, 1978 REPORT, supra note 6, at 56,180-81 (discussing the need for consent waivers for certain types of research). 171 Final Regulations Amending Basic HHS Policy for the Protection of Human Research Subjects, 46 Fed. Reg. 8366, 8390 (Jan. 26, 1981) (to be codified at 45 C.F.R. § 46.117). 172 45 C.F.R. § 46.116(d) (2012). 173 See HEW, 1978 REPORT, supra note 6, at 56, 175 (discussing the National Commission's scope of work). 174 Id. at 56,181. 404 Vol. 10. 2 WHY THE COMMON RULE Is HARD TO AMEND findings in its own regulatory recommendations.175 One of these findings was that "[if the subjects are not identified or identifiable, the research need not be considered to involve human subjects," and consent requirements should not apply. 176 In response to this recommendation, HEW proposed the exemption that now appears in 45 C.F.R. sec. 46.101(b)(4).177 (3) The National Commission specifically called for a mechanism to allow unconsented research access to identified data and records. 178 It found that even "where the subjects are identified, informed consent may be deemed unnecessary," if certain conditions are met.179 These included some conditions similar to the waiver criteria in today's HIPAA and Common Rule waiver provisions, plus one very important condition that fell by the wayside and never was properly implemented.180 This omitted condition required that nonconsensual use of data and biospecimens be allowed only after a determination that "the importance of the research justifies such invasion of the subjects' privacy."181 This omission is a factor that has 175 ITd. 176 ITd. 177 See Final Regulations Amending Basic HHS Policy for the Protection of Human Research Subjects, 46 Fed. Reg. 8366, 8371-73 (Jan. 26, 1981) (discussing changes to the Common Rule's exemption provisions in reponse to the National Commission's recommendations); id. at 8386-87 (implementing the exemption at 45 C.F.R. § 46.101(b)(4)). 178 HEW, 1978 Report, supra note 6, at 56,179-80. 179 Id. at 56, 181. 180 See Evans, supra note 5, at 120-24 (discussing the history of how HHS and later OCR failed to include, in the HIPAA and Common Rule waiver provisions, the "public use" requirement that the commission had recommended-i.e., that unconsented uses should be allowed only if the use is found to offer important and justifying public benefits). 181 HEW, 1978 REPORT, supra note 6 at 56,179; see also HEW, 1978 4052013 INDIANA HEALTH LAW REVIEW undermined public trust in the current framework for nonconsensual access to data and biospecimens and has contributed to the current pressures for reform. Under the current regulations, members of the public have no assurance that such uses will serve any beneficial public purpose. 182 The procedural constraints in 42 U.S.C. sec. 300v-1(b) had a significant impact on the policies embodied in the present Common Rule. The ANPRM proposed to amend the exemption at 45 C.F.R. sec. 46.101(b)(4) and it sought public comment on possible changes to the Common Rule's waiver provisions. These changes potentially run counter to the 1978 regulatory recommendations. The ANPRM should have explained, yet failed to do so, why the Secretary of HHS believes Congress has authorized her to make such changes. D. Why the Common Rule's Consent Provisions Are Hard to Amend A challenge HHS faces today is that it is trying to keep its regulations up to date using authorities granted by an outdated statute. The 1978 Act clearly envisioned an ongoing role for the President's Commission it created: "The Commission shall biennially report to the President, the Congress, and appropriate Federal agencies on the REPORT, supra note 6 at 56,181 (reporting findings of a Privacy Protection Study Commission, under the auspices of the National Commission, which elaborated this balancing requirement more specifically: "[Medical records can legitimately be used for biomedical or epidemiological research, without the individual's explicit authorization," provided that the medical care provider (who in all likelihood would have been the data holder in that era of paper records) determines "that the importance of the research or statistical purpose for which any use of disclosure is to be made is such as to warrant the risk to the individual from additional exposure of the record or information contained therein," and that an IRB ensures this condition has been met). 182 Evans, supra note 5, at 77, 125-26. 