Attachment C - Updated FAQs on Informed Consent for Use of Biospecimens and Data

Content approved and updated by SACHRP July and October 2009, March, July and October 2010,

July 2011, March 2018

FAQs, Recommendations, and Glossary:

Informed Consent and Research Use of Biospecimens and Associated Data

Table of Contents

Preface

I. Glossary and concepts

1. CODED means:

2. HONEST BROKER means:

3. LIMITED DATA SET:

4. When is research with specimens not Human Subjects Research?

5. How are studies with specimens addressed under the FDA regulations?

II. Related SACHRP Recommendations

6. Recommendation on Compatibility of Secondary Use with Consent.

7. Recommendation on the Definition of “Investigator.”

III. Frequently Asked Questions (FAQs)

FAQ #1:

Tissue biopsies were obtained for clinical diagnostic purposes, which have now been satisfied. The patients did not provide study specific informed consent for the research use of the tissue specimens. The hospital pathology department is willing to provide a portion of the remaining biopsy specimens to an investigator who will perform research assays. In order to allow matching with relevant clinical information, the specimens will be provided with identifiers such that the investigator can readily ascertain the identity of subjects.

Is consent of the patient from whom the biopsy was taken (or waiver of consent) required for the secondary research use?

FAQ #2:

Tissue biopsies were obtained for clinical diagnostic purposes, which have now been satisfied. The hospital pathology department is willing to provide a portion of the remaining biopsy specimens to an investigator who will perform research assays. The specimens will be coded such that the investigator will not be able to readily ascertain the identity of individuals.

Is consent of the patient from whom the biopsy was taken (or waiver of consent) required for the secondary research use?

FAQ #3:

Blood samples were obtained for research purposes, with informed consent of the subjects, and the original study has been completed. The samples remain under the control of the original investigator. Another investigator wants to use a portion of the remaining samples to perform research completely unrelated to the original study.

If the original consent stated that “…your sample will only be used for research on colon cancer,” but the secondary user is interested in studying Alzheimer’s disease, can the samples still be used if provided to the secondary user in a coded fashion?

FAQ #4:

It is increasingly common to collect and store specimens for future unspecified research. How broad can this consent be without requiring investigators to obtain additional consent for specific uses? Alternatively, how specific must this consent be to allow for future use of biospecimens?

FAQ #5:

It is increasingly common, as part of a primary research study, to collect and store identifiable biospecimens and identifiable data for future unspecified research. What are the options for review of studies involving use of these retained biospecimens and data, and what are the implications of the consent form for the primary study in determining options for this review?

FAQ #6:

When can informed consent be waived for use of previously-collected human biospecimens and data (e.g., when does such research meet “minimal risk” criteria, what does “practicability” mean with regard to the informed consent waiver criteria)?

FAQ #7:

If the sample is identifiable to the secondary user, is this considered to be human subjects research under the purview of the IRB? If so, what are the consent considerations?

FAQ #8:

Identifiable blood samples were obtained for research purposes, with informed consent of the subjects, and the original study has been completed. The samples remain under the control of the original investigator, who now wants to collaborate with another investigator to perform research unrelated to the original study.

If the original consent was silent on the question of subsequent uses, is informed consent (or waiver of consent) required before the identifiable sample can be used for other purposes?

FAQ #9:

Patients undergoing surgery provide informed consent to donate any excess tissue (i.e., beyond that needed for clinical purposes) to a tissue bank. The creation of the bank has been reviewed and approved by the IRB, meaning the IRB has approved the policies and procedures under which the bank will be managed, the control of specimens, and the types of research to be conducted, etc. The consent form makes it clear that the specimens and associated clinical data will be used for research, but does not specify or limit that use.

If the bank employs an “honest broker” mechanism, so that specimens and any associated data are coded so that the recipient investigator cannot readily ascertain the identity before being given to investigators, is this subsequent use considered to be human subjects research under the purview of the IRB?

FAQ #10:

Patients undergoing surgery provide informed consent to donate any excess tissue (i.e., beyond that needed for clinical purposes) to a tissue bank. The creation of the bank is reviewed as human subjects research and approved by the IRB. The consent form makes it clear that the specimens and associated clinical data will be used for research, but does not specify or limit that use.

If specimens are provided to the researchers with clinical information that allows the researcher to readily ascertain the identity of the subjects, do those researchers need separate IRB approval of the proposed research use of the specimens and data?

FAQ #11:

Patients undergoing surgery provide informed consent to donate any excess tissue (i.e., beyond that needed for clinical purposes) to a tissue bank. The creation of the bank is reviewed and approved by the IRB. The consent form makes it clear that the specimens and associated clinical data will be used for research, but does not specify or limit that use.

If specimens are provided to the researchers with clinical information that allows the researcher to readily ascertain the identity of the subjects, is a new consent from the patient/subject [or IRB waiver of informed consent] required?

FAQ #12:

An academic medical center has established a centralized tissue bank of specimens that it receives from a variety of sources. The bank was reviewed as human subjects research and has IRB-approved policies and procedures in place. These policies and procedures stipulate that the bank will release only coded specimens to researchers, without identifiers.

The institution now plans to begin moving newly obtained excess clinical specimens to the bank in a prospective, ongoing manner, after their original purpose has been served. The specimens would be identifiable going into the bank, in order to facilitate linkage back to clinical data. Is this permissible if there was no consent for research obtained from the patients?

FAQ #13:

A research participant provides informed consent and an authorization to allow extra blood and associated PHI to be stored for future research purposes. Blood samples will be stored in a repository with identifiers. The participant later changes his/her mind. Is this allowed, once tissue has been stored?

FAQ #14:

A research subject provides informed consent to allow extra blood to be stored with identifiers for future research purposes. The individual later changes his/her mind and requests that the specimen be withdrawn from the biorepository. The lead investigator who manages the repository proposes to the IRB that, rather than losing valuable specimens, all identifiers and coding be permanently removed, so that it would be impossible for anyone ever to link to this subject’s identity; doing so would mean that any subsequent uses are not human subjects research, per OHRP guidance.

Is this an acceptable approach?

FAQ #15:

An investigator collected specimens from a large number of cancer patients and stored them with identifiers. Some of the patient-subjects are now deceased.

Is research using the specimens of those subjects who died still considered to be human subjects research, and under the oversight of an IRB?

FAQ #16:

An investigator who collected and stored identifiable specimens accepts an offer at another institution, and plans to move the specimens with or without identifiers to the new institution.

What are the issues that the IRB and/or institution should consider, when faced with this situation?

FAQ #17:

A clinical trial is funded by an industry sponsor or other entity and the contract provides for specimens to be transferred to the sponsor or other entity.

What factors should be considered in such an arrangement?

FAQ #18:

The protocol for a clinical trial stipulates that all samples should be destroyed after the study is completed. The consent form is silent on the disposition of samples after the study.

What should be done if there are 10,000 identifiable specimens and new scientific data emerge in the field that warrant further testing on the samples?

FAQ #19:

A tissue biopsy was obtained for clinical diagnostic purposes, which have now been satisfied. The hospital pathology department is willing to provide a portion of the remaining biopsy specimen to an investigator, who will perform research assays with no clinical relevance. If the specimen is coded and identifying information is removed so that the identity of the patient cannot be readily ascertained by the investigator before it is provided to them (so that it is de-identified for the purposes of HIPAA), is the investigator conducting human subjects research under the purview of an IRB?

FAQ #20:

A tissue biopsy was obtained for clinical diagnostic purposes, which have now been satisfied. The hospital pathology department is willing to send a portion of the remaining biopsy specimen to an investigator, who will perform research assays. If the specimen will be provided to the researcher in an identifiable manner, is this considered to be human subjects research under the purview of an IRB?

FAQ #21:

Many hospitals have a sentence on the standard admission form to the effect that “This is a teaching and research institution, and any specimens remaining after your care is complete may be used for teaching or research purposes.” Is this sufficient to allow identifiable specimens to be used for research purposes, without any additional consent or waiver?

FAQ #22:

Many hospitals have a sentence on the standard admission form to the effect that “This is a teaching and research institution, and any specimens remaining after your care is complete may be used for teaching or research purposes.” Is this sufficient to allow identifiable specimens to be placed into a tissue bank, if they are coded and released to researchers through an honest broker mechanism?

FAQ #23:

A 13-year-old child is enrolled by his/her parents in a tissue banking protocol that involves storage of specimens for future research. Is the child’s assent required at the time of the original enrollment in the repository, in addition to parental permission?

FAQ #24:

A child is enrolled by his/her parents in a tissue banking protocol that involves storage of specimens for future research. Should there be a process in place for the child to give consent for continued storage and use of specimens when he/she reaches the age of majority?

FAQ #25:

What issues should be addressed in the consent process with regard to sponsorship, ownership, control, access, commercialization and possession of stored specimens?

Preface

The collection and use of human specimens have become essential to biomedical research. These biospecimens include blood and other tissues, some collected originally for clinical lab tests, some removed during surgeries, and some obtained specifically for research. While there is no accurate catalog of the number or locations of specimens, there are reasonable estimates that billions of specimens are now stored in laboratories, repositories and “tissue banks” across the country. Coupled with associated clinical data and the power of bioinformatics, these specimens represent an invaluable resource for current and future research on human health and disease.

