Clinical Research Management Webinar Series:
Regulatory Considerations for
Biorepositories: Navigating HHS, FDA,
HIPAA and Informed Consent Wednesday, December 19, 2012
12:00 p.m. - 1:00 p.m. CT
Disclaimer
2 © 2012 Huron Consulting Group. All Rights Reserved. Proprietary & Confidential.
The views expressed in this presentation are the views of the speakers and do not
necessarily reflect the views or policies of the companies they represent. This
presentation is intended for educational purposes only and does not replace independent
professional judgment. Neither Huron Consulting Group or Van Andel Research Institute
endorse or approve, and assume responsibility for, the content, accuracy or
completeness of the information presented.
Attendees should note that sessions are audio-recorded and may be published in various
media, including print, audio and video formats without further notice.
A Bit About Our Speakers
Madeleine Williams Director
P 312. 479. 3374
Maddie has over 10 years of research experience and assists clients with
research biorepository design and development, institutional review board (IRB) assessments
and operational support, regulatory compliance evaluations, and human research protection
program evaluation and accreditation.
Scott Jewell, Ph.D. Deputy Director for Research Resources
Professor and Director, Program for Biospecimen Science
Van Andel Research Institute
P 616. 234. 5435
Dr. Jewell is Deputy Director of Research Resources and Professor and Director for the
Program of Biospecimen Science at the Van Andel Research Institute. He has served as
President of the International Society for Biological and Environmental Repositories (ISBER)
and has spent more than 25 years in the collection, banking, distribution and analysis of
biospecimens for basic and clinical research.
3 © 2012 Huron Consulting Group. All Rights Reserved. Proprietary & Confidential.
Agenda
Recommended biorepository model
When DHHS, FDA and HIPAA regulations apply
When informed consent is not required
Pros and cons of different informed consent approaches
Q&A / Wrap-up
4 © 2012 Huron Consulting Group. All Rights Reserved. Proprietary & Confidential.
Regulatory Considerations
Applicable research and privacy regulations
• DHHS
• FDA
• HIPAA
• Other state and local laws
Goal should be to set up a biorepository that utilizes the
flexibility in the regulations
• Appropriate set up for collection and coding of samples and data
• Governance model for review and distribution of samples and data
to researchers
• Work with the IRB to design
5 © 2012 Huron Consulting Group. All Rights Reserved. Proprietary & Confidential.
Polling Question #1
What kind of biorepository activities are currently
ongoing at your institution?
a. We have a central biorepository “core” that supports all banking for
the institution
b. We have a central biorepository but also have decentralized individual
investigator biorepositories
c. We just have decentralized individual investigator/department
biorepositories at our institution
d. We only participate in external banking protocols (i.e. cooperative
group studies) and send our samples off site
e. We do not participate in any biobanking right now
f. Not sure what biorepository activities are ongoing 6 © 2012 Huron Consulting Group. All Rights Reserved. Proprietary & Confidential.
Recommended Biorepository Model
7
Step 1
Step 2
The Model is a Two-Step Process
Step 1: Procedures for collection and banking of
specimens
Step 2: Procedures for use of specimens
Note that “specimens” may be:
• Tissue
• DNA
• Images
• Text
8 © 2012 Huron Consulting Group. All Rights Reserved. Proprietary & Confidential.
The Model Separates the Known and Unknown
Activities
Oversight must be based on actual uses of
specimens
Step 1:
• Known use: Specimens will be collected and banked
for research
Step 2:
• Unknown uses: Specific research studies that
specimens will be used for
9 © 2012 Huron Consulting Group. All Rights Reserved. Proprietary & Confidential.
Step 1: DHHS and OHRP
OHRP considers the collection of specimens or data for
research purposes to be research and guidance
recommends that human tissue repositories supported by
HHS should be subject to oversight by an Institutional
Review Board (IRB).
The IRB should determine if:
• The activity is research as defined by the Common Rule
• If so, whether the research involves human subjects as defined by
the Common Rule
10
OPRR, Issues to Consider in the Research Use of Stored Data or Tissues, November 7, 1997
OHRP, Guidance on Research Involving Coded Private Information or Biological Specimens, October 16, 2008
© 2012 Huron Consulting Group. All Rights Reserved. Proprietary & Confidential.