406 Vol. 10.2 WHY THE COMMON RULE IS HARD TO AMEND protection of human subjects of biomedical and behavioral research."183 Those reports were to "include a review of the adequacy and uniformity" of federal rules, policies, guidelines and regulations, and could "include such recommendations for legislation and administrative action and the Commission deems appropriate."18 4 The statute viewed the President's Commission as an integral and ongoing part of the human subject protection framework. The President's Commission would determine when the Common Rule was out of date and to recommend new legislation or administrative action to address the problem. Unfortunately, the commission no longer exists. The statute offers no alternative pathway for updating the substantive ethical requirements of the Common Rule in its absence. Congress may have planned on periodically authorizing the creation of new commissions to perform this function, just as Congress had done when it replaced the 1974 National Commission with the 1978 President's Commission.185 If that was the plan, it fell off the tracks in the late 1980s. In 1985, Congress enacted legislation18 6 to create a Biomedical Ethics Board187 that was to "study and report to Congress on a continuing basis on the ethical issues arising from ... biomedical and behavioral research, including the protection of human subjects of such research."188 Unfortunately, this Board "became politically deadlocked due to abortion politics, its appropriations were frozen, and finally its term expired in 1990."189 As bioethical issues became increasingly divisive, Congress gave up creating statutory bioethics commissions to do the work of keeping the Common Rule up to date. HHS has been left to 183 42 U.S.C. § 300v-1(c) (2012). 184 Id 185 Id. § 300v-1(a). 186 Health Research Extension Act of 1985, Pub. L. 99-158, 99 Stat. 820 (1985). 187 Id. § 11 (to be codified at 42 U.S.C. § 275). 188 Id. (to be codified at 42 U.S.C. § 275(c)(1)). 189 Susan Cartier Poland, Hoetlics Cbnm2ssons: Tofwn Meetings with a Blue, BlueRiban' KENNEDY INST. OF ETHICS J. (1998), at 12, available at http://bioethics.georgetown.edu/publications/scopenotes/ sn34.pdf. 4072013 INDIANA HEALTH LAW REVIEW regulate under a defective statutory framework that lacks a functioning process for amending the regulations. Without the President's Commission, it is genuinely debatable whether the Secretary of HHS has any authority to amend the Common Rule's informed consent provisions. The statute at 42 U.S.C. section 300v-1(b) treats recommendations by the President's Commission as events that trigger HHS's statutory authority to make rules that impose substantive ethical requirements on human subjects research (such as informed consent requirements). If there is no President's Commission, there is seemingly no trigger that allows HHS to make rules that alter the Common Rule's informed consent requirements. The statute provides that, "[within 60 days of the date a Federal agency receives a recommendation from the Commission that the agency take any action with respect to its rules, policies, guidelines, or regulations, the agency shall publish such recommendation in the Federal Register"190 and then "[wlithin the 180-day period beginning on the date of such publication, the agency shall determine whether the action proposed by such recommendation is appropriate." 191 Thereafter, the agency must either take action-such as rulemaking-to implement the Commission's recommendations or else publish a determination that explains why the recommendation is inappropriate. What does this mean in the context of present-day efforts to modernize the Common Rule? A narrow reading of the statute suggests that the Secretary's authority to make substantive ethical rules comes into being only immediately after the Commission issues a recommendation within 60 days.192 By this view, Congress delegated to the Commission the task of developing substantive ethical policies to be included in the Common Rule. The Secretary of HHS was granted nothing more than a constrained authority to respond to those recommendations, and this was a one-time delegation of authority for the purpose of establishing the Common Rule as it now exists. Therefore, 190 42 U.S.C. § 300v-1(b)(1). 191 Id. § 300v-1(b)(2). 192 Id. § 300v-1(b)(1). 408 Vol. 10. 2 WHY THE COMMON RULE IS HARD TO AMEND there is a real question whether HHS has any authority to implement the ANPRM's proposed informed consent policies. Any amendment to the Common Rule's informed consent requirements would require further action by Congress. An alternative but somewhat less persuasive reading is that the "within 60 days" language was simply to ensure prompt action to implement the Commission's recommendations after they were first issued, but was not intended to preclude later action by the Secretary to respond to those same recommendations. As a result, the Secretary of HHS would have ongoing authority to respond to the Commission's recommendations, provided she follows the procedural constraints set out in 42 U.S.C. section 300v- 1(b)(2). Furthermore, if the Secretary's proposed amendments go against the 1978 regulatory recommendations, HHS first would need to publish a reasoned determination explaining why those recommendations are no longer appropriate. 193 This procedural step was ignored during efforts to develop the recent ANPRM. If the ANPRM proceeds to a rulemaking that amends the Common Rule in ways that contravene the 1978 regulatory recommendations, those amendments can be challenged as having violated the statutorily prescribed procedures. There have, of course, been many subsequent bioethics commissions, Secretary's advisory committees, and even President's Commissions addressing various aspects of human subject protection.194 The mere fact that later bioethics advisory bodies addressed similar subject matter does not, however, make them legal successors to the President's Commission that Congress created in 1978. To be a legal successor would mean that the recommendations 193 Id. § 300v-1(b)(2)(A). 