At the same time, there are significant ethical, legal and social policy implications relating to the collection, storage and use of biospecimens. Institutions, investigators, institutional review boards (IRBs), funding agencies and the public are struggling with issues like informed consent, ownership, stewardship, genetic testing, and future uses that are often unspecified at the time specimens are first obtained. The ethical tensions that frequently exist between the needs of society to advance knowledge through scientific inquiry and the rights of individuals are present in research involving specimens, and there is much inconsistency and uncertainty as to how they should be used responsibly. The research community would benefit from federal-level guidance.

The HHS Secretary's Advisory Committee on Human Research Protections (SACHRP) has considered a number of unanswered questions relating to informed consent and research use of biospecimens. Upon request by SACHRP, the Subpart A Subcommittee of SACHRP deliberated on these issues and presented their recommendations to SACHRP for further discussion and approval, over the course of several meetings in 2009 and 2010. The finalized recommendations take the form of a series of "Frequently Asked Questions" (FAQs), each presented as a commonly encountered scenario and a suggested response that addresses regulatory and ethical issues. The goal was to provide a framework for IRBs, institutions and investigators to consider individual research scenarios without prescribing the final outcome, recognizing that those decisions will always be case-specific.

In 2018, SACHRP revised the FAQs to account for the changes to the Common Rule that were finalized on January 19, 2017. These FAQs therefore reflect the revised Common Rule, and the content of this version of these FAQs should be used, in regard to Common Rule issues, only after the effective date of all Common Rule revisions. The previous FAQs applicable for studies approved and continuing under the previous Common Rule are available at https://www.hhs.gov/ohrp/sachrp-committee/recommendations/2011-october-13-letter-attachment-d/index.html.

In addition, in 2018, SACHRP has revised the document to account for earlier changes in HHS’s interpretation of the HIPAA Privacy Rule’s requirements for HIPAA authorizations that were announced in the 2013 HIPAA Omnibus. These changes removed the requirement that a HIPAA authorization be research study specific and instead permit a researcher to obtain an authorization to use and disclose protected health information (“PHI”) for future research provided that the future research is described in such a manner that it would be reasonable for the individual to expect that his or her PHI could be used or disclosed for such future research. In addition, the 2018 FAQ revisions address the 21st Century Cures Act, which authorizes IRBs reviewing FDA-regulated, minimal risk research to waive or alter informed consent requirements. In July 2017, FDA issued a guidance document, “IRB Waiver or Alteration of Informed Consent for Clinical Investigations Involving No More Than Minimal Risk to Human Subjects,” announcing its intention not to object to an IRB’s waiving or altering the informed consent requirements for an FDA-regulated clinical investigation that presents no more than minimal risk and involves adequate human subjects protections. The guidance, which took effect immediately, aligns FDA’s policy on waiving informed consent with the Common Rule’s requirements as set forth prior to the 2017 revisions.

Please note that there may be state laws that apply to these issues, but they are not addressed or contemplated in these FAQs.

It is hoped that these compiled FAQs and recommendations constitute a product that the Office for Human Research Protections, the Office for Civil Rights, and the Food and Drug Administration and others can use to provide much-needed guidance in this area.

I. Glossary and concepts

1. CODED means:

(1) Identifying information (such as name or social security number) that would enable the investigator to readily ascertain the identity of the individual to whom the private information or specimens pertain has been replaced with a number, letter, symbol, or combination thereof (i.e., the code); and

(2) A key to decipher the code exists, enabling linkage of the identifying information to the private information or specimens.

2. HONEST BROKER means:

A neutral intermediary (person or system) between the individual whose tissue and data are being studied, and the researcher. The honest broker collects and collates pertinent information regarding the tissue source, replaces identifiers with a code, and releases only coded information to the researcher.

3. LIMITED DATA SET:

As defined by HIPAA, limited data sets are data sets stripped of certain direct identifiers that are specified in the Privacy Rule. They are not de-identified information under the Privacy Rule.

A limited data set is protected health information that excludes the following direct identifiers of the individual or of relatives, employers, or household members of the individual: (1) names; (2) postal address information, other than town or city, state, and ZIP code; (3) telephone numbers; (4) fax numbers; (5) e-mail addresses; (6) social security numbers; (7) medical record numbers; (8) health plan beneficiary numbers; (9) account numbers; (10) certificate/license numbers; (11) vehicle identifiers and serial numbers, including license plate numbers; (12) device identifiers and serial numbers; (13) web URLs; (14) Internet Protocol (IP) address numbers; (15) biometric identifiers, including fingerprints and voiceprints; and (16) full-face photographic images and any comparable images.

Importantly, unlike de-identified data, protected health information in limited data sets may include the following: city, state and ZIP codes; all elements of dates (such as admission and discharge dates); and unique codes or identifiers not listed as direct identifiers.

Recognizing that institutions, IRBs and investigators are frequently faced with applying both the Common Rule and the HIPAA Privacy Rule, OHRP does not consider a Limited Data Set (as defined under the HIPAA Privacy Rule) to constitute identifiable private information under §46.102(e)(5).

4. When is research with specimens not Human Subjects Research?

OHRP does not consider research involving fully de-identified or fully anonymized information to involve human subjects.

OHRP does not consider research involving only coded private information or specimens to involve human subjects if the following conditions are both met:

(1) The private information or specimens were not collected specifically for the currently proposed research project through an interaction or intervention with living individuals; and

(2) the investigator(s) cannot readily ascertain the identity of the individual(s) to whom the coded private information or specimens pertain because, for example, there are agreements, IRB-approved policies and procedures, or legal requirements in place that prohibit the release of the key to the code to the investigators under any circumstances until the individuals are deceased.

5. How are studies with specimens addressed under the FDA regulations?

Certain research studies involving medical devices and tissue specimens will qualify as clinical investigations under the FDA regulations. Most commonly, devices that are tested using tissue samples are In Vitro Diagnostic (IVD) devices. Under the definition of a human subject in FDA device regulation 21 CFR 812.3(p), “Subject means a human who participates in an investigation, either as an individual on whom or on whose specimen an investigational device is used or as a control. A subject may be in normal health or may have a medical condition or disease.” Thus, if tissues are used to establish the safety and effectiveness of a device, then the FDA regulations apply. Under the FDA regulations, IRB review (21 CFR Part 56) is always required, and consent of the subject (21 CFR Part 50) is usually required. Consent may be waived in certain emergency situations under 21 CFR 50.23 and 50.24. Also, FDA applies enforcement discretion to certain clinical investigations of IVDs, as described in the guidance document “Guidance on Informed Consent for In Vitro Diagnostic Device Studies Using Leftover Human Specimens that are Not Individually Identifiable.” This guidance allows research with tissues without consent if seven conditions are met. The most important condition for the purposes of these FAQs is that “The specimens are not individually identifiable, i.e., the identity of the subject is not known to and may not readily be ascertained by the investigator or any other individuals associated with the investigation, including the sponsor. If the specimen is coded, it will be considered to be not individually identifiable if neither the investigator(s) nor any other individuals associated with the investigation or the sponsor can link the specimen to the subject from whom the specimen was collected, either directly or indirectly through coding systems.” The guidance uses essentially the same definition of “coded” that OHRP uses in its coded data guidance: “coded means that: 1) a number, letter, symbol, or combination thereof (i.e., the code) has replaced identifying information (such as name or social security number) that would enable the investigator or any other individuals associated with the investigation, including the sponsor to readily ascertain the identity of the individual to whom the specimen pertains; and 2) a key to decipher the code exists, enabling linkage of the identifying information to the specimen.”

In addition, under the 21st Century Cures Act and the Minimal Risk guidance, FDA allows an IRB overseeing a clinical investigation subject to FDA regulations to waive or alter the informed consent requirements. Specifically, an IRB may waive informed consent if it finds and documents that: (i) the clinical investigation involves no more than “minimal risk” to subjects; (ii) the waiver or alteration will not adversely affect the rights and welfare of the subjects; (iii) the clinical investigation could not practicably be carried out without the waiver or alteration; and (iv) whenever appropriate, the subjects will be provided with additional pertinent information after participation. Importantly, in contrast to FDA’s enforcement discretion policy regarding uses of leftover human specimens for in vitro diagnostics studies, for which specimens must not be “individually identifiable,” human specimens under this FDA policy allowing waivers of consent may be individually identifiable.

II. Related SACHRP Recommendations

6. Recommendation on Compatibility of Secondary Use with Consent.

The determination of whether a proposed secondary research use is compatible with the original consent will be context-specific based on a range of considerations. If the original consent form specifically prohibited the proposed research activity, it is presumed the research is not allowable. If the consent does not prohibit the proposed use, IRBs should consider several questions to determine compatibility:

• What is the nature of the proposed secondary research?

• Could it reasonably be understood to fall within the scope of research that was described in the original consent form?