Step 1: DHHS and OHRP
If the repository involves human research, the IRB should
review:
• Conditions under which data and samples are collected and shared
• Provisions to protect privacy
• Provisions to maintain confidentiality of data
OHRP has guidance as to when coded private information or
samples are not identifiable so that research on that
information does not involve human subjects.
• Impact on Step 2 and the need for IRB review
11
OPRR, Issues to Consider in the Research Use of Stored Data or Tissues, November 7, 1997
OHRP, Guidance on Research Involving Coded Private Information or Biological Specimens, October 16, 2008
© 2012 Huron Consulting Group. All Rights Reserved. Proprietary & Confidential.
Step 1: Other Considerations
Use of an honest broker when collecting identifiable
information
• An individual, organization or system collects identifiable data and
replaces identifiers with a code, and releases only coded
information to the researcher or to be stored in the repository.
• The honest broker is the only person who can link a subject with the
code that identifies that subject.
• Useful when collecting and adding long-term follow up data to a
repository.
Obtaining a Certificate of Confidentiality for repository
samples and data
12 © 2012 Huron Consulting Group. All Rights Reserved. Proprietary & Confidential.
When is Collection/Storage in Step 1 Not
Research?
Not all specimen or data collection/storage is
research even if specimens are used for research
• Pathologic lab archive
• Radiology film library
• Medical record
13 © 2012 Huron Consulting Group. All Rights Reserved. Proprietary & Confidential.
When Does Collection/Storage in Step 1 Not
Involve Human Subjects?
Not all research biorepository storage and collection
involves human subjects
• Collection of de-identified specimens
• Collection of already coded specimens
• Collection of autopsy specimens
14 © 2012 Huron Consulting Group. All Rights Reserved. Proprietary & Confidential.
The Model Minimizes Regulatory Burden
Steps 1 and 2 may have different regulatory
statuses
Step 1:
• Usually human research
• Usually subject to HIPAA
Step 2: (when properly designed)
• Usually not human research
• Usually not subject to HIPAA
15 © 2012 Huron Consulting Group. All Rights Reserved. Proprietary & Confidential.
Step 2: Does the research involving human
subjects?
Both DHHS and FDA regulations may apply.
• Systematically consider both.
First consider:
• Is there “research” as defined by DHHS?
• Is there “research” as defined by FDA?
If NO to both, stop. (If no research, no human
subjects)
Then consider:
• If DHHS “research” are there DHHS “human subjects”?
• If FDA “research” are there FDA “human subjects”? 16 © 2012 Huron Consulting Group. All Rights Reserved. Proprietary & Confidential.
Human Research Flowchart
17
Is activity “Human Research”
as defined by DHHS?
Is activity “Human Research”
as defined by FDA?
“Human Research”
under DHHS and FDA
Is activity “Human Research”
as defined by FDA?
“Human Research”
under DHHS only
NOT
“Human Research”
“Human Research”
under FDA only
No
NoNo
Yes
Yes Yes
START
© 2012 Huron Consulting Group. All Rights Reserved. Proprietary & Confidential.
Step 2: Readily Identifiable Information
OHRP guidance on biologic specimens and OHRP
guidance on engagement provides examples where
OHRP considers information to be NOT “readily
identifiable”: • The investigators and the holder of the key enter into an
agreement prohibiting the release of the key to the investigators
• IRB-approved written policies and operating procedures for a
repository or data management center prohibit the release of the
key to the investigators
• Legal requirements prohibit the release of the key to the
investigators
18 © 2012 Huron Consulting Group. All Rights Reserved. Proprietary & Confidential.
Step 2: Coded Samples and Data
If the biorepository releases coded samples and
data to investigators for specific research studies, in
most cases this will not meet the definition of human
subjects research
Should have appropriate governance structure in
place
• Scientific committee to review and approve requests for
samples/data
19 © 2012 Huron Consulting Group. All Rights Reserved. Proprietary & Confidential.
Scenario and Polling Question #2
20
An investigator is conducting research on diabetes. She
wants to develop an assay to screen for the presence of a
biomarker than is linked with type 2 diabetes. She will obtain
blood samples and data from a diabetes repository with no
identifying information. She will use these blood samples to
develop the assay.
