Human Source Material Banking (Biobanking in a Biorepository)

Guidance for Research Involving Collection and Storage of Human Biospecimens or Protected Health Information (PHI) for Unspecified Future Research

Links (These documents are also available in the eIRB library):

1.    Purpose: This policy provides guidance to the Tufts Health Sciences research community conducting research that includes the collection of human biological specimens (biospecimens) for future research use and storing biospecimens (with or without information about the source individual) in a repository referred to as a “biorepository.” This policy also addresses protected health information (PHI) that is intended to accompany the stored biospecimens.

2.    Scope: This policy applies to research studies in which biospecimens (with or without PHI) will be collected and stored for unspecified future research use. The policy does not address the mandatory collection and transfer of biospecimens to a biospecimen bank as legally required by state law or regulation. The policy is limited to biospecimens collected from living persons and does not address the use of biospecimens obtained post-mortem. Additionally, this policy does not apply to biospecimens or data collected and stored as part of routine clinical care or hospital procedures, such as blood banks, medical records, or pathologic biospecimens.

3.    Definitions: The following definitions will be used for the purposes of this policy.

3.1.   Biorepository: an entity that collects, processes, stores, and distributes biospecimens (with or without associated PHI) for future research purposes.
 

3.2.   Biospecimen Banking ​​​​​(formerly known as Tissue Banking): refers to the receipt, processing, storage, and subsequent use or distribution of biospecimens (with or without associated PHI) to investigators for research purposes.

 

3.2.1.   Storage for Batch Processing is not Biospecimen Banking: The Tufts Health Sciences Institutional Review Board (IRB) regularly reviews research protocols involving frequent or periodic collection and storage of biospecimens throughout the life of the study. These biospecimens are sometimes stored to allow for simultaneous or periodic pre-defined analysis throughout the course of the study or at the study’s conclusion. In this case, the plan for analysis is clearly described in the protocol and is designed to address specific aims of the study. These biospecimens are either destroyed during analysis or at the study’s end. This is not considered banking since the specimens will not be stored for future unspecified research use, will not be subjected to testing outside the stated purpose and objectives of the original study, and will not be disseminated to investigators not associated with the original study.
 

3.2.2.   Storage for Potential Repeat/Confirmatory Testing is not Biospecimen Banking: The collection, processing, cataloging, and storing (archiving) of biospecimens for future analyses described in the original study is not banking. A research protocol may clearly explain that some of the biospecimens acquired for purposes of the study will be stored for subsequent testing at some future date. Typically, these stored biospecimens will be used to repeat or confirm the result of previous analyses. These biospecimens will not be used for purposes beyond that of the original study, will not be used for future unspecified research, and will not be disseminated to investigators not associated with the original study.
 

3.3.   Cell Line: cells that have been adapted to grow continuously in the laboratory and are used in research or industry.
 

3.4.   Coded: ​identifying information or data (such as name or social security number) that would enable the investigator to readily ascertain the identity of the individual to whom the private information or biospecimens pertain has been replaced with a number, letter, symbol, or combination thereof (i.e., the code); and a key to decipher the code exists, enabling linkage of the identifying information to the private information or biospecimens.
 

3.5.   HIPAA3: the Federal Health Insurance Portability and Accountability Act of 1996 that governs the use or disclosure of protected health information (PHI) by covered entities (i.e., health care providers, health plans, etc.)
 

3.6.   Human Biological Specimen (biospecimen)1: includes any biological material that comes from a living human being, from molecules to subcellular structures and cell products such as proteins and DNA, to cells, tissues, and organs, including secretions, and waste (e.g., hair or nail clippings, urine, feces, sweat, tears, and shed skin cells).

 

Organisms, such as bacteria and viruses isolated from human specimens, are not human biological specimens.
 

3.7.   Identifiable: The identity of the research subject is or may be readily determined
 

3.7.1.   De-identified and coded: Biospecimens and PHI whose HIPAA-defined identifiers have been replaced with a code that is linked to the biospecimen or PHI. Although readily recognizable information has been replaced by coded information, the presence of a link connecting the original biospecimens/PHI and its coded identification could allow a biorepository or investigator who obtained the code to identify the source individual.
 