• Does the secondary research use impose new or significantly greater risks (including privacy risks) not described in the initial consent form?

• Are there known concerns of the study population(s) about the proposed secondary use?

7. Recommendation on the Definition of “Investigator.”

OHRP should revise its interpretation of who is considered an “investigator” in secondary use of coded information or specimens. Persons who are providing such information or specimens without identifiers should not be considered to be “investigators” involved in human subjects research, even if they are involved in analysis of aggregate data or publication of results, provided the secondary users are unable to readily ascertain the identity of subjects. Under such circumstances, neither party shall decode or re-identify subjects.

Mechanisms to support this interpretation could include (a) the presence of an agreement that prohibits release of the key from the original provider to secondary users; or (b) the existence of a repository or banking system that prohibits the secondary users from access to identifiers. These same interpretations and mechanisms should be applied whether the original provider and secondary user(s) are within the same institution or at different institutions.

The intent is to support a conclusion that secondary uses under such circumstances do not constitute research involving human subjects (as defined under 45 CFR 46.102(fe)) and therefore do not require IRB review and approval, in keeping with OHRP’s “Guidance on Research Involving Coded Private Information or Biological Specimens.”

III. Frequently Asked Questions (FAQs)

FAQ #1: Tissue biopsies were obtained for clinical diagnostic purposes, which have now been satisfied. The patients did not provide study specific informed consent for the research use of the tissue specimens. The hospital pathology department is willing to provide a portion of the remaining biopsy specimens to an investigator who will perform research assays. In order to allow matching with relevant clinical information, the specimens will be provided with identifiers such that the investigator can readily ascertain the identity of subjects. Is consent of the patient from whom the biopsy was taken (or waiver of consent) required for the secondary research use?

Response – HHS Common Rule Issues. Yes. Under this scenario, informed consent of the subjects should either be obtained (using either study-specific or “broad consent”) or waived under 45 CFR 46.116(f) because the samples are identifiable to the recipient investigator, and in any case, IRB review would be required.

HIPAA Issues. Assuming the hospital is a HIPAA covered entity, the use or disclosure of patient identifiers for the research purpose would also require a HIPAA authorization from the patient or an IRB or Privacy Board waiver of the authorization requirement.

FDA Issues. If the tissues are used to test an FDA regulated IVD, then IRB review is required and informed consent of the subjects for the secondary use must be obtained unless the subjects provided consent addressing the elements required under 21 CFR 50.25 at the time of tissue collection which would adequately address the secondary use activities. However, under FDA’s “Minimal Risk” guidance, an IRB may waive the informed consent requirements for minimal risk research if it determines that (i) the clinical investigation involves no more than “minimal risk” to subjects; (ii) the waiver or alteration will not adversely affect the rights and welfare of the subjects; (iii) the clinical investigation could not practicably be carried out without the waiver or alteration; and (iv) whenever appropriate, the subjects will be provided with additional pertinent information after participation. Importantly, in contrast to FDA’s enforcement discretion policy regarding use of leftover human specimens for in vitro diagnostics studies, the specimens to be used under this allowed waiver of consent may be individually identifiable.

FAQ #2: Tissue biopsies were obtained for clinical diagnostic purposes, which have now been satisfied. The hospital pathology department is willing to provide a portion of the remaining biopsy specimens to an investigator who will perform research assays. The specimens will be coded such that the investigator will not be able to readily ascertain the identity of individuals. Is consent of the patient from whom the biopsy was taken (or waiver of consent) required for the secondary research use?

Response – HHS Common Rule Issues. No. Under this scenario, neither consent nor waiver is required, because the activity is not considered to be research involving human subjects.

HIPAA Issues. If the information associated with the specimen is de-identified in accordance with the HIPAA Privacy Rule, neither authorization nor an IRB or Privacy Board waiver of the authorization is required, because de-identified information is not considered to be protected health information.

Note, however, that information associated with the specimen that is not individually identifiable per OHRP guidance (i.e., coded) may not necessarily be de-identified for HIPAA Privacy Rule purposes. For example, the coded information may not be considered to be de-identified under the Privacy Rule if the code is derived from a patient identifier or certain data elements, such as dates of service or zip codes, remain with the information. Thus, the use or disclosure of the information for research may still require a form of HIPAA permission, such as a HIPAA authorization, IRB or Privacy Board waiver of authorization, or, if the information constitutes a “limited data set,” a data use agreement with the recipient of the information.

FDA Issues. If the tissues are used to test an FDA regulated IVD, then IRB review is required. It may not be necessary to obtain informed consent of the subjects for the secondary use if the seven conditions are met in the FDA “Guidance on Informed Consent for In Vitro Diagnostic Device Studies Using Leftover Human Specimens that are Not Individually Identifiable.” An IRB also may waive informed consent if the four conditions in the “Minimal Risk” Guidance are met.

FAQ #3: Blood samples were obtained for research purposes, with informed consent of the subjects, and the original study has been completed. The samples remain under the control of the original investigator. Another investigator wants to use a portion of the remaining samples to perform research completely unrelated to the original study. If the original consent stated that “…your sample will only be used for research on colon cancer,” but the secondary user is interested in studying Alzheimer’s disease, can the samples still be used if provided to the secondary user in a coded fashion?

Response – HHS Common Rule Issues. The secondary use of de-identified or coded samples is not research involving human subjects under 45 CFR 46. Biospecimens that are de-identified , coded, or anonymized and are not readily identifiable are no longer subject to human subject regulations. Thus, there is no regulatory violation. Nevertheless, the original investigator and his/her institution have made an agreement with the subjects about use of their biospecimens, and in the case where secondary use of biospecimens is not compatible with the original consent, they have an obligation to honor that agreement.

Institutions should establish mechanisms to determine whether secondary uses are compatible with the original informed consent; this could involve consultation with the IRB that approved the original research, or review by some other body designated for these purposes. Coding should not be used as a means to circumvent the original terms of consent. This is ethically problematic, even if the original project is over and the secondary use is no longer considered to be research involving human subjects.

HIPAA Issues. Assuming the original investigator is in a HIPAA covered entity, the disclosure of direct identifiers for the new research purpose would require a HIPAA authorization from the subject or an IRB or Privacy Board waiver of the authorization requirement. If the research could be performed using only information about the subject that constitutes a limited data set, the original investigator could disclose the limited data set to the researcher after the researcher has signed a data use agreement that complies with the requirements in 45 CFR 164.514(e)(4).

Nevertheless, one must consider any explicit promises that were made in the informed consent and/or authorization that identifiable data are to be used “only” for a named, specific purpose. If such an explicit promise has been made that limits future use of identifiable data, then an IRB, Privacy Board and the investigator must consider this in determining appropriate future uses of those identifiable data, either under a waiver of authorization or under an interpretation of the authorization terms themselves.

FDA Issues. If tissues are used to test an FDA regulated IVD, then IRB review is required. It may not be necessary to obtain informed consent of the subjects for the secondary use if the seven conditions are met in the FDA “Guidance on Informed Consent for In Vitro Diagnostic Device Studies Using Leftover Human Specimens that are Not Individually Identifiable.” An IRB also may waive informed consent if the four conditions in the “Minimal Risk” Guidance are met. However, FDA agrees with the considerations described above regarding the ethical obligation to the subjects.

FAQ #4: It is increasingly common to collect and store specimens for future unspecified research. How broad can this consent be without requiring investigators to obtain additional consent for specific uses? Alternatively, how specific must this consent be to allow for future use of biospecimens?

Response – HHS Common Rule Issues. There is a tension between the desire to be as specific as possible when informing subjects of what will be done, and the reality that all specifics of future research may not be known at the time of initial consent.

In order to obtain effective consent from subjects in a primary study to future uses of their data and/or biospecimens in future studies, it is necessary to give subjects reasonable notice of the types, categories and/or purposes of research that might be conducted in the future and their associated risks. Thus, subjects can be informed that future studies using their identifiable data or biospecimens may involve genetic research, drug development, or searching for links between genes and environmental factors like diet or lifestyle, or between genes and diseases. While examples might be given of specific diseases (e.g., cancer, diabetes, heart disease), being overly specific or restrictive in this regard may result in problems later, when investigators propose other uses. IRBs and investigators therefore should consider the downstream implications before promising subjects that “your specimens will only be used for research on XYZ,” as such restrictions will be binding and, in general, not revocable, absent reconsent to the contrary.

When a future use of identifiable biospecimens is sufficiently described in a study’s protocol and consent form as being part of that study (i.e., the purpose is sufficiently described and all other elements of consent required by regulations are included in the consent form), further IRB review of that future use is not required.

When the future use of identifiable biospecimens and identifiable data described in a study’s consent form contemplates distinct future protocols, IRB review of those future uses is appropriate and needed. The IRB must first determine if the new protocol’s proposed use is within the scope of the original terms of consent. If it is not, specific consent to the new use is required, or consent must be waived by the IRB. If the new protocol’s proposed use is within the scope of the original terms of consent, the IRB may determine that the prior consent is sufficient for the new use. If it is unclear whether the new protocol’s use is within the scope of the original terms of consent, the IRB must determine whether more specific consent is needed for the new use or whether consent may be waived for the new use. If subjects were previously offered “broad consent” under the revised Common Rule but refused, consent waiver is not permitted for those subjects.

