Download:
pdf |
pdfAttachment 2a: Document 1 - JBS International Network Security
NETWORK SECURITY AT J BS INTERNATIONAL
JBS International, Inc. (JBS) has implemented an information security program whose
foundations are the security baseline provided by the HHS and SAMHSA security guidelines for
a multilayered, hierarchical approach to information/information technology (IT) security policy
and the risk-based approach to managing security defined by National Institute of Standards and
Technology (NIST). We understand that information security is properly managed as a
continuous process pursuing constant improvement and, thus, an essential guide we will use in
implementing our plan over time will be the Security Life Cycle stages defined by NIST’s
Security Life Cycle and Risk Management Framework (RMF). This strategy combines the
capabilities of people, operations, and technology.
With no plans to process or store personally identifiable information or other sensitive data, the
potential operational impact of an information security breach of the TCE-HIV Project Systems
and the corresponding minimum information security requirements are moderate to low
according to FIPS 199 categorization. Oversight for this security program is provided by a
Certified Information Systems Security Professional (CISSP). We understand that implementing
the requisite set of NIST-defined controls for even a low-impact system requires a
comprehensive, coordinated approach to all facets of information systems security involving all
team members. We also understand that all controls must be employed strategically depending
on the risk management profiles of specific activities and environments. With this in mind, the
security controls to be implemented for the TCE-HIV Project Systems include:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Access Controls
Awareness and Training
Audit and Accountability Controls
Certification, Accreditation, and Security Assessment Controls
Configuration Management Controls
Contingency Planning Controls
Identification and Authentication Controls
Incident Response Controls
Media Protection Controls
Physical and Environmental Protection Controls
Security Planning Policies and Procedures
Personnel Security Controls
Risk Assessment Controls
System Maintenance Controls
System and Services Acquisition Controls
System and Communications Protection Controls
System and Information Integrity
Essential information security tools and techniques supporting the TCE-HIV Project Systems in
the hosting environment include:
1
Attachment 2a: Document 1 - JBS International Network Security
•
•
•
•
•
•
•
•
Virtualization. To realize the enhanced control, manageability, standardization, and
recovery capabilities offered by virtualization, individual components of the TCE-HIV
systems are deployed as virtual machines using VMWare Infrastructure 3.5.
Understanding that virtualization concentrates risk, we follow best practices in protecting
key virtual infrastructure assets, strictly limiting physical access and requiring two-factor
authentication on ESX hosts and Virtual Center server management machines, locking
down the ESX host firewalls, and including all components of the VM Infrastructure in
our continuous monitoring program.
Network protection and segmentation. Whereas virtual switches and VLANs are used for
development and testing, production networks in the Data Center are separated with
physical routers and switches for additional assurance. All data-driven applications
hosted at the Data Center that support the TCE-HIV Project use dedicated database server
clusters, which are maintained behind multiple firewalls in an isolated subnet permitting
only properly authenticated SQL transactions originating at the Web application server as
incoming data. Web application servers reside on a separate DMZ network segment. The
firewalls provide network-based intrusion protection system (IPS) services with threat
signatures updated daily. Firewalls, routers, and switch operate in FIPS-199 compliant
mode.
Two-factor authentication. Relying solely on passwords, even when they are complex, is
widely acknowledged to be an inadequate method of authentication in protecting
sensitive information. Remote access to servers in our Data Center requires two-factor
authentication by authorized system administrators using the call-back mechanism
provided by PhoneFactor.
Data encryption. Sensitive data transmitted to applications such as the VLC are encrypted
during transmission using industry-standard 128-bit security sockets layer (SSL)
technology. To optimally protect data in storage, both on the database server and on
backup media, we take advantage where possible of the new capabilities of SQL Server
2008 for whole-file transparent database encryption (TDE) using 256-bit advance
encryption standard (AES) technology.
Host protection. The Web and database servers hosting applications for the TCE-HIV
Project are secured with host-based intrusion detection software and antivirus software
updated daily. The servers are locked down, with machine firewalls turned on and only
the minimum set of services needed to perform designated functions activated.
Physical security. All physical access to servers hosting applications for the TCE-HIV
Project residing in the Data Center is tracked and restricted to designated administrators.
Consistent with HHS policy, all operations performed by JBS staff on Substance Abuse
and Mental Health Services Administration (SAMHSA) data and systems with client
applications are restricted to PC desktop and laptop systems configured as secure Federal
Desktops.
Role-based access control. Direct access to SAMHSA data and database servers is
restricted to authorized personnel. Proper segregation of duties minimizes the potential
for collusion or for a single individual to have privileges sufficient to allow controls to be
circumvented in an undetected manner.
Application security. We recognize that the traditional defense-in-depth information
security strategy is often by itself ineffective in dealing with the growing variety of
sophisticated application-level exploits. In developing and maintaining applications for
2
Attachment 2a: Document 1 - JBS International Network Security
•
•
•
the TCE-HIV Project, our development team will follow secure coding practices to guard
against vulnerabilities that permit attacks on Web applications, including SQL injection
and cross-site scripting. Whenever changes are made to existing applications or new
applications are implemented for the TCE-HIV Project, we will scan them for common
vulnerabilities including the SANS Top 20 with the SAMHSA-standard AppScan
security testing tool and other scanning tools.
Monitoring and intrusion detection. All applications supporting the TCE-HIV Project and
their underlying components are monitored continuously thorough our Security
Information Management System (SIMS) and Network Management System (NMS). In
addition, database servers are protected with the Sentrigo HedgeHog real-time database
auditing and activity monitoring system to provide a more thorough and comprehensive
level of monitoring, auditing, and intrusion detection and alerting. Any attempt to access
data or objects not consistent with the defined profile of permitted activity will trigger an
alert and block access. In addition, an audit trail of generated alerts will be maintained.
Disaster recovery. All data supporting the TCE-HIV Project are backed up daily, with
database transaction logs backed up every 2 hours. Backups are written initially to disk at
the Data Center, with a copy of the backup file transmitted via VPN to our office in
Burlingame, California. Use of advanced data de-duplication technology will minimize
the transfer time. A copy of the backup file will also be written to tape and securely
stored offsite at our facility in Burlingame. In the event of a major failure at our Data
Center, our disaster recovery plan will include provisions for resuming TCE-HIV system
operations at our Burlingame office. We will test data recovery and restoration of service
at the alternative facility quarterly.
Independent verification. Annually, we will verify the security of all systems supporting
the TCE-HIV Project by having an independent, certified security specialist conduct a
comprehensive information systems security audit and review including the following
steps: (1) physical and environmental review—including physical security, power supply,
air conditioning, humidity control, and other environmental factors; (2) system
administration review—including security review of the operating systems, database
management systems, all system administration procedures, and compliance; (3)
application software review—including access control and authorizations, validations,
error and exception handling, business process flows within the application software,
complementary manual controls and procedures, and system development lifecycle; (4)
network security review—including internal and external connections to the system,
perimeter security, firewall review, router access control lists, port scanning, and
intrusion detection; (5) business continuity—including existence and maintenance of
fault tolerant and redundant hardware, backup procedures and storage, and documented
and tested disaster recovery/business continuity plan; and (6) data integrity review—
including examination of live data to verify adequacy of controls and impact of
weaknesses.
3
Attachment 2a: Document 2 - Project Working Group Feedback Results
Project Working Group (PWG) Feedback Results
Note: The instruments included in this OMB package have been revised and incorporate
feedback provided by the PWG. The section/question numbers indicated in the tables
below correspond with the instruments reviewed.
CLIENT LEVEL SURVEY (CLS)
Feedback
Section A – Q A3: Are you receiving services…”
Section A
Section B
Changes Made to Instrument
Moved what was Question A3 (Are you receiving
services other than from this agency/organization?) to
Section E (new question E22) and revised.
Specifically, asked about amount of services received
from this and other agency/organization.
Removed Sexual orientation question
Added questions asking about unprotected sexual
activity with (1) male partner, (2) female partner, and
(3) male partner and female partner as filters prior to
table.
Separated questions in table (i.e., B10a – B10j) to ask
about unprotected sexual activity by partner’s sex.
Section C
Added STI screening question (new question C1) and
changed instructions accordingly
Drug Testing Questions
Split previous question 1 (How frequently do you
conduct drug screening tests?) into two questions (1.
How frequently does your program conduct drug
testing?) and (2. For what reason(s) does your
program conduct drug testing?)
Added: For Cause and Scheduled to new number 2.
Changed time frame to 90 days for question 3 and
asked about frequency versus y/n (Has the client
received a drug test in the past 90 days? Yes,
specify, no, unknown)
Added question (new question 6) Was the sample
collection directly observed?
Changed the response options for new question 8
(What were the results of the client’s most recent drug
1
Attachment 2a: Document 2 - Project Working Group Feedback Results
CLIENT LEVEL SURVEY (CLS)
test?)
