Attachment D: FAQ's Terms and Recommendations on Informed Consent and Research Use of Biospecimens

July 20, 2011
Content approved by SACHRP in July and October 2009, and March, July and October 2010 and July 2011.

Preface

The collection and use of human specimens have become essential to biomedical research. These biospecimens include blood and other tissues, some collected originally for clinical lab tests, some removed during surgeries, and some obtained specifically for research. While there is no accurate catalog of the number or locations of specimens, there are reasonable estimates that billions of specimens are now stored in laboratories, repositories and “tissue banks” across the country. Coupled with associated clinical data and the power of bioinformatics, these specimens represent an invaluable resource for current and future research on human health and disease.

At the same time, there are significant ethical, legal and social policy implications relating to the collection, storage and use of biospecimens. Institutions, investigators, institutional review boards (IRBs), funding agencies and the public are struggling with issues like informed consent, ownership, stewardship, genetic testing, and future uses that are often unspecified at the time specimens are first obtained. The ethical tensions that frequently exist between the needs of science and the rights of individuals are present in research involving specimens, and there is much inconsistency and uncertainty as to how they should be used responsibly. The research community would benefit from federal-level guidance.

The HHS Secretary's Advisory Committee on Human Research Protections (SACHRP) has considered a number of unanswered questions relating to informed consent and research use of biospecimens. Upon request by SACHRP, the Subpart A Subcommittee of SACHRP deliberated on these issues and presented their recommendations to SACHRP for further discussion and approval, over the course of several meetings in 2009 and 2010. The finalized recommendations take the form of a series of "Frequently Asked Questions" (FAQs), each presented as a commonly encountered scenario and a suggested response that addresses regulatory and ethical issues. The goal was to provide a framework for IRBs, institutions and investigators to consider individual research scenarios without prescribing the final outcome, recognizing that those decisions will always be case-specific. Please note that there may be state laws that apply to these issues, but they are not addressed or contemplated in these FAQs.

It is hoped that these compiled FAQs and recommendations constitute a product that the Office for Human Research Protections, the Office for Civil Rights, and the Food and Drug Administration and others can use to provide much-needed guidance in this area.

I. Glossary and concepts

1. CODED2 means:

(1) Identifying information (such as name or social security number) that would enable the investigator to readily ascertain the identity of the individual to whom the private information or specimens pertain has been replaced with a number, letter, symbol, or combination thereof (i.e., the code); and

(2) A key to decipher the code exists, enabling linkage of the identifying information to the private information or specimens.

2. HONEST BROKER means:

A neutral intermediary (person or system) between the individual whose tissue and data are being studied, and the researcher. The honest broker collects and collates pertinent information regarding the tissue source, replaces identifiers with a code, and releases only coded information to the researcher.

3. LIMITED DATA SET:

As defined by HIPAA, limited data sets are data sets stripped of certain direct identifiers that are specified in the Privacy Rule. They are not de-identified information under the Privacy Rule.

A limited data set is protected health information that excludes the following direct identifiers of the individual or of relatives, employers, or household members of the individual: (1) names; (2) postal address information, other than town or city, state, and ZIP code; (3) telephone numbers; (4) fax numbers; (5) e-mail addresses; (6) social security numbers; (7) medical record numbers; (8) health plan beneficiary numbers; (9) account numbers; (10) certificate/license numbers; (11) vehicle identifiers and serial numbers, including license plate numbers; (12) device identifiers and serial numbers; (13) web URLs; (14) Internet Protocol (IP) address numbers; (15) biometric identifiers, including fingerprints and voiceprints; and (16) full-face photographic images and any comparable images.

Importantly, unlike de-identified data, protected health information in limited data sets may include the following: city, state and ZIP codes; all elements of dates (such as admission and discharge dates); and unique codes or identifiers not listed as direct identifiers.

Recognizing that institutions, IRBs and investigators are frequently faced with applying both the Common Rule and the HIPAA Privacy Rule, OHRP does not consider a Limited Data Set (as defined under the HIPAA Privacy Rule) to constitute individually identifiable information under 45 CFR 46.102(f)(2).

4. When is research with specimens not Human Subjects Research?2

OHRP does not consider research involving only coded private information or specimens to involve human subjects if the following conditions are both met:

(1) The private information or specimens were not collected specifically for the currently proposed research project through an interaction or intervention with living individuals; and

(2) the investigator(s) cannot readily ascertain the identity of the individual(s) to whom the coded private information or specimens pertain because, for example, there are agreements, IRB-approved policies and procedures, or legal requirements in place that prohibit the release of the key to the code to the investigators under any circumstances until the individuals are deceased.

5. How are studies with specimens addressed under the FDA regulations?

Certain research studies involving medical devices and tissue specimens will qualify as clinical investigations under the FDA regulations. Most commonly, devices that are tested using tissue samples are In Vitro Diagnostic (IVD) devices. Under the definition of a human subject in FDA device regulation 21 CFR 812.3(p), “Subject means a human who participates in an investigation, either as an individual on whom or on whose specimen an investigational device is used or as a control. A subject may be in normal health or may have a medical condition or disease.” Thus, if tissues are used to establish the safety and effectiveness of a device, then the FDA regulations apply. Under the FDA regulations, IRB review (21 CFR Part 56) is always required, and consent of the subject (21 CFR Part 50) is usually required. Consent may be waived in certain emergency situations under 21 CFR 50.23 and 50.24. FDA applies enforcement discretion to certain clinical investigations of IVDs, as described in the guidance document “Guidance on Informed Consent for In Vitro Diagnostic Device Studies Using Leftover Human Specimens that are Not Individually Identifiable.” This guidance allows research with tissues without consent if seven conditions are met. The most important condition for the purposes of these FAQs is that “The specimens are not individually identifiable, i.e., the identity of the subject is not known to and may not readily be ascertained by the investigator or any other individuals associated with the investigation, including the sponsor. If the specimen is coded, it will be considered to be not individually identifiable if neither the investigator(s) nor any other individuals associated with the investigation or the sponsor can link the specimen to the subject from whom the specimen was collected,

