DHHS is seeking guidance from stakeholders this month before formulating their rule change for a second period of public comment (Federal Register 76, 44512–44531, 2011; http://www.hhs.gov/ohrp/humansubjects/anprmqanda.html/). The proposed changes would revise the so-called 'Common Rule' governing institutional review of human research (DHHS 45 CFR parts 46, 160 and 164) and related protections under the remit of the US Food and Drug Administration (21 CFR parts 50, 56, 312 and 812).

From the journal's point of view, harmonization of the rules of institutional review boards (IRBs in the US, elsewhere called ethical review committees) is desirable because it permits more human research by combination of multisite studies and, where it is consented to by the research subjects, repurposing of existing data for new studies. However, we are skeptical that even the legislative and funding persuasion of central government can get the job done without a respectful ongoing relationship with research subjects that supports their expectations of participation in research. To this end, a uniform definition of de-identified information will be very helpful in obtaining broad consent for data reuse. It is also important that those states with the highest information security standards for protection of research subjects agree to participate. In this respect, although the privacy standards of the Federal Health Information Portability and Accountability Act of 1996 (HIPAA) are very strict and somewhat obstructive to health research, they do exist, and they can be centrally revised downward when other legislation provides the necessary protection for confidential information. Researchers may want to comment on the parts of the proposal in which HIPAA rules are to be extended from covered entities engaged in health-care operations to researchers. Also notable is the proposal that projects at institutions receiving US federal funding must comply whether or not the project itself is so funded.

Biological specimens are inherently identifiable and should be treated as such. Personally identifiable information is inherently discoverable and should be treated as such. However, we suspect that any information security measures do little in practice but serve their core function: to label certain kinds of information as 'private' because of their potential for abuse. Once so labeled, it should be possible to define and enforce against egregious abuses, for example, attempts to discover certain classes of confidential information for financial gain, identity fraud, unfair discrimination or defamation. In the spirit of respect for individuals, research volunteers who openly reveal their genotypes, medical status, faces and names should be similarly protected from abuse, just as we afford privacy to one another in public places and annually give our credit cards to thousands of people, only a few of whom abuse our trust.

Of the three fundamental ethical principles that guide human research, justice and respect for persons are explicitly mutual obligations of the researcher and the research subject. The third principle, beneficence, recognizes the potential for inequality imposed by decisions taken by the researcher and information the researcher has that the subject may not have: specialized knowledge of outcomes, new discoveries and ability to compare data with other subjects. In the proposed DHSS revision, all research will be assessed within a common framework of foreseeable risk to research participants considered against predicted benefits, allowing more attention to be paid to the few proposals entailing higher risk. It is rare that government action results in less complexity, but, with appropriate comments and participation, we have every hope that, in this case, more equitable protection for individuals engaged in research will lead to better participation and better results.