Activities Deemed Not to Be Research: Public Health Surveillance 2018 Requirements

NOTE: This guidance is consistent with the 2018 Requirements (i.e., the revised Common Rule).

Draft


This guidance, when finalized, will represent the Office for Human Research Protections’ (OHRP’s) current thinking on this topic. This guidance does not create or confer any rights for or on any person and does not operate to bind OHRP or the public.

OHRP guidance should be viewed as recommendations unless specific regulatory requirements are cited. The use of the word “must” in OHRP guidance means that something is required under the Department of Health and Human Services (HHS) regulations at 45 CFR part 46. The use of the word “should” in OHRP guidance means that something is recommended or suggested, but not required. An institution may use an alternative approach if the approach satisfies the requirements of 45 CFR part 46. OHRP is available to discuss alternative approaches by telephone at 240-453-8237 or 866-447-4777, or by email at ohrp@hhs.gov.


Date: November 7, 2018

Scope:

This guidance document applies to activities that are conducted or supported by HHS. It is intended to help entities determine whether a planned activity constitutes a public health surveillance activity deemed not to be research under the 2018 Requirements (subpart A of 45 CFR part 46).

Target Audience: Institutions, institutional review boards (IRBs), investigators, institutional officials, and other human research protection staff.

Regulatory Background:

In this document, the term “pre-2018 Requirements” refers to subpart A of 45 CFR part 46 (i.e., the Common Rule) as published in the 2016 edition of the Code of Federal Regulations. The pre-2018 Requirements were originally promulgated in 1991, and subsequently amended in 2005. The pre-2018 Requirements may also be referred to as the “pre-2018 Common Rule.”

The term “2018 Requirements” refers to the Common Rule as published in the July 19, 2018 edition of the e-Code of Federal Regulations. The 2018 Requirements were originally published on January 19, 2017 and further amended on January 22, 2018 and June 19, 2018. The 2018 Requirements may also be referred to as the “revised Common Rule.”

Any study initiated on or after January 21, 2019 is required to comply with the 2018 Requirements. Any study initiated before January 21, 2019 is required to comply with the pre-2018 Common Rule, unless an institution voluntarily instead elects to transition such studies to comply with the 2018 Requirements. This election to transition a study must be documented and dated by the institution or an IRB. If an institution voluntarily elects to transition studies initiated before January 21, 2019 to the 2018 Requirements, it may do so any time after July 19, 2018. If a study is transitioned to the 2018 Requirements during the delay period (i.e., July 19, 2018 through January 20, 2019), the study must continue to comply with the pre-2018 Requirements with the exception of the three burden-reducing provisions of the revised Common Rule applying in lieu of or in addition to their corresponding provisions in the pre-2018 Requirements. After the delay period ends on January 21, 2019, studies that transition during the delay period to comply with the revised Common Rule must comply with the entirety of the 2018 Requirements (except for the revised §46.114(b), for which compliance is required on and after January 20, 2020). More information about implementing the revised Common Rule is available on the OHRP website.

The 2018 Requirements include the addition of categories of activities that are not considered to fall within the definition of research at 45 CFR 46.102(l). While the 2018 Requirements retain the pre-2018 research definition as “a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge,” four categories of activities, including certain public health surveillance activities, have been explicitly deemed not to be research, to clarify that they do not fall within the scope of the regulations. As a result, the activities that are deemed not to be research under the revised definition are likely to include activities that were never considered research, as well as activities that might have been considered research under the pre-2018 regulation. Including these express exclusions from the revised Common Rule’s definition of research is intended to resolve uncertainties that existed in the regulated community concerning whether such activities were considered research.

For purposes of the 2018 Requirements, the following activities (among others) are deemed not to be research:  “Public health surveillance activities, including the collection and testing of information or biospecimens, conducted, supported, requested, ordered, required, or authorized by a public health authority. Such activities are limited to those necessary to allow a public health authority to identify, monitor, assess, or investigate potential public health signals, onsets of disease outbreaks, or conditions of public health importance (including trends, signals, risk factors, patterns in diseases, or increases in injuries from using consumer products). Such activities include those associated with providing timely situational awareness and priority setting during the course of an event or crisis that threatens public health (including natural or man-made disasters)” (45 CFR 46.102(l)(2)).

The revised Common Rule defines a public health authority as “an agency or authority of the United States, a state, a territory, a political subdivision of a state or territory, an Indian tribe, or a foreign government, or a person or entity acting under a grant of authority from or contract with such public agency, including the employees or agents of such public agency or its contractors or persons or entities to whom it has granted authority, that is responsible for public health matters as part of its official mandate” (45 CFR 46.102(k)).

