ETHICAL AND REGULATORY ISSUES FOR DATA REGISTRIES AND BIOSPECIMEN REPOSITORIES: IRB GUIDELINES

EMORY IRB WEBINAR

10/13/2016

• Review Definitions

• When IRB review required

• Identifiability

• Informed Consent

• Making use of data/samples

• FDA applicability

• Guidance and Tools

DEFINITIONSFOR THE PURPOSES OF THIS PRESENTATION, WE WILL USE THE FOLLOWINGTERMS AND DEFINITIONS…

DATABASES

A database is collection of information elements (i.e., data) arranged for ease and speed of search and retrieval. Most databases are now maintained electronically, but the term can also be applied to paper record systems.

SOME EXAMPLES OF DATABASES:• A set of observations (i.e., data) resulting from a research

study

• A collection of diagnosis, treatment, and follow-up information for a hospital's oncology patients

• A file of outcomes information compiled for quality assurance activities

• A list of prospective research subjects

WHEN IS A DATABASE A RESEARCH REGISTRY?• May receive information from multiple sources;

• Maintain the information over time;

• Control access to the information;

• Permit multiple individuals to use the information for a variety of purposes which may evolve over time

• May (often) contain codes that link information and specimens to the donor's identity. When a key to the code is retained, it may be maintained either by the registry or by the provider of the data

REPOSITORY

A collection of biological specimens (biospecimens), usually coded, whose organizers may receive specimens from multiple sources.

• Specimens are maintained and someone is delegated responsibility to control access.

• Usually includes phenotypic data (demographic and/or medical information) about the individuals from whom the specimens were obtained. When it does contain phenotype data, the repository is both a registry and a biospecimen repository.

SO, WHAT REQUIRES IRB REVIEW?

Registries and repositories: If there are research objectives, or if additional variables are collected purely for research, IRB review is required.

TAKE NOTE

Non-Research Databases and Repositories: Databases and repositories are frequently created and maintained for purposes totally unrelated to “research” as IRB defines it. For example, Emory maintains a variety of electronic health records and data warehouse intended for diagnosis, treatment, billing, marketing, and quality improvement/control purposes.

IRB REVIEW REQUIRED?

• If the project only includes Quality Assurance or Improvement objectives, may not require IRB oversight, or HIPAA authorization or waiver.

• Multisite QI registries are gray – harder to argue “not designed to contribute to generalizable knowledge”

• Important to consult with IRB to be sure

IRB REVIEW REQUIRED?IDENTIFIABILITY FACTOR…

• If any code is retained that could link samples/data to identifiers, either by the submitters and/or the registry/repository, then “human subjects” are involved and IRB oversight required if purpose is “research”

WHAT DETAILS DO WE NEED?The Emory IRB can consult on proposals to determine if they constitute Human Subjects Research and need IRB review.

• Key issues:• Clarity about purpose

• How specimens and/or data are obtained and by whom

• Identifiability of specimens at when collected for repository

• Process for disclosing or providing data and/or samples to researchers

There is guidance on requesting these determinations, which can be found on the IRB website.

A template for registry/repository protocols can be found here.

WHAT OTHER RULES MAY APPLY?

•Consider the funding source• Federal/NIH: DHHS, NIH policies,

HIPAA, & Emory• Industry/None: HIPAA & Emory

•Consider the possible research uses• Testing drug or device (even in vitro):

FDA

CONSENT FOR FUTURE USEThe IRB offers template language on our website. This language is to be inserted, as applicable, into the biomedical templates.

INFORMED CONSENT SPECIFICS

• What samples and/or data will be shared;

• How the samples and/or data will be shared;

• How the samples and/or data might be used

REQUIRED CONSENT INFORMATION:• A place for the subject to indicate that s/he has

provided his/her voluntary consent to the storage

• A statement as to whether or not there will be identifying information on the stored samples.

• A statement that the samples may be used for possible future research, including the area(s) of research for which they will be used, if known.

REQUIRED CONSENT INFORMATION:• No expectation of shared profit

• Who else will have access to samples, if known. Be clear that investigators may be outside of Emory.