Added question (new question 9) If the test was
positive for recent use of alcohol or other drugs, what
actions were taken as a result of the positive test?
CLIENT FOCUS GROUP INTERVIEW GUIDE
Feedback
What type of services are provided that target
HIV risk behaviors
Changes Made to Instrument
Added questions that addressed clients’ participation
in activities targeted to reduce HIV risk behavior.
ADMINISTRATOR INTERVIEW GUIDE
Feedback
What types of services are provided that
target HIV risk behaviors?
Discussion regarding service community
Changes Made to Instrument
Added question that specifically asks “What types of
services does your TCE-HIV project provide that target
HIV risk behaviors?”
Added question to the guide
DIRECT STAFF INTERVIEW GUIDE
Feedback
What types of services are provided that
target HIV risk behaviors?
Changes Made to Instrument
Added question that specifically asks “What types of
services does your TCE-HIV project provide that target
HIV risk behaviors?”
2
Attachment 2a: Document 2 - Project Working Group Feedback Results
PARTNERS INTERVIEW GUIDE
Feedback
What types of services are provided that target
HIV risk behaviors?
Discussion regarding service community.
Changes to Instrument
Added question that specifically asks “What types of
services does your TCE-HIV project provide that target
HIV risk behaviors?”
Expanded on community context questions.
3
45 CFR 46 consists of Sub-parts A, B, C and D. Sub-part A is also known as the “Common Rule”. The text of this
Rule was agreed upon by seventeen government agencies and published in the Federal Register on June 18, 1991.
The agencies all agreed to promulgate the same regulations based on this Common Rule so that human subjects
research would be regulated consistently across the government. The Federal Register made it clear that each agency
would implement the Common Rule through its particular regulations; DOE does so through 10 CFR 745. LLNL’s
Multiple Project Assurance with DHHS commits the Laboratory to implementing all sub-parts of 45 CFR 46, not
just the Common Rule. Therefore, when referencing federal regulations, this manual will use the DHHS regulations
(45 CFR 46) instead of DOE regulations (10 CFR 745) when referring to elements of the Common Rule.
CODE OF FEDERAL REGULATIONS
TITLE 45
PUBLIC WELFARE
DEPARTMENT OF HEALTH AND HUMAN SERVICES
NATIONAL INSTITUTES OF HEALTH
OFFICE FOR PROTECTION FROM RESEARCH RISKS
PART 46
PROTECTION OF HUMAN SUBJECTS
***
Revised June 18, 1991
Effective August 19, 1991
***
Subpart A --
Sec.
46.101
46.102
46.103
Federal Policy for the Protection of Human Subjects (Basic DHHS Policy for
Protection of Human Research Subjects)
To what does this policy apply?
Definitions.
Assuring compliance with this policy--research conducted or supported by any
Federal Department or Agency.
46.104-46.106[Reserved]
46.107
IRB membership.
46.108
IRB functions and operations.
46.109
IRB review of research.
46.110
Expedited review procedures for certain kinds of research involving no more than
minimal risk, and for minor changes in approved research.
46.111
Criteria for IRB approval of research.
46.112
Review by institution.
46.113
Suspension or termination of IRB approval of research.
46.114
Cooperative research.
46.115
IRB records.
46.116
General requirements for informed consent.
46.117
Documentation of informed consent.
46.118
Applications and proposals lacking definite plans for involvement of human
subjects.
46.119
46.120
46.121
46.122
46.123
46.124
Subpart B --
Sec.
46.201
46.202
46.203
46.204
46.205
46.206
46.207
46.208
46.209
46.210
46.211
Subpart C --
Sec.
46.301
46.302
46.303
46.304
46.305
Research undertaken without the intention of involving human subjects.
Evaluation and disposition of applications and proposals for research to be
conducted or supported by a Federal Department or Agency.
[Reserved]
Use of Federal funds.
Early termination of research support: Evaluation of applications and proposals.
Conditions.
Additional DHHS Protections Pertaining to Research, Development, and Related
Activities Involving Fetuses, Pregnant Women, and Human In Vitro Fertilization
Applicability.
Purpose.
Definitions.
Ethical Advisory Boards.
Additional duties of the Institutional Review Boards in connection with activities
involving fetuses, pregnant women, or human in vitro fertilization.
General limitations.
Activities directed toward pregnant women as subjects.
Activities directed toward fetuses in utero as subjects.
Activities directed toward fetuses ex utero, including nonviable fetuses, as
subjects.
Activities involving the dead fetus, fetal material, or the placenta.
Modification or waiver of specific requirements.
Additional DHHS Protections Pertaining to Biomedical and Behavioral Research
Involving Prisoners as Subjects
46.306
Applicability.
Purpose.
Definitions.
Composition of Institutional Review Boards where prisoners are involved.
Additional duties of the Institutional Review Boards where prisoners are
involved.
Permitted research involving prisoners.
Subpart D --
Additional DHHS Protections for Children Involved as Subjects in Research
Sec.
46.401
46.402
46.403
46.404
46.405
To what do these regulations apply?
Definitions.
IRB duties.
Research not involving greater than minimal risk.
Research involving greater than minimal risk but presenting the prospect of direct
benefit to the individual subjects.
46.406
46.407
46.408
46.409
Research involving greater than minimal risk and no prospect of direct benefit to
individual subjects, but likely to yield generalizable knowledge about the subject's
disorder or condition.
Research not otherwise approvable which presents an opportunity to understand,
prevent, or alleviate a serious problem affecting the health or welfare of children.
Requirements for permission by parents or guardians and for assent by children.
Wards.
Authority: 5 U.S.C. 301; Sec. 474(a), 88 Stat. 352 (42 U.S.C. 2891-3(a)).
Note: As revised, Subpart A of the DHHS regulations incorporates the Common Rule (Federal
Policy) for the Protection of Human Subjects (56 FR 28003). Subpart D of the HHS regulations
has been amended at Section 46.401(b) to reference the revised Subpart A.
The Common Rule (Federal Policy) is also codified at:
7 CFR Part 1c
10 CFR Part 745
14 CFR Part 1230
15 CFR Part 27
16 CFR Part 1028
22 CFR Part 225
24 CFR Part 60
28 CFR Part 46
32 CFR Part 219
34 CFR Part 97
38 CFR Part 16
40 CFR Part 26
45 CFR Part 690
49 CFR Part 11
Department of Agriculture
Department of Energy
National Aeronautics and Space Administration
Department of Commerce
Consumer Product Safety Commission
International Development Cooperation Agency, Agency for International
Development
Department of Housing and Urban Development
Department of Justice
Department of Defense
Department of Education
Department of Veterans Affairs
Environmental Protection Agency
National Science Foundation
Department of Transportation
TITLE 45
CODE OF FEDERAL REGULATIONS
PART 46
PROTECTION OF HUMAN SUBJECTS
***
Revised June 18, 1991
Effective August 19, 1991
***
Subpart A - Federal Policy for the Protection of Human Subjects (Basic
DHHS Policy for Protection of Human Research Subjects)
Source: 56 FR 28003, June 18, 1991.
§46.101 To what does this policy apply?
(a) Except as provided in paragraph (b) of this section, this policy applies to all research
involving human subjects conducted, supported or otherwise subject to regulation by any Federal
Department or Agency which takes appropriate administrative action to make the policy
applicable to such research. This includes research conducted by Federal civilian employees or
military personnel, except that each Department or Agency head may adopt such procedural
modifications as may be appropriate from an administrative standpoint. It also includes research
conducted, supported, or otherwise subject to regulation by the Federal Government outside the
United States.
(1) Research that is conducted or supported by a Federal Department or Agency, whether or
not it is regulated as defined in §46.102(e), must comply with all sections of this policy.
(2) Research that is neither conducted nor supported by a Federal Department or Agency but
is subject to regulation as defined in §46.102(e) must be reviewed and approved, in
compliance with §46.101, §46.102, and §46.107 through §46.117 of this policy, by an
Institutional Review Board (IRB) that operates in accordance with the pertinent requirements
of this policy.
(b) Unless otherwise required by Department or Agency heads, research activities in which the
only involvement of human subjects will be in one or more of the following categories are
exempt from this policy:1
(1) Research conducted in established or commonly accepted educational settings, involving
normal educational practices, such as (i) research on regular and special education
instructional strategies, or (ii) research on the effectiveness of or the comparison among
instructional techniques, curricula, or classroom management methods.
(2) Research involving the use of educational tests (cognitive, diagnostic, aptitude,
achievement), survey procedures, interview procedures or observation of public behavior,
unless: (i) information obtained is recorded in such a manner that human subjects can be
identified, directly or through identifiers linked to the subjects; and (ii) any disclosure of the
human subjects' responses outside the research could reasonably place the subjects at risk of
criminal or civil liability or be damaging to the subjects' financial standing, employability, or
reputation.
