Building Data or Biospecimen Repositories for Future Use

• Define the operating parameters for establishing and maintaining a new research repository.
• Convert an existing non-research repository into a research repository.

A repository’s operating procedures must include detailed mechanisms for controlling the collection, storage, use, and sharing of its samples and information.

The University of Illinois Urbana-Champaign IRB is responsible for any research repository maintained at the University of Illinois Urbana-Champaign.

In addition to the usual information contained in a human research protocol and an IRB application, the IRB expects that protocols for establishing and operating a research repository will include at least the following specific information:

Management Plan

An investigator who oversees a data and/or biospecimen repository must follow all the requirements for data/biospecimen use when creating a repository, including informed consent, authorization, sample coding, and de-identification. The investigator over the repository may release information/samples to other investigators for future studies and may include specific identifiers according to the specific wishes of the participant as indicated on the signed informed consent document.

All research data and/or biospecimen repositories managed by University of Illinois Urbana-Champaign investigators must have a management plan to secure IRB approval for the collection and use of data and/or biospecimens for research. The plan should describe the following:

• Consent processes for collecting the data and/or biospecimens
• Procedures for protecting privacy and confidentiality of the data and/or biospecimens
• Process used to gain access to the data and/or biospecimens for use in future research
• Process for returning results to participants and benefits sharing
• Governance and oversight over the data and/or biospecimens collection
• Process for custodianship of the data and/or biospecimens

Consent and Authorization 

Informed consent and authorization must be accounted for when building a data and/or biospecimen repository.

• Full informed consent and authorization for information or samples that will be collected within the covered entity for the research repository protocol. This means, that a repository is being built for current research purposes.
• Full informed consent and authorization for information or samples that were collected. The current project would like to use information or samples that have already been collected and the full consent and authorization that was signed must allow for information or samples to be added to the research registry.
• Waiver of consent plus a method to account for authorization (for example, left-over pathology samples or de-identified samples)

Full Consent & Authorization

Full informed consent and authorization must be obtained from participants to allow their information and/or samples for use and/or collecting of their data and/or samples, except where waivers or non-human subject determinations apply.

The consent must clearly state that the collected information and/or samples will be stored and used for future research. 

Authorization determines who can have access to participants' protected health information (PHI).  It is important to consider authorization how each sample and the accompanying information can be disclosed in the future. Some important considerations include:

• What protected health information (identifiable or non-identifiable) will accompany samples?
• Who will be allowed to receive the samples with the accompanying health information - only individuals within the University of Utah and its covered entity, or others from outside entities and institutions (e.g., sponsor, FDA, NIH, etc.)?

Waiver of Consent and Authorization

A Waiver of consent and authorization may be requested for obtaining data or samples for future use. However, a waiver is only appropriate if it is impossible or impractical to get consent from the participants. For example, left-over pathology samples or de-identified samples.

• A waiver of consent may be requested for the use of data and/or biospecimens. The IRB will approve a waiver if the study meets criteria, as outlined in 45 CFR 46.116(f)(3).
• A method to account for authorization must be used in conjunction with a waiver of consent (only if data is PHI). The following methods may be used:
  • Waiver of authorization
  • Limited data set
  • Safe Harbor De-identification

IRB Application

The management plan for the data and/or biospecimen repository must be attached to the new study application as outlined above. Consent and Authorization must also be accounted for in the application as outlined above.

Investigators should complete the Databases and Repositories Form with the new study application for the future use of data and/or biospecimens which includes the following questions:

• What will be stored for future use?
• What type(s) of future research will be allowed on the data/samples?
• Who manages the repository and where will the data/samples be storied?
• Will data/samples be identifiable or de-identified?
  Identifiable means that the participant can be identified by the repository using information kept with or linked to the data/sample.
  • Who will manage and have access to the identifiable data? Where will the data be kept? How will the data be kept confidential?
  • Who will de-identify the data/samples? When will the data/samples be de-identified?
• Will participants be able to withdraw data/samples from the repository?
• Will future research results or findings be communicated to participants?
• How will researchers obtain data/samples from the repository for use in future research?