Research Involving Human Specimens

Marianna Bledsoe, M.A.

HRPP 201

March 24, 2011

Overview of Presentation

Applicable federal regulations Determining when human specimen research is

human subjects research Applying relevant federal regulations Considerations for secondary use of

specimens/data Special considerations for banking VA tissue banking guidelines Current hot topics Tools and Resources

Human Biological Specimens

Any material derived from a human subject—such as blood, urine, tissues, organs, hair, nail clippings, or any other cells or fluids

Whether collected for research purposes or as residual specimens from diagnostic, therapeutic, or surgical procedures

Does not include fungi, viruses, bacteria, etc.

Applicable Federal Regulations

Common Rule: 38 CFR part 16 FDA Regulations:

– 21 CFR Part 50, 56, 812

HIPAA Privacy and Security Rules:– 45 CFR Part 160; Subparts A, C & E of Part 164

Privacy Act of 1974 HITECH Breach Notification Interim Final

Rule

When is Specimen Research Human Subjects Research?

Is it research?– Research means a systematic investigation,

including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge.

– OHRP considers creation of repositories for research purposes a research activity

When is Specimen Research Human Subjects Research?

Is it human subjects research?– Human subject – A living individual about whom

an investigator (whether professional or student) conducting research obtains a) data through intervention or interactions with the individual, or b) identifiable private information. [38 CFR 16.102(f)]

– Common Rule definition of identifiable = the identity of the subject is or may readily be ascertained by the investigator or associated with the information

When is Specimen Research Human Subjects Research?

Is it human subjects research (cont’d)?– For VA, research must meet both the

Common Rule and Privacy Rule definitions of identifiable.

When is Specimen Research Exempt?

(4) Research involving the collection or study of existing data, documents, records, pathological specimens, or diagnostic specimens, if these sources are publicly available or if the information is recorded by the investigator in such a manner that subjects cannot be identified, directly or through identifiers linked to the subjects.

OHRP Guidance on Coded Private Information or Biological Specimens

Definition of “Coded”:

(1) identifying information (such as name or social security number) that would enable the investigator to readily ascertain the identity of the individual to whom the private information or specimens pertain has been replaced with a number, letter, symbol, or combination thereof (i.e., the code); and

(2) a key to decipher the code exists, enabling linkage of the identifying information to the private information or specimens.

OHRP Guidance on Coded Private Information or Biological Specimens

“In general, OHRP considers private information or specimens to be individually identifiable as defined at 45 CFR 46.102(f) when they can be linked to specific individuals by the investigator(s) either directly or indirectly through coding systems.”

However, the OHRP coded specimens policy allows exceptions under certain conditions.

OHRP Guidance on Coded Private Information or Biological Specimens

Research involving only coded information or specimens is not considered to involve human subjects if the following conditions are both met:

(1) the private information or specimens were not collected specifically for the currently proposed research project through an interaction or intervention with living individuals; AND

(2) the investigator(s) cannot readily ascertain the identify of the individual(s) to whom the coded private information or specimens pertain.

OHRP Guidance on Coded Private Information or Biological Specimens

Examples of When Coded Data/Biologic Specimens Are Not Individually Identifiable to Investigators:

(a)the investigators and the holder of the key enter into an agreement prohibiting the release of the key to the investigators under any circumstances, until the individuals are deceased

OHRP Guidance on Coded Private Information or Biological Specimens

Examples of When Coded Data/Biologic Specimens Are Not Individually Identifiable to Investigators:

(b) there are IRB-approved written policies and operating procedures for a repository or data management center that prohibit the release of the key to the investigators under any circumstances, until the individuals are deceased; or

(c) there are other legal requirements prohibiting the release of the key to the investigators, until the individuals are deceased.

OHRP Guidance on Coded Private Information or Biological Specimens

Only applies if:

1. Person(s) doing coding of data/specimens and person(s) holding codes are not part of the research team; AND

2. Specimens/data are not being obtained for thespecific research in question by an interaction or intervention with living individuals.