(3) Research involving the use of educational tests (cognitive, diagnostic, aptitude,
achievement), survey procedures, interview procedures, or observation of public behavior
that is not exempt under paragraph (b)(2) of this section, if: (i) the human subjects are elected
or appointed public officials or candidates for public office; or (ii) Federal statute(s)
require(s) without exception that the confidentiality of the personally identifiable information
will be maintained throughout the research and thereafter.
(4) Research involving the collection or study of existing data, documents, records,
pathological specimens, or diagnostic specimens, if these sources are publicly available or if
the information is recorded by the investigator in such a manner that subjects cannot be
identified, directly or through identifiers linked to the subjects.
(5) Research and demonstration projects which are conducted by or subject to the approval of
Department or Agency heads, and which are designed to study, evaluate, or otherwise
examine: (i) Public benefit or service programs; (ii) procedures for obtaining benefits or
services under those programs; (iii) possible changes in or alternatives to those programs or
procedures; or (iv) possible changes in methods or levels of payment for benefits or services
under those programs.
(6) Taste and food quality evaluation and consumer acceptance studies, (i) if wholesome
foods without additives are consumed or (ii) if a food is consumed that contains a food
ingredient at or below the level and for a use found to be safe, or agricultural chemical or
environmental contaminant at or below the level found to be safe, by the Food and Drug
Administration or approved by the Environmental Protection Agency or the Food Safety and
Inspection Service of the U.S. Department of Agriculture.
(c) Department or Agency heads retain final judgment as to whether a particular activity is
covered by this policy.
(d) Department or Agency heads may require that specific research activities or classes of
research activities conducted, supported, or otherwise subject to regulation by the Department or
Agency but not otherwise covered by this policy, comply with some or all of the requirements of
this policy.
(e) Compliance with this policy requires compliance with pertinent Federal laws or regulations
which provide additional protections for human subjects.
(f) This policy does not affect any State or local laws or regulations which may otherwise be
applicable and which provide additional protections for human subjects.
(g) This policy does not affect any foreign laws or regulations which may otherwise be
applicable and which provide additional protections to human subjects of research.
(h) When research covered by this policy takes place in foreign countries, procedures normally
followed in the foreign countries to protect human subjects may differ from those set forth in this
policy. [An example is a foreign institution which complies with guidelines consistent with the
World Medical Assembly Declaration (Declaration of Helsinki amended 1989) issued either by
sovereign states or by an organization whose function for the protection of human research
subjects is internationally recognized.] In these circumstances, if a Department or Agency head
determines that the procedures prescribed by the institution afford protections that are at least
equivalent to those provided in this policy, the Department or Agency head may approve the
substitution of the foreign procedures in lieu of the procedural requirements provided in this
policy. Except when otherwise required by statute, Executive Order, or the Department or
Agency head, notices of these actions as they occur will be published in the Federal Register or
will be otherwise published as provided in Department or Agency procedures.
(i) Unless otherwise required by law, Department or Agency heads may waive the applicability
of some or all of the provisions of this policy to specific research activities or classes or research
activities otherwise covered by this policy. Except when otherwise required by statute or
Executive Order, the Department or Agency head shall forward advance notices of these actions
to the Office for Protection from Research Risks, National Institutes of Health, Department of
Health and Human Services (DHHS), and shall also publish them in the Federal Register or in
such other manner as provided in Department or Agency procedures.1
§46.102 Definitions.
(a) Department or Agency head means the head of any Federal Department or Agency and any
other officer or employee of any Department or Agency to whom authority has been delegated.
(b) Institution means any public or private entity or Agency (including Federal, State, and other
agencies).
(c) Legally authorized representative means an individual or judicial or other body authorized
under applicable law to consent on behalf of a prospective subject to the subject's participation in
the procedure(s) involved in the research.
(d) Research means a systematic investigation, including research development, testing and
evaluation, designed to develop or contribute to generalizable knowledge. Activities which meet
this definition constitute research for purposes of this policy, whether or not they are conducted
or supported under a program which is considered research for other purposes. For example,
some demonstration and service programs may include research activities.
(e) Research subject to regulation, and similar terms are intended to encompass those research
activities for which a Federal Department or Agency has specific responsibility for regulating as
a research activity, (for example, Investigational New Drug requirements administered by the
Food and Drug Administration). It does not include research activities which are incidentally
regulated by a Federal Department or Agency solely as part of the Department's or Agency's
1
Institutions with DHHS-approved assurances on file will abide by provisions of Title 45 CFR Part 46 Subparts AD. Some of the other departments and agencies have incorporated all provisions of Title 45 CFR Part 46 into their
policies and procedures as well. However, the exemptions at 45 CFR 46.101(b) do not apply to research involving
prisoners, fetuses, pregnant women, or human in vitro fertilization, Subparts B and C. The exemption at 45 CFR
46.101(b)(2), for research involving survey or interview procedures or observation of public behavior, does not
apply to research with children, Subpart D, except for research involving observations of public behavior when the
investigator(s) do not participate in the activities being observed.
broader responsibility to regulate certain types of activities whether research or non-research in
nature (for example, Wage and Hour requirements administered by the Department of Labor).
(f) Human subject means a living individual about whom an investigator (whether professional
or student) conducting research obtains (1) data through intervention or interaction with the
individual, or (2) identifiable private information.
Intervention includes both physical procedures by which data are gathered (for example,
venipuncture) and manipulations of the subject or the subject's environment that are performed
for research purposes. Interaction includes communication or interpersonal contact between
investigator and subject. Private information includes information about behavior that occurs in a
context in which an individual can reasonably expect that no observation or recording is taking
place, and information which has been provided for specific purposes by an individual and which
the individual can reasonably expect will not be made public (for example, a medical record).
Private information must be individually identifiable (i.e., the identity of the subject is or may
readily be ascertained by the investigator or associated with the information) in order for
obtaining the information to constitute research involving human subjects.
(g) IRB means an Institutional Review Board established in accord with and for the purposes
expressed in this policy.
(h) IRB approval means the determination of the IRB that the research has been reviewed and
may be conducted at an institution within the constraints set forth by the IRB and by other
institutional and Federal requirements.
(i) Minimal risk means that the probability and magnitude of harm or discomfort anticipated in
the research are not greater in and of themselves than those ordinarily encountered in daily life or
during the performance of routine physical or psychological examinations or tests.
(j) Certification means the official notification by the institution to the supporting Department or
Agency, in accordance with the requirements of this policy, that a research project or activity
involving human subjects has been reviewed and approved by an IRB in accordance with an
approved assurance.
§46.103 Assuring compliance with this policy -- research conducted or supported by any Federal
Department or Agency.
(a) Each institution engaged in research which is covered by this policy and which is conducted
or supported by a Federal Department or Agency shall provide written assurance satisfactory to
the Department or Agency head that it will comply with the requirements set forth in this policy.
In lieu of requiring submission of an assurance, individual Department or Agency heads shall
accept the existence of a current assurance, appropriate for the research in question, on file with
the Office for Protection from Research Risks, National Institutes Health, DHHS, and approved
for Federal-wide use by that office. When the existence of an DHHS-approved assurance is
accepted in lieu of requiring submission of an assurance, reports (except certification) required
by this policy to be made to Department and Agency heads shall also be made to the Office for
Protection from Research Risks, National Institutes of Health, DHHS.
(b) Departments and agencies will conduct or support research covered by this policy only if the
institution has an assurance approved as provided in this section, and only if the institution has
certified to the Department or Agency head that the research has been reviewed and approved by
an IRB provided for in the assurance, and will be subject to continuing review by the IRB.
Assurances applicable to federally supported or conducted research shall at a minimum include:
(1) A statement of principles governing the institution in the discharge of its responsibilities
for protecting the rights and welfare of human subjects of research conducted at or sponsored
by the institution, regardless of whether the research is subject to Federal regulation. This
may include an appropriate existing code, declaration, or statement of ethical principles, or a
statement formulated by the institution itself. This requirement does not preempt provisions
of this policy applicable to Department- or Agency-supported or regulated research and need
not be applicable to any research exempted or waived under §46.101 (b) or (i).
(2) Designation of one or more IRBs established in accordance with the requirements of this
policy, and for which provisions are made for meeting space and sufficient staff to support
the IRB's review and record-keeping duties.
(3) A list of IRB members identified by name; earned degrees; representative capacity;
indications of experience such as board certifications, licenses, etc., sufficient to describe
each member's chief anticipated contributions to IRB deliberations; and any employment or
other relationship between each member and the institution; for example: full-time employee,
part-time employee, member of governing panel or board, stockholder, paid or unpaid
consultant. Changes in IRB membership shall be reported to the Department or Agency head,
unless in accord with §46.103(a) of this policy, the existence of a DHHS-approved assurance
is accepted. In this case, change in IRB membership shall be reported to the Office for
Protection from Research Risks, National Institutes of Health, DHHS.