either directly or indirectly through coding systems.” The guidance uses essentially the same definition of “coded” that OHRP uses in its coded data guidance: “coded means that: 1) a number, letter, symbol, or combination thereof (i.e., the code) has replaced identifying information (such as name or social security number) that would enable the investigator or any other individuals associated with the investigation, including the sponsor to readily ascertain the identity of the individual to whom the specimen pertains; and 2) a key to decipher the code exists, enabling linkage of the identifying information to the specimen.”

II. Related SACHRP Recommendations

1. Recommendation on Compatibility of Secondary Use with Consent.

The determination of whether a proposed secondary research use is compatible with the original consent will be context-specific based on a range of considerations. If the original consent form specifically prohibited the proposed research activity, it is presumed the research is not allowable. If the consent does not prohibit the proposed use, IRBs should consider several questions to determine compatibility:

What is the nature of the proposed secondary research?
Could it reasonably be understood to fall within the scope of research that was described in the original consent form?
Does the new research use impose new or significantly greater risks (including privacy risks) not described in the initial consent form?
Are there known concerns of the study population(s) about the proposed new use?

2. Recommendation on the Definition of “Investigator.”

OHRP should revise its interpretation of who is considered an “investigator” in secondary use of coded information or specimens. Persons who are providing such information or specimens without identifiers should not be considered to be “investigators” involved in human subjects research, even if they are involved in analysis of aggregate data or publication of results, provided the secondary users are unable to readily ascertain the identity of subjects. Under such circumstances, neither party shall decode or re-identify subjects.

Mechanisms to support this interpretation could include (a) the presence of an agreement that prohibits release of the key from the original provider to secondary users; or (b) the existence of a repository or banking system that prohibits the secondary users from access to identifiers. These same interpretations and mechanisms should be applied whether the original provider and secondary user(s) are within the same institution or at different institutions.

The intent is to support a conclusion that secondary uses under such circumstances do not constitute research involving human subjects (as defined under 45 CFR 46.102(f)) and therefore do not require IRB review and approval, in keeping with OHRP’s “Guidance on Research Involving Coded Private Information or Biological Specimens.”

III. Frequently Asked Questions (FAQs)

FAQ #1

Tissue biopsies were obtained for clinical diagnostic purposes, which have now been satisfied. The patients did not provide study specific informed consent for the research use of the tissue specimens. The hospital pathology department is willing to provide a portion of the remaining biopsy specimens to an investigator who will perform research assays. In order to allow matching with relevant clinical information, the specimens will be provided with identifiers such that the investigator can readily ascertain the identity of subjects.

Is consent of the patient from whom the biopsy was taken (or waiver of consent) required for the secondary research use?

Response – HHS Common Rule Issues. Yes. Under this scenario, informed consent of the subjects should either be obtained or waived under 45 CFR 46.116(d) because the samples are identifiable to the recipient investigator.

HIPAA Issues. Assuming the hospital is a HIPAA covered entity, the use or disclosure of patient identifiers for the research purpose would also require a HIPAA authorization from the patient or an IRB or Privacy Board waiver of the authorization requirement.

FDA Issues. If the tissues are used to test an FDA regulated IVD, then IRB review is required and informed consent of the subjects for the secondary use must be obtained unless the subjects provided consent addressing the elements required under 21 CFR 50.25 at the time of tissue collection which would adequately address the secondary use activities.

FAQ #2

Tissue biopsies were obtained for clinical diagnostic purposes, which have now been satisfied. The hospital pathology department is willing to provide a portion of the remaining biopsy specimens to an investigator who will perform research assays. The specimens will be coded such that the investigator will not be able to readily ascertain the identity of individuals.

Is consent of the patient from whom the biopsy was taken (or waiver of consent) required for the secondary research use?

Response– HHS Common Rule Issues. No. Under this scenario, neither consent nor waiver is required, because the activity is not considered to be research involving human subjects.

HIPAA Issues. If the information associated with the specimen is de-identified in accordance with the HIPAA Privacy Rule, neither authorization nor an IRB or Privacy

Board waiver of the authorization is required, because de-identified information is not considered to be protected health information.

Note, however, that information associated with the specimen that is not individually identifiable per OHRP guidance (i.e., coded) may not necessarily be de-identified for HIPAA Privacy Rule purposes. For example, the coded information may not be considered to be de-identified under the Privacy Rule if the code is derived from a patient identifier or certain data elements, such as dates of service or zip codes, remain with the information. Thus, the use or disclosure of the information for research may still require a form of HIPAA permission, such as a HIPAA authorization, IRB or Privacy Board waiver of authorization, or, if the information constitutes a “limited data set,” a data use agreement with the recipient of the information.

FDA Issues. If the tissues are used to test an FDA regulated IVD, then IRB review is required. It may not be necessary to obtain informed consent of the subjects for the secondary use if the seven conditions are met in the FDA “Guidance on Informed Consent for In Vitro Diagnostic Device Studies Using Leftover Human Specimens that are Not Individually Identifiable.”

FAQ #3

Blood samples were obtained for research purposes, with informed consent of the subjects, and the original study has been completed. The samples remain under the control of the original investigator. Another investigator wants to use a portion of the remaining samples to perform research completely unrelated to the original study.