Indeed, the revised Common Rule establishes the formal category of regulatory “broad consent” that may be used for the storage, maintenance and secondary research use of identifiable private information and identifiable biospecimens. “Broad consent” under the revised Common Rule requires the disclosure of, among other things, (i) a general description of the types of research that may be conducted with the identifiable private information or identifiable biospecimens, (ii) a description of the identifiable private information or identifiable biospecimens that might be used in research, whether sharing of identifiable private information or identifiable biospecimens might occur, and the types of institutions or researchers that might conduct research with the identifiable private information or identifiable biospecimens, and (iii) a description of the period of time that the identifiable private information or identifiable biospecimens may be stored and maintained (which period of time could be indefinite), and a description of the period of time that the identifiable private information or identifiable biospecimens may be used for research purposes (which period of time could be indefinite).

As an alternative, the creation of a repository with an oversight committee and “honest broker” mechanisms that distribute specimens to investigators in coded fashion can remove subsequent uses from IRB review, to the extent they no longer constitute human subjects research. In these cases, special attention should be given upfront to ensure that the repository (whose creation and maintenance is human subjects research and requires IRB approval) is established with policies and procedures to manage effectively subsequent uses in keeping with the banking protocol that the IRB approved.

HIPAA Issues. This scenario raises a number of HIPAA-related issues for institutions that are covered entities under the HIPAA Privacy Rule.

There are two separate activities to consider when a HIPAA covered entity is collecting and storing identifiable health information in a research repository for future unspecified research:

(A) A covered entity’s use or disclosure of protected health information (PHI) to create the repository; and

(B) The release of PHI from the repository for a future research purpose.

There are a number of ways health information can move into and out of a research repository, including those established for future unspecified research. In this scenario, it is assumed that the repository will contain PHI and that authorization will be obtained to disclose PHI to the repository. With reference to the two separate activities in this scenario:

(A) An authorization may state that the purpose of the authorization is to create a research repository or database.

(B) Health information can then be subsequently used and disclosed from the research repository in one of several ways:

1. With authorization, which may be combined with the authorization for the creation of the repository provided that the future research to be performed using PHI from the repository is described in such a manner that it would be reasonable for the individual to expect that his or her PHI could be used or disclosed for such future research.

2. With an IRB or Privacy Board waiver of the authorization requirement

3. Preparatory to research (with certain representations)

4. Use of a HIPAA De-identified Dataset*

5. Use of a Limited Data Set (with data use agreement)

6. Research solely on decedents (with certain representations)

FDA Issues. If the tissues are used to test an FDA regulated IVD, then IRB review is required. If the tissues are identifiable, then subjects must provide consent for the secondary use and that consent must cover the elements of consent in 21 CFR 50.25. If the original consent met the requirements of 21 CFR 50.25, then that consent would be sufficient to meet FDA requirements. If the original consent did not meet those requirements, then the subjects must provide consent specifically for the use to test the IVD. Finally, it may not be necessary to obtain informed consent of the subjects for the secondary use if the seven conditions are met in the FDA “Guidance on Informed Consent for In Vitro Diagnostic Device Studies Using Leftover Human Specimens that are Not Individually Identifiable.” An IRB also may waive informed consent if the four conditions in the “Minimal Risk” Guidance are met.

Other than the use of tissues for testing IVDs, FDA has no regulations that specifically apply to the collection of tissues or their storage. It is worth noting that when non-governmental organizations (NGOs) and pharmaceutical sponsors collect and store specimens for future unspecified research, without the involvement of federal funding or a covered entity, it is also often the case that the HHS regulations and HIPAA do not apply.

FAQ #5: It is increasingly common, as part of a primary research study, to collect and store identifiable biospecimens and identifiable data for future unspecified research. What are the options for review of studies involving use of these retained biospecimens and data, and what are the implications of the consent form for the primary study in determining options for this review?

Response - HHS Common Rule Issues and Associated HIPAA Issues. There are three approaches described in regulation for reviewing plans for secondary research on identifiable biospecimens and data collected in a primary research study:

1. De-identify the biospecimens and data, in which case the future research would not be considered “human subjects research” and no further review of such research would be required under the common rule;

2. Require that individual future research studies that use retained biospecimens and data go through IRB review. Under these circumstances, the IRB could (a) require additional individual consent, or (b) find that the original consent was sufficiently specific so that additional consent was not required, or (c) find that the research is appropriate for a waiver of consent.

3. Find that the future research, as describe in the protocol and consent, meets one or more criteria for exemption from review.

Secondary research undergoing IRB review

If the proposed secondary research undergoes IRB review and the IRB determines that participants must consent again to the additional research or that the research meets the criteria for a waiver of informed consent, no further guidance is required. Yet there is little clarity on what criteria to use to assess the adequacy of the original consent in allowing future research without re-consenting and without a waiver. At one extreme, a simple checkbox allowing participants to agree to have their identifiable biospecimens or data stored and used for future research is insufficient; at the other extreme fully specified assays or use would be acceptable, but such specificity is unlikely to be able to be offered for the entire range of possible future research uses.

To understand how informed consent might be effectively offered and obtained for future research, it is helpful to identify and analyze each component element of informed consent required by the Common Rule.

§46.116(a)(1) A statement that the study involves research, an explanation of the purposes of the research and the expected duration of the subject's participation, a description of the procedures to be followed, and identification of any procedures which are experimental;

For future use, it should be sufficiently clear that the study involves research; no additional duration of personal involvement is expected, but the duration of biospecimen/data storage and use may need to be described, and typically subjects will undergo no additional procedures beyond those described for the primary study. The primary aspect of this element that may be unclear at the time the primary consent is presented is the purpose of the future research.

§46.116(a)(2) A description of any reasonably foreseeable risks or discomforts to the subject;

Risks of future research are primarily related to maintenance of privacy and confidentiality, and there are no additional discomforts.

§46.116(a)(3) A description of any benefits to the subject or to others which may reasonably be expected from the research;

Benefits of future research are almost always indirect. It can be disclosed that participants should expect no personal benefit in advance of a specific description of the research.

§46.116(a)(4) A disclosure of appropriate alternative procedures or courses of treatment, if any, that might be advantageous to the subject;

Given the nature of future research, there would be no alternative procedures or courses of treatment.

§46.116(a)(5) A statement describing the extent, if any, to which confidentiality of records identifying the subject will be maintained;

This element is particularly applicable to future research, as biospecimens and data will necessarily be maintained, often for an uncertain duration.

§46.116(a)(6) For research involving more than minimal risk, an explanation as to whether any compensation and an explanation as to whether any medical treatments are available if injury occurs and, if so, what they consist of, or where further information may be obtained;

Future use typically would not involve greater than minimal risk.

§46.116(a)(7) An explanation of whom to contact for answers to pertinent questions about the research and research subjects' rights, and whom to contact in the event of a research-related injury to the subject; and

In most cases, the contact information should be the same as that for the original protocol, and research-related injury is likely not relevant.

§46.116(a)(8) A statement that participation is voluntary, refusal to participate will involve no penalty or loss of benefits to which the subject is otherwise entitled, and the subject may discontinue participation at any time without penalty or loss of benefits to which the subject is otherwise entitled.

Discontinuation raises particular problems in storage and maintenance of biospecimens and data for future research.

In summary, based on the considerations described above, disclosures of the following information must be addressed to allow future research without obtaining subjects’ reconsent or waiver of their consent:

• purpose of the research;

• duration of use of the specimens/information;

• privacy and confidentiality protections; and

• processes for, and limitations to, withdrawal of biospecimens and data.

Duration of storage, privacy protections and processes around withdrawal may all differ from the corresponding provisions for the main study, but in principle, provisions for each of these considerations for retained information and specimens could be explicitly and adequately described at the time of initial consent. The purpose of the research, in contrast, most often cannot be described with the same detail as the purpose of the primary study, and this inability is the main obstacle to a consent for future unspecified research being regarded as adequate both from an ethical and a regulatory perspective.

The revised Common Rule offers some insights into what information might be needed in the original consent form so that additional consent would not be required for future use. These insights come from the additional disclosures required for regulatory “broad consent.” “Broad consent” is allowed for storage, maintenance and secondary use of biospecimens and data, and logical consistency would suggest that the required “broad consent” elements should be sufficient, from an ethical perspective, to satisfy consent requirements for future use of identifiable biospecimens and/or data in the circumstance where biospecimens and data are collected as part of a primary protocol and this protocol and consent already address the risks of the primary collection.

