Building Data or Biospecimen Repositories for Future Use

Who Can Build a Data or Biospecimen Repository?

Data and/or biospecimen repositories, registries, or banks may be maintained by:

An investigator or department within the University of Utah and its covered entity
An external investigator or institution
A sponsor (industry, government agency, or non-profit organization)

Organizers of a repository control access to data and/or biospecimens. It is important that the management of the repository include physical and procedural mechanisms for the secure receipt, storage, and transmission of the data and/or biospecimens.

Is IRB Approval Necessary to Build a Registry?

There are many scenarios in which a database or registry is created or used. Generally:

Building and maintaining a registry or database for current research purposes needs IRB approval.
Building and maintaining a registry or database for future research purposes needs IRB approval.
Creating and maintaining a registry or database for quality improvement purposes does not need IRB approval. However, if an investigator later wants to access that registry or database for research, IRB approval should be sought.
Using identifiable data from any database or registry for research purposes needs IRB approval. See Use of Collected Data or Biospecimens.

The IRB considers each project on a case-by-case basis and will apply the appropriate human research protection regulations and HIPAA regulations, as applicable. Some projects may not be considered human subjects research but still be subject to HIPAA privacy regulations.

Investigators who collect data and biospecimens to be entered into a repository must:

Create a management plan
Obtain IRB approval, as applicable.

Investigators receiving data and/or biospecimens from the repository must also agree in writing to specific conditions required by the repository’s IRB.

IRB Applications for Repository Protocols

Researchers who wish to develop or maintain a research data and/or biospecimen repository must submit an application for IRB review and receive IRB approval before initiating any repository-related activity. A repository protocol may be submitted to the IRB to accomplish one of the following purposes:

Define the operating parameters for establishing and maintaining a new research repository.
Convert an existing non-research repository into a research repository.

A repository's operating procedures must include detailed mechanisms for controlling the collection, storage, use, and sharing of its samples and information.

The University of Utah IRB is responsible for any research repository maintained at the University of Utah or its affiliate institutions.

In addition to the usual information contained in a human research protocol and an IRB application, the IRB expects that protocols for establishing and operating a research repository will include at least the following specific information:

A detailed description of the physical and procedural mechanisms for the secure receipt, storage, and transmission of information and/or biospecimens to ensure the protection of participants' privacy and confidentiality.
The specific conditions under which data and/or biospecimens may be accepted into the repository.
The specific conditions under which data and/or biospecimens may be shared with or released to research investigators.

Step 1: Management Plan

An investigator who oversees a data and/or biospecimen repository must follow all the requirements for data/biospecimen use when creating a repository, including informed consent, authorization, sample coding, and de-identification. The investigator over the repository may release information/samples to other investigators for future studies and may include specific identifiers according to the specific wishes of the participant as indicated on the signed informed consent document.

All research data and/or biospecimen repositories managed by University of Utah investigators must have a management plan to secure IRB approval for the collection and use of data and/or biospecimens for research. A data/biospecimen repository management plan template may be found on the Forms Menu. The plan should describe the following:

Consent processes for collecting the data and/or biospecimens
Procedures for protecting privacy and confidentiality of the data and/or biospecimens
Process used to gain access to the data and/or biospecimens for use in future research
Process for returning results to participants and benefits sharing
Governance and oversight over the data and/or biospecimens collection
Process for custodianship of the data and/or biospecimens

Step 2: Consent & Authorization

Informed consent and authorization must be accounted for when building a data and/or biospecimen repository.

Full informed consent and authorization for information or samples that will be collected within the covered entity for the research repository protocol. This means, that a repository is being built for current research purposes.
Full informed consent and authorization for information or samples that were collected. The current project would like to use information or samples that have already been collected and the full consent and authorization that was signed must allow for information or samples to be added to the research registry.
Waiver of consent plus a method to account for authorization (for example, left-over pathology samples or de-identified samples)

Full Consent & Authorization

Full informed consent and authorization must be obtained from participants to allow their information and/or samples for use and/or collecting of their data and/or samples, except where waivers or non-human subject determinations apply.

