Table 5.

Exemption Category 4 – Secondary Research Uses of Identifiable Private Information or Identifiable Biospecimens

Pre-2018 Requirements¹² (prior exemption category at 45 CFR §46.101)	Final Rule¹³ (new exemption category at 45 CFR §46.104)
(4) Research, involving the collection or study of existing data, documents, records, pathological specimens, or diagnostic specimens, if these sources are publicly available or if the information is recorded by the investigator in such a manner that subjects cannot be identified, directly or through identifiers linked to the subjects.	(4) Secondary research for which consent is not required: secondary research uses of identifiable private information or identifiable biospecimens, if at least one of the following criteria is met: (i) the identifiable private information or identifiable biospecimens are publicly available; (ii) information, which may include information about biospecimens, is recorded by the investigator in such a manner that the identity of the human subjects cannot readily be ascertained directly or through identifiers linked to the subjects, the investigator does not contact the subjects, and the investigator will not reidentify subjects; (iii) the research involves only information collection and analysis involving the investigator's use of identifiable health information when that use is regulated under 45 CFR §160 and 45 CFR §164, subparts A and E, for the purposes of “health care operations” or “research” as those terms are defined at 45 CFR §164.501 or for “public health activities and purposes” as described under 45 CFR §164.512(b); or (iv) the research is conducted by, or on behalf of, a federal department or agency using government-generated or government-collected information obtained for non-research activities, if the research generates identifiable private information that is or will be maintained on information technology that is subject to and in compliance with… the E-Government Act of 2002, if all of the identifiable private information…will be maintained in systems of records subject to the Privacy Act of 1974, and, if applicable, the information used in the research was collected subject to the Paperwork Reduction Act of 1995.

Pre-2018 Requirements¹² (prior exemption category at 45 CFR §46.101)

Final Rule¹³ (new exemption category at 45 CFR §46.104)

(4) Research, involving the collection or study of existing data, documents, records, pathological specimens, or diagnostic specimens, if these sources are publicly available or if the information is recorded by the investigator in such a manner that subjects cannot be identified, directly or through identifiers linked to the subjects.

(4) Secondary research for which consent is not required: secondary research uses of identifiable private information or identifiable biospecimens, if at least one of the following criteria is met: (i) the identifiable private information or identifiable biospecimens are publicly available; (ii) information, which may include information about biospecimens, is recorded by the investigator in such a manner that the identity of the human subjects cannot readily be ascertained directly or through identifiers linked to the subjects, the investigator does not contact the subjects, and the investigator will not reidentify subjects; (iii) the research involves only information collection and analysis involving the investigator's use of identifiable health information when that use is regulated under 45 CFR §160 and 45 CFR §164, subparts A and E, for the purposes of “health care operations” or “research” as those terms are defined at 45 CFR §164.501 or for “public health activities and purposes” as described under 45 CFR §164.512(b); or (iv) the research is conducted by, or on behalf of, a federal department or agency using government-generated or government-collected information obtained for non-research activities, if the research generates identifiable private information that is or will be maintained on information technology that is subject to and in compliance with… the E-Government Act of 2002, if all of the identifiable private information…will be maintained in systems of records subject to the Privacy Act of 1974, and, if applicable, the information used in the research was collected subject to the Paperwork Reduction Act of 1995.

Note: Some sections of the 2018 regulation in the Final Rule are abbreviated in this table.