If the original consent stated that “…your sample will only be used for research on colon cancer,” but the secondary user is interested in studying Alzheimer’s disease, can the samples still be used if provided to the secondary user in a coded fashion?

Response– HHS Common Rule Issues. The secondary use of de-identified or coded samples is not research involving human subjects under 45 CFR 46. In the case where secondary use of tissue samples is not compatible with the original consent for tissues that are de-identified, coded, or anonymized and are not readily identifiable, the samples are no longer subject to human subject regulations. Thus, there is no regulatory violation. Nevertheless, the original investigator and his/her institution have made an agreement with the subjects about use of their specimens, and have an obligation to honor that agreement.

Institutions should establish mechanisms to determine whether secondary uses are compatible with the original informed consent; this could involve consultation with the IRB that approved the original research, or review by some other body designated for these purposes. Coding should not be used as a means to circumvent the original terms of consent. This is ethically problematic, even if the original project is over and the secondary use is no longer considered to be research involving human subjects.

HIPAA Issues. Assuming the original investigator is in a HIPAA covered entity, the disclosure of direct identifiers for the new research purpose would require a study-specific HIPAA authorization from the subject or an IRB or Privacy Board waiver of the authorization requirement. If the research could be performed using only information about the subject that constitutes a limited data set, the original investigator could disclose the limited data set to the researcher after the researcher has signed a data use agreement that complies with the requirements in 45 CFR 164.514(e)(4).

FDA Issues. If tissues are used to test an FDA regulated IVD, then IRB review is required. It may not be necessary to obtain informed consent of the subjects for the secondary use if the seven conditions are met in the FDA “Guidance on Informed Consent for In Vitro Diagnostic Device Studies Using Leftover Human Specimens that are Not Individually Identifiable.” However, FDA agrees with the considerations described above regarding the ethical obligation to the subjects.

FAQ #4

It is increasingly common to collect and store specimens for future unspecified research. How broad can this consent be without requiring investigators to obtain additional consent for specific uses? Alternatively, how specific must this consent be to allow for future use of biospecimens?

Response– HHS Common Rule Issues. There is a tension between the desire to be as specific as possible when informing subjects of what will be done, and the reality that specifics of future research are, by definition, not known at the time of consent.

Many institutions and IRBs have found it prudent to include some general language in the consent form sufficient to give subjects a reasonable idea of the types of research that might be conducted in the future and the associated risks, but without placing unreasonable restrictions on what the research might be. Thus, subjects can be informed that future studies may involve genetic research, drug development, or searching for links between genes and environmental factors like diet or lifestyle, or between genes and diseases. While examples might be given of specific diseases (e.g., cancer, diabetes, heart disease), being overly specific or restrictive in this regard may result in problems later, when investigators propose other uses. IRBs and investigators should consider the downstream implications before promising subjects that “your specimens will only be used for research on XYZ.”

Future uses of identifiable specimens should be reviewed by the IRB, which should determine whether the research is compatible with original terms of consent, whether additional consent may be required, or whether consent may be waived.

Alternatively, the creation of a repository with an oversight committee and “honest broker” mechanisms that distribute specimens to investigators in coded fashion can remove subsequent uses from IRB review, to the extent they no longer constitute human subjects research. In these cases, special attention should be given upfront to ensure that

the repository (which is human subjects research and does require IRB approval) is established with policies and procedures to effectively manage subsequent uses in keeping with what the IRB approved.

HIPAA Issues. This scenario raises a number of HIPAA-related issues for institutions that are covered entities under the HIPAA Privacy Rule.

While consent under 45 CFR 46 can be broader than a specific research study, an authorization under the HIPAA Privacy Rule must be study-specific. How specific must that authorization be? How can health information associated with specimens be used and disclosed from a research repository when specific research uses are unknown at the time the information is collected?

There are two separate activities to consider when a HIPAA covered entity is collecting and storing identifiable health information in a research repository for future unspecified research:

(A) A covered entity’s use or disclosure of protected health information (PHI) to create the repository; and

(B) The release of PHI from the repository for a future research purpose.

There are a number of ways health information can move into and out of a research repository, including those established for future unspecified research. In this scenario, it is assumed that the repository will contain PHI and that authorization will be obtained to disclose PHI to the repository. With reference to the two separate activities in this scenario:

(A) An authorization for research use and disclosure of PHI under the HIPAA Privacy Rule must be study-specific. However, the authorization may state that the purpose of the authorization is to create a research repository or database.

(B) Health information can then be subsequently used and disclosed from the research repository in one of several ways:

1. With study-specific authorization

2. With an IRB or Privacy Board waiver of the authorization requirement

3. Preparatory to research (with certain representations)

4. Use of a HIPAA De-identified Dataset*

5. Use of a Limited Data Set (with data use agreement)

6. Research solely on decedents (with certain representations)

FDA Issues. If the tissues are used to test an FDA regulated IVD, then IRB review is required. If the tissues are identifiable, then subjects must provide consent for the secondary use and that consent must cover the elements of consent in 21 CFR 50.25. If the original consent met the requirements of 21 CFR 50.25, then that consent would be sufficient to meet FDA requirements. If the original consent did not meet those requirements, then the subjects must provide consent specifically for the use to test the IVD. Finally, it may not be necessary to obtain informed consent of the subjects for the secondary use if the seven conditions are met in the FDA “Guidance on Informed

Consent for In Vitro Diagnostic Device Studies Using Leftover Human Specimens that are Not Individually Identifiable.”

Other than the use of tissues for testing IVDs, FDA has no regulations that apply to the collection of tissues or their storage. It is worth noting that when non-governmental organizations (NGOs) and pharmaceutical sponsors collect and store specimens for future unspecified research, without the involvement of federal funding or a covered entity, it is also often the case that the HHS regulations and HIPAA do not apply.

