Sorry, you need to enable JavaScript to visit this website.

Sign Up For Mailing List Button

Donate to Genetic Alliance

Disease Search Button

Chapter XXV - Research Involving Data and/or Biological Specimens

Facebook icon
Google+ icon
Twitter icon
LinkedIn icon
Del.icio.us icon
Digg icon

OVERVIEW AND GENERAL INFORMATION
The purpose of this policy is to describe the requirements for IRB approval (or exemption) and informed consent for any of the following:

  • Data and/or biological specimens collected for research purposes;
  • Data and/or specimens collected, stored, and/or distributed for future research uses;
  • Previously collected data/specimens used for secondary research.

Prospective collection of data and/or specimens for research purposes (e.g., additional questions added to routine surveys being performed for non-research purposes, an extra tube of blood taken at the time of clinical blood drawing, etc.) is “research involving human participants,” and IRB review and approval is required. Informed consent (and HIPAA authorization for data that include PHI) must also be obtained.

Collection and storage of data and/or specimens for future research uses and/or distribution (i.e., rather than using data/specimens only for pre-defined analyses as described in a specific IRB-approved protocol) are activities that meet the definition of “research involving human participants;” and IRB review and approval is required. Informed consent (and HIPAA authorization for data that include PHI) is also required.

When the data and/or specimens to be stored for future research uses are generated as part of another research study (e.g., clinical trial), a separate protocol describing repository activities must generally be submitted for IRB review and approval unless the bank is externally controlled Note: Sponsor-mandated data sharing may not require a stand-alone repository submission.

In some cases, secondary uses of previously collected data and/or specimens meet the definition of “research involving human participants,” and IRB approval or exemption is required.

Certain activities involving data and/or specimens do not meet the definition of “research involving human participants” and do not require IRB approval or exemption.

ACTIVITIES THAT ARE NOT HUMAN PARTICIPANTS RESEARCH
Laboratory research with commercially available tissue specimens, cell lines, or other human cells does not meet the definition of “research involving human participants” and may be performed without IRB approval or exemption as long as the work is not FDA-regulated (see “Research Subject to FDA Regulations” below).

Research with autopsy specimens does not meet the definition of “research involving human participants” and may be performed without IRB approval or exemption. Research involving decedents’ PHI is subject to HIPAA regulations.

Research with previously collected anonymous (see “Definitions” above) data and/or specimens does not meet the definition of “research involving human participants” and may be performed without IRB approval or exemption only when the data/specimens to be studied were not collected specifically for the current research. Note: An investigator may not de-identify data and/or specimens under his or her control (e.g., data collected by the investigator for another study) for future research uses without IRB review.

Research with previously collected coded data and/or specimens does not meet the definition of “research involving human participants” and may be performed without IRB approval or exemption only when all of the following conditions are met:

  • The data and/or specimens to be studied were not collected specifically for the current research;
  • Investigator(s) cannot “readily ascertain” the identity of the source(s) of the coded data or specimens because one or more of the conditions below is met:
    • The investigators and the holder of the “key”, enter into an agreement prohibiting the release of the key to the investigators under any circumstances (until the source individuals are deceased); AND/OR
    • IRB-approved written policies and procedures for the repository or data coordinating center prohibit the release of the key to the investigators under any circumstances (until the source individuals are deceased).

Research with remnantspecimens does not meet the definition of “research involving human participants” and may be performed without IRB approval or exemption only when their use meets the conditions for anonymous or coded specimens. Note: An investigator may not deidentify data and/or specimens under his or her control (e.g., specimens generated by the investigator from a clinical procedure) for future research uses without IRB review.

The research uses of previously collected data and/or specimens described above may be defined as “research involving human participants” under FDA regulations and may require IRB approval and participant informed consent, depending on the nature of the research (see “Research Subject to FDA Regulations” below).

EXEMPT RESEARCH
Research involving existing data and/or specimens is exempt when all of the following conditions are met:

  • All data and/or specimens are available, or “on the shelf,” at the time the research is submitted for an exempt determination;
  • The sources of the data and/or specimens are publicly available or the information is recorded by the investigator in a way that participants cannot be identified, directly or through identifiers linked to the participants;
  • The research is not subject to FDA regulations. Note: An investigator may not deidentify data and/or specimens under his or her control (e.g., data collected by the investigator for another purpose or study) for future research uses without IRB review.

Prospective collection of biological specimens is not exempt from IRB review. Prospective data collection may be exempt in certain cases (e.g., some research qualifying under exempt category #1), depending on the nature of the data and population from whom the information is collected.