Informed Consent

Informed consent required when there is intervention/interaction with a living individual or private identifiable information is being collected and/or used, unless waived by the IRB

Should be clear and understandable

Additional Informed Consent Content

Must meet requirements of human subjects regulations

In addition, should also include:– Description of specimens/data and process used for

collecting them– Risks, including risks to privacy and confidentiality,

and methods to protect risks– Description of the purpose of the collection and

conditions for sharing– Types of research to be conducted

Additional Informed Consent Content

– Statement of the right to withdraw– Whether results will be returned– Commercial use, if any, and plans, if any, for

sharing profits– Plans for re-contact, if any

As appropriate:– Details about where and how long the specimens

will be stored– Genetic uses and information on the

consequences of DNA typing

Additional Informed Consent Content

As appropriate (cont’d)– Conditions for sharing with other researchers– What will happen to specimens when no

longer useful, when repository loses support, or is transferred to others

IRB Waivers of Consent

The research involves no more than minimal risk to the subjects;

 (2) The waiver or alteration will not adversely affect the rights and welfare of the subjects;

 (3) The research could not practicably be carried out without the waiver or alteration; and

 (4) Whenever appropriate, the subjects will be provided with additional pertinent information after participation.

Secondary Use of Specimens

Research use for a purpose other than that described in the protocol

Research should be compatible with the informed consent under which the specimens were collected– See discussion of the Secretary’s Advisory

Committee for Human Research Protections

Special Considerations for Repositories

How does the Common Rule apply? Three paths to human subjects research:

– Creating a research repository/database through intervention or interaction with individual

– Creating a research repository/database by obtaining identifiable private information

– Obtaining identifiable private information from a research repository/database

Special Considerations for Repositories

Need for review and oversight of repository operating procedures and policies for protecting subject privacy and confidentiality, access and dissemination

Need for mechanism for ensuring specimen use is consistent/compatible with informed consent

Need to address custodianship issues: – Material Transfer Agreements; CRADAs– Plans if repository/bank closes– Plans for transfer if PI leaves institution

HIPAA Privacy and Security Rules

HIPAA does not apply to specimens per se, but may apply to information associated with the specimen

HIPAA authorization for use and disclosure of protected health information generally required but there are certain exceptions

HIPAA Privacy Rule

Use or Disclosure of PHI for Research With an individual’s Authorization

Must be study specific

Authorization NOT required if one of the following applies: IRB or Privacy Board waiver Preparatory to research (with certain representations) Limited data set (with data use agreement) De-identified dataset Research solely on decedents (with certain representations and

documentation) IC, waiver of IC, or express legal permission prior to compliance

date (and other conditions of transition provisions met)

VA Policies VHA Handbook 1200.05--Requirements for the

Protection of Human Subjects in Research VHA Handbook 1200.12—Use of Data and Data

Repositories in VHA Research VHA Handbook 1605.1--Privacy and Release of

Information VHA Handbook 1605.2—Minimum Necessary

Standard for Protected Health Information VA Handbook 6500--Information Security Program VHA Handbook 1106.01—Pathology and

Laboratory Medicine Service Procedures

VA Specimen Banking Guidelines

Current requirements found on ORD web site http://www.research.va.gov/programs/tissue_banking/default.cfm

VA Definition of De-identified De-identified data is health or other information

about an individual that:

Does not contain any of the 18 HIPAA identifiersAND

Is de-identified according to the Common Rule

HIPAA Identifiers

1. Names or initials

2. All geographic subdivisions smaller than a state

3. All elements of dates except the year and all ages over 89

4. Telephone numbers

5. Fax numbers

6. E-mail addresses

7. Social Security numbers (or scrambled SSNs)

8. Medical record numbers

9. Health plan beneficiary numbers

HIPAA Identifiers (cont’d)

10. Account numbers

11. Certificate or license numbers

12. Vehicle identifiers

13. Device identifiers and serial numbers

14. URLs

15. IP addresses

16. Biometric identifiers, including finger and voice prints

17. Full-face photographs and any comparable images

18. Any other unique identifying number, characteristic, or code

Specimens for a Single Research Protocol

.

A waiver from ORD must be obtained if:– If specimens are stored off-site at a non-profit

institution 5 years– If specimens are stored off-site at a non-academic,

for-profit institution for >3 months If the specimens are sent to a non-VA institution for

testing as defined in the protocol, once the specific analyses are performed, the remainder of the specimens must be destroyed or returned to the VA for destruction.

