Therefore, in the final rule, we modeled the criterion on the relevant Common Rule requirement for the approval of
human subjects research, and
revised the proposed criterion to state: «the privacy risks to individuals whose protected health information is to be used or disclosed are reasonable in
relation to the anticipated benefits if any to the individuals, and the importance of the knowledge that may reasonably be expected to result from the research.»