3.7.2.   Non-Identifiable: Biospecimens/PHI from which identifiable information was permanently removed and cannot be retrieved by the biorepository or an investigator. Biospecimens/PHI whose identifiable information was replaced with a code is considered non-identifiable only if the code and/or the code’s key (linking information) was subsequently destroyed.
 

3.8. Leftover/Remnant Biospecimens: Remaining portion of a specimen obtained for clinical purposes that is no longer needed for its original purpose and that would otherwise be discarded (College of American Pathologists, Accreditation Program)
 

3.9.   Protected Health Information (PHI)3: Individually identifiable health information maintained by a health care provider, health plan, or health care clearinghouse covered under HIPAA.
 

3.10.Source Individual: the individual from whom the biospecimens and/or PHI is/are collected.

4.    PI Responsibilities: 

4.1. Complete the Collection and Storage of Human Biological Specimens for Unspecified Future Research section of the protocol or Site-Specific Appendix.
 

4.2. Informed Consent:
 

4.2.1.   If biospecimen banking is an optional component of the main research study, information describing the optional biospecimen banking may be included in the main informed consent form (ICF) or a separate biospecimen banking ICF.
 

4.2.2.   ​​​​​​Written informed consent must be obtained in accordance with SOP: Informed Consent Process for Research (HRP-090) and SOP: Written Documentation of Consent (HRP-091)

 

4.2.3.   Investigators should also refer to the following policies and guidances, as applicable:

4.2.3.1.   OHRP Issues to Consider in the Research Use of Stored Data or Tissues5

4.2.3.2.   OHRP Guidance on Research Involving Coded Private Information or Biological Specimens6

4.2.3.3.   NIH Genomic Data Sharing Policy7

4.2.3.4.   Supplemental Information to the National Institutes of Health Genomic Data Sharing Policy8

4.2.3.5. NIH Points to Consider for IRBs and Institutions in their Review of Data Submission Plans for Institutional Certifications9

4.2.3.6.   Office of Human Research Protections (OHRP) Code of Federal Regulations Effective 19 July 2018
 

5.    IRB Review: 
 

5.1. The IRB will review proposed biospecimen banking per IRB policies and procedures.
 

5.2. ​​​​​​A subject’s decision to participate in the biospecimen banking component of a study cannot be a requirement for participation in the main study. The only exception to this is when the entire study is biospecimen banking for future use of stored specimens and there is no “main study” with a purpose other than biospecimen banking.
 

5.3. The IRB will consider whether standard clinical care might be affected by participation in the proposed biospecimen banking and will review the procedure for choosing the specimen(s) to be sent for protocol-directed testing versus biospecimen banking for future research use. For example:
 

5.3.1.  If the proposed research involves placing “leftover” (‘leftover’ after the performance of standard of care or research tests and required sample retention) biospecimens in a biorepository for the purpose of unspecified future research, the IRB may guard against removal of more than the usual amount of biospecimen(s) needed for the standard of care or research tests by requiring that the surgeon not know if the subject has consented to the research use of any surplus materials.

Please Note: The specimen must arrive at the pathology lab intact for examination before research samples can be procured.  This is true of all biospecimen types (tissue, blood, urine, etc.).

In the case of research tests, those specific samples have been designated to the particular study in question.  The clinical laboratories would not redirect the samples as leftover/remnant without explicit consideration of the study in which the samples stemmed from originally.

5.4   The IRB will consider how biospecimens are identified, de-identified and coded, or rendered no longer identifiable. 
 

5.4.1    In most cases, biospecimens or PHI will be de-identified and coded before being stored at the biorepository.
 

5.4.2    ​​​​​​​The key to the code to re-identify subjects is to remain within the exclusive possession and control of the PI or designee at Tufts Medical Center or Tufts University. This should be described in the protocol and/or Site-Specific Appendix.

NOTE: It may be necessary (or policy) for a biorepository to re-code biospecimens and/or PHI upon receipt to further protect privacy of the source individual and confidentiality of the data. For example, an Investigator who submits biospecimens or PHI to a biorepository may need to also request biospecimens or PHI from the biorepository for future research. Since the biospecimens/PHI the investigator receives were re-coded by the biorepository, it further protects the identity of the source individual.

5.5   In specific circumstances in which the biospecimens or PHI must retain certain HIPAA identifiers (for example, date of collection), the following requirements must also be met:
 

5.5.1  ​​​​​​​ The IRB is to grant a waiver of research authorization to use or disclose identifiable health information, and/or the research authorization language in the ICF must specify the HIPAA identifiers that will accompany the specimens or PHI to the biorepository.
 