Polling question:
Is IRB review required? A. Yes
B. No
C. Not Sure
© 2012 Huron Consulting Group. All Rights Reserved. Proprietary & Confidential.
Follow Up For Polling Question #2
21
Yes
FDA considers data regarding the use of a device on human
specimens (identified or unidentified) to be a clinical investigation if it
will be submitted to or held for inspection by FDA as part of an
application for a research or marketing permit
Relevant to specimens:
• Individual who serves as a control
• An individual on whose specimen a device is used
Important to consider both DHHS and FDA
Scientific review can monitor for this to trigger when IRB review is
needed
© 2012 Huron Consulting Group. All Rights Reserved. Proprietary & Confidential.
HIPAA
Applies if samples and data are collected within or received by a covered
entity
Most likely scenarios for repository data, sample labeling:
• Identifiable
– Authorization from the patient OR
– Waiver of authorization from IRB/Privacy Board
• Limited Data Set
– Data Use Agreement is in place
• De-identified (all PHI removed)
– If samples are coded to achieve de-identification, HIPAA states that the code
may not be derived from or related to the information about the individual and is
not otherwise capable of being translated to identify the individual.
– For example, the code may not be derived from the individual’s name (i.e.
initials), social security number or medical record number.
22 © 2012 Huron Consulting Group. All Rights Reserved. Proprietary & Confidential.
“De-identified” versus “not readily identifiable”
HIPAA defines identifiers that need to be stripped
from data to make protected health information de-
identified.
However, an investigator cannot readily identify the
individual from whom the following was obtained:
• Zip code
• Fingerprints
• Dental records
23 © 2012 Huron Consulting Group. All Rights Reserved. Proprietary & Confidential.
Informed Consent
24
Human Subject Research Regulations (HHS and FDA)
• Informed consent is not required if :
1) the research does not meet the definition of human subjects research under
HHS;
2) is exempt from the HHS regulations;
3) the research has been granted a waiver of consent by the IRB; or
4) if the FDA-regulated research involves anonymous tissue specimens where
FDA does not require consent (FDA enforcement discretion*)
OHRP Guidance
• The IRB should review and approve a sample informed consent
document for distribution to tissue collectors and their local IRBs
* FDA Guidance, Informed Consent for In Vitro Diagnostic Device Studies Using Leftover Human Specimens that are Not Individually Identifiable, April 25, 2006
© 2012 Huron Consulting Group. All Rights Reserved. Proprietary & Confidential.
Informed Consent
25
NCI and ISBER Best Practices
• Informed consent information describing the future research should
be as specific as possible
• Obtain informed consent whenever possible
• Consent may be obtained for unspecified future research;
mechanisms should be in place to assure that future research uses
of identifiable specimens are consistent with the original consent
• Subjects should have the right to withdraw consent and to have
their unused specimens and data removed from the repository
unless the specimens and data are anonymous (no link).
© 2012 Huron Consulting Group. All Rights Reserved. Proprietary & Confidential.
Informed Consent Approaches
26
General consent for biorepository
• Can get consent from subjects to bank specimens (Step 1) and
indicate that for future research (Step 2) either their specimens will
not be identified, an IRB will waive consent, or their consent will be
obtained
• Cannot get “blanket” consent from subjects for unspecified future
research with identifiable specimens
Tiered consent for biorepository
• Subjects can specify the types of research for which their
samples/data will be used
• Have to be able to track subject choices
Research study specific consent © 2012 Huron Consulting Group. All Rights Reserved. Proprietary & Confidential.
HIPAA Authorization
27
A HIPAA authorization may not seek permission to use or
disclose PHI for future unspecified research uses of health
information.
Authorization can be obtained to create a repository (Step 1) but
that authorization does not cover subsequent research uses of
identifiable data.
Recommend that data used for future research from the
repository (Step 2) be a LDS or de-identified (authorization not
required).
© 2012 Huron Consulting Group. All Rights Reserved. Proprietary & Confidential.
Questions?
Thank you!
For further information, please contact:
Scott Jewell
Van Andel Research Institute
P 616. 234. 5435
Madeleine Williams
Director, Huron Consulting Group
P 312. 479. 3374