FAQ #5

When can informed consent be waived for use of previously-collected human specimens and data (e.g., when does such research meet “minimal risk” criteria, what does “practicability” mean with regard to the informed consent waiver criteria)?

Response– HHS Common Rule Issues. The criteria for waiver of consent under 45 CFR 46.116(d) include that the research involves no more than minimal risk; the waiver would not adversely affect the rights and welfare of subjects; the research could not practicably be carried out without the waiver; and whenever appropriate, the subjects will be provided with pertinent information after participation.

Points to consider in applying these criteria include the nature of the research; the protections in place to maintain privacy and confidentiality (e.g., coding, limited/controlled access, honest broker mechanisms); the change in level of risk, if any; the ability to locate or contact subjects; risk of introducing bias into the research; potential anxiety or confusion for subjects; the number of subjects; the length of time since specimens were first collected; and the likelihood that subjects would object to the proposed secondary use, based on the nature of original collection.

HIPAA Issues. The concept of waiver of informed consent is not a HIPAA concept. As set forth in more detail in 45 CFR 164.512(i)(2), the HIPAA authorization requirement can be waived by an IRB or privacy board when (1) the research use or disclosure involves no more than minimal risk to the individual’s privacy; (2) the research could not practicably be conducted without the waiver; and (3) the research could not practicably be conducted without use or disclosure of the protected health information.

FDA Issues. FDA regulations do not include the waiver of consent found at 45 CFR 46.116(d). Therefore, the use of this waiver for FDA regulated studies is not possible. If the tissues are used to test an FDA regulated IVD, then IRB review is required. It may not be necessary to obtain informed consent of the subjects for the secondary use if the seven conditions are met in the FDA “Guidance on Informed Consent for In Vitro Diagnostic Device Studies Using Leftover Human Specimens that are Not Individually Identifiable.” If the tissues are identifiable, then consent addressing the elements under 21 CFR 50.25 is required.

FAQ #6

If the sample is identifiable to the secondary user, is this considered to be human subjects research under the purview of the IRB? If so, what are the consent considerations?

Response– HHS Common Rule Issues. Yes. This is human subjects research under the purview of the IRB. The IRB should consider whether the secondary use is compatible with the original terms of consent given by the subjects.

FDA Issues. If the tissues are used to test an FDA regulated IVD, then IRB review is required. Because the subjects are identifiable to the secondary user, the FDA “Guidance on Informed Consent for In Vitro Diagnostic Device Studies Using Leftover Human Specimens that are Not Individually Identifiable” is not applicable. Consent addressing the elements under 21 CFR 50.25 is required, either at the time of the original collection of the blood samples, or at the time of the use of the specimens for the IVD testing.

FAQ #7

Identifiable blood samples were obtained for research purposes, with informed consent of the subjects, and the original study has been completed. The samples remain under the control of the original investigator, who now wants to collaborate with another investigator to perform research unrelated to the original study.

If the original consent was silent on the question of subsequent uses, is informed consent (or waiver of consent) required before the identifiable sample can be used for other purposes?

Response– HHS Common Rule Issues. Yes. Under these circumstances, the IRB should consider the original terms of consent, and determine whether a waiver might be appropriate or whether additional consent is required.

The criteria for waiver of consent under 45 CFR 46.116(d) include that the research involves no more than minimal risk; the waiver would not adversely affect the rights and welfare of subjects; the research could not practicably be carried out without the waiver; and whenever appropriate, the subjects will be provided with pertinent information after participation.

Points to consider in applying these criteria include the nature of the research; the protections in place to maintain privacy and confidentiality (e.g., coding,

limited/controlled access, honest broker mechanisms); the change in level of risk, if any; the ability to locate or contact subjects; risk of introducing bias into the research ; potential anxiety or confusion for subjects; the number of subjects; the length of time since specimens were first collected; and the likelihood that subjects would object to the proposed secondary use, based on the nature of original collection.

HIPAA Issues. A HIPAA authorization for research must be research-study specific. Thus, assuming a HIPAA covered entity is involved, a new HIPAA authorization would be required for the subsequent unrelated research use or disclosure, or another form of HIPAA permission obtained (e.g., waiver of authorization). If the research could be performed using only information about the subject that constitutes a limited data set, the original investigator could disclose the limited data set to the new investigator after the new investigator has signed a data use agreement that complies with the requirements in 45 CFR 164.514(e)(4).

FAQ #8

Patients undergoing surgery provide informed consent to donate any excess tissue (i.e., beyond that needed for clinical purposes) to a tissue bank. The creation of the bank has been reviewed and approved by the IRB, meaning the IRB has approved the policies and procedures under which the bank will be managed, the control of specimens, and the types of research to be conducted, etc. The consent form makes it clear that the specimens and associated clinical data will be used for research, but does not specify or limit that use.

If the bank employs an “honest broker” mechanism, so that specimens and any associated data are coded so that the recipient investigator cannot readily ascertain the identity before being given to investigators, is this subsequent use considered to be human subjects research under the purview of the IRB?

Response– HHS Common Rule Issues. No, the subsequent research use is not considered to be research involving human subjects and IRB review is not required. However, there should be mechanisms in place to ensure that proposed research uses are compatible with the original consent.

HIPAA Issues. A HIPAA authorization for research must be research-study specific. Thus, assuming a HIPAA covered entity is involved and the information is not considered fully de-identified under the HIPAA Privacy Rule, a new HIPAA authorization would be required for the subsequent unrelated research use or disclosure, or another form of HIPAA permission obtained (e.g., waiver of authorization, data use agreement if use or disclosure of a limited data set).