USING BASIC EXEMPT CRITERIA 45 CFR 46.101(B)(4)
Research includes studies of biological specimens that have been banked for research purposes. Although health information about the individuals who provided these specimens can be linked to them, researchers cannot have direct access to their names, or other information that would allow them to be identified. It may be appropriate to use an Honest Broker.

  • Specimens may include tissue, blood, or bodily fluid;
  • Specimens were obtained independent of this research study;
  • Specimens are archived in a recognized tissue bank;
  • All specimens and corresponding data are recorded anonymously; OR
  • Data are recorded in such a way that researchers cannot identify participants. Two acceptable strategies for this de-identification exist:
    • Identifiable data are de-identified by an appropriate software program; OR
    • The de-identification of data is carried out by a person who is independent of the research (i.e., an independent "honest broker"), who has been identified by name in the protocol, and who has completed the "honest broker" certification form. Information linking the assigned code numbers to the participants’ identity (if applicable) is maintained solely by the independent "honest broker".
  • All specimens are currently in existence.

ADDITIONAL REQUIREMENTS OR CONSIDERATIONS
Tissue bank or repository must be identified by name, and the IRB number or a copy of the consent form completed by participants must be included.

If specimens were collected as part of another research project, a copy of the initial consent form must be attached to ensure that participants participating in the initial project did not restrict the use of their sample to that initial project or to certain types of analyses

If specimens are still being collected, the investigators of the proposed study cannot personally participate in the collection of those specimens. Under these circumstances, the study must be approved by the IRB as "not human participants research" (45CFR46.102(f)). This issue needs to be addressed explicitly in the protocol.

SECONDARY USES OF PREVIOUSLY COLLECTED DATA/SPECIMENS
IRB approval or exemption is required for secondary research uses of previously collected data and/or biological specimens, unless only anonymous or coded data/specimens are used as described above (see “Activities That Are Not Human participants Research”).

Secondary research uses of non-research collections of data/specimens (e.g., data or specimens that are retained for purposes other than research, such as clinical or educational records, archived pathology specimens, etc.) require IRB approval or exemption, as such collections have not been established as repositories with IRB-approved procedures for releasing materials that consider human participants protection requirements.

Secondary (i.e., “new”) uses of data/specimens obtained for primary research purposes by an investigator with IRB approval (or exemption) require IRB review of an amendment or a new protocol describing the proposed secondary use, depending on the previous approval (or exemption) and the new research objective(s). Informed consent may also be required for this new use (as described below), depending on the scope of the original consent and the newly proposed research.

Research using previously collected data and/or specimens must be consistent with the scope and terms described in the original informed consent process/document, as applicable. If consent was not obtained (e.g., data/specimens obtained for non-research purposes) or the original consent does not adequately include the proposed secondary use, specific informed consent for the new research may be required. De-identification or coding of data/specimens should not be used as a means for circumventing the original terms of consent. Except in unusual circumstances, informed consent is required when identifiable data and/or specimens are used.

Informed consent (and HIPAA authorization, when applicable) can be waived by the IRB for minimal risk non-exempt research with previously collected data and/or specimens when the research meets the regulatory criteria for waiver (see “Informed Consent Requirements” below).

Protocols for using previously collected data and/or biological specimens for research purposes should include the following information, as applicable:

  • Purpose of using data/specimens;
  • Type(s) of data/specimens to be studied;
  • Source(s) and circumstances under which the data/specimens were collected;
  • State of the data/specimens to be obtained (i.e., identifiable or coded);
  • If the data include individually identifiable protected health information;
  • Whether informed consent (and HIPAA authorization, when applicable) was obtained for collection and future use of data/specimens;
  • Physical location/equipment and security provisions for data/specimen storage;
  • Process for destruction or de-identification of identifiable or coded data/specimens at the end of the retention period.

Investigators may not share data and/or specimens with collaborators for secondary research purposes without IRB approval. Distribution of data and/or specimens for secondary research uses beyond a single transfer described in a specific IRB-approved protocol generally requires approval for a repository.

Confidential disclosure agreements (CDAs), data use agreements (DUAs), or material transfer agreements (MTAs) may be required for sharing research data or specimens with outside collaborators. Access to and/or use of identifiable patient information from medical records or clinical databases for research purposes must comply with the requirements of the HIPAA Privacy and Security Rules and university, if applicable.

The proposed use of student education records in research must comply with the requirements of the Family Educational Rights and Privacy Act (FERPA).

