Real Safety AI Foundation / Research

Policy, Enforcement, and Implementation

Solicited, Not Secondary: The Common Rule Exemption, the Seam Between Two Regimes, and Research on Adults in Psychiatric Crisis

Publisher: Real Safety AI Foundation

Working draft. Not peer reviewed.

Written
August 2026
Version
v0.5
Pages
26
Download PDFPlain language slides (PDF)Export BibTeXExport RIS

Abstract

The Common Rule exempts secondary research uses of identifiable private information, and places non-identifiable information outside the definition of human subjects research altogether. Both provisions were written for the reuse of material that came into existence for some other reason: clinical records, registries, banked specimens, completed studies. Neither was written for material assembled by asking people to hand it over so that researchers could have it. This Article argues that solicited collection is not secondary research, and that treating it as such produces a jurisdictional gap rather than a substantive one. The Common Rule attaches to investigators at institutions holding an assurance. The Privacy Rule attaches to covered entities. A private organization that solicits sensitive records from individuals and supplies them to universities is neither, so the conduct that would receive the most scrutiny if an investigator performed it receives none when a non-covered party performs it first. The receiving institution's inquiry begins at receipt and turns on identifiability, never on provenance. No body with authority ever sees the collection. The population this reaches hardest is the one Congress and the Department have declined to cover for forty-eight years. Subparts exist for pregnant women, prisoners, and children. No subpart exists for adults whose decisional capacity is uncertain or impaired, though a federal commission recommended one in 1978, successive bioethics bodies repeated the request, the Department solicited public comment on it in 2007, and the 2018 revision added nothing. The Article offers an account of that pattern, examines a published study whose methods section states the mechanism in the researchers' own words, and proposes an amendment to 45 C.F.R. § 46.104(d)(4) that reaches solicited collection while leaving registry, archival, and clinical reuse untouched.

Keywords

  • human subjects research
  • Common Rule
  • secondary research exemption
  • solicited collection
  • intermediary shield
  • decisional capacity
  • Subpart E
  • institutional review board
  • HIPAA covered entity
  • psychiatric crisis
  • research provenance
  • informed consent

Plain language slides

First slide of the plain language summary of Solicited, Not Secondary: The Common Rule Exemption, the Seam Between Two Regimes, and Research on Adults in Psychiatric CrisisOpen the 28-slide summary (PDF)

Suggested citation

Gilly, Travis. "Solicited, Not Secondary: The Common Rule Exemption, the Seam Between Two Regimes, and Research on Adults in Psychiatric Crisis." Real Safety AI Foundation Working Draft, August 2026. https://realsafetyai.org/research/solicited-not-secondary/

Other versions

This paper is also posted on SSRN.

SSRN version

References (29)

  1. Ancheff v. Hartford Hospital, 260 Conn. 785, 799 A.2d 1067 (2002).
  2. Abdillahi, I. (2024). Algorithmic surveillance in the era of the mental health appsphere. American Journal of Community Psychology, 73(1–2), 17–26.
  3. Botkin, J. R. (2017). Transparency and choice in learning healthcare systems. Learning Health Systems, 2(1), e10049.
  4. Burris, S. (2008). Regulatory innovation in the governance of human subjects research: A cautionary tale and some modest proposals. Regulation & Governance, 2(1), 65–84.
  5. Enos, G. (2023). Duke public policy report suggests federal law restricting data brokers. Mental Health Weekly, 33(10), 1–7.
  6. Federal Policy for the Protection of Human Subjects, 82 Fed. Reg. 7149 (Jan. 19, 2017).
  7. Friesen, P., Douglas-Jones, R., Marks, M., Pierce, R., Fletcher, K., Mishra, A., Lorimer, J., Véliz, C., Hallowell, N., Graham, M., Chan, M. S., Davies, H., & Sallamuddin, T. (2021). Governing AI-driven health research: Are IRBs up to the task? Ethics & Human Research, 43(2), 35–42.
  8. Grimes v. Kennedy Krieger Institute, Inc., 366 Md. 29, 782 A.2d 807 (2001).
  9. Hall, M. A., & King, N. M. P. (2016). Conscience, courage, and “consent.” Hastings Center Report, 46(2), 30–32.
  10. Horizon Omega & AI Safety Montreal. (2026). Montreal AI Safety, Ethics and Governance Event Series: Presentation and question period with Etienne Brisson, The Human Line Project [Recorded public event]. Internet Archive. https://archive.org/details/brisson-human-line-project-montreal-ai-safety-2026_202608
  11. Hoyt, C., et al. (2025). An analysis of institutional review board policies for enrollment of adults with impaired or uncertain decision-making capacity.
  12. Kim, J. (2023). Data brokers and the sale of Americans’ mental health data. Duke Sanford Cyber Policy Program.
  13. Lynch, H. F., Bierer, B. E., & Cohen, I. G. (2016). Confronting biospecimen exceptionalism in proposed revisions to the Common Rule. Hastings Center Report, 46(1), 4–5.
  14. Moore, J., et al. (2026). Characterizing delusional spirals through human-LLM chat logs. In Proceedings of the 2026 ACM Conference on Fairness, Accountability, and Transparency.
  15. National Bioethics Advisory Commission. (1998). Research involving persons with mental disorders that may affect decisionmaking capacity.
  16. National Research Act, Pub. L. No. 93-348, 88 Stat. 342 (1974).
  17. Nock, M. K., Kleiman, E. M., Abraham, M., Bentley, K. H., Brent, D. A., Buonopane, R. J., et al. (2020). Consensus statement on ethical and safety practices for conducting digital monitoring studies with people at risk of suicide and related behaviors. Psychiatric Research and Clinical Practice, 3(2), 57–66.
  18. Rivers v. Katz, 67 N.Y.2d 485 (1986).
  19. Request for Information and Comments on Research That Involves Adult Individuals with Impaired Decision-Making Capacity, 72 Fed. Reg. 50,966 (Sept. 5, 2007).
  20. Suthers v. Amgen, Inc., 372 F. Supp. 2d 416 (S.D.N.Y. 2005).
  21. T.D. v. New York State Office of Mental Health, 228 A.D.2d 95 (N.Y. App. Div. 1996).
  22. Terry, N. (2015). Developments in genetic and epigenetic data protection in behavioral and mental health spaces. Behavioral Sciences & the Law, 33(5), 653–661.
  23. Tovino, S. A. (2013). A “common” proposal. Houston Law Review, 50, 787.
  24. Truog, R. D., et al. (2003). Protecting subjects with decisional impairment in research: The need for a multifaceted approach. American Journal of Respiratory and Critical Care Medicine, 167, 1.
  25. White v. Kennedy Krieger Institute, Inc., 110 A.3d 724 (Md. Ct. Spec. App. 2015).
  26. White, T., Blok, E., & Calhoun, V. D. (2020). Data sharing and privacy issues in neuroimaging research: Opportunities, obstacles, challenges, and monsters under the bed. Human Brain Mapping, 43(1), 278–291.
  27. University of Texas System v. Paxton, No. 03-13-00329-CV (Tex. App. July 7, 2015).
  28. Washington University v. Catalona, 437 F. Supp. 2d 985 (E.D. Mo. 2006), aff’d, 490 F.3d 667 (8th Cir. 2007).
  29. Whitlock v. Duke University, 637 F. Supp. 1463 (M.D.N.C. 1986).

All research