The Common Rule: What 45 CFR 46 Actually Means for Research Today
If you've ever worked on a research project involving human participants — whether a clinical trial, a survey study, or an interview-based project — you've probably heard someone mention "the Common Rule.Practically speaking, " That's 45 CFR 46. And if you've ever submitted an IRB application, you've dealt with its requirements firsthand.
But here's what most people don't realize: this regulation, first issued in 1974, has shaped virtually every aspect of how human subjects research works in the United States. It determines what counts as "research," who needs to give informed consent, when you can skip review altogether, and what happens when things go wrong.
People argue about this. Here's where I land on it.
So let's unpack what 45 CFR 46 actually is, why it matters, and how it works in practice.
What Is 45 CFR 46?
45 CFR 46 is the common name for the Federal Policy for the Protection of Human Subjects. It's part of the Code of Federal Regulations — hence the "CFR" — and lives in Title 45 (which covers health and human services), Part 46 Most people skip this — try not to..
The regulation was originally published in 1974, making it one of the oldest federal protections for research participants still on the books. Even so, it got the nickname "Common Rule" because it created a unified standard that multiple federal agencies could all follow. Instead of every agency having its own rules for human subjects research, 45 CFR 46 became the baseline that 20+ federal departments and agencies adopted The details matter here..
What the regulation actually covers
At its core, 45 CFR 46 does three things:
- Defines what counts as "human subjects research" — not every activity with people involved falls under this rule, and knowing the distinction matters.
- Establishes the IRB system — Institutional Review Boards are the local committees that review and oversee research involving humans.
- Sets the requirements for informed consent — what participants must be told, how information must be presented, and when consent is valid.
The 2018 changes you should know about
The rule you see today isn't exactly the same one issued in 1974. It went through major revisions in 2018 — often called the "Final Rule" — that took effect in 2019. These changes updated requirements for informed consent, created new categories of exempt research, and added provisions for multi-site studies And that's really what it comes down to..
This is where a lot of people lose the thread.
If you're working with older guidance or textbooks, just know they might be referencing the pre-2018 version Most people skip this — try not to..
Why It Matters
Here's the thing — 45 CFR 46 isn't just bureaucratic paperwork. It exists because of real harm. Before these protections, research participants were sometimes subjected to experiments without their knowledge, coerced into dangerous studies, or simply never told about risks.
The most infamous example is the Tuskegee Syphilis Study, which ran from 1932 to 1972. Hundreds of Black men were intentionally left untreated for syphilis so researchers could study the disease's progression — even after penicillin became the standard cure. The study only ended because of media exposure, and it directly led to the creation of modern human subjects protections.
So when you see 45 CFR 46, think of it as the legal backbone that prevents research from becoming exploitation. Every IRB review, every consent form, every protocol submission — that's the system working to make sure participants are treated ethically.
What changes when you understand this regulation
If you're a researcher, knowing 45 CFR 46 well can actually save you time. Understanding what qualifies as exempt research means you won't waste months waiting for a full board review when you don't need one. Knowing what makes consent "valid" means your applications won't get sent back for revisions.
If you're a research participant — or might become one — understanding your rights under this regulation means you can make genuinely informed decisions about whether to enroll in a study.
How It Works
Determining if your activity is covered
The first question 45 CFR 46 asks is whether your activity is even "research" involving "human subjects." This isn't as obvious as it sounds.
Research is defined as a "systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge."
Human subject is "a living individual about whom an investigator (whether professional or student) obtains data through intervention or interaction with the individual, or obtains identifiable private information."
So if you're doing a class project that won't be published or shared beyond your professor, it might not meet the definition of research. If you're collecting anonymous survey responses with no way to identify respondents, you might not have "human subjects."
But — and this is important — don't make this call alone. Your institution's IRB makes the final determination But it adds up..
The three categories of review
Once your activity is determined to be human subjects research, it falls into one of three review categories:
Exempt — Research that falls into certain categories (like educational settings, anonymous surveys, or analysis of existing publicly available data) is exempt from ongoing IRB oversight. Note: "exempt" doesn't mean "unregulated." The IRB still makes the exemption determination, and you still have to follow basic ethical principles Small thing, real impact..
