To jump to the applicable section, click the section name below:
| Not Human Research | Qualify for Exempt Review | Record Reviews | Data Management & Sharing |
Secondary Research
[D117.0000] Protocols Involving Coded Private Information or Biological Specimens Guide
Circumstances in which coded private information or biological specimens meet the federal definition of “human research” requiring IRB review.
Activities that meet the federal regulatory definition of “research” with a “human subject” require IRB review. Begin by asking the following questions and considering applicable circumstances. See the National Institutes of Health (NIH) Research Involving Private Information or Biospecimens Flowchart for an overview of the determination.
Does the activity involve research?
Research means “a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge. Activities that meet this definition constitute research for purposes of this policy, whether or not they are conducted or supported under a program that is considered research for other purposes. For example, some demonstration and service programs may include research activities”. [45 CFR 46.102(l)]
Does the research involve human subjects?
Human subject means a living individual about whom an investigator (whether professional or student) is conducting research:
1. obtains information or biospecimens through intervention or interaction with the individual, and uses, studies, or analyzes the information or biospecimens; or
3. obtains, uses studies, analyzes, or generates identifiable private information or identifiable biospecimens.” [45 CFR 46.102(e)]
Note: Under the definition of human subject at 45 CFR 46.102(e), obtaining identifiable private information or identifiable specimens for research purposes constitutes human subjects research. Obtaining identifiable private information or identifiable specimens includes, but is not limited to:
- using, studying, or analyzing for research purposes identifiable private information or identifiable specimens that have been provided to investigators from any source; and
- using, studying, or analyzing for research purposes identifiable private information or identifiable specimens that were already in the possession of the investigator.
Does the research involve coded information?
Identifying information (such as name or social security number) that would enable the investigator to readily ascertain the identity of the individual to whom the private information or specimens pertain has been replaced with a number, letter, symbol, or combination thereof (i.e., the code) and a key to decipher the code exists, enabling linkage of the identifying information to the private information or specimens.
What if the individual providing the specimen is involved in the conduct, analysis or reporting of the research?
If the individuals who provide coded information or specimens collaborate on other activities related to the conduct of this research with the recipient investigators, then OHRP would consider such additional activities to constitute involvement in the conduct of the research (ex. the study, interpretation, or analysis of the data resulting from the coded information or specimens; authorship of presentations or manuscripts related to the research).
What if the investigator unexpectedly learns or believes it is necessary to learn the identity of individuals to whom the previously obtained private information or specimens pertain?
If an investigator who obtains coded private information or specimens about living individuals unexpectedly learns the identity of one or more living individuals, or is able to readily ascertain the identity of the individuals to whom the previously obtained private information or specimens pertain, then the research activity now would involve human subjects under the HHS regulations. Unless this human subjects research is determined to be exempt under HHS regulations at 45 CFR 46.104(d), IRB review of the research would be required. Informed consent of the subjects also would be required unless the IRB approved a waiver of informed consent under HHS regulations at 45 CFR part 46.116(e) or (f).
What if testing requires analysis of fresh tissue?
For procurement of fresh tissue, it may be necessary to have prior knowledge of specific procedures to obtain excess tissue in time to conduct an analysis that is sensitive to tissue decay. However, if knowledge of surgical procedures results in the researcher’s ability to ascertain a patient’s identity, then the research activity involves human subjects and would require IRB review. Research personnel showing up at the operating room to collect a sample indicates prior awareness of the individual patient. Doing so would only be allowed under an IRB-approved research protocol and with informed consent.
In such cases, it is recommended to consult with an organized specimen bank that can perform rapid identification of tissue availability and serve as an honest broker* to promptly provide the specimen to researchers without identifiers. Organized biospecimen repositories that provide such procurement services generally operate under an IRB-approved protocol in which donors have provided informed consent and authorization for research use and/or sharing of excess or leftover specimens for research purposes.
University of Kentucky (UK) Biospecimen Repositories:
*Honest Broker - an individual or system who collects and provides de-identified information/samples to a recipient secondary researcher. The honest broker collects and collates pertinent information regarding the tissue source, replaces identifiers with a code, and releases only coded information to the researcher. The honest broker should not be involved with the recipient's study or co-author on resulting research publications. For Protected Health Information, the honest broker should de-identify data or samples according to "HIPAA safe-harbor standards" before sending it to the researcher.
What if the research is NIH-funded and generates large-scale genomic data?
The NIH Genomic Data Sharing (GDS) Policy requires IRB review, informed consent for future research, and broad data sharing to be obtained even if the cell lines or clinical specimens are de-identified. The NIH GDS policy applies to all NIH-funded research that generates large-scale genomic data. Large-scale data include genome-wide association studies (GWAS), single-nucleotide polymorphisms (SNPs) arrays, and genome sequence, transcriptomic, metagenomic, epigenomic, and gene expression data. Examples can be found in the Supplemental Information to the "NIH Genomic Data Sharing Policy."
What if the research involves use of newborn dried blood spots?
Research with non-identified newborn blood spots, similar to other research with non-identified specimens, is not considered research with human subjects under the Common Rule Regulations. To determine if additional regulations or applicable ethical principles apply, submit a Not Human Research (NHR) Request Form to ORI for a determination of need for IRB review. Generally, if the subject population has received notification that private information will be used for research purposes (e.g., HIPAA Privacy Notice), IRB review may not be required.