5.5.2    ​​​​​​​ All other identifiers must be removed from the biospecimens or PHI. For example, if the biorepository only needs the date of collection of the specimens, the source individual’s name and all other HIPAA identifiers should be removed and the specimens de-identified and coded.
 

5.6   Future use of biospecimens or PHI might require further IRB review and approval as well as additional HIPAA determinations.
 

5.7   When PHI accompanies the biospecimens to the biorepository, the IRB will consider whether the PHI exists at the time of biospecimen collection and if future PHI will be transferred to the biorepository.
 

5.7.1    If PHI will be collected and transferred to the biorepository in the future, the protocol must describe the duration, frequency, and rationale for the future transfer of PHI to the biorepository. ​​​​​​​

Appendix
HIPAA Identifiers:

A HIPAA identifier is any one of the following types of information about the individual (or the relatives, employers, or household members of the individual) from whom the biospecimens are collected:3​​​​​​​

  1. Names
  2. Geographic subdivisions smaller than a state (except the first three digits of a zip code if the geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people and the initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000)
  3. All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, and date of death and all ages over 89 and all elements of dates (including year) indicative of such age (except that such ages and elements may be aggregated into a single category of age 90 or older)
  4. Telephone numbers
  5. Fax numbers
  6. Email addresses
  7. Social Security Numbers (SSNs)
  8. Medical Record Numbers (MRNs)
  9. Health plan beneficiary numbers
  10. Account numbers
  11. Certificate/license numbers
  12. Vehicle identifiers and serial numbers, including license plate numbers
  13. Device identifiers and serial numbers
  14. Web Universal Resource Locators (URLs)
  15. Internet Protocol (IP) address numbers
  16. Biometric identifiers, including finger and voice prints
  17. Full face photographic images and any comparable images
  18. Any other unique identifying number, characteristic, or code (excluding a random identifier code for the subject that is not related to or derived from any existing identifier).

References

  1. Note: This definition is adapted from the 1999 report of the National Bioethics Advisory Commission entitled “Research Involving Human Biological Materials: Ethical Issues and Policy Guidance. https://bioethicsarchive.georgetown.edu/nbac/hbm.pdf
  2. Response of the Department of Health and Human Services to NBAC’s Report Research Involving Human Biological Materials: Ethical Issues and Policy Guidance https://aspe.hhs.gov/report/response-department-health-and-human-services-nbacs-report-research-involving-human-biological-materials-ethical-issues-and-policy-guidance
  3. Health Insurance Portability and Accountability Act (“HIPAA”). http://www.hhs.gov/hipaa/
  4. Protecting Personal Health Information in Research: Understanding the HIPAA Privacy Rule, Department of Health and Human Services, NIH Publication Number 03-5388, 2003. https://privacyruleandresearch.nih.gov/pdf/hipaa_privacy_rule_booklet.pdf
  5. OHRP Issues to Consider in the Research Use of Stored Data or Tissues. http://www.hhs.gov/ohrp/policy/reposit.html
  6. OHRP Guidance on Research Involving Coded Private Information or Biological Specimens (2008). http://www.hhs.gov/ohrp/policy/cdebiol.html
  7. NIH Genomic Data Sharing (GDS) Policy. http://grants.nih.gov/grants/guide/notice-files/NOT-OD-14-124.html and https://osp.od.nih.gov/wp-content/uploads/Supplemental_Info_GDS_Policy.pdf
  8. Supplemental Information to the National Institutes of Health Genomic Data Sharing Policy. https://osp.od.nih.gov/wp-content/uploads/Supplemental_Info_GDS_Policy.pdf
  9. NIH Points to Consider for IRBs and Institutions in their Review of Data Submission Plans for Institutional Certifications. https://sharing.nih.gov/sites/default/files/flmngr/GDS_Points_to_Consider_for_Institutions_and_IRBs.pdf
  10. Office of Human Research Protections (OHRP) Code of Federal Regulations Effective 19 July 2018
  11. FDA Guidance on Informed Consent for In Vitro Diagnostic Device Studies Using Leftover Human Specimens that are Not Individually Identifiable, Effective April 2006