194 See Former Bioethics Commissions, PRESIDENT'S COUNCIL ON BIOEIHICs,httpilbioethics.georgetown.edu/pcbe/reports/past commissions (last visited Mar. 13 2013) (listing all former U.S. national bioethics commissions); see also Poland, supra note 189 at 11-13 (discussing prior bioethics commissions and providing a bibliography of their work products). 4092013 INDIANA HEALTH LAW REVIEW of a later body would enjoy the special legal status described in 42 U.S.C. sec. 300v-1(b): the Secretary must either find the recommendations appropriate and implement them or else publish a reasoned determination rejecting them. The work of later commissions and advisory bodies lacks this special status because of the way those bodies were formed. These later bodies were created by executive order, 195 pursuant to other, unrelated statutes or under the Secretary of HHS's general authority.196 So formed, these bodies are not legal successors to the two commissions that Congress authorized by statute in 1974 and 1978. For example, the current Secretary's Advisory Committee on Human Research Protections is merely an advisory committee formed at the discretion of the Secretary of HHS rather than by Congress.197 The 1978 Act expressly envisioned that such advisory committees could exist alongside the President's Commission formed under that legislation but did not regard them as substitutes for it.198 To create a new commission whose recommendations would enjoy the same legal status as the 1978 regulatory recommendations seemingly would require another act of Congress. Until that happens, the regulatory recommendations of the 1974 National Commission, as endorsed by the 1978 President's Commission, have an enduring legal significance, just as the Belmont Report has an enduring ethical significance today. The 1978 regulatory recommendations establish congressionally authorized parameters for human subject regulation and they limit the 195 See, e.g., Executive Order 12975, 60 Fed. Reg. 52063 (Oct. 3, 1995) (creating the Clinton administration's National Bioethics Advisory Commission); Executive Order 13237, 66 Fed. Reg. 59851 (Nov. 28, 2001) (creating the Bush administration's President's Council on Bioethics); Executive Order 13521, 75 Fed. Reg. 62671 (Nov. 24, 2009) (creating the Obama administration's Presidential Commission for the Study of Bioethical Issues). 196 42 U.S.C. § 217a (2012). 197 See Secretary's Advisory Committee on Human Research Protections, HHS.GOV, http://www.hhs.gov/ohrp/sachrp/charter/index. html (last visited Mar. 14, 2013). 198 42 U.S.C. § 300v-1(a)(3) (2012). 410 Vol. 10.2 WHY THE COMMON RULE IS HARD TO AMEND discretion of agency Secretaries to amend the Common Rule. How, then, can the Common Rule be modernized? The statute requires input from a commission that no longer exists. Into this gap, the ANPRM presumed that HHS has authority to update the Common Rule on its own, yet the statute does not appear to give HHS this authority. The Chevron'99 and Meac 00 framework of deference treats agencies as the most appropriate bodies to interpret the meaning of agencies' own enabling statutes. Courts must apply Chevron's deferential two-step analysiS201 in reviewing agencies' interpretations of their own enabling statutes; however, this is true only if the agency advances its interpretation in the context of a notice-and-comment proceeding and if the agency is acting pursuant to a Congressional delegation of lawmaking authority.202 The problem with the ANPRM is that HHS appears to have been acting without a delegation of lawmaking authority. Therefore, it seems doubtful that the ANPRM's presumption of rulemaking authority will be entitled to Chevron deference. Eskridge and Baer point out that there are "a number of precedents where the Court has taken a non-deferential approach to agency interpretations of their own jurisdiction or authority."203 The authors found that the Court applied Chevron deference only about one-third of the time in such situations. 204 199 Chevron, U.S.A., Inc. v. Natural Res. Def. Council, 467 U.S. 837 (1984). 200 United States v. Mead Corp., 533 U.S. 218 (2001). 201 See Chevron, 467 U.S. at 842 (directing courts, as the first step, to assess whether Congress has "directly spoken to the precise question at issue" and, if so, to be guided by the statute or, if not, to proceed to step two). See also Chevron at 843 (directing courts, in step two, to inquire whether the "agency's answer is based on a permissible [i.e., not necessarily the best] construction of the statute" and, if so, to defer to it). 202 Mead, 533 U.S. at 226-27, 230-33. See also Gonzales v. Oregon, 546 U.S. 243, 259 (2006). 203 William N. Eskridge, Jr. & Lauren E. Baer, The Continuum of Deference: &pmme 6burt Deatment of Agency Satutazy Interpetations fam Chevmn to Hamdan, 96 GEO. L.J. 1083, 1130 (2008). 