(4) Written procedures which the IRB will follow (i) for conducting its initial and continuing
review of research and for reporting its findings and actions to the investigator and the
institution; (ii) for determining which projects require review more often than annually and
which projects need verification from sources other than the investigators that no material
changes have occurred since previous IRB review; and (iii) for ensuring prompt reporting to
the IRB of proposed changes in a research activity, and for ensuring that such changes in
approved research, during the period for which IRB approval has already been given, may
not be initiated without IRB review and approval except when necessary to eliminate
apparent immediate hazards to the subject.
(5) Written procedures for ensuring prompt reporting to the IRB, appropriate institutional
officials, and the Department or Agency head of (i) any unanticipated problems involving
risks to subjects or others or any serious or continuing noncompliance with this policy or the
requirements or determinations of the IRB; and (ii) any suspension or termination of IRB
approval.
(c) The assurance shall be executed by an individual authorized to act for the institution and to
assume on behalf of the institution the obligations imposed by this policy and shall be filed in
such form and manner as the Department or Agency head prescribes.
(d) The Department or Agency head will evaluate all assurances submitted in accordance with
this policy through such officers and employees of the Department or Agency and such experts
or consultants engaged for this purpose as the Department or Agency head determines to be
appropriate. The Department or Agency head's evaluation will take into consideration the
adequacy of the proposed IRB in light of the anticipated scope of the institution's research
activities and the types of subject populations likely to be involved, the appropriateness of the
proposed initial and continuing review procedures in light of the probable risks, and the size and
complexity of the institution.
(e) On the basis of this evaluation, the Department or Agency head may approve or disapprove
the assurance, or enter into negotiations to develop an approvable one. The Department or
Agency head may limit the period during which any particular approved assurance or class of
approved assurances shall remain effective or otherwise condition or restrict approval.
(f) Certification is required when the research is supported by a Federal Department or Agency
and not otherwise exempted or waived under §46.101 (b) or (i). An institution with an approved
assurance shall certify that each application or proposal for research covered by the assurance
and by §46.103 of this policy has been reviewed and approved by the IRB. Such certification
must be submitted with the application or proposal or by such later date as may be prescribed by
the Department or Agency to which the application or proposal is submitted. Under no condition
shall research covered by §46.103 of the policy be supported prior to receipt of the certification
that the research has been reviewed and approved by the IRB. Institutions without an approved
assurance covering the research shall certify within 30 days after receipt of a request for such a
certification from the Department or Agency, that the application or proposal has been approved
by the IRB. If the certification is not submitted within these time limits, the application or
proposal may be returned to the institution. (Approved by the Office of Management and Budget
under Control Number 9999-0020.)
§§46.104--46.106 [Reserved]
§46.107 IRB membership.
(a) Each IRB shall have at least five members, with varying backgrounds to promote complete
and adequate review of research activities commonly conducted by the institution. The IRB shall
be sufficiently qualified through the experience and expertise of its members, and the diversity of
the members, including consideration of race, gender, and cultural backgrounds and sensitivity to
such issues as community attitudes, to promote respect for its advice and counsel in safeguarding
the rights and welfare of human subjects. In addition to possessing the professional competence
necessary to review specific research activities, the IRB shall be able to ascertain the
acceptability of proposed research in terms of institutional commitments and regulations,
applicable law, and standards of professional conduct and practice. The IRB shall therefore
include persons knowledgeable in these areas. If an IRB regularly reviews research that involves
a vulnerable category of subjects, such as children, prisoners, pregnant women, or handicapped
or mentally disabled persons, consideration shall be given to the inclusion of one or more
individuals who are knowledgeable about and experienced in working with these subjects.
(b) Every nondiscriminatory effort will be made to ensure that no IRB consists entirely of men or
entirely of women, including the institution's consideration of qualified persons of both sexes, so
long as no selection is made to the IRB on the basis of gender. No IRB may consist entirely of
members of one profession.
(c) Each IRB shall include at least one member whose primary concerns are in scientific areas
and at least one member whose primary concerns are in nonscientific areas.
(d) Each IRB shall include at least one member who is not otherwise affiliated with the
institution and who is not part of the immediate family of a person who is affiliated with the
institution.
(e) No IRB may have a member participate in the IRB's initial or continuing review of any
project in which the member has a conflicting interest, except to provide information requested
by the IRB.
(f) An IRB may, in its discretion, invite individuals with competence in special areas to assist in
the review of issues which require expertise beyond or in addition to that available on the IRB.
These individuals may not vote with the IRB
§46.108 IRB functions and operations.
In order to fulfill the requirements of this policy each IRB shall:
(a) Follow written procedures in the same detail as described in §46.103(b)(4) and to the extent
required by §46.103(b)(5).
(b) Except when an expedited review procedure is used (see §46.110), review proposed research
at convened meetings at which a majority of the members of the IRB are present, including at
least one member whose primary concerns are in nonscientific areas. In order for the research to
be approved, it shall receive the approval of a majority of those members present at the meeting
§46.109 IRB review of research.
(a) An IRB shall review and have authority to approve, require modifications in (to secure
approval), or disapprove all research activities covered by this policy.
(b) An IRB shall require that information given to subjects as part of informed consent is in
accordance with §46.116. The IRB may require that information, in addition to that specifically
mentioned in §46.116, be given to the subjects when in the IRB's judgment the information
would meaningfully add to the protection of the rights and welfare of subjects.
(c) An IRB shall require documentation of informed consent or may waive documentation in
accordance with §46.117.
(d) An IRB shall notify investigators and the institution in writing of its decision to approve or
disapprove the proposed research activity, or of modifications required to secure IRB approval of
the research activity. If the IRB decides to disapprove a research activity, it shall include in its
written notification a statement of the reasons for its decision and give the investigator an
opportunity to respond in person or in writing.
(e) An IRB shall conduct continuing review of research covered by this policy at intervals
appropriate to the degree of risk, but not less than once per year, and shall have authority to
observe or have a third party observe the consent process and the research. (Approved by the
Office of Management and Budget under Control Number 9999-0020.)
§46.110 Expedited review procedures for certain kinds of research involving no more than
minimal risk, and for minor changes in approved research.
(a) The Secretary, HHS, has established, and published as a Notice in the Federal Register, a list
of categories of research that may be reviewed by the IRB through an expedited review
procedure. The list will be amended, as appropriate, after consultation with other departments
and agencies, through periodic republication by the Secretary, HHS, in the Federal Register. A
copy of the list is available from the Office for Protection from Research Risks, National
Institutes of Health, DHHS, Bethesda, Maryland 20892.
(b) An IRB may use the expedited review procedure to review either or both of the following:
(1) some or all of the research appearing on the list and found by the reviewer(s) to involve
no more than minimal risk,
(2) minor changes in previously approved research during the period (of one year or less) for
which approval is authorized.
Under an expedited review procedure, the review may be carried out by the IRB chairperson or
by one or more experienced reviewers designated by the chairperson from among members of
the IRB. In reviewing the research, the reviewers may exercise all of the authorities of the IRB
except that the reviewers may not disapprove the research. A research activity may be
disapproved only after review in accordance with the non-expedited procedure set forth in
§46.108(b).
(c) Each IRB which uses an expedited review procedure shall adopt a method for keeping all
members advised of research proposals which have been approved under the procedure.
(d) The Department or Agency head may restrict, suspend, terminate, or choose not to authorize
an institution's or IRB's use of the expedited review procedure.
§46.111 Criteria for IRB approval of research.
(a) In order to approve research covered by this policy the IRB shall determine that all of the
following requirements are satisfied:
(1) Risks to subjects are minimized: (i) by using procedures which are consistent with sound
research design and which do not unnecessarily expose subjects to risk, and (ii) whenever
appropriate, by using procedures already being performed on the subjects for diagnostic or
treatment purposes.
(2) Risks to subjects are reasonable in relation to anticipated benefits, if any, to subjects, and
the importance of the knowledge that may reasonably be expected to result. In evaluating
risks and benefits, the IRB should consider only those risks and benefits that may result from
the research (as distinguished from risks and benefits of therapies subjects would receive
even if not participating in the research). The IRB should not consider possible long-range
effects of applying knowledge gained in the research (for example, the possible effects of the
research on public policy) as among those research risks that fall within the purview of its
responsibility.
(3) Selection of subjects is equitable. In making this assessment the IRB should take into
account the purposes of the research and the setting in which the research will be conducted
and should be particularly cognizant of the special problems of research involving vulnerable
populations, such as children, prisoners, pregnant women, mentally disable persons, or
economically or educationally disadvantaged persons.
(4) Informed consent will be sought from each prospective subject or the subject's legally
authorized representative, in accordance with, and to the extent required by §46.116.