Collecting and Storing Specimens for Secondary or Future Research

A tissue bank established at a VA site by a VA-paid investigator does not require ORD approval.

The ACOS/R or research office should maintain records of all tissue banks within the facility.

Collecting and Storing Specimens for Secondary or Future Research

The researcher must obtain a waiver from ORD before banking human biological specimens for future research use at an off-site location.

Specimens may not be banked for future research use at a non-academic, for-profit institution.

Off-site tissue banks are approved on a per protocol basis.

Collecting and Storing Specimens for Secondary or Future Research

Exception: National Cancer Institute (NCI)-sponsored cooperative tissue banks listed on the next slide. As a result of a letter of understanding with the NCI, these banks are designated as VA-approved if they are used for one of their protocols (for example, the SWOG-supported tissue bank can be used for SWOG protocols without ORD approval).

VA-Approved NCI Tissue Banks

Clinical Trials Cooperative Groups Tissue Resources – American College of Surgeons Oncology Group (ACOSOG) – Cancer and Leukemia Group B (CALGB) – Eastern Cooperative Oncology Group (ECOG) – Gynecologic Oncology Group (GOG) – North Central Cancer Treatment Group (NCCTG) – National Surgical Adjuvant Breast and Bowel Project (NSABP) – Radiation Therapy Oncology Group (RTOG) – Southwest Oncology Group (SWOG)– National Cancer Institute of Canada Clinical Trials Group (NCIC

CTG) Cooperative Breast Cancer Tissue Resource Cooperative Human Tissue Network Gynecologic Oncology Group Tissue Network Cancer Prevention Network

Storage of Specimens

Specimens must be labeled with a code that does not contain any of the 18 HIPAA identifiers.

In the case of storage at non-profits, the key to the code must be maintained at the VA unless there is a compelling reason otherwise. If the storage is at a for-profit institution, then it is mandatory that the code be maintained at the VA.

Additional Requirements for Specimens Stored at For-Profit Sites

Only analyses/tests listed in the protocol and informed consent may be performed.

The code must be maintained at the VAMC. All specimens must be de-identified to meet both

Common Rule and HIPAA requirements. Limited DNA/RNA analyses may be performed.

Additional Requirements (cont’d)

HIPAA authorization must be a separate stand alone document and expire at the end of the study.

Use of initials outside of VA is generally not permitted.

Before company personnel may view files at the VA, they must complete VA security and privacy training.

Specimens must be destroyed within 1 year of the study completion date. The company should inform the PI in writing when samples are destroyed.

Data Linked to Banked or Stored Specimens

If data linked to the sample leaves the VA, then it should be de-identified or stored in a database that is encrypted according to FIPS 140-2 standards.

See VA Handbook 6500 “Information Security”

Application Process

The investigator must complete VA form 10-0436. This is a pdf form that can be filled in and saved using Acrobat Reader version 7 or higher (http://www.va.gov/vaforms/medical/pdf/vha-10-0436-fill.pdf).

The additional required information can be scanned and attached to the pdf or to the e-mail. – Research protocol– Tissue bank manual /SOPs [non-profits]– VA consent form– HIPAA authorization

Application Process (cont’d)

The application should be e-mailed to Kristina Hill (Kristina.Hill@va.gov). It should be sent from the research office.

Alternatively, the form and requested information can be faxed to: (202) 495-6156.

Application Process (cont’d)

After the application is reviewed, the PI and ACOS/R will receive a memo listing any issues that need to be addressed.

Frequent issues with applications include informed consent issues, use of identifiers, long term storage, and mandatory banking or genetic testing which is not permissible except when integral to study design.

Multi-Site Trials

If several VAMCs are planning to participate in the same clinical trial, then only one of the VA sites needs to apply for a waiver.