Expedited — Research that poses minimal risk and fits specific categories can be reviewed by a single IRB member rather than the full committee. This speeds things up considerably Simple as that..
Full board review — Research that involves greater than minimal risk, vulnerable populations, or complex ethical questions goes before the full IRB at a convened meeting That alone is useful..
Informed consent requirements
The regulation spells out what valid informed consent must include:
- A statement explaining the purpose of the research
- A description of procedures and how long participation takes
- Information about reasonably foreseeable risks and benefits
- Alternative treatments or procedures available
- How confidentiality will be protected
- Contact information for questions
- A statement that participation is voluntary and can be stopped anytime
The 2018 updates added a new requirement: consent forms must include a specific section describing any future use of collected data or biospecimens. Participants have to explicitly agree (or decline) to this Not complicated — just consistent..
Common Mistakes People Make
Assuming "minimal risk" means "no risk"
Minimal risk means the probability and magnitude of harm aren't greater than what people encounter in daily life or routine physical or psychological exams. Which means it doesn't mean there's zero risk. Researchers sometimes underplay this, and IRBs push back.
Using outdated consent templates
If you're working from a template your department used five years ago, check it against current requirements. The 2018 changes added new elements, and your IRB likely won't accept old forms.
Confusing "exempt" with "excluded"
Some activities aren't even considered human subjects research under the regulation — they're outside the scope entirely. But researchers sometimes incorrectly assume they're exempt when they actually need review. The IRB makes this call, not you alone.
Not accounting for continuing review
Some approvals expire. But if your study runs longer than your approval period, you need to renew — or you can't continue enrolling participants. This catches people off guard.
Practical Tips for Researchers
Start the IRB process early. Even expedited reviews take weeks. Full board reviews might need a month or more. Build this into your timeline from the start.
Read your institution's guidance. Every IRB interprets the federal regulations slightly differently. Your institution likely has specific forms, checklists, and procedures. Use them That alone is useful..
Be precise about vulnerable populations. If your research involves children, prisoners, pregnant women, or people with impaired decision-making capacity, there are additional protections. Know these upfront.
Keep good records. Your protocol, consent forms, recruitment materials, and IRB correspondence should be organized and accessible. If your study gets audited — it happens — you'll need them.
Don't guess about exemptions. If you're unsure whether your research qualifies for exempt status, submit an inquiry or a determination request. It's better to get a formal answer than to proceed incorrectly.
FAQ
Does 45 CFR 46 apply to private companies?
Yes, if the research is conducted or supported by a federal agency that adopted the Common Rule. Consider this: many private companies do research under federal grants or contracts. On the flip side, purely privately-funded research without federal involvement may not be covered — though many institutions apply the same standards regardless That's the part that actually makes a difference. No workaround needed..
What happens if you violate the Common Rule?
Consequences vary. Practically speaking, in serious cases, research could be reported to the Office for Human Research Protections (OHRP). Now, the institution might face penalties from funding agencies. The IRB can suspend or terminate approval of research. Reputational damage in the research community can be significant too.
Do I need IRB approval for a student project?
It depends. If the project is designed to contribute to generalizable knowledge (presented at a conference, published, shared beyond the class), it likely needs review. Class projects for course credit only usually don't — but check with your instructor and institutional policies.
What's the difference between 45 CFR 46 and HIPAA?
They cover different things. So hIPAA (the Health Insurance Portability and Accountability Act) specifically protects medical information. 45 CFR 46 protects research participants broadly. If your research involves health data, you might need to comply with both.
Can participants withdraw from a study at any time?
Yes. Under 45 CFR 46, participation must be voluntary, and participants can stop at any time without penalty. Your consent form needs to make this clear Which is the point..
The bottom line: 45 CFR 46 is the foundation of ethical human subjects research in the U.That said, s. It's been around since 1974, evolved substantially since then, and will keep evolving. Whether you're submitting your first IRB application or you've been doing this for years, taking the time to understand these regulations isn't just about compliance — it's about respecting the people who make research possible by agreeing to participate.
Not the most exciting part, but easily the most useful.