The primary required “broad consent” elements describing purpose are found in §46.116(d)(2) and (5) of the revised Common Rule:

§46.116(d)(2): A general description of the types of research that may be conducted with the identifiable private information or identifiable biospecimens. This description must include sufficient information such that a reasonable person would expect that the broad consent would permit the types of research conducted;

§46.116(d)(5): Unless the subject or legally authorized representative will be provided details about specific research studies, a statement that they will not be informed of the details of any specific research studies that might be conducted using the subject’s identifiable private information or identifiable biospecimens, including the purposes of the research, and that they might have chosen not to consent to some of those specific research studies;

§46.116(d)(2) applies a “reasonable person” standard, and is most plausibly interpreted to require the disclosure of areas of research that might be of concern to particular individuals so that they have the opportunity to decline participation. It is important to note that the “reasonable person” standard does not refer to the acceptability of the research to such a person, but rather to whether a “reasonable person” would regard the description as adequate.

§46.116(d)(5) provides an accompanying disclaimer – namely, that the research will not be so exhaustively described that misunderstanding is impossible. The reasonable person standard is inherently imperfect, and potential participants are warned that research may be done that satisfies §46.116(d)(2) but that might still be objectionable to them.

These provisions are broad and general, and raise the possibility that, outside the context of regulatory “broad consent,” neither reconsent nor a waiver would be required if (a) the initial consent had described whether or not the future research would involve purposes or procedures that participants might find objectionable, and (b) duration of storage, privacy protections and withdrawal provisions were explicitly described. In other words, the requirement to disclose purpose may be served by constraining what types of studies would not be done in addition to describing what types of studies would be done.

While regulatory “broad consent” is a provision of the revised Common Rule, this analysis of the effect of primary consent is not dependent on regulatory changes, and would be the same under the pre-2018 Common Rule.

Future research that may be exempt

The pre-2018 Common Rule has no exemption criteria that would allow future unspecified studies using identifiable biospecimens and data to be conducted without any IRB review. The revised Common Rule, on the other hand, adds several exemption categories that might apply. These include §46.104(d)(4)(iii) - the “HIPAA exemption”, and §46.104(d)(8) - secondary research for which broad consent is required.

§46.104(d)(4) Secondary research for which consent is not required: Secondary research uses of identifiable private information or identifiable biospecimens, if at least one of the following criteria is met: (iii) The research involves only information collection and analysis involving the investigator’s use of identifiable health information when that use is regulated under 45 CFR parts 160 and 164, subparts A and E, for the purposes of “health care operations” or “research” as those terms are defined at 45 CFR 164.501 or for “public health activities and purposes” as described under 45 CFR 164.512(b);

If identifiable data (not including identifiable biospecimens) are collected and analyzed within one or more HIPAA covered entities, it is possible that future secondary use could be exempt, but that this exemption is justified because the full processes and protections of HIPAA are in place with regard to those data. Review and authorizations or waivers for research use under HIPAA are all needed. This exemption removes IRB review under the Common Rule, but, in the case of multi-site research sharing or exchanging information between multiple HIPAA covered entities, the HIPAA review itself may be logistically complex.

§46.104(d)(8) Secondary research for which broad consent is required: Research involving the use of identifiable private information or identifiable biospecimens for secondary research use, if the following criteria are met…

The exemption for research for which “broad consent” was obtained does not require that the initial biospecimens and data be obtained under exemption §46.104(d)(7). In fact, there is no explicit reference to the preceding exemption for storage and maintenance. This omission implies that broad consent, as described in §46.116(d), can be obtained in the context of primary collection of research biospecimens and data, and that a consent satisfying the elements of broad consent is effective for the purposes of this exemption, despite not being collected in the context of §46.104(d)(7).

Use of this exemption provides a pathway for future research protocols to be exempt from IRB review. It requires limited IRB review of the specific protocol to ensure privacy protections and to confirm that the future research is consistent with the original consent, but does not require review against the complete set of approval criteria of §46.111. The main limitation of this approach is that, if the original consent is explicitly designed to satisfy the requirements of “broad consent,” §46.116(f)(1) prohibits an IRB from waiving consent for an individual who had previously refused “broad consent.” Under some circumstance this limitation requires complex tracking of pre-existing biospecimens and data, but it should be straightforward to apply in the context of limited biospecimens and data collected in a primary research protocol where no biospecimens or data would be retained if consent was refused.

FAQ #6: When can informed consent be waived for use of previously-collected human biospecimens and data (e.g., when does such research meet “minimal risk” criteria, what does “practicability” mean with regard to the informed consent waiver criteria)?

Response – HHS Common Rule Issues. The criteria for waiver of consent under 45 CFR 46.116(f) include that the research involves no more than minimal risk; the waiver would not adversely affect the rights and welfare of subjects; the research could not practicably be carried out without the waiver; if the research involves using identifiable private information or identifiable biospecimens, the research could not practicably be carried out without using such information or biospecimens in an identifiable format; and whenever appropriate, the subjects will be provided with pertinent information after participation.

Points to consider in applying these criteria include the nature of the research; the protections in place to maintain privacy and confidentiality (e.g., coding, limited/controlled access, honest broker mechanisms); the change in level of risk, if any; the ability to locate or contact subjects; risk of introducing bias into the research; potential anxiety or confusion for subjects; the number of subjects; the length of time since specimens were first collected; and the likelihood that subjects would object to the proposed secondary use, based on the nature of original collection.

HIPAA Issues. The concept of waiver of informed consent is not a HIPAA concept. As set forth in more detail in 45 CFR 164.512(i)(2), the HIPAA authorization requirement can be waived by an IRB or privacy board when (1) the research use or disclosure involves no more than minimal risk to the individual’s privacy; (2) the research could not practicably be conducted without the waiver; and (3) the research could not practicably be conducted without use or disclosure of the protected health information.

FDA Issues. If the tissues are used to test an FDA regulated IVD, then IRB review is required. It may not be necessary to obtain informed consent of the subjects for the secondary use if the seven conditions are met in the FDA “Guidance on Informed Consent for In Vitro Diagnostic Device Studies Using Leftover Human Specimens that are Not Individually Identifiable.” If the tissues are identifiable, then consent addressing the elements under 21 CFR 50.25 is required, unless an IRB waives informed consent under the “Minimal Risk” Guidance.

FAQ #7: Blood samples were obtained for research purposes, with informed consent of the subjects, and the original study has been completed. The samples remain under the control of the original investigator. Another investigator wants to use a portion of the remaining samples to perform research unrelated to the original study. If the sample is identifiable to the secondary user, is this considered to be human subjects research under the purview of the IRB? If so, what are the consent considerations?

Response – HHS Common Rule Issues. Yes. This is human subjects research under the purview of the IRB. Consent will be needed if the research is unrelated, unless an IRB waives the requirements for informed consent. The IRB should consider whether the secondary use is compatible with, or has been excluded by, the terms of the original consent given by the subjects. An IRB cannot waive informed consent, however, if a subject was previously offered and refused “broad consent” for the proposed research.

FDA Issues. If the tissues are used to test an FDA regulated IVD, then IRB review is required. Because the subjects are identifiable to the secondary user, the FDA “Guidance on Informed Consent for In Vitro Diagnostic Device Studies Using Leftover Human Specimens that are Not Individually Identifiable” is not applicable. Consent addressing the elements under 21 CFR 50.25 is required, either at the time of the original collection of the blood samples, or at the time of the use of the specimens for the IVD testing, unless an IRB waives informed consent requirements under the “Minimal Risk” Guidance.

FAQ #8: Identifiable blood samples were obtained for research purposes, with informed consent of the subjects, and the original study has been completed. The samples remain under the control of the original investigator, who now wants to collaborate with another investigator to perform research unrelated to the original study. If the original consent was silent on the question of subsequent uses, is informed consent (or waiver of consent) required before the identifiable sample can be used for other purposes?

Response – HHS Common Rule Issues. Under these circumstances, the IRB should consider the original terms of consent, and determine whether a waiver might be appropriate or whether additional consent is required. Waiver would not be available, however, if a subject was previously offered and refused “broad consent” for the proposed research.

The criteria for waiver of consent under 45 CFR 46.116(f) include that the research involves no more than minimal risk; the waiver would not adversely affect the rights and welfare of subjects; the research could not practicably be carried out without the waiver; if the research involves using identifiable private information or identifiable biospecimens, the research could not practicably be carried out without using such information or biospecimens in an identifiable format; and whenever appropriate, the subjects will be provided with pertinent information after participation.

HIPAA Issues. If an authorization for future research was obtained from the research subject and the secondary user’s research falls within the scope of that authorization, then the disclosure of PHI to, and use of the PHI by, the secondary user would be permissible under the original authorization. If the secondary research use does not fall within the scope of the original authorization, then a new HIPAA authorization (or waiver of authorization) would be required to permit the use and disclosure of PHI for the unrelated research. Notably, if the research could be performed using only information about the subject that constitutes a limited data set, the original investigator could disclose the limited data set to the new investigator after the new investigator has signed a data use agreement that complies with the requirements in 45 CFR 164.514(e)(4).

FDA Issues. If the tissues are used to test an FDA regulated IVD, then IRB review is required. Because the subjects are identifiable to the secondary user, the FDA “Guidance on Informed Consent for In Vitro Diagnostic Device Studies Using Leftover Human Specimens that are Not Individually Identifiable” is not applicable. Consent addressing the elements under 21 CFR 50.25 is required, unless an IRB waives informed consent requirements under the “Minimal Risk” Guidance.