In the Works

Changes to the HIPAA Privacy Rule HITECH Breach Notification Requirements

Final Rule New VA Handbook on Specimen

Research

Current Hot Topics

Return of Research Results and Incidental Findings

Group Harms Intellectual

Property/Ownership/Custodianship Identifiability

– Differing definitions– Impact of emerging genetic technologies and

extent and availability of databases containing patient/subject information

Current Policy Discussions

Secretary’s Advisory Committee on Human Research Protections

– http://www.hhs.gov/ohrp/sachrp– FAQs on Specimen Research (October 2008 –

October 2010)– Implications of the Havasupai Case (July 21,

2010)– Discussion of Identifiability (October 20, 2010)– Subcommittee on Harmonization exploring

secondary use of specimens, HITECH

Biorepository Best Practices

International Society for Biological and Environmental Repositories (ISBER) “2008 Best Practices for Repositories” http://www.isber.org/Pubs/BestPractices2008.pdf

National Cancer Institute Best Practices for Biospecimen Resources (June 2007) http://biospecimens.cancer.gov/global/pdfs/NCI_Best_Practices_060507.pdf

Other Resources

Report of the Public Responsibility in Medicine and Research (PRIM&R) Human Tissue/Specimen Banking Working Group (March 2007) http://www.primr.org/uploadedFiles/PRIMR_Site_Home/Public_Policy/Recently_Files_Comments/Tissue%20Banking%20White%20Paper%203-7-07%20final%20combined.pdf

Contact Information

Marianna Bledsoe, M.A. Senior Program Manager for

Biorepositories and Biobanking E-mail: Marianna.Bledsoe@va.gov Phone: 202-443-5781 Fax: 202-495-6156

Acknowledgements

Marilyn Mason, PhD. Kristina Hill, MPH

Selected SACHRP FAQs

FAQ # 1Approved by SACHRP July 22, 2009

Tissue biopsies were obtained for clinical diagnostic purposes, which have now been satisfied. The hospital pathology department is willing to provide a portion of the remaining biopsy specimens to an investigator who will perform research assays. In order to allow matching with relevant clinical information, the specimens will be provided with identifiers such that the investigator can readily ascertain the identity of subjects.

Is consent of the patient from whom the biopsy was taken (or waiver of consent) required for the secondary research use?

Response # 1Approved by SACHRP July 22, 2009

Yes. Under this scenario, informed consent of the subjects should either be obtained or waived under 45 CFR 46.116(d) because the samples are identifiable to the recipient investigator.

HIPAA Issues for FAQ #1Approved by SACHRP October 27, 2009

Assuming the hospital is a HIPAA covered entity, the use or disclosure of patient identifiers for the research purpose would also require a HIPAA authorization from the patient or a waiver of authorization by an IRB or Privacy Board.

FAQ # 2Approved by SACHRP July 22, 2009

Tissue biopsies were obtained for clinical diagnostic purposes, which have now been satisfied. The hospital pathology department is willing to provide a portion of the remaining biopsy specimens to an investigator who will perform research assays. The specimens will be coded such that the investigator will not be able to readily ascertain the identity of individuals.

Is consent of the patient from whom the biopsy was taken (or waiver of consent) required for the secondary research use?

Response # 2Approved by SACHRP July 22, 2009

No. Under this scenario, neither consent nor waiver is required, because the activity is not considered to be research involving human subjects.

HIPAA Issues for FAQ #2Approved as modified by SACHRP October 27, 2009

If the information associated with the specimens is de-identified in accordance with the HIPAA Privacy Rule, neither authorization nor waiver of authorization is required, because it would no longer be considered Protected Health Information.

Note, however, that information associated with the specimens that is not individually identifiable per OHRP guidance (i.e., coded) may not necessarily be de-identified for HIPAA Privacy Rule purposes. For example, the coded information may not be considered to be de-identified under the Privacy Rule if the code is derived from a patient identifier or certain data elements, such as dates of service or zip codes, remain with the information. Thus, the use or disclosure of the information for research may still require a form of HIPAA permission, such as a HIPAA authorization, IRB or Privacy Board waiver of authorization, or, if the information constitutes a “limited data set” a data use agreement with the recipient of the information.

FAQ # 6Approved by SACHRP October 27, 2009

Blood samples were obtained for research purposes, with informed consent of the subjects, and the original study has been completed. The samples remain under the control of the original investigator. Another investigator wants to use a portion of the remaining samples to perform research unrelated to the original study.

If the sample is identifiable to the secondary user, is this considered to be human subjects research under the purview of the IRB? If so, what are the consent considerations ?

Response # 6Approved by SACHRP October 27, 2009

Yes. This is human subjects research under the purview of the IRB. The IRB should consider whether the secondary use is compatible with the original terms of consent given by the subjects.