However, if the information associated with the specimens is de-identified in accordance with the HIPAA Privacy Rule, neither authorization nor waiver of authorization is required, because it would no longer be considered protected health information. The Privacy Rule permits a covered entity to assign to, and retain with, the de-identified health information, a code or other means of record re-identification if that code is not derived from or related to the information about the individual and is not otherwise capable of being translated to identify the individual. For example, an encrypted individual identifier (e.g., a social security number) would not meet the conditions for use as a re-identification code for de-identified health information because it is derived from individually identified information. In addition, the covered entity may not (1) use or disclose the code or other means of record identification for any other purpose, or (2) disclose its method of re-identifying the information.

FDA Issues. If the tissues are used to test an FDA regulated IVD, then IRB review is required. It may not be necessary to obtain informed consent of the subjects for the secondary use if the seven conditions are met in the FDA “Guidance on Informed Consent for In Vitro Diagnostic Device Studies Using Leftover Human Specimens that are Not Individually Identifiable.” If the seven conditions are not met, then consent addressing the elements under 21 CFR 50.25 is required.

FAQ #9

Patients undergoing surgery provide informed consent to donate any excess tissue (i.e., beyond that needed for clinical purposes) to a tissue bank. The creation of the bank is reviewed as human subjects research and approved by the IRB. The consent form makes it clear that the specimens and associated clinical data will be used for research, but does not specify or limit that use.

If specimens are provided to the researchers with clinical information that allows the researcher to readily ascertain the identity of the subjects, do those researchers need separate IRB approval of the proposed research use of the specimens and data?

Response– HHS Common Rule Issues. Yes, the provision of identifiable information with the specimen means the research to be conducted with the specimen is a separate human subjects research protocol and separate IRB approval would be required.

FDA Issues. If the tissues are used to test an FDA regulated IVD, then separate IRB review is required.

FAQ #10

Patients undergoing surgery provide informed consent to donate any excess tissue (i.e., beyond that needed for clinical purposes) to a tissue bank. The creation of the bank is reviewed and approved by the IRB. The consent form makes it clear that the specimens and associated clinical data will be used for research, but does not specify or limit that use.

If specimens are provided to the researchers with clinical information that allows the researcher to readily ascertain the identity of the subjects, is a new consent from the patient/subject [or IRB waiver of informed consent] required?

Response– HHS Common Rule Issues. Yes, a new consent from the subjects is required unless the IRB determines that the original consent was adequate to allow the subsequent research use, or the IRB determines a waiver is appropriate.

Points to consider in applying these criteria include the nature of the research; the protections in place to maintain privacy and confidentiality (e.g., coding, limited/controlled access, honest broker mechanisms); the change in level of risk, if any; the ability to locate or contact subjects; risk of introducing bias into the research ; potential anxiety or confusion for subjects; the number of subjects; the length of time since specimens were first collected; and the likelihood that subjects would object to the proposed secondary use, based on the nature of original collection.

HIPAA Issues. A covered entity's use or disclosure of protected health information to create a research database or repository, and use or disclosure of protected health information from the database or repository for a future research purpose, are each considered a separate research activity under the Privacy Rule. A HIPAA authorization for research must be research-study specific. Thus, assuming a HIPAA covered entity is involved, a new HIPAA authorization would be required for a future research use or disclosure of protected health information from the repository, or another form of HIPAA permission would need to apply or be obtained (e.g., waiver of authorization). If the research could be performed using only information about the subject that constitutes a limited data set, the tissue bank could use, or could disclose to the researcher, the limited data set after the researcher and the tissue bank have signed a data use agreement that complies with the requirements in 45 CFR 164.514(e)(4)

FDA Issues. If the tissues are used to test an FDA regulated IVD, then IRB review is required. Consent addressing the elements under 21 CFR 50.25 is required. If the original consent met the requirements of 21 CFR 50.25, that would be sufficient. If not, subjects must provide consent prior to the use of the tissues to test the IVD.

FAQ #11

An academic medical center has established a centralized tissue bank of specimens that it receives from a variety of sources. The bank was reviewed as human subjects research and has IRB-approved policies and procedures in place. These policies and procedures stipulate that the bank will release only coded specimens to researchers, without identifiers.

The institution now plans to begin moving newly obtained excess clinical specimens to the bank in a prospective, ongoing manner, after their original purpose has been served. The specimens would be identifiable going into the bank, in order to facilitate linkage back to clinical data. Is this permissible if there was no consent for research obtained from the patients?

Response– HHS Common Rule Issues. Generally no. Because the excess clinical specimens are identifiable, this is human subjects research and consent would be required. In rare circumstances, the IRB may determine that the conditions for a waiver of consent under 45 CFR 46.116(d) have been met.

Points to consider include governance and oversight of the bank; protections in place to maintain privacy and confidentiality (e.g. coding, limited/controlled access, honest broker mechanisms, de-identification processes, limited data use agreements); policies regarding access to specimens; the nature of the research for which the specimens may be used; the ability to locate or contact subjects; risk of introducing bias into the collection; potential anxiety or confusion for subjects; the number of subjects; the length of time since specimens were first collected; and the likelihood that subjects would object to the research use of their specimens.

HIPAA Issues. A covered entity's use or disclosure of protected health information to create a research database or repository is considered a separate research activity under the HIPAA Privacy Rule. Assuming the academic medical center is a HIPAA covered entity, the disclosure or use of direct identifiers for the purpose of creating the database would require a HIPAA authorization from the subject or an IRB or Privacy Board waiver of the authorization requirement. If the specimens could be included in the database using only information about the subject that constitutes a limited data set, the specimens could be included in the database after the academic medical center and the database have signed a data use agreement that complies with the requirements in 45 CFR 164.514(e)(4).