Circumstances in which Coded Private Information or Biological Specimens WOULD NOT generally meet the federal definition of “human research” requiring IRB review.
OHRP considers private information or specimens not to be individually identifiable when they cannot be linked to specific individuals by the investigator(s) either directly or indirectly through coding systems. For example, OHRP does not consider research involving only coded private information or specimens to involve human subjects as defined under 45 CFR 46.102(f) IF the following conditions are BOTH met:
I. The private information or specimens were not collected specifically for the currently proposed research project through an interaction or intervention with living individuals; and
II. The investigator(s) cannot readily ascertain the identity of the individual(s) to whom the coded private information or specimens pertain because, for example:
- The investigators and the holder of the key enter into an agreement prohibiting the release of the key to the investigators under any circumstances, until the individuals are deceased (note that the HHS regulations do not require the IRB to review and approve this agreement);
- There are IRB-approved written policies and operating procedures for a repository or data management center that prohibit the release of the key to the investigators under any circumstances, until the individuals are deceased; or
- There are other legal requirements prohibiting the release of the key to the investigators until the individuals are deceased.
If a researcher or any of the research study personnel listed on the protocol have direct knowledge of subjects or access to the code (the possibility to readily ascertain the identity of the individual or of re-identifying subjects), the activity would be human research requiring IRB review.
To obtain an official “Not Human Research” determination from the IRB: Complete the online Not Human Research (NHR) Request Form.
National Institutes of Health (NIH) Research Involving Private Information or Biospecimens Flowchart
Circumstances in which coded private information or biological specimens may qualify for Exempt IRB review.
Research initiated under the revised human subject regulations include a secondary research category eligible for Exempt IRB review under HHS regulation 45 CFR 46.104(d)
Exempt Category 4 includes Secondary Research for Which Consent is Not Required: Use of Identifiable Information or Identifiable Biospecimens that have been or will be collected for some other ‘primary’ or ‘initial’ activity, if ONE of the following criteria is met:
(i) Biospecimens or Information are Publicly Available
(ii) Information recorded so subject cannot readily be identified (directly or indirectly/linked); Investigator does not contact subjects and will not re-identify the subjects
(iii) Collection and Analysis involving Investigators' Use of Identifiable Health Information when use is regulated by HIPAA “health care operations,” or “research,” or “public health activities and purposes.”
(iv) Research information collected by or on behalf of the federal government using government-generated or collected information obtained for non-research activities.
See the UK ORI's Exemption Categories Overview for Category 4 conditions and limitations.
References
- The Federal Policy for the Protection of Human Subjects (2017)
- OHRP - Guidance on Research Involving Coded Private Information or Biological Specimens (2008)
- Attachment D: FAQ's Terms and Recommendations on Informed Consent and Research Use of Biospecimens
- NIH Genomic Data Sharing Policy (2014)
- Newborn Screening Saves Lives Reauthorization Act (2014)
- NIH Office of Extramural Research Decision Chart for Research Involving Private Information or Biological Specimens
[D126.0000] Record Reviews
Record reviews are a type of secondary research. Secondary research involves research use of material collected for some other primary or initial activity.
The specifics of the record review will determine whether IRB review is needed and, if so, what type of review is applicable. The ORI Interactive Secondary Research Tool provides guidance on the need for and level of review that may apply to your research.
If you are conducting a review with identifiable private records, the records meet the definition of human subjects, and IRB review is required.
A record review involving little to no risk to subjects may be eligible for Exempt Review or Expedited Review. Both review types permit secondary use of material retrospectively and/or prospectively collected.
- Retrospective record reviews evaluate data that is in existence at the time of IRB review.
- Prospective record reviews evaluate data that does not yet exist at the time of IRB review.
In your IRB application, indicate if the collection will include review of records generated after IRB review (i.e., prospective record review). If needed by the entity providing access to the records, you should also include a date range for records you will review or include in data pulls. For instance, the beginning date would be the date the earliest record was generated. The end date would be the date the most recent record was generated. The end date could be the same as the study closure date.
Informed Consent Implication:
Human subject research requires informed consent or an IRB review to waive or alter informed consent. For prospective record reviews, the IRB would consider if the investigators were likely to have access and opportunity to complete an informed consent process with prospective subjects or if it is impracticable to conduct the research without a waiver. In other words, impracticable means the research could not be conducted if informed consent were required.
Informed consent may only be waived or altered in specific circumstances where the regulatory criteria below and ethical considerations are met.
Criteria for waiver or alteration of informed consent:
- The research involves no more than minimal risk to the subjects;
- The waiver or alteration will not adversely affect the rights and welfare of the subjects;
- The research could not practicably be carried out without the waiver or alteration; and
- Whenever appropriate, the subjects or legally authorized representatives will be provided with additional pertinent information after participation.
- If the research involves using or accessing identifiable private information or identifiable biospecimens, the research could not practically be carried out without using such information or biospecimens in an identifiable format.
Research subject to HIPAA regulations must also either obtain a HIPAA Authorization from the subjects or qualify for a HIPAA Waiver of Authorization.
Data Management & Sharing Resources
Additional Resources
National Institutes of Health (NIH) Research Involving Private Information or Biospecimens Flowchart
[T65.0000]
OHRP Coded Private Information or Specimens Use in Research, Guidance (2008)
[T27.0000]