(5) Informed consent will be appropriately documented, in accordance with, and to the extent
required by §46.117.
(6) When appropriate, the research plan makes adequate provision for monitoring the data
collected to ensure the safety of subjects.
(7) When appropriate, there are adequate provisions to protect the privacy of subjects and to
maintain the confidentiality of data.
(b) When some or all of the subjects are likely to be vulnerable to coercion or undue influence,
such as children, prisoners, pregnant women, mentally disabled persons, or economically or
educationally disadvantaged persons, additional safeguards have been included in the study to
protect the rights and welfare of these subjects.
§46.112 Review by institution.
Research covered by this policy that has been approved by an IRB may be subject to further
appropriate review and approval or disapproval by officials of the institution. However, those
officials may not approve the research if it has not been approved by an IRB.
§46.113 Suspension or termination of IRB approval of research.
An IRB shall have authority to suspend or terminate approval of research that is not being
conducted in accordance with the IRB's requirements or that has been associated with
unexpected serious harm to subjects. Any suspension or termination or approval shall include a
statement of the reasons for the IRB's action and shall be reported promptly to the investigator,
appropriate institutional officials, and the Department or Agency head. (Approved by the Office
of Management and Budget under Control Number 9999-0020.)
§46.114 Cooperative research.
Cooperative research projects are those projects covered by this policy which involve more than
one institution. In the conduct of cooperative research projects, each institution is responsible for
safeguarding the rights and welfare of human subjects and for complying with this policy. With
the approval of the Department or Agency head, an institution participating in a cooperative
project may enter into a joint review arrangement, rely upon the review of another qualified IRB,
or make similar arrangements for avoiding duplication of effort.
§46.115 IRB records.
(a) An institution, or when appropriate an IRB, shall prepare and maintain adequate
documentation of IRB activities, including the following:
(1) Copies of all research proposals reviewed, scientific evaluations, if any, that accompany
the proposals, approved sample consent documents, progress reports submitted by
investigators, and reports of injuries to subjects.
(2) Minutes of IRB meetings which shall be in sufficient detail to show attendance at the
meetings; actions taken by the IRB; the vote on these actions including the number of
members voting for, against, and abstaining; the basis for requiring changes in or
disapproving research; and a written summary of the discussion of controverted issues and
their resolution.
(3) Records of continuing review activities.
(4) Copies of all correspondence between the IRB and the investigators.
(5) A list of IRB members in the same detail as described in §46.103(b)(3).
(6) Written procedures for the IRB in the same detail as described in §46.103(b)(4) and
§46.103(b)(5).
(7) Statements of significant new findings provided to subjects, as required by §46.116(b)(5).
(b) The records required by this policy shall be retained for at least 3 years, and records relating
to research which is conducted shall be retained for at least 3 years after completion of the
research. All records shall be accessible for inspection and copying by authorized representatives
of the Department or Agency at reasonable times and in a reasonable manner. (Approved by the
Office of Management and Budget under Control Number 9999-0020.)
§46.116 General requirements for informed consent.
Except as provided elsewhere in this policy, no investigator may involve a human being as a
subject in research covered by this policy unless the investigator has obtained the legally
effective informed consent of the subject or the subject's legally authorized representative. An
investigator shall seek such consent only under circumstances that provide the prospective
subject or the representative sufficient opportunity to consider whether or not to participate and
that minimize the possibility of coercion or undue influence. The information that is given to the
subject or the representative shall be in language understandable to the subject or the
representative. No informed consent, whether oral or written, may include any exculpatory
language through which the subject or the representative is made to waive or appear to waive any
of the subject's legal rights, or releases or appears to release the investigator, the sponsor, the
institution or its agents from liability for negligence.
(a) Basic elements of informed consent. Except as provided in paragraph (c) or (d) of this
section, in seeking informed consent the following information shall be provided to each subject:
(1) a statement that the study involves research, an explanation of the purposes of the
research and the expected duration of the subject's participation, a description of the
procedures to be followed, and identification of any procedures which are experimental;
(2) a description of any reasonably foreseeable risks or discomforts to the subject;
(3) a description of any benefits to the subject or to others which may reasonably be expected
from the research;
(4) a disclosure of appropriate alternative procedures or courses of treatment, if any, that
might be advantageous to the subject;
(5) a statement describing the extent, if any, to which confidentiality of records identifying
the subject will be maintained;
(6) for research involving more than minimal risk, an explanation as to whether any
compensation and an explanation as to whether any medical treatments are available if injury
occurs and, if so, what they consist of, or where further information may be obtained;
(7) an explanation of whom to contact for answers to pertinent questions about the research
and research subjects' rights, and whom to contact in the event of a research-related injury to
the subject; and
(8) a statement that participation is voluntary, refusal to participate will involve no penalty or
loss of benefits to which the subject is otherwise entitled, and the subject may discontinue
participation at any time without penalty or loss of benefits to which the subject is otherwise
entitled.
(b) additional elements of informed consent. When appropriate, one or more of the following
elements of information shall also be provided to each subject:
(1) a statement that the particular treatment or procedure may involve risks to the subject (or
to the embryo or fetus, if the subject is or may become pregnant) which are currently
unforeseeable;
(2) anticipated circumstances under which the subject's participation may be terminated by
the investigator without regard to the subject's consent;
(3) any additional costs to the subject that may result from participation in the research;
(4) the consequences of a subject's decision to withdraw from the research and procedures for
orderly termination of participation by the subject;
(5) A statement that significant new findings developed during the course of the research
which may relate to the subject's willingness to continue participation will be provided to the
subject; and
(6) the approximate number of subjects involved in the study.
(c) An IRB may approve a consent procedure which does not include, or which alters, some or
all of the elements of informed consent set forth above, or waive the requirement to obtain
informed consent provided the IRB finds and documents that:
(1) the research or demonstration project is to be conducted by or subject to the approval of
state or local government officials and is designed to study, evaluate, or otherwise examine:
(i) public benefit or service programs; (ii) procedures for obtaining benefits or services under
those programs; (iii) possible changes in or alternatives to those programs or procedures; or
(iv) possible changes in methods or levels of payment for benefits or services under those
programs; and
(2) the research could not practicably be carried out without the waiver or alteration.
(d) An IRB may approve a consent procedure which does not include, or which alters, some or
all of the elements of informed consent set forth in this section, or waive the requirements to
obtain informed consent provided the IRB finds and documents that:
(1) the research involves no more than minimal risk to the subjects;
(2) the waiver or alteration will not adversely affect the rights and welfare of the subjects;
(3) the research could not practicably be carried out without the waiver or alteration; and
(4) whenever appropriate, the subjects will be provided with additional pertinent information
after participation.
(e) The informed consent requirements in this policy are not intended to preempt any applicable
Federal, State, or local laws which require additional information to be disclosed in order for
informed consent to be legally effective.
(f) Nothing in this policy is intended to limit the authority of a physician to provide emergency
medical care, to the extent the physician is permitted to do so under applicable Federal, State, or
local law. (Approved by the Office of Management and Budget under Control Number 99990020.)
§46.117 Documentation of informed consent.
(a) Except as provided in paragraph (c) of this section, informed consent shall be documented by
the use of a written consent form approved by the IRB and signed by the subject or the subject's
legally authorized representative. A copy shall be given to the person signing the form.
(b) Except as provided in paragraph (c) of this section, the consent form may be either of the
following:
(1) A written consent document that embodies the elements of informed consent required by
§46.116. This form may be read to the subject or the subject's legally authorized
representative, but in any event, the investigator shall give either the subject or the
representative adequate opportunity to read it before it is signed; or
(2) A short form written consent document stating that the elements of informed consent
required by §46.116 have been presented orally to the subject or the subject's legally
authorized representative. When this method is used, there shall be a witness to the oral
presentation. Also, the IRB shall approve a written summary of what is to be said to the
subject or the representative. Only the short form itself is to be signed by the subject or the
representative. However, the witness shall sign both the short form and a copy of the
summary, and the person actually obtaining consent shall sign a copy of the summary. A
copy of the summary shall be given to the subject or the representative, in addition to a copy
of the short form.
(c) An IRB may waive the requirement for the investigator to obtain a signed consent form for
some or all subjects if it finds either:
(1) That the only record linking the subject and the research would be the consent document
and the principal risk would be potential harm resulting from a breach of confidentiality.
Each subject will be asked whether the subject wants documentation linking the subject with
the research, and the subject's wishes will govern; or
(2) That the research presents no more than minimal risk of harm to subjects and involves no
procedures for which written consent is normally required outside of the research context.
In cases in which the documentation requirement is waived, the IRB may require the investigator
to provide subjects with a written statement regarding the research. (Approved by the Office of
Management and Budget under Control Number 9999-0020.)
§46.118 Applications and proposals lacking definite plans for involvement of human subjects.
