Repositories and broad consent

Overview

An increasing number of researchers are choosing to store and maintain tissue, blood, and other biological specimens, along with medical information or other data linked to the specimen, for unspecified future use. This collection of information is frequently called a repository.

A research repository is a collection of any human biological materials and/or data that are individually identifiable and intended to be used for research purpose(s). Repository activities involve three components: the collection, storage, and distribution of materials/data.

The term “Broad Consent” applies to a specific type of consent and tracking for storage and secondary research of identifiable private information or biospecimens. This broad consent concept must be implemented on an institutional level and requires tracking of individuals who decline to provide consent. Because of the implications of the robust tracking and system requirements for individuals who do not provide consent and excluding their data from all future research, we are not promoting the use of broad consent at this time. Investigators can continue to use biospecimens that are coded or to seek waiver of consent for use of biospecimens with identifiers retained consistent with current practices.

How to obtain approval for a repository

An investigator can obtain IRB review of a repository either through a stand-alone application (e.g. for the creation and maintenance of repository) or, if the collection occurs in conjunction with a specific research project, by explicitly building into the IRB application the intent to store data and/or biospecimens for future use.

In order for the IRB to approve the banking of data/specimens for future research, the following information needs to be provided:

• A description of how the data/specimens will be stored, including whether they will be stored in an identifiable manner (e.g., direct or indirect identifiers are associated with them)
• A description of where the data/specimens will be stored and the security protections in place to minimize the risk of breach of confidentiality
• Whether the banking of data/specimens is optional and if not, whether the consent form adequately describes that participation in the project means the subjects’ specimen(s) will be stored indefinitely for future use
• The procedures in place by which subjects can withdrawal their data/specimens from long-term banking or whether de-identification makes withdrawal impossible
• Limits on intended future use (e.g., the specimens will only be used to study a specific disease)
• The policies and procedures for receipt and release of repository information
• How the repository will be dismantled, data and any specimens disposed of, in the event that there is inadequate support for its continuing operation
• The informed consent process

Informed consent

Researchers are typically expected to obtain informed consent from subjects for the inclusion of their data/specimens in a bank for future use. Broad consent is an option to obtain consent for studies involving storage, maintenance, and secondary use of identifiable data or specimens. Broad consent is not in addition to traditional informed consent, but separate from traditional informed consent.

The proposed consent process used to inform potential subjects of the purpose of the bank, procedures, whether any clinical information is stored with the specimen(s), whether the samples will be identifiable, the risks and how these are minimized, potential benefit, privacy and confidentiality protections, etc.

• There are different elements of informed consent from traditional informed consent. The elements are:
  • Risks, benefits, confidentiality, voluntariness, and whom to contact;
  • Whether identifiable information or specimens will be sold for commercial profit and whether the subject will or will not share in this commercial profit;
  • Whether research may involve whole genome sequencing;
  • General description about the types of research that will be done with the identifiable information or specimens;
  • Description of the identifiable information or specimens that might be used in the research, whether sharing of such information will occur, and the types of  institutions or researchers that might conduct research with the identifiable information or specimens;
  • Time information will be stored and maintained, and stored and used for research;
  • Unless told otherwise, a statement that individuals will NOT be informed of the details of any results of studies; and
  • Unless told otherwise, a statement that clinically relevant results will NOT be shared.
• When a participant withdraws their broad consent, the IRB cannot issue a waiver or alteration of consent to allow continued use of the identifiable information or specimens.

The new rule allows waiver of a signature requirement (e.g. waiver of documentation) when a broad consent is used, so long as all the elements above are met. However, it is expected that use of a waiver of a signature for broad consent will be used rarely (e.g. for distinct cultural groups where signing documents is not the norm, or when the initial activity involved only oral communication through activities like a phone survey).