In order to take advantage of the revised Common Rule’s exclusion from the definition of research pertaining to public health surveillance activities for activities initiated before January 21, 2019, an institution must follow several steps (as outlined in the transition provision at 45 CFR 46.101(l)):

  • The institution must determine that the activity (or a set of activities) under consideration will transition to be conducted in accordance with the revised Common Rule.
  • Either the institution or the IRB must document the transition decision (including the date of the decision) in accordance with §46.101(l)(4), and retain such documentation for at least 3 years in accordance with §46.115(b).
  • After the institution’s transition decision is documented and dated, the carve-outs from the definition of research are available to be implemented for the transitioned activity (or set of activities).

Public health surveillance activities that an institution transitions to the 2018 Requirements and that meet the criteria described in 45 CFR 46.102(l)(2) are not required to comply with any provision in the Common Rule, because the 2018 Requirements deem these activities as outside of the scope of “research” and, therefore, outside the scope of the Common Rule.

Guidance

I. Introduction

Public health surveillance activities are deemed not to be research because HHS recognizes that the requirements of 45 CFR part 46 should not impede a public health authority’s ability to accomplish its mandated mission to protect and maintain the health and welfare of the population(s) for which it is responsible.[1] Other laws, regulations, policies, or standards may be applicable to the conduct of these activities, such as the Health Insurance Portability and Accountability Act: HIPAA Privacy Rule (45 CFR 160 and 164), and the World Health Organization guidelines on ethical issues in public health surveillance.

This explicit exclusion of public health surveillance activities from the definition of research does not mean that other public health activities that do not constitute public health surveillance activities, as described in 45 CFR 46.102(l)(2), are necessarily research subject to 45 CFR part 46. Public health activities are varied, and may be neither research nor surveillance. Public health activities include such things as providing public service health messages or conducting vaccination campaigns. Public health activities that do not meet the definition of research under 45 CFR 46.102(l) are not subject to the 2018 Requirements, regardless of whether they constitute a public health surveillance activity as described in 45 CFR 46.102(l)(2).

The line between public health surveillance activities and research activities can be difficult to draw. The applicability of the public health surveillance activities exclusion depends on the purpose of the project, the context in which it is conducted, and the role of the public health authority. Determining whether a project is a public health surveillance activity for purposes of 45 CFR 46.102(l)(2) requires familiarity with the language of the provision itself, the regulatory definition of a public health authority, the features of public health surveillance, and the details of the particular activity in question. Because activities that constitute public health surveillance activities under 45 CFR 46.102(l)(2) are deemed not to be research, it is not necessary to consider whether they are systematic investigations designed to develop or contribute to generalizable knowledge. 

II. Determining what “public health surveillance activities” are under the 2018 Requirements

The 2018 Requirements do not prescribe any specific requirements for who determines whether projects do or do not constitute public health surveillance activities under 45 CFR 46.102(l)(2). Decisions about the applicability of 45 CFR part 46.102(l)(2) should be thoughtful and deliberate. There is no requirement that an IRB must make such findings.

This guidance discusses the three criteria set out in the 2018 Requirements for determining whether an activity constitutes a public health surveillance activity deemed not to be research:

  • The activity must be a public health surveillance activity (45 CFR 46.102(l)(2));
  • The activity must be conducted, supported, requested, ordered, required, or authorized by a public health authority (45 CFR 46.102(k) and 46.102(l)(2)); and
  • The activity must be limited to that necessary to allow a public health authority to identify, monitor, assess, or investigate potential public health signals, onsets of disease outbreaks, or conditions of public health importance (including trends, signals, risk factors, patterns in diseases, or increases in injuries from using consumer products) (45 CFR 46.102(l)(2)).

If an activity is composed of multiple components, some of which are not public health surveillance, OHRP’s view is that only those components that serve to enable a public health authority to carry out one or more public health surveillance objectives should be considered potentially eligible for the public health surveillance activity exclusion under 45 CFR 46.102(l)(2).

A. Is the activity a “public health surveillance activity”?

Public health surveillance activities are not explicitly defined under the 2018 Requirements. Rather, the regulation provides a description of the types of public health surveillance activities that are deemed not to be research.

In general, public health surveillance involves collecting, testing, analyzing, and using information or biospecimens to improve public health and prevent disease. It provides timely and useful evidence, and it enables public health authorities to be more effective in their efforts to protect and promote public health. Thus, public health surveillance is an important element of public health practice.