FDA Issues. FDA regulations do not cover the specimen banking. However, if the tissues are used to test an FDA regulated IVD, then IRB review is required. It may not be necessary to obtain informed consent of the subjects for the secondary use if the seven conditions are met in the FDA “Guidance on Informed Consent for In Vitro Diagnostic Device Studies Using Leftover Human Specimens that are Not Individually Identifiable.” If the seven conditions are not met, then consent addressing the elements under 21 CFR 50.25 is required.

FAQ #12

A research participant provides informed consent and an authorization to allow extra blood and associated PHI to be stored for future research purposes. Blood samples will be stored in a repository with identifiers. The participant later changes his/her mind. Is this allowed, once tissue has been stored?

Response– HHS Common Rule Issues. Yes. Subjects have the right to withdraw from research, and this extends to withdrawing their specimens from future research. Subjects should be informed upfront about the procedures for withdrawing specimens from a repository. The obligation to honor subjects’ requests to withdraw does not extend to retrieving specimens already distributed to secondary users. Analyses already completed will generally not be destroyed or removed from datasets. These practical limitations to withdrawal should be disclosed to subjects as part of the consent process.

HIPAA Issues. With respect to HIPAA authorizations, the HIPAA Privacy Rule provides an individual with the right to revoke an authorization in writing, except to the extent the covered entity has already acted in reliance on the authorization. For example, a covered entity is not required to retrieve information that it disclosed from its repository to a researcher under a valid authorization before receiving the revocation. Thus, if a covered entity obtained an individual’s authorization to disclose identifiable health information from its repository to a researcher, then the covered entity is not required to seek the return of the information from the researcher. Further, the reliance exception would permit the continued use or disclosure of PHI by a covered entity already obtained pursuant to the authorization to the extent necessary to protect the integrity of the research (e.g., to account for the subject’s withdrawal from a research repository).

FDA Issues. The FDA regulations do not cover the specimen banking. If the tissues were used in an FDA regulated clinical investigation to test an IVD, then the subjects have the right to withdraw from research, and no future use of the specimens can be made. Please refer to the FDA guidance “Data Retention When Subjects Withdraw from FDA-Regulated Clinical Trials” for information on the withdrawal of data.

FAQ #13

A research subject provides informed consent to allow extra blood to be stored with identifiers for future research purposes. The individual later changes his/her mind and requests that the specimen be destroyed. The lead investigator who manages the repository proposes to the IRB that, rather than losing valuable specimens, all identifiers and coding be permanently removed, so that it would be impossible for anyone ever to link to this subject’s identity; doing so would mean that any subsequent uses are not human subjects research, per OHRP guidance.

Is this an acceptable approach?

Response– HHS Common Rule Issues. While it is true that permanently stripping a specimen of all identifiers or codes would mean that subsequent uses are not considered to be human subjects research, doing this after the fact would not be acceptable, if done solely to avoid withdrawing specimens on request. If the specimen is identifiable at the time of the request, failing to follow through when it is possible to do so would violate the ethical principle of respect for persons, and possibly the terms of original consent.

HIPAA Issues. Assuming the removal of identifiers and coding is sufficient to deidentify the PHI associated with the specimen in compliance with 45 CFR 164.514(b), the HIPAA Privacy Rule no longer governs the use or disclosure of the remaining information..

FDA Issues. FDA regulations do not cover specimen banking.

FAQ #14

An investigator collected specimens from a large number of cancer patients and stored them with identifiers. Some of the patient-subjects are now deceased.

Is research using the specimens of those subjects who died still considered to be human subjects research, and under the oversight of an IRB?

Response– HHS Common Rule Issues. No. 45 CFR 46.102 defines a human subject as a “living individual.” However, deceased individuals would still have protections under the HIPAA Privacy Rule.

HIPAA Issues. The Privacy Rule generally protects the Protected Health Information of decedents in the same manner as that of living individuals. However, in the research context, the Privacy Rule allows the use or disclosure of decedent information without the authorization of a personal representative and without waiver of authorization by an IRB or Privacy Board if the covered entity receives representations from the researcher that the decedents’ protected health information is necessary for the research and is being sought solely for research on decedents (and not related living individuals) and, upon request of the covered entity, receives documentation of the deaths of the individuals.

FDA Issues. No. Under FDA's regulations, "human subject" means "an individual who is or becomes a participant in research, either as a recipient of the test article or as a control. A subject may be either a healthy human or a patient." (See 21 CFR 50.3(g); similar language is found at 21 CFR 312.3 and 812.3(p).) FDA has interpreted its regulations as applicable only to research involving living human subjects. Since the individuals referenced are deceased, research involving those tissues does not meet FDA’s definition of a clinical investigation involving human subjects. See FAQ # 114 in the FDA guidance document “Exception from Informed Consent Requirements for Emergency Research.”

FAQ #15

An investigator who collected and stored identifiable specimens accepts an offer at another institution, and plans to move the specimens with or without identifiers to the new institution.

What are the issues that the IRB and/or institution should consider, when faced with this situation?

Response– HHS Common Rule Issues. In most cases, specimens collected at an institution, in the course of research or medical practice at the institution, will belong to the institution, not to the investigator. These issues are an institutional responsibility, and involve multiple components across the institution, including legal counsel, sponsored or grant programs administration, the technology transfer office, and the IRB, as appropriate. The first determination is whether, and if so, how the institution will release the specimens to the new institution. The IRB’s role could include determination as to whether the transfer and use of specimens at the new institution is compatible with the consent under which the specimens were collected, whether additional consent may be required, or whether there are concerns relating to the communities or populations represented by the specimens.