• Whether the subject may be re-contacted by researchers

• How to request sample destruction (if date not specified)

REQUIRED CONSENT INFORMATION:

• Clear indication of what collection procedures the subject will undergo – may vary based on subject and/or needs of repository

• Options: different consent versions; options within single consent

• CAREFUL – requires excellent tracking system

RECOMMENDED CONSENT INFORMATION:• Incidental findings, returning results

• FDA-related language

• Genomic analysis-related language

INCIDENTAL FINDINGS

• Based on the nature of the research expected to be done with the data/specimens, determine if any expected or incidental findings should ever be shared with participants

• Keep in mind that when a registry/repository will be used broadly for many types of future research, it will be hard to predict what kinds of findings might result

• Here is a link to our modular consent form, which includes suggested language

FDA-REGULATED USES – CONSENT AND IRB REVIEW• FDA regulations – which include informed consent and IRB

review - apply to in vitro diagnostic device studies, evenwhen using leftover samples.

• If samples completely deidentified before getting to researchers, still ALWAYS needs IRB review, though consent requirement may not be enforced

• Would have to be no overlap between repository personnel and research team

FDA AND USE OF SAMPLES, CONT’D

• Recommend that informed consent include potential use in FDA-regulated studies, when appropriate

• Include FDA as entity that could access subject’s private information

NIH AND USE OF SAMPLES FOR GENOMIC ANALYSES• NIH-funded protocols involving large-scale genomic

analyses now require informed consent, even if using deidentified data/specimens

• To allow for this type of use, recommend including potential for future genomic analyses (including risks to privacy) in up-front repository consent

USING DATA OR SPECIMENS FROM A REGISTRY/REPOSITORY…

IRB REVIEW NEEDED?

BEST PRACTICES FOR SHARING DATA/SPECIMENS

IDENTIFIABILITY TO THE RECIPIENT

• IRB submission by recipient required if receiving any identifiable data/specimens OR if recipient’s intended use is beyond scope of original consent/HIPAA

• Additional consent likely will be required

IDENTIFIABILITY TO THE RECIPIENT• Identifiable: specimens or data can be linked, by an

investigator, to an individual directly or indirectly through coding systems

• HIPAA cites 18 sources of protected health information (PHI) which can be identifiers

• PHI: Name, address, telephone, fax, email, MRN, SSN, finger/voice prints, photos, device serial numbers, etc.

• NOT PHI: Dx, age under 89, first 3 digits of zip code, ptoutcome, type of device, etc.

LIMITED DATA SETS:

• Limited data sets can include some PHI

• Admission, discharge, and service dates

• DOB and/or DOD

• Age over 89

• 5-digit zip code or other geographic info above the street address level

DATA USE AGREEMENT:

• Set conditions for use of data/specimens

• Limits who may receive/use the data/specimen

• Requires recipient to not try to further reidentify or contact donor

CODED SPECIMENS

• Any code that may be used to uniquely identify the sample (but not the donor)

• Use of samples requires key to the code not be shared with recipient

• Agreement should be documented

DO YOU HAVE TO WORRY ABOUT HIPAA?

• Triggered by obtaining or disclosing PHI by a “covered component” under the HIPAA Privacy Rule

• In doubt?• Carol McMahon, JD: Director, Privacy and Administrative

Compliance Initiatives

• Advises IRB/Investigators as needed

WITHIN SCOPE? HOW IRB DETERMINES• If you are seeking approval to

use data and/or samples from an existing source, the IRB will want to review the following:

• Consent language from original study

• Aims and objectives of newly proposed study

• Process outlined in the original study pertaining to provision of data and/or samples.

PROTECT THE DATA!

DATA SECURITY

• Be aware of requirements for storing sensitive data

REGULATORY “MUST HAVES”• All copies of your approved protocols, consent and assent

forms, as well as IRB correspondence (approval, pending letters) should be maintained. A protocol template is available on the IRB website.

• Maintain copies of original signed copies of consents and assents (give a copy to subjects)

• Informed Consent Tracking Log by Subject –this is important if subjects have the right to remove their samples and/or data

• Retained Fluid and Tissue Log –keep a log that aligns with the needs of your study.

REFERENCES

Applicable regulations:

• 45 CFR §46

• 21 CFR §50 and 56

Guidance:

• http://it.emory.edu/security/security_awareness/encrypt.html

• Your local IT support person or the LITS Service Desk at 404.727.7777

ADDITIONAL QUESTIONS?Please contact us at:

Maria Davila, MD, CCRC, CIP Team Lead, QA and Education Consultant(404) 712-0724

Shara Karlebach, WHNP-BC,CIPQA and Education Consultant (404) 712-0727

Jessica Baker, BS QA and Education Research Protocol Analyst(404) 712-9698

Clarissa Dupree, BSQA and Education Research Analyst Assistant404-727-8864