Public health surveillance uses information and biospecimens from a variety of sources, including mandatory reporting of certain conditions, routine monitoring, vital records, medical records, medical billing records, clinical specimens, and public health investigations. Further, it often uses the same analytical and laboratory techniques as epidemiological research. However, the difference between public health surveillance and research in this context is that the purpose of the surveillance is to inform the decisions or actions that must be made by a public health authority.

The direct link to decision making and action by a public health authority is a hallmark of public health surveillance. In the context of public health surveillance, the collection, management, analysis, and interpretation of surveillance information or biospecimens is designed to inform a public health authority, and generally is followed by public health action or by the dissemination of information to public health programs and others to stimulate public health action.[2]

For the purposes of this guidance, OHRP views surveillance activities that are not undertaken for the purpose of directly informing public health decision making or action generally not to be public health surveillance, even if they might be considered surveillance for other purposes.

While the best recognized public health surveillance use of information or biospecimens is the monitoring of diseases and detection of outbreaks in the population, this category of activities includes many other uses that are critical to public health practice. For instance, public health surveillance includes the collection and use of information or biospecimens to estimate the scope and magnitude of a public health problem, including the geographic and demographic distribution of a health event to facilitate public health planning. Public health surveillance also includes the use of information or biospecimens to detect changes in relevant practices or behaviors, monitor changes in infectious disease agents and environmental factors, evaluate control measures and response efforts, and actively monitor, identify, and assess the safety of medical products.

B. Is the activity being conducted, supported, requested, ordered, required, or authorized by a “public health authority”?

For the purposes of the 2018 Requirements, the definition of a “public health authority” extends to government entities at all levels, within the United States and abroad, that are responsible for public health matters. It also extends to anyone acting on such an entity’s behalf, for example, through a grant of authority or contract. Examples of a public health authority include ministries of health, state and local health departments, the Centers for Disease Control and Prevention (CDC), the Food and Drug Administration (FDA), and the Occupational Safety and Health Administration (OSHA).[3]   

The definition of a “public health authority” requires that an agency’s official mandate include the responsibility for public health matters. The mandate can be responsibility for public health matters, generally, or it can be for specific public health programs. Furthermore, an agency’s official mandate does not have to be exclusively or primarily for public health. Therefore, to the extent a government agency is responsible for public health matters as part of its official mandate, OHRP considers that, for purposes of this guidance, it qualifies as a public health authority.

For instance, various HHS agencies, such as the National Institutes of Health (NIH), and the Health Resources and Services Administration (HRSA), are authorized by law to assist the Secretary of Health and Human Services in carrying out the purposes of section 301 of the Public Health Service Act, which authorizes the Secretary to conduct or cooperate in a broad range of activities designed to advance public health, including public health surveillance activities and research. For purposes of this guidance, those agencies may be considered public health authorities under the revised Common Rule.[4]

Public health surveillance activities that are conducted by a public health authority may be eligible for consideration under this provision. OHRP considers that an activity is “conducted” by a public health authority when the public health authority participates directly in the collection, testing, analysis, or use of the information or biospecimens, or funds these uses through a contract.

Public health surveillance activities that are supported by a public health authority (e.g., through a grant or cooperative agreement), or that are requested, ordered, required, or authorized by a public health authority, also may be eligible for consideration under this provision, even if they are carried out by an entity that is not a public health authority (e.g., academic institutions, health care organizations, nonprofit entities).

C. Is the activity limited to one that is necessary to allow a public health authority to identify, monitor, assess, or investigate potential public health signals, onsets of disease outbreaks, or conditions of public health importance (including trends, signals, risk factors, patterns in diseases, or increases in injuries from using consumer products)?

The 2018 Requirements specify that the activities deemed not to be research because they are public health surveillance activities are limited to those necessary to allow a public health authority to identify, monitor, assess, or investigate potential public health signals, onsets of disease outbreaks, or conditions of public health importance (including trends, signals, risk factors, and patterns in diseases or injuries).

To satisfy the “limited to those necessary” condition of this provision, OHRP considers only the component parts of an activity that address one or more of these objectives to appropriately constitute a public health surveillance activity.

Research activities that do not constitute public health surveillance, such as a secondary research analysis of data for some other scientific purpose using information collected as part of a public health surveillance activity, can be carried out in tandem with a public health surveillance activity. In such a circumstance, the non-public health surveillance activity (in the example above, the secondary research analysis) should be reviewed to determine whether the 2018 requirements apply.