Beyond these IRB-related considerations, other institutional policies will need to be considered. Formal agreements should be established that govern the transfer of specimens from the institution that provides the specimens to the investigator and/or the new receiving institution. These agreements should specify as appropriate the rights and obligations of both the provider and the recipient, including intellectual property terms and publication rights, as well as the rights of subjects (e.g., whether subjects would have the ability to withdraw specimens once they pass to the new institution).

Similar considerations at the receiving institution would apply, including the need for IRB review of proposals for ongoing use of identifiable specimens. If specimens are transferred without identifiers, subsequent uses would not be considered to be research involving human subjects under 45 CFR 46.

HIPAA Issues. If the institution is a HIPAA covered entity and the specimens are to be transferred along with information that constitutes protected health information, then the institution needs to consider whether the transfer of information from it to another entity was encompassed in the original HIPAA authorization or in any IRB or Privacy Board waiver of the authorization requirement that the institution may have obtained. If the specimens could be transferred along with only information about the subject that constitutes a limited data set, the specimens could be transferred after the transferring institution and the receiving institution have signed a data use agreement that complies with the requirements in 45 CFR 164.514(e)(4). If the specimens could be transferred after having been de-identified in a manner that complies with 45 CFR 164.514(b), the HIPAA Privacy Rule would not govern the transfer.

FDA issues. If the specimens are being or have been used in FDA regulated clinical investigations of IVDs, then FDA and the sponsor have to be notified if there is a change in ownership or location.

FAQ #16

A clinical trial is funded by an industry sponsor or other entity and the contract provides for specimens to be transferred to the sponsor or other entity.

What factors should be considered in such an arrangement?

Response– HHS Common Rule and HIPAA Issues. This arrangement requires coordination of the provisions of the protocol, informed consent form, HIPAA authorization, and clinical trial or other sponsorship agreement. The protocol should describe the specific specimens and data to be transferred to the sponsor, and this transfer of identified specimens should be disclosed to the research subject in the informed consent form, at least in general terms. (Presumably, the disclosure to the sponsor of the identifiable data that are to accompany those specimens has been permitted by the study’s HIPAA authorization, which may or may not have been combined with the informed consent.) The best informed consent practice in such an arrangement is to inform the research subject whether there are “downstream” restrictions on the recipient of the specimens for their future use. In situations in which there are no contractual provisions that limit the recipient sponsor’s downstream uses of the specimens, the subjects therefore should be informed of this, in the same manner that they are informed that once personal data have been disclosed to a sponsor that is not a HIPAA covered entity, there is essentially no HIPAA-imposed limit on the sponsor’s future uses of those data. If a research site or researcher seeks to limit downstream uses by a recipient sponsor of specimens or data, then this can usually be accomplished by seeking to negotiate, in the clinical trial or other sponsorship agreement, specific limits on future uses by the sponsor of the transferred specimens and data.

FAQ #17

The protocol for a clinical trial stipulates that all samples should be destroyed after the study is completed. The consent form is silent on the disposition of samples after the study.

What should be done if there are 10,000 identifiable specimens and new scientific data emerges in the field that warrants further testing on the samples?

Response– HHS Common Rule Issues. The investigator could amend the protocol, describing the circumstances and seeking IRB approval to retain the specimens for additional research. The IRB should consider if this additional research is compatible with the original terms under which samples were obtained, and whether a waiver of informed consent, or new consent, may be appropriate.

HIPAA Issues. The HIPAA Privacy Rule would govern protected health information accompanying the specimens, not the specimens themselves. Assuming the investigator is in a HIPAA covered entity, the disclosure or use of direct identifiers for additional research would also require a HIPAA authorization from the subject or an IRB or Privacy Board waiver of the authorization requirement. If the additional research could be performed using only information about the subject that constitutes a limited data set, the

investigator could use and disclose the limited data set for the additional research in compliance with the terms of a data use agreement that complies with the requirements in 45 CFR 164.514(e)(4). If the additional research could be accomplished after the specimens have been de-identified in a manner that complies with 45 CFR 164.514(b), the HIPAA Privacy Rule would not govern the additional research.

FAQ #18

A tissue biopsy was obtained for clinical diagnostic purposes, which have now been satisfied. The hospital pathology department is willing to provide a portion of the remaining biopsy specimen to an investigator, who will perform research assays with no clinical relevance. If the specimen is coded and identifying information is removed so that the identity of the patient cannot be readily ascertained by the investigator before it is provided to them (so that it is de-identified for the purposes of HIPAA), is the investigator conducting human subjects research under the purview of an IRB?

Response– HHS Common Rule Issues. No, this is not research involving human subjects, because the recipient investigator will not be able to readily ascertain the identity of patients from whom specimens were obtained.

FAQ #19

A tissue biopsy was obtained for clinical diagnostic purposes, which have now been satisfied. The hospital pathology department is willing to send a portion of the remaining biopsy specimen to an investigator, who will perform research assays. If the specimen will be provided to the researcher in an identifiable manner, is this considered to be human subjects research under the purview of an IRB?

Response– HHS Common Rule Issues. Yes, this is human subjects research. Because investigators will receive a specimen with identifiable information, the research is non-exempt human subjects research that is nevertheless potentially eligible for expedited review.

FDA Issues. If the tissues are used to test an FDA regulated IVD, then this is a clinical investigations for which IRB review is required and consent addressing the elements under 21 CFR 50.25 is required.

FAQ #20

identifiable specimens to be used for research purposes, without any additional consent or waiver?