Certain types of applications for grants, cooperative agreements, or contracts are submitted to
departments or agencies with the knowledge that subjects may be involved within the period of
support, but definite plans would not normally be set forth in the application or proposal. These
include activities such as institutional type grants when selection of specific projects is the
institution's responsibility; research training grants in which the activities involving subjects
remain to be selected; and projects in which human subjects' involvement will depend upon
completion of instruments, prior animal studies, or purification of compounds. These
applications need not be reviewed by an IRB before an award may be made. However, except for
research exempted or waived under §46.101 (b) or (i), no human subjects may be involved in any
project supported by these awards until the project has been reviewed and approved by the IRB,
as provided in this policy, and certification submitted, by the institution, to the Department or
Agency.
§46.119 Research undertaken without the intention of involving human subjects.
In the event research is undertaken without the intention of involving human subjects, but it is
later proposed to involve human subjects in the research, the research shall first be reviewed and
approved by an IRB, as provided in this policy, a certification submitted, by the institution, to the
Department or Agency, and final approval given to the proposed change by the Department or
Agency.
§46.120 Evaluation and disposition of applications and proposals for research to be conducted or
supported by a Federal Department or Agency.
(a) The Department or Agency head will evaluate all applications and proposals involving
human subjects submitted to the Department or Agency through such officers and employees of
the Department or Agency and such experts and consultants as the Department or Agency head
determines to be appropriate. This evaluation will take into consideration the risks to the
subjects, the adequacy of protection against these risks, the potential benefits of the research to
the subjects and others, and the importance of the knowledge gained or to be gained.
(b) On the basis of this evaluation, the Department or Agency head may approve or disapprove
the application or proposal, or enter into negotiations to develop an approvable one.
§46.121 [Reserved]
§46.122 Use of Federal funds.
Federal funds administered by a Department or Agency may not be expended for research
involving human subjects unless the requirements of this policy have been satisfied.
§46.123 Early termination of research support: Evaluation of applications and
proposals.
(a) The Department or Agency head may require that Department or Agency support for any
project be terminated or suspended in the manner prescribed in applicable program requirements,
when the Department or Agency head finds an institution has materially failed to comply with
the terms of this
policy.
(b) In making decisions about supporting or approving applications or proposals covered by this
policy the Department or Agency head may take into account, in addition to all other eligibility
requirements and program criteria, factors such as whether the applicant has been subject to a
termination or suspension under paragraph (a) of this section and whether the applicant or the
person or persons who would direct or has/have directed the scientific and technical aspects of an
activity has/have, in the judgment of the Department or Agency head, materially failed to
discharge responsibility for the protection of the rights and welfare of human subjects (whether
or not the research was subject to Federal regulation).
§46.124 Conditions
With respect to any research project or any class of research projects the Department or Agency
head may impose additional conditions prior to or at the time of approval when in the judgment
of the Department or Agency head additional conditions are necessary for the protection of
human subjects.
Subpart B - Additional DHHS Protections Pertaining to Research,
Development, and Related Activities Involving Fetuses, Pregnant Women, and
Human In Vitro Fertilization
Source: 40 FR 33528, Aug. 8, 1975; 43 FR 1758, January 11, 1978; 43 FR 51559, November 3,
1978.
§46.201 Applicability.
(a) The regulations in this subpart are applicable to all Department of Health and Human
Services grants and contracts supporting research, development, and related activities involving:
(1) the fetus, (2) pregnant women, and (3) human in vitro fertilization.
(b) Nothing in this subpart shall be construed as indicating that compliance with the procedures
set forth herein will in any way render inapplicable pertinent State or local laws bearing upon
activities covered by this subpart.
(c) The requirements of this subpart are in addition to those imposed under the other subparts of
this part.
§46.202 Purpose.
It is the purpose of this subpart to provide additional safeguards in reviewing activities to which
this subpart is applicable to assure that they conform to appropriate ethical standards and relate
to important societal needs.
§46.203 Definitions.
As used in this subpart:
(a) "Secretary" means the Secretary of Health and Human Services and any other officer or
employee of the Department of Health and Human Services (DHHS) to whom authority has been
delegated.
(b) "Pregnancy" encompasses the period of time from confirmation of implantation (through any
of the presumptive signs of pregnancy, such as missed menses, or by a medically acceptable
pregnancy test), until expulsion or extraction of the fetus.
(c) "Fetus" means the product of conception from the time of implantation (as evidenced by any
of the presumptive signs of pregnancy, such as missed menses, or a medically acceptable
pregnancy test), until a determination is made, following expulsion or extraction of the fetus, that
it is viable.
(d) "Viable" as it pertains to the fetus means being able, after either spontaneous or induced
delivery, to survive (given the benefit of available medical therapy) to the point of independently
maintaining heart beat and respiration. The Secretary may from time to time, taking into account
medical advances, publish in the Federal Register guidelines to assist in determining whether a
fetus is viable for purposes of this subpart. If a fetus is viable after delivery, it is a premature
infant.
(e) "Nonviable fetus" means a fetus ex utero which, although living, is not viable.
(f) "Dead fetus" means a fetus ex utero which exhibits neither heartbeat, spontaneous respiratory
activity, spontaneous movement of voluntary muscles, nor pulsation of the umbilical cord (if still
attached).
(g) "In vitro fertilization" means any fertilization of human ova which occurs outside the body of
a female, either through admixture of donor human sperm and ova or by any other means.
§46.204 Ethical Advisory Boards.
(a) One or more Ethical Advisory Boards shall be established by the Secretary. Members of these
Board(s) shall be so selected that the Board(s) will be competent to deal with medical, legal,
social, ethical, and related issues and may include, for example, research scientists, physicians,
psychologists, sociologists, educators, lawyers, and ethicists, as well as representatives of the
general public. No Board member may be a regular, full-time employee of the Department of
Health and Human Services.
(b) At the request of the Secretary, the Ethical Advisory Board shall render advice consistent
with the policies and requirements of this part as to ethical issues, involving activities covered by
this subpart, raised by individual applications or proposals. In addition, upon request by the
Secretary, the Board shall render advice as to classes of applications or proposals and general
policies, guidelines, and procedures.
(c) A Board may establish, with the approval of the Secretary, classes of applications or
proposals which: (1) must be submitted to the Board, or (2) need not be submitted to the Board.
Where the Board so establishes a class of applications or proposals which must be submitted, no
application or proposal within the class may be funded by the Department or any component
thereof until the application or proposal has been reviewed by the Board and the Board has
rendered advice as to its acceptability from an ethical standpoint.
(d) [Nullified under Public Law 103-43, June 10, 1993]
§46.205 Additional duties of the Institutional Review Boards in connection with activities
involving fetuses, pregnant women, or human in vitro fertilization.
(a) In addition to the responsibilities prescribed for Institutional Review Boards under Subpart A
of this part, the applicant's or offeror's Board shall, with respect to activities covered by this
subpart, carry out the following additional duties:
(1) determine that all aspects of the activity meet the requirements of this subpart;
(2) determine that adequate consideration has been given to the manner in which potential
subjects will be selected, and adequate provision has been made by the applicant or offeror
for monitoring the actual informed consent process (e.g., through such mechanisms, when
appropriate, as participation by the Institutional Review Board or subject advocates in: (i)
overseeing the actual process by which individual consents required by this subpart are
secured either by approving induction of each individual into the activity or verifying,
perhaps through sampling, that approved procedures for induction of individuals into the
activity are being followed, and (ii) monitoring the progress of the activity and intervening as
necessary through such steps as visits to the activity site and continuing evaluation to
determine if any unanticipated risks have arisen);
(3) carry out such other responsibilities as may be assigned by the Secretary.
(b) No award may be issued until the applicant or offeror has certified to the Secretary that the
Institutional Review Board has made the determinations required under paragraph (a) of this
section and the Secretary has approved these determinations, as provided in §46.120 of Subpart
A of this part.
(c) Applicants or offerors seeking support for activities covered by this subpart must provide for
the designation of an Institutional Review Board, subject to approval by the Secretary, where no
such Board has been established under Subpart A of this part.
§46.206 General limitations.
(a) No activity to which this subpart is applicable may be undertaken unless:
(1) appropriate studies on animals and non-pregnant individuals have been completed;
(2) except where the purpose of the activity is to meet the health needs of the mother or
the particular fetus, the risk to the fetus is minimal and, in all cases, is the least possible
risk for achieving the objectives of the activity;
(3) individuals engaged in the activity will have no part in: (i) any decisions as to the
timing, method, and procedures used to terminate the pregnancy, and (ii) determining the
viability of the fetus at the termination of the pregnancy; and
(4) no procedural changes which may cause greater than minimal risk to the fetus or the
pregnant woman will be introduced into the procedure for terminating the pregnancy
solely in the interest of the activity.