FAQ #9: Patients undergoing surgery provide informed consent to donate any excess tissue (i.e., beyond that needed for clinical purposes) to a tissue bank. The creation of the bank has been reviewed and approved by the IRB, meaning the IRB has approved the policies and procedures under which the bank will be managed, the control of specimens, and the types of research to be conducted, etc. The consent form makes it clear that the specimens and associated clinical data will be used for research, but does not specify or limit that use. If the bank employs an “honest broker” mechanism, so that specimens and any associated data are coded so that the recipient investigator cannot readily ascertain the identity before being given to investigators, is this subsequent use considered to be human subjects research under the purview of the IRB?

Response – HHS Common Rule Issues. No, the subsequent research use is not considered to be research involving human subjects and IRB review is not required. However, there should be mechanisms in place to ensure that proposed research uses are compatible with the original consent.

HIPAA Issues. Assuming a HIPAA covered entity is involved and the information is not considered fully de-identified under the HIPAA Privacy Rule, a form of HIPAA permission is required to permit the use and disclosure of PHI by the tissue bank. If the research subject executed a HIPAA authorization permitting future research uses and disclosures of PHI, that authorization could serve as the requisite permission provided that the research falls within the scope of the original authorization. If the secondary research use does not fall within the scope of the original authorization, a new HIPAA authorization would be required for the subsequent research use or disclosure of PHI, or another form of HIPAA permission obtained (e.g., waiver of authorization, data use agreement if use or disclosure of a limited data set).

However, if the information associated with the specimens is de-identified in accordance with the HIPAA Privacy Rule, neither authorization nor waiver of authorization is required, because it would no longer be considered protected health information. The Privacy Rule permits a covered entity to assign to, and retain with, the de-identified health information, a code or other means of record re-identification if that code is not derived from or related to the information about the individual and is not otherwise capable of being translated to identify the individual. For example, an encrypted individual identifier (e.g., a social security number) would not meet the conditions for use as a re-identification code for de-identified health information because it is derived from individually identified information. In addition, the covered entity may not (1) use or disclose the code or other means of record identification for any other purpose, or (2) disclose its method of re-identifying the information.

FDA Issues. If the tissues are used to test an FDA regulated IVD, then IRB review is required. It may not be necessary to obtain informed consent of the subjects for the secondary use if the seven conditions are met in the FDA “Guidance on Informed Consent for In Vitro Diagnostic Device Studies Using Leftover Human Specimens that are Not Individually Identifiable.” If the seven conditions are not met, then consent addressing the elements under 21 CFR 50.25 is required, unless an IRB waives informed consent requirements under the “Minimal Risk” Guidance.

FAQ #10: Patients undergoing surgery provide informed consent to donate any excess tissue (i.e., beyond that needed for clinical purposes) to a tissue bank. The creation of the bank is reviewed as human subjects research and approved by the IRB. The consent form makes it clear that the specimens and associated clinical data will be used for research, but does not specify or limit that use. If specimens are provided to the researchers with clinical information that allows the researcher to readily ascertain the identity of the subjects, do those researchers need separate IRB approval of the proposed research use of the specimens and data?

Response – HHS Common Rule Issues. Yes, the provision of identifiable information with the specimen means the research to be conducted with the specimen is a separate human subjects research protocol and separate IRB approval would be required.

FDA Issues. If the tissues are used to test an FDA regulated IVD, then separate IRB review is required.

FAQ #11: Patients undergoing surgery provide informed consent to donate any excess tissue (i.e., beyond that needed for clinical purposes) to a tissue bank. The creation of the bank is reviewed and approved by the IRB. The consent form makes it clear that the specimens and associated clinical data will be used for research, but does not specify or limit that use. If specimens are provided to the researchers with clinical information that allows the researcher to readily ascertain the identity of the subjects, is a new consent from the patient/subject [or IRB waiver of informed consent] required?

Response– HHS Common Rule Issues. Yes, a new consent from the subjects is required unless the IRB determines that the original consent was adequate to allow the subsequent research use, or the IRB determines a waiver is appropriate.

Points to consider in applying these criteria include the nature of the research; the protections in place to maintain privacy and confidentiality (e.g., coding, limited/controlled access, honest broker mechanisms); the change in level of risk, if any; the ability to locate or contact subjects; risk of introducing bias into the research ; potential anxiety or confusion for subjects; the number of subjects; the length of time since specimens were first collected; and the likelihood that subjects would object to the proposed secondary use, based on the nature of original collection.

HIPAA Issues. A covered entity's use or disclosure of protected health information to create a research database or repository, and use or disclosure of protected health information from the database or repository for a future research purpose, are each considered a separate research activity under the Privacy Rule. Assuming a HIPAA covered entity is involved, a HIPAA authorization (or waiver of authorization) would be required for the disclosure of PHI to the repository and the future research use or disclosure of PHI from the repository,. If the research subject executed a HIPAA authorization permitting future research uses and disclosures of PHI, that single authorization could serve as the requisite permission for both of these activities provided that the future research falls within the scope of the authorization. If the secondary research use does not fall within the scope of the original authorization, a new authorization could be obtained from the research subject or another form of HIPAA permission would need to apply or be obtained (e.g., waiver of authorization). If the research could be performed using only information about the subject that constitutes a limited data set, the tissue bank could use, or could disclose to the researcher, the limited data set after the researcher and the tissue bank have signed a data use agreement that complies with the requirements in 45 CFR 164.514(e)(4).

FDA Issues. If the tissues are used to test an FDA regulated IVD, then IRB review is required. Consent addressing the elements under 21 CFR 50.25 is required. If the original consent met the requirements of 21 CFR 50.25, that would be sufficient. If not, subjects must provide consent prior to the use of the tissues to test the IVD, unless an IRB waives informed consent requirements under the “Minimal Risk” Guidance.

FAQ #12: An academic medical center has established a centralized tissue bank of specimens that it receives from a variety of sources. The bank was reviewed as human subjects research and has IRB-approved policies and procedures in place. These policies and procedures stipulate that the bank will release only coded specimens to researchers, without identifiers. The institution now plans to begin moving newly obtained excess clinical specimens to the bank in a prospective, ongoing manner, after their original purpose has been served. The specimens would be identifiable going into the bank, in order to facilitate linkage back to clinical data. Is this permissible if there was no consent for research obtained from the patients?

Response – HHS Common Rule Issues. Generally, no. Because the excess clinical specimens are identifiable, this is human subjects research and consent would be required. In rare circumstances, the IRB may determine that the conditions for a waiver of consent under 45 CFR 46.116(f) have been met.

Points to consider include governance and oversight of the bank; protections in place to maintain privacy and confidentiality (e.g., coding, limited/controlled access, honest broker mechanisms, de-identification processes, limited data use agreements); policies regarding access to specimens; the nature of the research for which the specimens may be used; the ability to locate or contact subjects; risk of introducing bias into the collection; potential anxiety or confusion for subjects; the number of subjects; the length of time since specimens were first collected; and the likelihood that subjects would object to the research use of their specimens.

HIPAA Issues. A covered entity's use or disclosure of protected health information to create a research database or repository is considered a separate research activity under the HIPAA Privacy Rule. Assuming the academic medical center is a HIPAA covered entity, the disclosure or use of direct identifiers for the purpose of creating the database would require a HIPAA authorization from the subject or an IRB or Privacy Board waiver of the authorization requirement. If the specimens could be included in the database using only information about the subject that constitutes a limited data set, the specimens could be included in the database after the academic medical center and the database have signed a data use agreement that complies with the requirements in 45 CFR 164.514(e)(4).

FDA Issues. FDA regulations do not cover the specimen banking. However, if the tissues are used to test an FDA regulated IVD, then IRB review is required. It may not be necessary to obtain informed consent of the subjects for the secondary use if an IRB waives informed consent requirements under the “Minimal Risk” Guidance or if the seven conditions are met in the FDA “Guidance on Informed Consent for In Vitro Diagnostic Device Studies Using Leftover Human Specimens that are Not Individually Identifiable.” If requirements of neither policy are met, then consent addressing the elements under 21 CFR 50.25 is required.

FAQ #13: A research participant provides informed consent and an authorization to allow extra blood and associated PHI to be stored for future research purposes. Blood samples will be stored in a repository with identifiers. The participant later changes his/her mind. Is this allowed, once tissue has been stored?

Response – HHS Common Rule Issues. Yes. Subjects have the right to withdraw from research, and this extends to withdrawing their specimens from future research. Subjects should be informed upfront about the procedures for withdrawing specimens from a repository. The obligation to honor subjects’ requests to withdraw does not extend to retrieving specimens already distributed to secondary users. Analyses already completed will generally not be destroyed or removed from datasets. These practical limitations to withdrawal should be disclosed to subjects as part of the consent process.