For the purpose of this guidance, OHRP considers objectives necessary to allow a public health authority to conduct a public health surveillance activity that may qualify for exclusion from the definition of research to include activities consistent with the following guidance on the regulatory standard in application:

  • Identify generally refers to activities that are undertaken to detect potential signals, onsets of disease outbreaks, or conditions of public health importance that had not previously been recognized.
  • Monitor generally refers to activities that are undertaken to maintain situational awareness of an identified signal, outbreak, or condition, in order to detect changes that warrant further public health action.
  • Assess generally refers to activities that are undertaken to evaluate the characteristics of a signal, outbreak, or condition, including its magnitude, prevalence or incidence, and the context in which a signal, outbreak, or condition occurs or has been detected, in order to inform public health action.
  • Investigate generally refers to the range of activities that are undertaken in response to an identified or perceived threat to public health, to determine the magnitude of the problem, identify cases, or determine the cause, and to inform appropriate control measures. The problem under investigation might be a signal, an outbreak, or any other occurrence that warrants action.
  • Provide situational awareness refers to assembling the critical information that is needed to respond to a disease outbreak or other public health emergency.[5]
  • Potential public health signals, onsets of disease outbreaks, and conditions of public health importance generally include conditions affecting health and safety, such as infectious and chronic diseases, injury, including those related to medical products, and mental health.

 III. Activities that are not Public Health Surveillance Activities

Activities that satisfy all three of the numbered criteria in section II above are public health surveillance activities deemed not to be research under 45 CFR 46.102(l)(2). Therefore, OHRP considers that the following activities would not qualify for this exclusion from the definition of research: (1) activities that are not public health surveillance activities (e.g., under OHRP’s general view, certain activities that do not directly inform public health decision making or action), (2) activities that do not involve a public health authority (or an entity acting on behalf of a public health authority), and (3) activities that are not limited to those necessary to allow a public health authority to identify, monitor, assess, or investigate potential public health signals, onsets of disease outbreaks, or conditions of public health importance.

IV. Examples of Public Health Surveillance Activities

The following are examples of public health surveillance activities that OHRP considers not to be research under 45 CFR 46.102(l)(2):

  • Safety and injury surveillance activities designed to enable a public health authority to identify, monitor, assess, and investigate potential safety signals for a specific product or class of products (e.g., the surveillance activities of FDA’s Adverse Event Reporting System,[6] the Vaccine Adverse Event Reporting System,[7] Manufacturer and User Facility Device Experience database,[8] the Medical Product Safety Network,[9] and the Sentinel Initiative[10]).
  • Surveillance activities designed to enable a public health authority to identify unexpected changes in the incidence or prevalence of a certain disease in a defined geographic region where specific public health concerns have been raised (e.g.,the U.S. influenza surveillance system[11]).
  • Surveillance activities designed to enable a public health authority to identify the prevalence or incidence of known risk factors associated with a health problem in the context of a domestic or international public health emergency.
  • Surveillance activities designed to enable a public health authority to locate the range and source of a disease outbreak or to identify cases of a disease outbreak.
  • Surveillance activities designed to enable a public health authority to detect the onset of disease outbreaks or provide timely situational awareness during the course of an event or crisis that threatens the public health, such as a natural or man-made disaster.
  • Surveillance activities designed to enable a public health authority to identify the prevalence or incidence of a condition of public health importance, known risk factors associated with a condition of public health importance, or behaviors or medical practices related to prevalence of a known condition of public health importance (e.g., surveillance of the prevalence of tobacco use, exposure to secondhand smoke, lung cancer, or use of smoking cessation treatments).

If you have specific questions about how to apply this guidance, please contact OHRP by phone at (866) 447-4777 (toll-free within the United States) or (240) 453-6900, or by e-mail at ohrp@hhs.gov


[1] 82 FR 7176.

[2] Thacker SB, Qualters JR, Lee LM. Public Health Surveillance in the United States: Evolution and Challenges. MMWR Supp. 2012 Jul 27; 61(3):3-9.

[3] See https://www.hhs.gov/hipaa/for-professionals/special-topics/public-health/index.html.
Note that the definition of “public health authority,” in the 2018 Requirements is substantively the same as the definition of “public health authority” under the HIPAA Privacy Rule (45 CFR 164.501), except that foreign governments may be considered a “public health authority” under the 2018 Requirements.

[5] Stoto MA. The Effectiveness of U.S. Public Health Surveillance Systems for Situational Awareness during the 2009 H1N1 Pandemic: A Retrospective Analysis. PLoS ONE 2012; 7(8):e40984. https://doi.org/10.1371/journal.pone.0040984

Content created by Office for Human Research Protections (OHRP)
Content last reviewed on November 12, 2018