Specifically, the following need to be described in the consent form:

• Purpose of the repository
• All type(s) of research that will, or may be conducted, including whether genetic analysis will be performed. This should be as specific as possible
• Specific materials/data that will be deposited in the repository, and how these will be collected. Brief description of the operation of the repository
• Describe if data/specimens will be released to outside investigators and conditions under which these will be released (e.g., with direct or indirect identifiers, or stripped of any identifiers), or if there will be no secondary/future use. Subjects must be given an option of consenting to any secondary/future use. Inform subjects that they may be recontacted to seek additional consent for secondary/future use, or give subjects option to indicate if they are willing to be re-contacted
• With whom the data/specimens may be share, if known
• Potential risks of disclosure of the information, such as negative effects on insurance coverage, employment status, emotional discomfort, familial strife, or even harm to a cultural group
• The potential benefits, including whether any results will be provided to the research participant
• Procedures to protect confidentiality and privacy during collection, storage, and distribution of data/specimens
• Indicate if their data/specimens will eventually be made anonymous and if so, how and when
• Information regarding ownership of data/specimens, and whether use of data/specimens may lead to new discoveries or commercially valuable products, and whether donor subjects will receive any financial benefits from these discoveries/products
• Describe if the donor subjects can have their data/specimens destroyed or all personal identifiers removed if he or she decides to withdraw from the research
• Duration of storage of data/specimens; if indefinite, provide a justification
• Fate of the data/specimens if PI leaves or repository center ceases operation

Minors who reach legal age of consent

Unless the IRB determines that the requirements for obtaining informed consent can be waived, the investigators should seek and obtain the legally effective informed consent for the now adult subject for any continued analysis of data/specimens for which the subject’s identity is readily identifiable to the investigator(s). Review OHRP’s guidance for research involving children (https://www.hhs.gov/ohrp/regulations-and-policy/guidance/faq/children-research/index.html).

Identifiable information

Since breach of confidentiality is the major risk for stored repository materials, there must be an adequate plan for protecting the security and confidentiality of the repository materials and prevent accidental or inappropriate release of information. Only the minimum necessary information should be submitted to the repository. Whenever possible, all information should be de-identified or a coding system should be in place to prevent secondary researchers from obtaining the identity of the subject.

A Certificate of Confidentiality is recommended as an additional protective measure, especially if the repository includes collection of genetic materials/information or sensitive data. If a Certificate of Confidentiality will be obtained, a copy of the certificate should be provided to the IRB once this becomes available. For information on Certificate of Confidentiality, visit http://grants1.nih.gov/grants/policy/coc/

Secondary use of information

IRB oversight for secondary use of information depends on what type of information is released to the researcher. More information regarding this topic can be found in OHRP’s Guidance on Coded Private Information or Biological Specimens.

The determination of whether consent was obtained for any future use is context-specific based on a range of considerations. If the original consent form specifically prohibited the proposed research activity, it is presumed the research is not allowable. If the consent does not prohibit the proposed use, the IRB will consider several questions to determine compatibility:

• What is the nature of the proposed secondary research?
• Could it reasonably be understood to fall within the scope of research that was described in the original consent form?
• Does the new research use impose new or significantly greater risks (including privacy risks) not described in the initial consent form?
• Are there known concerns of the study population(s) about the proposed new use?

NIH Genomic Data Sharing (GDS) requirements

If the project is subject to the NIH GDS requirements, please review the HRPP Guidance, NIH Genomic Data Sharing policy. The IRB protocol should include a description, at a minimum, of the following:

• Type of data that will be shared (i.e., the type of genomic data, relevant associated data, and information necessary to interpret the data)
• The data repository to which the data will be submitted
• The timeline for the data to be shared
• Any limitations on the secondary research uses of the data, if the study involved human data acknowledgement that the Institutional Certification will be submitted and assurance by the Institutional Review Board (IRB) that the data can be shared through NIH-designated data repositories, consistent with data sharing under the NIH GDS Policy

Additional considerations

• Under the HIPAA Privacy Rule separate permission is required for the storage of biological materials as well as each research use of identifiable materials. Written authorization from subjects for each research use of their protected health information must be obtained or a waiver of such authorization sought from the IRB for a use for which written authorization was not previously obtained.
•  If the tissues are used to test an FDA regulated IVD, then IRB review is required and informed consent of the subjects for the secondary use must be obtained unless the subjects provided consent addressing the elements required under 21 CFR 50.25 at the time of tissue collection which would adequately address the secondary use activities, or the FDA “Guidance on Informed Consent for In Vitro Diagnostic Device Studies Using Leftover Human Specimens that are Not Individually Identifiable” has been met.

Version 2020-3