(b) No inducements, monetary or otherwise, may be offered to terminate pregnancy for purposes
of the activity. Source: 40 FR 33528, Aug. 8, 1975, as amended at 40 FR 51638, Nov. 6, 1975.
§46.207 Activities directed toward pregnant women as subjects.
(a) No pregnant woman may be involved as a subject in an activity covered by this subpart
unless: (1) the purpose of the activity is to meet the health needs of the mother and the fetus will
be placed at risk only to the minimum extent necessary to meet such needs, or (2) the risk to the
fetus is minimal.
(b) An activity permitted under paragraph (a) of this section may be conducted only if the mother
and father are legally competent and have given their informed consent after having been fully
informed regarding possible impact on the fetus, except that the father's informed consent need
not be secured if: (1) the purpose of the activity is to meet the health needs of the mother; (2) his
identity or whereabouts cannot reasonably be ascertained; (3) he is not reasonably available; or
(4) the pregnancy resulted from rape.
§46.208 Activities directed toward fetuses in utero as subjects.
(a) No fetus in utero may be involved as a subject in any activity covered by this subpart unless:
(1) the purpose of the activity is to meet the health needs of the particular fetus and the fetus
will be placed at risk only to the minimum extent necessary to meet such needs, or
(2) the risk to the fetus imposed by the research is minimal and the purpose of the activity is
the development of important biomedical knowledge which cannot be obtained by other
means.
(b) An activity permitted under paragraph (a) of this section may be conducted only if the mother
and father are legally competent and have given their informed consent, except that the father's
consent need not be secured if: (1) his identity or whereabouts cannot reasonably be ascertained,
(2) he is not reasonably available, or (3) the pregnancy resulted from rape.
§46.209 Activities directed toward fetuses ex utero, including nonviable fetuses, as subjects.
(a) Until it has been ascertained whether or not a fetus ex utero is viable, a fetus ex utero may not
be involved as a subject in an activity covered by this subpart unless:
(1) there will be no added risk to the fetus resulting from the activity, and the purpose of the
activity is the development of important biomedical knowledge which cannot be obtained by
other means, or
(2) the purpose of the activity is to enhance the possibility of survival of the particular fetus
to the point of viability.
(b) No nonviable fetus may be involved as a subject in an activity covered by this subpart unless:
(1) vital functions of the fetus will not be artificially maintained,
(2) experimental activities which of themselves would terminate the heartbeat or respiration
of the fetus will not be employed, and
(3) the purpose of the activity is the development of important biomedical knowledge which
cannot be obtained by other means.
(c) In the event the fetus ex utero is found to be viable, it may be included as a subject in the
activity only to the extent permitted by and in accordance with the requirements of other subparts
of this part.
(d) An activity permitted under paragraph (a) or (b) of this section may be conducted only if the
mother and father are legally competent and have given their informed consent, except that the
father's informed consent need not be secured if: (1) his identity or whereabouts cannot
reasonably be ascertained, (2) he is not reasonably available, or (3) the pregnancy resulted from
rape.
§46.210 Activities involving the dead fetus, fetal material, or the placenta.
Activities involving the dead fetus, mascerated fetal material, or cells, tissue, or organs excised
from a dead fetus shall be conducted only in accordance with any applicable State or local laws
regarding such activities.
§46.211 Modification or waiver of specific requirements.
Upon the request of an applicant or offeror (with the approval of its Institutional Review Board),
the Secretary may modify or waive specific requirements of this subpart, with the approval of the
Ethical Advisory Board after such opportunity for public comment as the Ethical Advisory
Board considers appropriate in the particular instance. In making such decisions, the Secretary
will consider whether the risks to the subject are so outweighed by the sum of the benefit to the
subject and the importance of the knowledge to be gained as to warrant such modification or
waiver and that such benefits cannot be gained except through a modification or waiver. Any
such modifications or waivers will be published as notices in the Federal Register.
Subpart C - Additional DHHS Protections Pertaining to Biomedical and
Behavioral Research Involving Prisoners as Subjects
Source: 43 FR 53655, Nov. 16, 1978.
§46.301 Applicability.
(a) The regulations in this subpart are applicable to all biomedical and behavioral research
conducted or supported by the Department of Health and Human Services involving prisoners as
subjects.
(b) Nothing in this subpart shall be construed as indicating that compliance with the procedures
set forth herein will authorize research involving prisoners as subjects, to the extent such
research is limited or barred by applicable State or local law.
(c) The requirements of this subpart are in addition to those imposed under the other subparts of
this part.
§46.302 Purpose.
Inasmuch as prisoners may be under constraints because of their incarceration which could affect
their ability to make a truly voluntary and un-coerced decision whether or not to participate as
subjects in research, it is the purpose of this subpart to provide additional safeguards for the
protection of prisoners involved in activities to which this subpart is applicable.
§46.303 Definitions.
As used in this subpart:
(a) "Secretary" means the Secretary of Health and Human Services and any other officer or
employee of the Department of Health and Human Services to whom authority has been
delegated.
(b) "DHHS" means the Department of Health and Human Services.
(c) "Prisoner" means any individual involuntarily confined or detained in a penal institution. The
term is intended to encompass individuals sentenced to such an institution under a criminal or
civil statute, individuals detained in other facilities by virtue of statutes or commitment
procedures which provide alternatives to criminal prosecution or incarceration in a penal
institution, and individuals detained pending arraignment, trial, or sentencing.
(d) "Minimal risk" is the probability and magnitude of physical or psychological harm that is
normally encountered in the daily lives, or in the routine medical, dental, or psychological
examination of healthy persons.
§46.304 Composition of Institutional Review Boards where prisoners are involved.
In addition to satisfying the requirements in §46.107 of this part, an Institutional Review Board,
carrying out responsibilities under this part with respect to research covered by this subpart, shall
also meet the following specific requirements:
(a) A majority of the Board (exclusive of prisoner members) shall have no association with the
prison(s) involved, apart from their membership on the Board.
(b) At least one member of the Board shall be a prisoner, or a prisoner representative with
appropriate background and experience to serve in that capacity, except that where a particular
research project is reviewed by more than one Board only one Board need satisfy this
requirement.
§46.305 Additional duties of the Institutional Review Boards where prisoners are involved.
(a) In addition to all other responsibilities prescribed for Institutional Review Boards under this
part, the Board shall review research covered by this subpart and approve such research only if it
finds that:
(1) the research under review represents one of the categories of research permissible under
§46.306(a)(2);
(2) any possible advantages accruing to the prisoner through his or her participation in the
research, when compared to the general living conditions, medical care, quality of food,
amenities and opportunity for earnings in the prison, are not of such a magnitude that his or
her ability to weigh the risks of the research against the value of such advantages in the
limited choice environment of the prison is impaired;
(3) the risks involved in the research are commensurate with risks that would be accepted by
non-prisoner volunteers;
(4) procedures for the selection of subjects within the prison are fair to all prisoners and
immune from arbitrary intervention by prison authorities or prisoners. Unless the principal
investigator provides to the Board justification in writing for following some other
procedures, control subjects must be selected randomly from the group of available prisoners
who meet the characteristics needed for that particular research project;
(5) the information is presented in language which is understandable to the subject
population;
(6) adequate assurance exists that parole boards will not take into account a prisoner's
participation in the research in making decisions regarding parole, and each prisoner is
clearly informed in advance that participation in the research will have no effect on his or her
parole; and
(7) where the Board finds there may be a need for follow-up examination or care of
participants after the end of their participation, adequate provision has been made for such
examination or care, taking into account the varying lengths of individual prisoners'
sentences, and for informing participants of this fact.
(b) The Board shall carry out such other duties as may be assigned by the Secretary.
(c) The institution shall certify to the Secretary, in such form and manner as the Secretary may
require, that the duties of the Board under this section have been fulfilled.
§46.306 Permitted research involving prisoners.
(a) Biomedical or behavioral research conducted or supported by DHHS may involve prisoners
as subjects only if:
(1) the institution responsible for the conduct of the research has certified to the Secretary
that the Institutional Review Board has approved the research under §46.305 of this subpart;
and
(2) in the judgment of the Secretary the proposed research involves solely the following:
(A) study of the possible causes, effects, and processes of incarceration, and of criminal
behavior, provided that the study presents no more than minimal risk and no more than
inconvenience to the subjects;
(B) study of prisons as institutional structures or of prisoners as incarcerated persons,
provided that the study presents no more than minimal risk and no more than
inconvenience to the subjects;
(C) research on conditions particularly affecting prisoners as a class (for example, vaccine
trials and other research on hepatitis which is much more prevalent in prisons than
elsewhere; and research on social and psychological problems such as alcoholism, drug
addiction, and sexual assaults) provided that the study may proceed only after the
Secretary has consulted with appropriate experts including experts in penology, medicine,
and ethics, and published notice, in the Federal Register, of his intent to approve such
research; or
(D) research on practices, both innovative and accepted, which have the intent and
reasonable probability of improving the health or well-being of the subject. In cases in
which those studies require the assignment of prisoners in a manner consistent with
protocols approved by the IRB to control groups which may not benefit from the research,
the study may proceed only after the Secretary has consulted with appropriate experts,
including experts in penology, medicine, and ethics, and published notice, in the Federal
Register, of the intent to approve such research. (b) Except as provided in paragraph (a) of
this section, biomedical or behavioral research conducted or supported by DHHS shall not
involve prisoners as subjects.