HIPAA Issues for FAQ #6Approved by SACHRP October 27, 2009

A HIPAA authorization for research must be research-study specific. Thus, assuming a HIPAA covered entity is involved, a new HIPAA authorization would be required for the subsequent unrelated research use or disclosure, or another form of HIPAA permission obtained (e.g., waiver of authorization).

FAQ # 7Approved by SACHRP October 27, 2009

Blood samples were obtained for research purposes, with informed consent of the subjects, and the original study has been completed. The samples remain under the control of the original investigator, who now wants to collaborate with another investigator to perform research unrelated to the original study.

If the original consent was silent on the question of subsequent uses, is informed consent (or waiver of consent) required before the sample can be used for other purposes?

Response # 7Approved by SACHRP October 27, 2009

Yes. Under these circumstances, the IRB should consider the original terms of consent, and determine whether a waiver might be appropriate or whether additional consent is required.

The criteria for waiver of consent under 45 CFR 46.116(d) include that the research involves no more than minimal risk; the waiver would not adversely affect the rights and welfare of subjects; the research could not practicably be carried out without the waiver; and whenever appropriate, the subjects will be provided with pertinent information after participation.

Points to consider in applying these criteria include the nature of the research; the protections in place to maintain privacy and confidentiality (e.g., coding, limited/controlled access, honest broker mechanisms); the change in level of risk, if any; the ability to locate or contact subjects; risk of introducing bias into the research ; potential anxiety or confusion for subjects; the number of subjects; the length of time since specimens were first collected; and the likelihood that subjects would object to the proposed secondary use, based on the nature of original collection.

FAQ # 9Approved by SACHRP October 27, 2009

Patients undergoing surgery agree to donate any excess tissue (i.e., beyond that needed for clinical purposes) to a tissue bank. The creation of the bank is reviewed as human subjects research and approved by the IRB. The consent form makes it clear that the specimens and associated clinical data will be used for research, but does not specify or limit that use.

If specimens are provided to the researchers with clinical information that allows the researcher to readily ascertain the identity of the subjects, do those researchers need separate IRB approval of the proposed research use of the specimens and data?

Response # 9Approved by SACHRP October 27, 2009

Yes, the provision of identifiable information with the specimen means the research to be conducted with the specimen is a separate human subjects research protocol and separate IRB approval would be required.

FAQ # 10Approved by SACHRP October 27, 2009

Patients undergoing surgery agree to donate any excess tissue (i.e., beyond that needed for clinical purposes) to a tissue bank. The creation of the bank is reviewed and approved by the IRB. The consent form makes it clear that the specimens and associated clinical data will be used for research, but does not specify or limit that use.

If specimens are provided to the researchers with clinical information that allows the researcher to readily ascertain the identity of the subjects, is a new consent from the patient/subject [or IRB waiver of informed consent] required?

Response # 10Approved by SACHRP October 27, 2009

Yes, a new consent is required unless IRB determines that the original consent was adequate to allow the subsequent research use, or the IRB determines a waiver is appropriate.

The criteria for waiver of consent under 45 CFR 46.116(d) include that the research involves no more than minimal risk; the waiver would not adversely affect the rights and welfare of subjects; the research could not practicably be carried out without the waiver; and whenever appropriate, the subjects will be provided with pertinent information after participation.

Points to consider in applying these criteria include the nature of the research; the protections in place to maintain privacy and confidentiality (e.g., coding, limited/controlled access, honest broker mechanisms); the change in level of risk, if any; the ability to locate or contact subjects; risk of introducing bias into the research ; potential anxiety or confusion for subjects; the number of subjects; the length of time since specimens were first collected; and the likelihood that subjects would object to the proposed secondary use, based on the nature of original collection.

A Real Life Example

Real Example

A non-VA researcher approaches a VA ophthalmologist wanting to obtain residual fluid that is used to wash eyes during treatment for cataracts. This fluid is waste that would ordinarily be discarded. The non-VA researcher will use the material to study the mechanisms of cataract formation in mice. No identifying information is sought.

Is this human subjects research? Is an FWA and IRB approval required at the VA site? What if the VA opthalmologist were providing identifiers

along with the specimens? Would a FWA or IRB approval be required at the VA site?