Response– HHS Common Rule Issues. No, an additional consent or waiver is required. If the information provided to prospective subjects were limited to the above statement, this would not be sufficient to meet the requirements of informed consent for research under 45 CFR 46. However, the IRB should review each protocol that proposes to use such specimens and, as part of that review, consider whether the criteria for a waiver of informed consent have been met at 45 CFR 46.116(d).

HIPAA Issues. This approach (single sentence on the hospital admission form) would also not be sufficient for HIPAA authorization purposes. In order to comply with the HIPAA Privacy Rule, an authorization must meet the requirements of 45 CFR 164.508(c).

FDA Issues. If the tissues are used to test an FDA regulated IVD, then IRB review is required and consent addressing the elements under 21 CFR 50.25 is required. The single sentence on the admission form would not meet this requirement.

FAQ #21

Many hospitals have a sentence on the standard admission form to the effect that “This is a teaching and research institution, and any specimens remaining after your care is complete may be used for teaching or research purposes.” Is this sufficient to allow identifiable specimens to be placed into a tissue bank, if they are coded and released to researchers through an honest broker mechanism?

Response– HHS Common Rule Issues. The plan to remove identifiers from the specimens and manage them through a bank might be factors the IRB considers when assessing the risks to subjects, but it doesn’t change the fundamental answer above (FAQ #20). The creation of a bank containing identifiable specimens would be considered human subjects research and thus, subject to IRB review and informed consent. As above, the statement on the admission form would not be considered sufficient to meet the requirements of informed consent under 45 CFR 46. However, the IRB could consider whether the criteria for waiving or altering informed consent have been met at 45 CFR 46.116(d). The subsequent research use of specimens would not be considered human subjects research if the conditions of the OHRP guidance on coded private information or biological specimens have been met.

FDA Issues. FDA regulations do not apply to specimen banking. However, if the tissues are used to test an FDA regulated IVD, then IRB review is required. It may not be necessary to obtain informed consent of the subjects for the secondary use if the seven conditions are met in the FDA “Guidance on Informed Consent for In Vitro Diagnostic Device Studies Using Leftover Human Specimens that are Not Individually Identifiable.” If the seven conditions are not met, then consent addressing the elements under 21 CFR 50.25 is required. The single sentence on the admission form would not meet this requirement.

FAQ #22

A 13-year-old child is enrolled by his/her parents in a tissue banking protocol that involves storage of specimens for future research. Is the child’s assent required at the time of the original enrollment in the repository, in addition to parental permission?

Response– HHS Common Rule Issues. Yes, if the IRB determines that the children are capable of providing assent, taking into account the ages, maturity and psychological state of the subjects [45 CFR 46.408(a) and 46.116]. Given that most projects that store tissues for future unspecified research are not likely to hold out a prospect of direct benefit that is important to the health or well-being of the children and is available only in the context of the research, it is anticipated that affirmative agreement on the part of the child would generally be required.

HIPAA Issues. The HIPAA Privacy Rule does not require assent.

FDA Issues. Tissue banking in and of itself does not constitute an FDA regulated clinical investigation, and the FDA regulations would not apply.

FAQ #23

A child is enrolled by his/her parents in a tissue banking protocol that involves storage of specimens for future research. Should there be a process in place for the child to give consent for continued storage and use of specimens when he/she reaches the age of majority?

Response– HHS Common Rule Issues. In and of itself, the retention of specimens in a biobank is not considered to be research involving human subjects. However, ongoing use of such specimens (e.g., continued analysis of specimens or data for which the subject’s identity is readily identifiable to the investigator(s)), or ongoing collection of identifiable information, is human subjects research. In these cases, it would be necessary for the investigator(s) to seek and obtain the legally effective informed consent of the now-adult subjects.

The IRB may consider, if appropriate, a waiver under 45 CFR 46.116(d) of the requirements for obtaining informed consent in order for the subjects to continue their participation in the research. Such a waiver may be considered at the time of initial review or during a subsequent amendment. Factors that may make it impracticable to conduct the research, and therefore would support a waiver, include the number of subjects, length of time since first enrolled, and ability to locate subjects (see also FAQ #5).

HIPAA Issues. A valid HIPAA authorization signed by a parent, as the personal representative of a minor child at the time the authorization is signed, remains valid until it expires or is revoked, even if such time extends beyond the child’s age of majority. However, if the authorization expires on the date the minor reaches the age of majority, a new authorization would be required at that time for continued use or disclosure of

protected health information Absent obtaining a new authorization, a covered entity may only continue to use and disclose for research purposes if 1) an IRB or privacy board has waived the requirement for an authorization, or 2) if the use or disclosure is of a limited data set after the signing of a data use agreement that complies with the requirements in 45 CFR 164.514(e)(4), or if 3) information has been de-identified in a manner that complies with 45 CFR 164.514(b) so that the HIPAA Privacy Rule would not govern.

FDA Issues. Tissue banking in and of itself does not constitute an FDA regulated clinical investigation, and the FDA regulations would not apply.

FAQ # 24

What issues should be addressed in the consent process with regard to sponsorship, ownership, control, access, commercialization and possession of stored specimens?

Response– HHS Common Rule Issues. Consent documents for such projects should disclose sponsorship and address issues including (but not limited to) disposition of samples, who will have access, how samples will be used, and the potential for commercialization, if any. Subjects should be informed to what extent, if any, they can expect to control or receive compensation from future commercial uses.

Some of these matters are subject to state laws, and consent documents should reflect that.

As with any part of the consent form, care should be taken to communicate these complicated issues in simple terms understandable to the subject

Attachment D: FAQ's Terms and Recommendations on Informed Consent and Research Use of Biospecimens

Related Letters