Subpart D - Additional DHHS Protections for Children Involved as Subjects
in Research
Source: 48 FR 9818, March 8, 1983; 56 FR 28032, June 18, 1991.
§46.401 To what do these regulations apply?
(a) This subpart applies to all research involving children as subjects, conducted or supported by
the Department of Health and Human Services.
(1) This includes research conducted by Department employees, except that each head of an
Operating Division of the Department may adopt such non-substantive, procedural
modifications as may be appropriate from an administrative standpoint.
(2) It also includes research conducted or supported by the Department of Health and Human
Services outside the United States, but in appropriate circumstances, the Secretary may,
under paragraph (i) of §46.101 of Subpart A, waive the applicability of some or all of the
requirements of these regulations for research of this type.
(b) Exemptions at §46.101(b)(1) and (b)(3) through (b)(6) are applicable to this subpart. The
exemption at §46.101(b)(2) regarding educational tests is also applicable to this subpart.
However, the exemption at §46.101(b)(2) for research involving survey or interview procedures
or observations of public behavior does not apply to research covered by this subpart, except for
research involving observation of public behavior when the investigator(s) do not participate in
the activities being observed.
(c) The exceptions, additions, and provisions for waiver as they appear in paragraphs (c) through
(i) of §46.101 of Subpart A are applicable to this subpart.
§46.402 Definitions.
The definitions in §46.102 of Subpart A shall be applicable to this subpart as well. In addition, as
used in this subpart:
(a) "Children" are persons who have not attained the legal age for consent to treatments or
procedures involved in the research, under the applicable law of the jurisdiction in which the
research will be conducted.
(b) "Assent" means a child's affirmative agreement to participate in research. Mere failure to
object should not, absent affirmative agreement, be construed as assent.
(c) "Permission" means the agreement of parent(s) or guardian to the participation of their child
or ward in research.
(d) "Parent" means a child's biological or adoptive parent.
(e) "Guardian" means an individual who is authorized under applicable State or local law to
consent on behalf of a child to general medical care.
§46.403 IRB duties.
In addition to other responsibilities assigned to IRBs under this part, each IRB shall review
research covered by this subpart and approve only research which satisfies the conditions of all
applicable sections of this subpart.
§46.404 Research not involving greater than minimal risk.
DHHS will conduct or fund research in which the IRB finds that no greater than minimal risk to
children is presented, only if the IRB finds that adequate provisions are made for soliciting the
assent of the children and the permission of their parents or guardians, as set forth in §46.408.
§46.405 Research involving greater than minimal risk but presenting the prospect of direct
benefit to the individual subjects.
DHHS will conduct or fund research in which the IRB finds that more than minimal risk to
children is presented by an intervention or procedure that holds out the prospect of direct benefit
for the individual subject, or by a monitoring procedure that is likely to contribute to the subject's
well-being, only if the IRB finds that:
(a) the risk is justified by the anticipated benefit to the subjects;
(b) the relation of the anticipated benefit to the risk is at least as favorable to the subjects as that
presented by available alternative approaches; and
(c) adequate provisions are made for soliciting the assent of the children and permission of their
parents or guardians, as set forth in §46.408.
§46.406 Research involving greater than minimal risk and no prospect of direct benefit to
individual subjects, but likely to yield generalizable knowledge about the subject's disorder or
condition.
DHHS will conduct or fund research in which the IRB finds that more than minimal risk to
children is presented by an intervention or procedure that does not hold out the prospect of direct
benefit for the individual subject, or by a monitoring procedure which is not likely to contribute
to the well-being of the subject, only if the IRB finds that:
(a) the risk represents a minor increase over minimal risk;
(b) the intervention or procedure presents experiences to subjects that are reasonably
commensurate with those inherent in their actual or expected medical, dental, psychological,
social, or educational situations;
(c) the intervention or procedure is likely to yield generalizable knowledge about the subjects'
disorder or condition which is of vital importance for the understanding or amelioration of the
subjects' disorder or condition; and
(d) adequate provisions are made for soliciting assent of the children and permission of their
parents or guardians, as set forth in §46.408.
§46.407 Research not otherwise approvable which presents an opportunity to understand,
prevent, or alleviate a serious problem affecting the health or welfare of children.
DHHS will conduct or fund research that the IRB does not believe meets the requirements of
§46.404, §46.405, or §46.406 only if:
(a) the IRB finds that the research presents a reasonable opportunity to further the understanding,
prevention, or alleviation of a serious problem affecting the health or welfare of children; and
(b) the Secretary, after consultation with a panel of experts in pertinent disciplines (for example:
science, medicine, education, ethics, law) and following opportunity for public review and
comment, has determined either:
(1) that the research in fact satisfies the conditions of §46.404, §46.405, or §46.406, as
applicable, or
(2) the following:
(i) the research presents a reasonable opportunity to further the understanding,
prevention, or alleviation of a serious problem affecting the health or welfare of children;
(ii) the research will be conducted in accordance with sound ethical principles;
(iii) adequate provisions are made for soliciting the assent of children and the permission
of their parents or guardians, as set forth in §46.408.
§46.408 Requirements for permission by parents or guardians and for assent by children.
(a) In addition to the determinations required under other applicable sections of this subpart, the
IRB shall determine that adequate provisions are made for soliciting the assent of the children,
when in the judgment of the IRB the children are capable of providing assent. In determining
whether children are capable of assenting, the IRB shall take into account the ages, maturity, and
psychological state of the children involved. This judgment may be made for all children to be
involved in research under a particular protocol, or for each child, as the IRB deems appropriate.
If the IRB determines that the capability of some or all of the children is so limited that they
cannot reasonably be consulted or that the intervention or procedure involved in the research
holds out a prospect of direct benefit that is important to the health or well-being of the children
and is available only in the context of the research, the assent of the children is not a necessary
condition for proceeding with the research. Even where the IRB determines that the subjects are
capable of assenting, the IRB may still waive the assent requirement under circumstances in
which consent may be waived in accord with §46.116 of Subpart A.
(b) In addition to the determinations required under other applicable sections of this subpart, the
IRB shall determine, in accordance with and to the extent that consent is required by §46.116 of
Subpart A, that adequate provisions are made for soliciting the permission of each child's parents
or guardian. Where parental permission is to be obtained, the IRB may find that the permission
of one parent is sufficient for research to be conducted under §46.404 or §46.405. Where
research is covered by §46.406 and §46.407 and permission is to be obtained from parents, both
parents must give their permission unless one parent is deceased, unknown, incompetent, or not
reasonably available, or when only one parent has legal responsibility for the care and custody of
the child.
(c) In addition to the provisions for waiver contained in §46.116 of Subpart A, if the IRB
determines that a research protocol is designed for conditions or for a subject population for
which parental or guardian permission is not a reasonable requirement to protect the subjects (for
example, neglected or abused children), it may waive the consent requirements in Subpart A of
this part and paragraph (b) of this section, provided an appropriate mechanism for protecting the
children who will participate as subjects in the research is substituted, and provided further that
the waiver is not inconsistent with Federal, State, or local law. The choice of an appropriate
mechanism would depend upon the nature and purpose of the activities described in the protocol,
the risk and anticipated benefit to the research subjects, and their age, maturity, status, and
condition.
(d) Permission by parents or guardians shall be documented in accordance with and to the extent
required by §46.117 of Subpart A.
(e) When the IRB determines that assent is required, it shall also determine whether and how
assent must be documented.
§46.409 Wards.
(a) Children who are wards of the State or any other agency, institution, or entity can be included
in research approved under §46.406 or §46.407 only if such research is:
(1) related to their status as wards; or
(2) conducted in schools, camps, hospitals, institutions, or similar settings in which the
majority of children involved as subjects are not wards.
(b) If the research is approved under paragraph (a) of this section, the IRB shall require
appointment of an advocate for each child who is a ward, in addition to any other individual
acting on behalf of the child as guardian or in loco parentis. One individual may serve as
advocate for more than one child. The advocate shall be an individual who has the background
and experience to act in, and agrees to act in, the best interests of the child for the duration of the
child's participation in the research and who is not associated in any way (except in the role as
advocate or member of the IRB) with the research, the investigator(s), or the guardian
organization.
| File Type | application/pdf |
| File Title | APPENDIX 5: |
| Author | proth |
| File Modified | 2010-10-20 |
| File Created | 2010-10-20 |