REPOSITORIES – COLLECTION, STORAGE, AND/OR DISTRIBUTION OF DATA/SPECIMENS
Data and specimen repositories/banks may range from materials held by a single investigator in his/her office or laboratory to large networks with central coordinating centers. Although the size, purpose, types of information and materials stored, and populations from whom the data/specimens are collected may also vary widely, creating a data and/or specimen bank for future research purposes (i.e., rather than using data/specimens only for pre-defined analyses as described in a specific IRB-approved protocol) is defined as “research involving human participants;” and IRB review and approval is required.
Informed consent is required for collection of data and/or biological specimens to be stored for future. HIPAA authorization is also required when the data include protected health information.

Protocols for creating data and/or biological specimen repositories for research purposes should include the following information, as applicable:

  • Purpose of collecting and storing data/specimens;
  • Type(s) of data/specimens to be collected and stored;
  • Source(s) and circumstances of data/specimen collection (i.e., obtained directly from participants or from a secondary source);
  • How the data/specimens will be stored (i.e., identifiable, coded, or de-identified);
  • If the data include individually identifiable protected health information;
  • Physical location/equipment and security provisions for data/specimen storage;
  • Length of time data/specimens will be stored;
  • Any limits on data/specimens’ intended future use (e.g., for cancer research only);
  • With whom data/specimens may be shared;
  • Process for requesting and releasing data/specimens;
  • How data/specimens will be released (i.e., identifiable, coded, or de-identified);
  • Procedures to withdraw participants’ data/specimens from future research;
  • Plan for continuing repository operations in the absence (or departure) of the principal investigator;
  • Process for destruction or de-identification of identifiable or coded data/specimens at the end of the retention period.

Consideration should be given to obtaining a National Institutes of Health (NIH) Certificate of Confidentiality to protect the confidentiality of banked identifiable or coded data/specimens. Certificates of Confidentiality are intended to protect information that, if disclosed, could have adverse consequences for research participants or damage their financial standing, employability, insurability, or reputation.

Examples include information about the following:

  • HIV, AIDS, and other sexually transmitted diseases;
  • Sexual attitudes, preferences, or practices;
  • Use of alcohol, drugs, or other addictive products;
  • Illegal conduct;
  • Participants' psychological well-being or mental health;
  • Genetic studies, including future use of stored biological samples.

Methods for handling and storing data (including the use of personal computers and portable storage devices) must comply with industry standards. Restricted data, including protected health information, must be encrypted if stored or used on portable devices, if removed from a secure university/site location, or if electronically transmitted.

Investigators and IRBs should consider when research involving the collection and storage of personally identifiable information (i.e., information that can be used to distinguish an individual’s identity, such as name, social security number, date of birth, etc., or information linked to an individual, such as medical, financial, or employment information) might expose research participants to the risk of fraud or identity theft. This is especially important in research linked to “fee-for-service” activities, where federal financial regulations for protecting consumers against identity theft may apply. In such cases, plans for handling and storing personally identifiable information must comply with Federal Trade Commission rules.

INFORMED CONSENT REQUIREMENTS
Informed consent must be obtained for collection and storage of data and/or biological specimens for future research. HIPAA authorization is also required when the data include protected health information.

Investigators and IRBs should balance the ethical obligation to provide sufficient information regarding possible future research uses of stored data and/or specimens during the consent process for banking with the practical issues of trying to anticipate and describe all possible research uses of these materials. However, the consent process for collecting and banking data and/or specimens should be as specific as possible regarding the circumstances and any risks associated with data/specimen collection, as well as the procedures for maintaining the security and confidentiality of the stored materials.

In addition to the required elements of informed consent, the consent process should include the following information, as applicable:

  • Description of the data/specimens to be collected and how they will be obtained;
  • Any risks associated with obtaining the data/specimens;
  • How the data/specimens will be used (to the extent known);
  • Any limits on data/specimens’ intended future use (e.g., for cancer research only);
  • Whether any identifying information will be retained, and if so, how it will be stored;
  • Certificate of Confidentiality information, when applicable;
  • Description of the repository, including physical location, security procedures, etc.;
  • Who will have access to the data/specimens;
  • How long the data/specimens will be stored;
  • With whom data/specimens may be researchers);
  • How to withdraw data/specimens from future research;
  • Whether or not participants may be re-contacted in the future (e.g., for consent to future research, to return research results, etc.).

If data and/or specimens may be commercialized, the consent process/document must include language that complies with state law. In addition, HIPAA regulations prohibit the sale of an individual’s PHI without his/her authorization.

When identifiable specimens and/or genetic information are stored and may be released for future research, the consent process/document should also include language describing the protections provided by the Genetic Information Nondiscrimination Act.