HIPAA Issues. With respect to HIPAA authorizations, the HIPAA Privacy Rule provides an individual with the right to revoke an authorization in writing, except to the extent the covered entity has already acted in reliance on the authorization. For example, a covered entity is not required to retrieve information that it disclosed from its repository to a researcher under a valid authorization before receiving the revocation. Thus, if a covered entity obtained an individual’s authorization to disclose identifiable health information from its repository to a researcher, then the covered entity is not required to seek the return of the information from the researcher. Further, the reliance exception would permit the continued use or disclosure of PHI by a covered entity already obtained pursuant to the authorization to the extent necessary to protect the integrity of the research (e.g., to account for the subject’s withdrawal from a research repository).

FDA Issues. The FDA regulations do not cover the specimen banking. If the tissues were used in an FDA regulated clinical investigation to test an IVD, then the subjects have the right to withdraw from research, and no future use of the specimens can be made. Please refer to the FDA guidance “Data Retention When Subjects Withdraw from FDA-Regulated Clinical Trials” for information on the withdrawal of data.

FAQ #14: A research subject provides informed consent to allow extra blood to be stored with identifiers for future research purposes. The individual later changes his/her mind and requests that the specimen be withdrawn from the biorepository. The lead investigator who manages the repository proposes to the IRB that, rather than losing valuable specimens, all identifiers and coding be permanently removed, so that it would be impossible for anyone ever to link to this subject’s identity; doing so would mean that any subsequent uses are not human subjects research, per OHRP guidance. Is this an acceptable approach?

Response – HHS Common Rule Issues. While it is true that permanently stripping a specimen of all identifiers or codes would mean that subsequent uses are not considered to be human subjects research, doing this after the subject has made the request for withdrawal of the specimens would be ethically suspect, if done solely to avoid withdrawing specimens on request. If the specimen is identifiable at the time of the request, failing to follow through when it is possible to do so would violate the ethical principle of respect for persons, and possibly the terms of original consent.

Further, an investigator, when faced with a subject’s withdrawal of “broad consent,” might react by de-identifying the subject’s biospecimens or data, and then continuing to use them for research despite the subject’s withdrawal. Although de-identifying biospecimens and/or data as a response to subject withdrawal of “broad consent,” in order to continue to use those biospecimens and data for research, may not offend specific regulatory standards, such a practice would offend accepted ethical precepts of human subjects research. Alternately, a subject seeking to withdraw his or her biospecimens may be appropriately asked by the researcher to allow the biospecimens to be de-identified but retained for future research use.

If an investigator intends, upon subject withdrawal, to de-identify the subject’s data and biospecimens and continue to use them in their new de-identified form for research, this must be stated in the original informed consent. However, an IRB should probably view such a practice as ethically suspect and should consider disapproval of it, even if the practice may not prohibited by specific regulation.

Notably, in the preamble to the revised Common Rule, in discussing the consequences of a subject’s withdrawing his or her “broad consent,” OHRP noted that this would not be possible if the data or biospecimens had already been de-identified , for example, at study conclusion or when sharing with other investigators.

HIPAA Issues. Assuming the removal of identifiers and coding is sufficient to de-identify the PHI associated with the specimen in compliance with 45 CFR 164.514(b), the HIPAA Privacy Rule no longer governs the use or disclosure of the remaining information..

FDA Issues. FDA regulations do not cover specimen banking.

FAQ #15: An investigator collected specimens from a large number of cancer patients and stored them with identifiers. Some of the patient-subjects are now deceased. Is research using the specimens of those subjects who died still considered to be human subjects research, and under the oversight of an IRB?

Response – HHS Common Rule Issues. No. 45 CFR 46.102 defines a human subject as a “living individual.” However, deceased individuals would still have protections under the HIPAA Privacy Rule. Ethical considerations remain, and some IRBs may choose to accept jurisdiction even though the subjects are deceased.

HIPAA Issues. The Privacy Rule generally protects the Protected Health Information of decedents in the same manner as that of living individuals for fifty (50) years following the individual’s death. However, in the research context, the Privacy Rule allows the use or disclosure of decedent information without the authorization of a personal representative and without waiver of authorization by an IRB or Privacy Board if the covered entity receives representations from the researcher that the decedents’ protected health information is necessary for the research and is being sought solely for research on decedents (and not related living individuals) and, upon request of the covered entity, receives documentation of the deaths of the individuals.

FDA Issues. No. Under FDA's regulations, "human subject" means "an individual who is or becomes a participant in research, either as a recipient of the test article or as a control. A subject may be either a healthy human or a patient." (See 21 CFR 50.3(g); similar language is found at 21 CFR 312.3 and 812.3(p).) FDA has interpreted its regulations as applicable only to research involving living human subjects. Since the individuals referenced are deceased, research involving those tissues does not meet FDA’s definition of a clinical investigation involving human subjects. See FAQ # 114 in the FDA guidance document “Exception from Informed Consent Requirements for Emergency Research.”

FAQ #16: An investigator who collected and stored identifiable specimens accepts an offer at another institution, and plans to move the specimens with or without identifiers to the new institution. What are the issues that the IRB and/or institution should consider, when faced with this situation?

Response – HHS Common Rule Issues. In most cases, specimens collected at an institution, in the course of research or medical practice at the institution, will belong to the institution, not to the investigator. These issues are an institutional responsibility, and involve multiple components across the institution, including legal counsel, sponsored or grant programs administration, the technology transfer office, and the IRB, as appropriate. The first determination is whether, and if so how, the institution will release the specimens to the new institution. The IRB’s role could include determination as to whether the transfer and use of specimens at the new institution is compatible with the consent under which the specimens were collected, whether additional consent may be required, or whether there are concerns relating to the communities or populations represented by the specimens.

Beyond these IRB-related considerations, other institutional policies will need to be considered. Formal agreements should be established that govern the transfer of specimens from the institution that provides the specimens to the investigator and/or the new receiving institution. These agreements should specify as appropriate the rights and obligations of both the provider and the recipient, including intellectual property terms and publication rights, as well as the rights of subjects (e.g., whether subjects would have the ability to withdraw specimens once they pass to the new institution).

Similar considerations at the receiving institution would apply, including the need for IRB review of proposals for ongoing use of identifiable specimens. If specimens are transferred without identifiers, subsequent uses would not be considered to be research involving human subjects under 45 CFR Part 46.

HIPAA Issues. If the institution is a HIPAA covered entity and the specimens are to be transferred along with information that constitutes protected health information, then the institution needs to consider whether the transfer of information from it to another entity was encompassed in the original HIPAA authorization or in any IRB or Privacy Board waiver of the authorization requirement that the institution may have obtained. If the specimens could be transferred along with only information about the subject that constitutes a limited data set, the specimens could be transferred after the transferring institution and the receiving institution have signed a data use agreement that complies with the requirements in 45 CFR 164.514(e)(4). If the specimens could be transferred after having been de-identified in a manner that complies with 45 CFR 164.514(b), the HIPAA Privacy Rule would not govern the transfer.

FDA issues. If the specimens are being or have been used in FDA regulated clinical investigations of IVDs, then FDA and the sponsor have to be notified if there is a change in ownership or location.

FAQ #17: A clinical trial is funded by an industry sponsor or other entity and the contract provides for specimens to be transferred to the sponsor or other entity. What factors should be considered in such an arrangement?

Response – HHS Common Rule and HIPAA Issues. This arrangement requires coordination of the provisions of the protocol, informed consent form, HIPAA authorization, and clinical trial or other sponsorship agreement. The protocol should describe the specific specimens and data to be transferred to the sponsor, and this transfer of identified specimens should be disclosed to the research subject in the informed consent form, at least in general terms. (Presumably, the disclosure to the sponsor of the identifiable data that are to accompany those specimens has been permitted by the study’s HIPAA authorization, which may or may not have been combined with the informed consent.) The best practice for informed consent in such an arrangement is to inform the research subject what the future research uses would be and whether there will be any restrictions on the recipient of the specimens and associated data in regard to their future use. In situations in which there are no contractual provisions that limit the recipient sponsor’s downstream uses of the specimens, the subjects therefore should be informed of this, in the same manner that they are informed that once personal data have been disclosed to a sponsor that is not a HIPAA covered entity, there is essentially no HIPAA-imposed limit on the sponsor’s future uses of those data. If a research site or researcher seeks to limit downstream uses by a recipient sponsor of specimens or data, then this can usually be accomplished by seeking to negotiate, in the clinical trial or other sponsorship agreement, specific limits on future uses by the sponsor of the transferred specimens and data. Under “broad consent” requirements, prospective subjects must be informed of the types of institutions or researchers that might conduct research with the identifiable biospecimens or identifiable data.

FDA issues. If the specimens are being or have been used in FDA regulated clinical investigations of IVDs, then FDA and the sponsor have to be notified if there is a change in ownership or location.

FAQ #18: The protocol for a clinical trial stipulates that all samples should be destroyed after the study is completed. The consent form is silent on the disposition of samples after the study. What should be done if there are 10,000 identifiable specimens and new scientific data emerge in the field that warrant further testing on the samples?

Response – HHS Common Rule Issues. The investigator could amend the protocol, describing the circumstances and seeking IRB approval to retain the specimens for additional research. The IRB should consider if this additional research is compatible with the original terms under which samples were obtained, and whether a waiver of informed consent, or obtaining new consent from subjects, may be appropriate.

