Storing research information for future use

An increasing number of researchers are choosing to store and maintain tissue, blood, and other biological specimens, along with medical information or other data linked to the specimen, for unspecified future use. A research repository is a collection of any human biological materials and/or data that are individually identifiable and intended to be used for research purpose(s). Repository activities involve three components: the collection, storage, and distribution of materials/data. Specific IRB approval is required for banking of specimens, and continuing oversight by the IRB is necessary.

An investigator can obtain IRB review of a repository either through a stand-alone application (e.g. for the creation and maintenance of a tissue bank) or, if the collection occurs in conjunction with a specific research project, by explicitly building into the IRB application the intent to store data and/or tissue for future use.

In order for the IRB to approve the banking of data/specimens for future research, the following information needs to be provided:

• A description of how the data/specimens will be stored, including whether they will be stored in an identifiable manner (e.g., direct or indirect identifiers are associated with them).
•  A description of where the data/specimens will be stored and the security protections in place to minimize the risk of breach of confidentiality.
• Whether the banking of data/specimens is optional and if not, whether the consent form adequately describes that participation in the project means the subjects’ specimen(s) will be stored indefinitely for future use.
• The procedures in place by which subjects can withdrawal their data/specimens from long-term banking or whether de-identification makes withdrawal impossible.
• Limits on intended future use (e.g., the specimens will only be used in cancer-related research).
• The proposed consent process used to inform potential subjects of the purpose of the bank, procedures, whether any clinical information is stored with the specimen(s), whether the samples will be identifiable, the risks and how these are minimized, potential benefit, privacy and confidentiality protections, etc.
•  The policies and procedures for receipt and release of repository information.
• How the repository will be dismantled, data and any specimens disposed of, in the event that there is inadequate support for its continuing operation.

IRB oversight

Some repositories are established and maintained explicitly for research purposes. Others are established and maintained for non-research purposes, but may be accessed for research. Regardless of their intended purpose, such resources often hold information of value for research. When the purpose of the repository includes research, its collection and storage activities are considered human subjects research and require IRB oversight.

Informed consent

Researchers are typically expected to obtain informed consent from subjects for the inclusion of their data/specimens in a bank for future use. Specifically, the following need to be described in the consent form:

• Purpose of the repository.
• All type(s) of research that will, or may be conducted, including whether genetic analysis will be performed. This should be as specific as possible.
• Specific materials/data that will be deposited in the repository, and how these will be collected. Brief description of the operation of the repository.
• Describe if data/specimens will be released to outside investigators and conditions under which these will be released (e.g., with direct or indirect identifiers, or stripped of any identifiers), or if there will be no secondary/future use. Subjects must be given an option of consenting to any secondary/future use. Inform subjects that they may be re- contacted to seek additional consent for secondary/future use, or give subjects option to indicate if they are willing to be re-contacted.
• With whom the data/specimens may be share, if known.
• Potential risks of disclosure of the information, such as negative effects on insurance coverage, employment status, emotional discomfort, familial strife, or even harm to a cultural group.
• The potential benefits, including whether any results will be provided to the research participant.
• Procedures to protect confidentiality and privacy during collection, storage, and distribution of data/specimens.
• Indicate if their data/specimens will eventually be made anonymous and if so, how and when.
• Information regarding ownership of data/specimens, and whether use of data/specimens may lead to new discoveries or commercially valuable products, and whether donor subjects will receive any financial benefits from these discoveries/products.
• Describe if the donor subjects can have their data/specimens destroyed or all personal identifiers removed if he or she decides to withdraw from the research.
• Duration of storage of data/specimens; if indefinite, provide a justification.
• Fate of the data/specimens if PI leaves or repository center ceases operation.

Minors who reach legal age of consent

Unless the IRB determines that the requirements for obtaining informed consent can be waived, the investigators should seek and obtain the legally effective informed consent for the now adult subject for any continued analysis of data/specimens for which the subject’s identity is readily identifiable to the investigator(s). Review OHRP’s guidance for research involving children.

Identifiable information

Since breach of confidentiality is the major risk for stored repository materials, there must be an adequate plan for protecting the security and confidentiality of the repository materials and prevent accidental or inappropriate release of information. Only the minimum necessary information should be submitted to the repository. Whenever possible, all information should be de-identified or a coding system should be in place to prevent secondary researchers from obtaining the identity of the subject. A Certificate of Confidentiality is recommended as an additional protective measure, especially if the repository includes collection of genetic materials/information or sensitive data. If a Certificate of Confidentiality will be obtained, a copy of the certificate should be provided to the IRB once this becomes available. View information on Certificate of Confidentiality.

Secondary use of information

IRB oversight for secondary use of information depends on what type of information is released to the researcher. More information regarding this topic can be found in the Office for Human Research Protections (OHRP) Guidance on Coded Private Information or Biological Specimens.

The determination of whether consent was obtained for any future use is context-specific based on a range of considerations. If the original consent form specifically prohibited the proposed research activity, it is presumed the research is not allowable. If the consent does not prohibit the proposed use, the IRB will consider several questions to determine compatibility:

• What is the nature of the proposed secondary research?
• Could it reasonably be understood to fall within the scope of research that was described in the original consent form?
• Does the new research use impose new or significantly greater risks (including privacy risks) not described in the initial consent form?
• Are there known concerns of the study population(s) about the proposed new use?

NIH Genomic Data Sharing (GDS) requirements

If the project is subject to the NIH GDS requirements, please review the HRPP Guidance, NIH Genomic Data Sharing policy. The IRB protocol should include a description, at a minimum, of the following:

• Type of data that will be shared (i.e., the type of genomic data, relevant associated data, and information necessary to interpret the data)
• The data repository to which the data will be submitted
• The timeline for the data to be shared
• Any limitations on the secondary research uses of the data, if the study involved human data acknowledgement that the Institutional Certification will be submitted and assurance by the Institutional Review Board (IRB) that the data can be shared through NIH-designated data repositories, consistent with data sharing under the NIH GDS Policy.

Additional considerations

• Under the HIPAA Privacy Rule separate permission is required for the storage of biological materials as well as each research use of identifiable materials. Written authorization from subjects for each research use of their protected health information must be obtained or a waiver of such authorization sought from the IRB for a use for which written authorization was not previously obtained.
•  If the tissues are used to test an FDA regulated IVD, then IRB review is required and informed consent of the subjects for the secondary use must be obtained unless the subjects provided consent addressing the elements required under 21 CFR 50.25 at the time of tissue collection which would adequately address the secondary use activities, or the FDA “Guidance on Informed Consent for In Vitro Diagnostic Device Studies Using Leftover Human Specimens that are Not Individually Identifiable” has been met.

 

Version 2019-8