OHRP Provides Draft Guidance Regarding the Common Rule’s Public Health Surveillance Exclusion

On November 19, 2018, the U.S. Department of Health and Human Services, Office for Human Research Protections (“OHRP”) announced the availability of additional draft guidance related to a new exclusion from regulatory oversight included in the updated Federal Policy for the Protection of Human Subjects (the “Common Rule”), which will go into effect on January 21, 2019. [1]

The updated Common Rule excludes “public health surveillance activities” from the definition of “research.” [2] This draft guidance, titled “Activities Deemed Not to Be Research: Public Health Surveillance 2018 Requirements” [3] (the “Draft Guidance”), provides insight into OHRP’s interpretation of this exclusion. Significantly, the Draft Guidance clarifies that such surveillance activities may be carried out by non-governmental entities, such as universities and other research institutions, on behalf of a public health authority—meaning that implementation of the new exemption will be widespread across the research community.

OHRP is requesting written comments on the Draft Guidance, which must be submitted by December 19, 2018. [4]

Background of Public Health Surveillance Exclusion
OHRP uses the term “pre-2018 Requirements” to refer to the Common Rule regulations as published in the 2016 edition of the Code of Federal Regulations, and it uses the term “2018 Requirements” to refer to the updated Common Rule requirements that will go into effect on January 21, 2019. [5]

The 2018 Requirements include additional categories of activities that are treated as excluded from the Common Rule’s definition of research at 45 C.F.R. 46.102(l) and thus not subject to institutional review board review, approval and oversight. One of these categories, which is the subject of the Draft Guidance, relates to “public health surveillance activities.” [6]

There are three criteria outlined in the 2018 Requirements for determining whether an activity constitutes a public health surveillance activity deemed not to be research:

• The activity must be a public health surveillance activity;
• The activity must be conducted, supported, requested, ordered, required, or authorized by a public health authority, as defined at 45 C.F.R. 46.102(k); and

• The activity must be limited to that necessary to allow a public health authority to identify, monitor, assess, or investigate potential public health signals, onsets of disease outbreaks, or conditions of public health importance (including trends, signals, risk factors, patterns in diseases, or increases in injuries from using consumer products). [7]

OHRP’s Interpretation of the Public Health Surveillance Exclusion
Within the Draft Guidance, OHRP acknowledges that public health activities are varied, may be neither research nor surveillance, and include such activities as providing “public service health messages or conducting vaccination campaigns.” [8] Additionally, OHRP notes that the “line between public health surveillance activities and research activities can be difficult to draw,” and the applicability of the public health surveillance activities exclusion “depends on the purpose of the project, the context in which it is conducted, and the role of the public health authority.” [9] The Draft Guidance then provides further context for the requirements of this exclusion:

A. Is the activity a “public health surveillance activity”?
The 2018 Requirements do not explicitly define a “public health surveillance activity,” but instead describe types of activities that fit this exclusion. The Draft Guidance discusses that, while public health surveillance activities can use data from a variety of sources and may involve the same “analytical and laboratory techniques as epidemiological research,” a critical distinction from research is that the purpose of the surveillance is to inform the decisions or actions that must be made by a public health authority. [10] OHRP further states that it views surveillance activities not undertaken for the purpose of directly informing public health decision making or action as “generally not to be public health surveillance, even if they might be considered surveillance for other purposes.” [11]

The Draft Guidance acknowledges that while the best recognized public health surveillance use of information or biospecimens is the monitoring of diseases and detection of outbreaks in the population, but also makes clear that this category of activities includes many other uses that are critical to public health practice, including, for example:

• The collection and use of information or biospecimens to estimate the scope and magnitude of a public health problem, including the geographic and demographic distribution of a health event, to facilitate public health planning; and 
• The use of information or biospecimens to detect changes in relevant practices or behaviors, monitor changes in infectious disease agents and environmental factors, evaluate control measures and response efforts, and actively monitor, identify, and assess the safety of medical products. [12]

B. Is the activity being conducted, supported, requested, ordered, required, or authorized by a “public health authority”?
The Draft Guidance specifies that the definition of a “public health authority” extends to government entities at all levels, within the United States and abroad, where that entity is responsible for public health matters as part of its mandate. However, that mandate can apply to public health matters generally or to a specific health matter, and the government entity’s mandate does not have be exclusively or even primarily aimed at public health matters.

Importantly, the definition also “extends to anyone acting on such an entity’s behalf, for example, through a grant of authority or contract.” [13] OHRP considers that an activity is “conducted” by a public health authority when the public health authority participates directly in the collection, testing, analysis, or use of the information or biospecimens, or funds these uses through a contract. In addition, an activity may qualify if it is “supported” by a public health authority, e.g., through a grant or cooperative agreement, or if it is “requested, ordered, required, or authorized” by a public health authority, even if it is carried out by an entity that is not a public health authority (e.g., academic institutions, health care organizations, nonprofit entities). [14]

C. Is the activity limited to one that is necessary to allow a public health authority to identify, monitor, assess, or investigate potential public health signals, onsets of disease outbreaks, or conditions of public health importance (including trends, signals, risk factors, patterns in diseases, or increases in injuries from using consumer products)?
The Draft Guidance clarifies that not all component parts of an activity may qualify as a public health surveillance activity. Instead, the exemption is limited to those parts that allow a public health authority to identify, monitor, assess, or investigate potential public health signals, onsets of disease outbreaks, or conditions of public health importance. [15] As an example, the Draft Guidance notes that where secondary research is conducted in tandem with a public health surveillance activity, the research component will need to be separately assessed for compliance with Common Rule requirements. [16]

The Draft Guidance provides further context for the terms “identify,” “monitor,” “assess,” and “investigate” as follows:

• “Identify” generally refers to activities that are undertaken to detect potential signals, onsets of disease outbreaks, or conditions of public health importance that previously had not been recognized.
• “Monitor” generally refers to activities that are undertaken to maintain situational awareness of an identified signal, outbreak, or condition to detect changes that warrant further public health action.
• “Assess” generally refers to activities that are undertaken to evaluate the characteristics of a signal, outbreak, or condition, including its magnitude, prevalence, or incidence, and the context in which a signal, outbreak, or condition occurs or has been detected, for the purpose of informing public health action.