HIPAA Issues. The HIPAA Privacy Rule would govern protected health information accompanying the specimens, not the specimens themselves. Assuming the investigator is in a HIPAA covered entity, the disclosure or use of direct identifiers for additional research would also require a HIPAA authorization from the subject or an IRB or Privacy Board waiver of the authorization requirement. If the additional research could be performed using only information about the subject that constitutes a limited data set, the investigator could use and disclose the limited data set for the additional research in compliance with the terms of a data use agreement that complies with the requirements in 45 CFR 164.514(e)(4). If the additional research could be accomplished after the specimens have been de-identified in a manner that complies with 45 CFR 164.514(b), the HIPAA Privacy Rule would not govern the additional research.

FDA Issues. The investigator could amend the protocol, describing the circumstances and seeking IRB approval to retain the specimens for additional research. The IRB should consider if this additional research is compatible with the original terms under which samples were obtained, and whether a waiver of informed consent, or obtaining of new consent from subjects, may be appropriate.

FAQ #19: A tissue biopsy was obtained for clinical diagnostic purposes, which have now been satisfied. The hospital pathology department is willing to provide a portion of the remaining biopsy specimen to an investigator, who will perform research assays with no clinical relevance. If the specimen is coded and identifying information is removed so that the identity of the patient cannot be readily ascertained by the investigator before it is provided to them (so that it is de-identified for the purposes of HIPAA), is the investigator conducting human subjects research under the purview of an IRB?

Response – HHS Common Rule Issues. No, this is not research involving human subjects, because the recipient investigator will not be able to readily ascertain the identity of patients from whom specimens were obtained.

FDA Issues. If the tissues are used to test an FDA regulated IVD, then IRB review is required. It may not be necessary to obtain informed consent of the subjects for the secondary use if an IRB waives informed consent requirements under the “Minimal Risk” Guidance or if the seven conditions are met in the FDA “Guidance on Informed Consent for In Vitro Diagnostic Device Studies Using Leftover Human Specimens that are Not Individually Identifiable.” If requirements of neither policy are met, then consent addressing the elements under 21 CFR 50.25 is required.

FAQ #20: A tissue biopsy was obtained for clinical diagnostic purposes, which have now been satisfied. The hospital pathology department is willing to send a portion of the remaining biopsy specimen to an investigator, who will perform research assays. If the specimen will be provided to the researcher in an identifiable manner, is this considered to be human subjects research under the purview of an IRB?

Response – HHS Common Rule Issues. Yes, this is human subjects research. Because investigators will receive a specimen with identifiable information, the research is human subjects research that is nevertheless potentially eligible for an exemption or expedited review.

FDA Issues. If the tissues are used to test an FDA regulated IVD, then this is a clinical investigations for which IRB review is required and consent addressing the elements under 21 CFR 50.25 is required.

FAQ #21: Many hospitals have a sentence on the standard admission form to the effect that “This is a teaching and research institution, and any specimens remaining after your care is complete may be used for teaching or research purposes.” Is this sufficient to allow identifiable specimens to be used for research purposes, without any additional consent or waiver?

Response – HHS Common Rule Issues. No, an additional consent or waiver is required. If the information provided to prospective subjects were limited to the above statement, this would not be sufficient to meet the requirements of informed consent for research under 45 CFR Part 46. However, the IRB should review each protocol that proposes to use such specimens and, as part of that review, consider whether the criteria for a waiver of informed consent have been met at 45 CFR 46.116(f).

HIPAA Issues. This approach (single sentence on the hospital admission form) would also not be sufficient for HIPAA authorization purposes. In order to comply with the HIPAA Privacy Rule, an authorization must meet the requirements of 45 CFR 164.508(c).

FDA Issues. If the tissues are used to test an FDA regulated IVD, then IRB review is required and consent addressing the elements under 21 CFR 50.25 is required, unless an IRB waives informed consent requirements under the “Minimal Risk” Guidance. The single sentence on the admission form would not meet this requirement.

FAQ #22: Many hospitals have a sentence on the standard admission form to the effect that “This is a teaching and research institution, and any specimens remaining after your care is complete may be used for teaching or research purposes.” Is this sufficient to allow identifiable specimens to be placed into a tissue bank, if they are coded and released to researchers through an honest broker mechanism?

Response – HHS Common Rule Issues. As above, the statement on the admission form would not be considered sufficient to meet the requirements of informed consent under 45 CFR Part 46. The plan to remove identifiers from the specimens and manage them through a bank might be factors the IRB considers when assessing the risks to subjects, but it doesn’t change the fundamental answer above (FAQ #21). The creation of a bank containing identifiable specimens would be considered human subjects research and thus, subject to IRB review and informed consent. However, the IRB could consider whether the criteria for waiving or altering informed consent have been met at 45 CFR 46.116(f). The subsequent research use of specimens would not be considered human subjects research if the conditions of the OHRP guidance on coded private information or biological specimens have been met.

FDA Issues. FDA regulations do not apply to specimen banking. However, if the tissues are used to test an FDA regulated IVD, then IRB review is required. It may not be necessary to obtain informed consent of the subjects for the secondary use if an IRB waives informed consent requirements under the “Minimal Risk” Guidance or if the seven conditions are met in the FDA “Guidance on Informed Consent for In Vitro Diagnostic Device Studies Using Leftover Human Specimens that are Not Individually Identifiable.” If neither policy is met, then consent addressing the elements under 21 CFR 50.25 is required. The single sentence on the admission form would not meet this requirement.

FAQ #23: A 13-year-old child is enrolled by his/her parents in a tissue banking protocol that involves storage of specimens for future research. Is the child’s assent required at the time of the original enrollment in the repository, in addition to parental permission?

Response – HHS Common Rule Issues. Yes, if the IRB determines that the children are capable of providing assent, taking into account the ages, maturity and psychological state of the subjects [45 CFR 46.408(a) and 46.116]. Given that most projects that store tissues for future unspecified research are not likely to hold out a prospect of direct benefit that is important to the health or well-being of the children and are not likely to offer a benefit to the child that is available only in the context of the research, then waiver of the child’s assent would not be appropriate, and affirmative agreement on the part of the child would generally be required.

HIPAA Issues. The HIPAA Privacy Rule does not require assent.

FDA Issues. Tissue banking in and of itself does not constitute an FDA regulated clinical investigation, and the FDA regulations would not apply.

FAQ #24: A child is enrolled by his/her parents in a tissue banking protocol that involves storage of specimens for future research. Should there be a process in place for the child to give consent for continued storage and use of specimens when he/she reaches the age of majority?

Response – HHS Common Rule Issues. In and of itself, the retention of specimens in a biobank is not considered to be research involving human subjects. However, ongoing use of such specimens (e.g., continued analysis of specimens or data for which the subject’s identity is readily identifiable to the investigator(s)), or ongoing collection of identifiable information, is human subjects research. In these cases, it would be necessary for the investigator(s) to seek and obtain the legally effective informed consent of the now-adult subjects.

The IRB may consider, if appropriate, a waiver under 45 CFR 46.116(f) of the requirements for obtaining informed consent in order for the subjects to continue their participation in the research. Such a waiver may be considered at the time of initial review or during a subsequent amendment. Factors that may make it impracticable to conduct the research, and therefore would support a waiver, include the number of subjects, length of time since first enrolled, and ability to locate subjects (see also FAQ #6).

HIPAA Issues. A valid HIPAA authorization signed by a parent, as the personal representative of a minor child at the time the authorization is signed, remains valid until it expires or is revoked, even if such time extends beyond the child’s age of majority. However, if the authorization expires on the date the minor reaches the age of majority, a new authorization would be required at that time for continued use or disclosure of protected health information Absent obtaining a new authorization, a covered entity may only continue to use and disclose for research purposes if 1) an IRB or privacy board has waived the requirement for an authorization, or 2) if the use or disclosure is of a limited data set after the signing of a data use agreement that complies with the requirements in 45 CFR 164.514(e)(4), or if 3) information has been de-identified in a manner that complies with 45 CFR 164.514(b) so that the HIPAA Privacy Rule would not govern.

FDA Issues. Tissue banking in and of itself does not constitute an FDA regulated clinical investigation, and the FDA regulations would not apply.

FAQ #25: What issues should be addressed in the consent process with regard to sponsorship, ownership, control, access, commercialization and possession of stored specimens?

Response – HHS Common Rule Issues. Consent documents for such projects must include, when appropriate, a statement that the subject’s biospecimens may be used for commercial profit and whether the subject will or will not share in this commercial profit. The consent also should disclose sponsorship and address issues including (but not limited to) disposition of samples, who will have access, and how samples will be used. Subjects should be informed to what extent, if any, they can expect to control or receive compensation from future commercial uses.

Some of these matters are subject to state laws, and consent documents should reflect any such applicable requirements.

As with any part of the consent form, care should be taken to communicate these complicated issues in simple terms understandable to the subject.

Attachment C - Updated FAQs on Informed Consent for Use of Biospecimens and Data

Related Letters