The informed consent process/document must not include any exculpatory language through which participants are made to waive or appear to waive any legal rights regarding the collection or use of their data and/or specimens.

Research using previously banked data and/or specimens should be consistent with the scope and terms described in the original informed consent process/document, as applicable. If consent was not obtained (e.g., data/specimens obtained for non-research purposes) or the original consent does not adequately include the proposed secondary use, specific informed consent for the new research may be required. Except in unusual circumstances, informed consent is required when identifiable data and/or specimens are used.

Informed consent (and HIPAA authorization, when applicable) can be waived by the IRB for minimal risk non-exempt research with previously collected data and/or specimens when the research meets the regulatory criteria for waiver. Waiver of HIPAA authorization can also be granted (when applicable) by the Privacy Board for secondary uses of existing data and/or specimens in exempt research.

RESEARCH SUBJECT TO FDA REGULATIONS
Activities involving data and/or specimens that do not require IRB approval under DHHS regulations (see “Activities That Are Not Human Participants Research” above) must still receive IRB approval if the activities are subject to FDA regulations (e.g., involving FDAregulated products or submission of data/results to FDA). Activities with data and/or specimens defined by FDA as “research involving human participants” include testing of in vitro diagnostic devices using biological specimens and the use of clinical data for historical “controls” in investigational drug studies.

Until recently, FDA regulations did not permit waivers of the informed consent requirements in research, except for emergencies (i.e., emergency use of a test article or emergency research) or in certain types of military research. The criteria listed above for waiver or alteration of informed consent are now applicable to FDA-regulated research per an amendment to the Federal Food, Drug and Cosmetic Act (FD&C Act) prepared by the Office of Good Clinical Practice, Center for Drug Evaluation and Research, Center for Biologics Evaluation and Research and the Center for Devices and Radiological Health at the Food and Drug Administration (FDA), passed on December 13, 2016, known as the 21st Century Cures Act (Cures Act) (P.L. 114-255). This law provides FDA with the authority to permit an exception from informed consent requirements when the proposed clinical testing poses no more than minimal risk to the human participant and includes appropriate safeguards to protect the rights, safety, and welfare of the human participant. Also. under specific circumstances in vitro diagnostic device studies may be performed with biological specimens without informed consent, as described below.

FDA intends to exercise “enforcement discretion” regarding the requirements for informed consent in an in vitro diagnostic device study involving biological specimens when all of the following criteria are met:

  • The study meets the IDE exemption criteria;
  • The study uses leftover/remnant specimens, specimens obtained from repositories, or unused specimens that were previously collected for other research purposes;
  • The specimens are not individually identifiable ;
  • Clinical information accompanying the specimens does not make the specimen source identifiable;
  • Individuals caring for the patients from whom the specimens were obtained do not share information with the investigator(s);
  • Specimens are provided to the investigator(s) without identifiers, and the supplier has stablished policies to prevent the release of personal information;
  • The study has been reviewed and approved by an IRB. For more information see FDA “Guidance on Informed Consent for In Vitro Diagnostic Device Studies Using Leftover Human Specimens that are Not Individually Identifiable.”

APPLICABLE REGULATIONS/GUIDANCE
FDA “Guidance on Informed Consent for In Vitro Diagnostic Device Studies Using Leftover Human Specimens that are Not Individually Identifiable” (04/25/06); National Bioethics Advisory Commission “Research Involving Human Biological Materials: Ethical Issues and Policy Guidance” (08/99); NIH “Research Repositories, Databases, and the HIPAA Privacy Rule” (07/02/04); OHRP “Guidance on Research Using Coded Private Information or Specimens” (10/16/08); OHRP “Guidance on the Genetic Information Nondiscrimination Act: Implications for Investigators and Institutional Review Boards” (03/24/09); OHRP “Issues to Consider in the Research Use of Stored Data or Tissues” (11/07/97); “Report of the Public Responsibility in Medicine and Research (PRIM&R) Human Tissue/Specimen Banking Working Group” (03/07); The Secretary’s Advisory Committee on Human Research Protections (SACHRP) “FAQs, Terms, and Recommendations on Informed Consent and Research Use of Biospecimens” (07/20/11)

Twitter icon
Facebook icon
LinkedIn icon
Google+ icon
YouTube icon
RSS icon

4301 Connecticut Ave NW, Suite 404, Washington DC 20008-2369 | Tel: 202.966.5557 | Fax: 202.966.8553 | EIN 52-1571905

Except where otherwise noted, content on this site is licensed under a Creative Commons Attribution 3.0 License.