•  “Investigate” generally refers to the range of activities that are undertaken in response to an identified or perceived threat to public health, to determine the magnitude of the problem, identify cases, or determine the cause, and to inform appropriate control measures. The problem under investigation might be a signal, an outbreak, or any other occurrence that warrants action. [17]

Examples of Public Health Surveillance Activities
Finally, the Draft Guidance provides several examples of activities that OHRP considers to be public health surveillance activities and, thus, not research. These examples include surveillance activities designed to enable a public health authority to:

• Identify, monitor, assess, and investigate potential safety signals for a specific product or class of products (e.g., the surveillance activities of the Food and Drug Administration’s Adverse Event Reporting System, the Vaccine Adverse Event Reporting System, the Manufacturer and User Facility Device Experience database, the Medical Product Safety Network, and the Sentinel Initiative);
• Identify unexpected changes in the incidence or prevalence of a certain disease in a defined geographic region where specific public health concerns have been raised (e.g., the U.S. influenza surveillance system);
• Identify the prevalence or incidence of known risk factors associated with a health problem in the context of a domestic or international public health emergency;
• Locate the range and source of a disease outbreak or identify cases of a disease outbreak;
• Detect the onset of disease outbreaks or provide timely situational awareness during the course of an event or crisis that threatens the public health, such as a natural or human-made disaster; or
• Identify the prevalence or incidence of a condition of public health importance, known risk factors associated with a condition of public health importance, or behaviors or medical practices related to prevalence of a known condition of public health importance (e.g., surveillance of the prevalence of tobacco use, exposure to secondhand smoke, lung cancer, or use of smoking cessation treatments). [18]

Next Steps
As noted above, OHRP will take comments on the Draft Guidance through December 19, 2018. K&L Gates’ health care practice regularly assists clients in complying with the Common Rule and navigating the changes to the Common Rule. We will continue to closely monitor guidance published by OHRP related to Common Rule implementation, and will provide additional analysis related to any significant developments or modifications to the Common Rule as the January 21, 2019, implementation date of the final rule approaches.

[1] The relevant federal agencies issued the updated Common Rule on January 19, 2017, but subsequently delayed implementation. 83 Fed. Reg. 2885 (Jan. 22, 2018); 83 Fed. Reg. 17595 (April 20, 2018); 83 Fed. Reg. 28497 (June 19, 2018).
[2] 45 C.F.R. § 46.102(l)(2) (Jan. 21, 2019).
[3] The Draft Guidance is available at: https://www.hhs.gov/ohrp/regulations-and-policy/requests-for-comments/draft-guidance-activities-deemed-not-be-research-public-health-surveillance/index.html.
[4] See Notice of Availability, 83 Fed. Reg. 58261 (Nov. 19, 2018).
[5] The 2018 Requirements were originally published on January 19, 2017, and were further amended on January 22, 2018, and June 19, 2018. For a more detailed discussion of the 2018 Requirements, and subsequent guidance, see our January 22, 2018 alert, “Federal Agencies Delay Implementation of Common Rule Requirements”; our April 27, 2018 alert, “Federal Agencies Propose to Further Delay Implementation of Sweeping Revisions to the “Common Rule”--but Offer Incentives for Institutions Willing to Transition Existing Research Projects”; and our October 16, 2018 alert “FDA Release Guidance on How Recent Changes to the Common Rule May Affect FDA-Regulated Clinical Trials,” http://www.klgates.com/federal-agencies-delay-implementation-of-common-rule-revisions-01-22-2018/; http://www.klgates.com/federal-agencies-propose-to-further-delay-implementation-of-sweeping-revisions-to-the-common-rule/; http://www.klgateshub.com/details/?pub=FDA-Releases-Guidance-on-How-Recent-Changes-to-the-Common-Rule-May-Impact-FDA-Regulated-Clinical-Trials-10-16-2018.
[6] 45 C.F.R. § 46.102(l)(2) (Jan. 21, 2019).
[7] Id.
[8] Office for Human Research Protections, “Activities Deemed Not to Be Research: Public Health Surveillance 2018 Requirements”, Nov. 7, 2018 (draft), https://www.hhs.gov/ohrp/regulations-and-policy/requests-for-comments/draft-guidance-activities-deemed-not-be-research-public-health-surveillance/index.html.
[9] Id. The 2018 Requirements do not provide any specific requirements regarding who determines whether projects are or are not considered to be public health surveillance activities under 45 CFR 46.102(l)(2). OHRP notes that “decisions about the applicability of 45 CFR part 46.102(l)(2) should be thoughtful and deliberate.” Id.
[10] Id.
[11] Id.
[12] Id.
[13] Id.
[14] Id.
[15] Id.
[16] Id.
[17] Id.
[18] Id.