204 Id. at 1131 (finding Chevron deference applied in 34.4% of cases 4112013 INDIANA HEALTH LAW REVIEW It may indeed be unreasonable for Congress to have left a major federal regulation bereft of a functioning mechanism through which the regulation can be amended. That fact does not, however, imply that HHS has rulemaking authority by default. With no commission in place to trigger HHS's authority to amend the Common Rule's informed consent requirement, it may simply be that nobody has a valid delegation of the necessary rulemaking authority. The ANPRM presumed that HHS could fill the gap. Rather than defer to the agency's interpretation, courts may see this as a problem that only Congress can solve. V. CONCLUSION Nobody denies that the Common Rule is ripe for modernization. The question is how to devise an appropriate process for doing so, given the constraints imposed by earlier statutes. Developing appropriate policies on informed consent to the use of data and biospecimens is not just a normative bioethical inquiry; it is also a legal inquiry that requires close attention to process and procedure and may require congressional action to resolve. Here once again it is useful to view the 1978 Act in the context of its time. An influential strand of contemporary (1980s) commentary viewed Congress's creation of special commissions as a check on unfettered agency discretion that could produce "policy drift."2 0 5 The concern was that agency rulemaking might, over time, produce policy outcomes at odds with compromises struck during passage of the original enabling legislation. Commissions, it was believed, could help keep agency rulemaking responsive to the with less stringent deference, or no deference, applied in the other 65.5% of cases). 205 See, e.g., Barry R. Weingast & Mark J. Moran, Bureaucratic Discretion or Congressional Control? Regulatory Policymaking by the Federal Trade Commission, 91 J. POL. EcoN. 765 (1983) (advancing this theory); Matthew D. McCubbins, Roger G. Noll, Barry R. Weingast, Strctuw and Pnxss Poltis and Poli cyhA2nistivetAAgements and the Potial Contrl ofAgences 75 VA. L. REV. 431 (1989) (same); Craig N. Oren, Clearing the Air: The McCubbins-Noll-Weingast Hypothesis and the Clean Air Act, 9 VA. ENVTL. L. J. 45 (1989) (challenging this view). 412 Vol. 10. 2 WHY THE COMMON RULE IS HARD TO AMEND interests of the coalition that had been instrumental in passing the legislation. The statute at 42 U.S.C. sec. 300v- 1(b)(2) forced agencies that implement the Common Rule- present and future-to stop and consider the balance struck when Congress authorized rulemaking in this area. Congress presumably understood that conditions can change, possibly requiring a new balance to be struck in future times. Section 300v-1(b)(2) was a message from Congress to the future: If you want to strike a new balance, you must jump over some extra procedural hurdles and, possibly, enlist the involvement of Congress at that future time. Congress never fully authorized the Secretary of HHS to strike the balance between the individual's right of informed consent and the public's interest in the advancement of science. Congress entrusted the task of striking that balance, in the first instance, to its two statutorily created commissions. Congress also signaled its desire to remain involved, if future developments evolve in ways that the two commissions failed to contemplate. This raises the possibility that legislative action may be required in order to implement the reform program that the ANRPM proposed. If that is the case, there are various options for modernizing the Common Rule. One option, of course, is to ask Congress to amend 42 U.S.C. section 300v-1(b). Such amendments could grant the Secretary of HHS unconstrained authority to make regulations that establish informed consent policy. If that approach is unavailing, that is not necessarily the end of reforms. The Secretary of HHS has significant discretion to make the Common Rule function better without amending the regulatory text itself. 206 The Common Rule is indeed hard to amend, but there are promising pathways for implementing sound policies within the framework of the existing regulation. 207 Skillful 206 Evans, supra note 5, at 129-130. 207 Id. (discussing the use of discretionary authority the Secretary already possesses under 45 C.F.R. § 46.101(c) and exploring potential uses of interpretive guidance and creation of safe harbors that create strong incentives for voluntary compliance with desired norms). See 4132013 INDIANA HEALTH LAW REVIEW use of these other approaches may avoid the need for regulatory amendments that may, in the end, prove unlawful. also Comments of Barbara J. Evans, Dkt. No. HHS-OPHS-2011-0005, 76 Fed. Reg. 44, 512 (Oct. 25, 2011), available at http://www.regulations. gov/#!documentDetial:D=HHS-OPHS-2011-0005-0822 (citing the example of FDA's use of guidance in 2006 to elicit voluntary compliance with new privacy protections for biospecimens in return for an exercise of FDA's enforcement discretion). 414 Vol. 10.2