The consent must clearly state that the collected information and/or samples will be stored and used for future research. Please see the "Future Use of Private Information or Biospecimens" section on the Consent Document Checklist as a guide for the specific requirements or use the Model Consent Language for Future Use of Biospecimens or the Model Consent Language for Future Use of Information.

If use of the sample involves genetic testing, the investigator must also include language regarding the disclosure of results as outlined in the IRB guidance on Genetic Research.

Authorization determines who can have access to participants' protected health information (PHI). This language is outlined in the HIPAA Authorization section of our Consent Document Checklist on the IRB website. It is important to consider authorization how each sample and the accompanying information can be disclosed in the future. Some important considerations include:

What protected health information (identifiable or non-identifiable) will accompany samples?
Who will be allowed to receive the samples with the accompanying health information - only individuals within the University of Utah and its covered entity, or others from outside entities and institutions (e.g., sponsor, FDA, NIH, etc.)?

Waiver of Consent and Authorization

A Waiver of consent and authorization may be requested for obtaining data or samples for future use. However, a waiver is only appropriate if it is impossible or impractical to get consent from the participants. For example, left-over pathology samples or de-identified samples.

A waiver of consent may be requested for the use of data and/or biospecimens. The IRB will approve a waiver if the study meets criteria, as outlined in 45 CFR 46.116(f)(3).
A method to account for authorization must be used in conjunction with a waiver of consent. The following methods may be used:
- Waiver of authorization
- Limited data set
- Safe Harbor De-identification

Step 3: ERICA Application

The management plan for the data and/or biospecimen repository must be attached to the ERICA application as outlined above in section 1. Consent and Authorization must also be accounted for in the application as outlined above in section 2.

Investigators should complete an additional page in the application for the future use of data and/or biospecimens which includes the following questions:

What will be stored for future use?
What type(s) of future research will be allowed on the data/samples?
Who manages the repository and where will the data/samples be storied?
Will data/samples be identifiable or de-identified?
Identifiable means that the participant can be identified by the repository using information kept with or linked to the data/sample.
- Who will manage and have access to the identifiable data? Where will the data be kept? How will the data be kept confidential?
- Who will de-identify the data/samples? When will the data/samples be de-identified?
Will participants be able to withdraw data/samples from the repository?
Will future research results or findings be communicated to participants?
How will researchers obtain data/samples from the repository for use in future research?

Samples that have been collected or will be collected solely for non-research purposes, such as pathology samples, may be used and stored for research. The investigator must either obtain full consent and authorization from participants or provide justification for the use of a waiver of consent and other method to account for authorization.

The IRB will often request that these samples be de-identified without a link to identifiers to protect the privacy and confidentiality of the participants.
According to the Common Rule, deceased individuals do not meet the definition of a human subject; however, the IRB is still responsible for assuring HIPAA regulations are followed and must review research involving specimens collected from postmortem individuals. The IRB will also consider ethical issues concerning potential harm to the decedents’ families or other associated groups (e.g., race, sect, etc.).

Typically, consent is not required to use and store autopsy specimens; however, if the research involves genetic testing of these samples for heritable traits, a consent form signed by the responsible family member(s) may be required. Written consent from the responsible family member(s) should be gained in conjunction with or following the autopsy consent process. Collection of autopsy specimens may not occur without IRB approval.

In addition to the new study application, the Research Using Decedents Information form must also be completed and attached to the new study application.

VA research involving human biospecimens removed at autopsy must be consistent with the permission given by the person authorized to grant permission for autopsy.
There are few opportunities for tissue samples to be publicly available, but there may be limited circumstances of tissue samples being made available to qualified researchers for valid research purposes at a reasonable cost.

Publicly available samples must be characterized as de-identified samples. If the identity of the sample is known, the identity must be recognizable in the public domain and not entitled to a presumption of anonymity.
VA biospecimens may be stored outside the VA with IRB, and VA R&D committee approvals. Several guidance documents are posted on the VA tissue banking website that you can refer to when VA biospecimens are collected and banked for research including:
- Elements to include in a biorepository protocol
- Elements to include in an informed consent form when biospecimens will be banked
- Stewardship of biospecimen collections when they are banked inside or outside the VA

Institutional Review Board