OHSU

ORIO Policy for Collection and Use of Human Biologic Material in Research

I. GENERAL

II. DEFINITIONS

III. INFORMATION REQUIRED FOR SUBMISSION

IV. LEVEL OF REVIEW REQUIRED

V. CONSENT AND AUTHORIZATION REQUIREMENTS

VI. GUIDELINES FOR REPOSITORIES

VII. USE OF PRE-EXISTING COLLECTIONS



EXECUTIVE SUMMARY:

This policy covers the use of human biological material in research and the additional requirements for such research under HIPAA rules and the Oregon Genetic Privacy Law (ORS 192.531-549).
Requirements for submission of protocols involving human biological materials are discussed in depth in Section III of this policy. Protocols to be submitted to the IRB for review must include detailed information on:

  • The justification for the research design
  • The source and retention of samples (including approval from the clinical laboratory if applicable-see IIIB)
  • Recruitment, consent and authorization procedures (including a consent form following the genetic consent form template if applicable-see Section V)
  • The level of sample identification and confidentiality protections (note that there are specific requirements for genetic research on coded samples, described in IIID)
  • The possibility of sharing research results with subjects (recontact), if applicable

If tissue is anonymous and is available from Pathology or a repository without any identifiers, it is not PHI and is not subject to HIPAA rules. However, these samples are subject to Oregon's Genetic Privacy Law and special protections apply. Most notably, a human biological sample, or genetic information obtained from such a sample, collected on or after June 12, 2003, may be used without consent in genetic research only if:

  • The sample is anonymous as defined by HIPAA rules and the Oregon Genetic Privacy Law (see definitions under "Identification of Samples" in the Glossary, Section II of this policy).
  • The subject was notified prior to the time the research is conducted that future anonymous research might take place.
  • At the time of notification the subject did not request the sample or information be withheld from anonymous research (ORS 192.531-549).

Additional requirements for obtaining a waiver of consent and authorization are discussed in Section V-D. Sections VI and VII describe the requirements for tissue repositories and use of pre-existing tissue collections.

Additional information on genetic research and the Oregon Genetic Privacy Law may be found on The Genetic Research Page.



I. GENERAL

Access to human biologic material is essential for biomedical research. Federal oversight of collection and use of these materials is mandated in DHHS regulations [45CFR46]. The primary risk in using human biologic material is the harm that can occur when private information about individual subjects is revealed. It is therefore necessary to develop a system of protections to ensure that the risk of breach of confidentiality is minimized and the interests of the persons who provide biologic samples are protected.

The National Bioethics Advisory Commission (NBAC) was appointed to review the practices and policies regarding use of human biologic material in research and to make recommendations for the ethical conduct of these studies. The NBAC's draft standards for use of human biologic material for research were published in 1999. In addition, the Oregon legislature has established laws [ORS 192.531-549; the Genetic Privacy Act] intended to protect the rights of humans who provide biological samples for genetic research and to protect subjects from being involved in genetic research against their wishes. Finally, the HIPAA Privacy Standards, which became effective April 14, 2003, provide strong protections for the access to, and use and disclosure of, protected health information (PHI). Because the majority of studies involving human biological samples will eventually involve genetic testing and the creation and use of genetic PHI, the OHSU policy for the use of human biological samples is based on the NBAC guidelines for tissue use, the Oregon Genetic Privacy Law and the HIPAA Privacy Standards.



II. DEFINITIONS

(incorporates definitions from Oregon Administrative Rules (OAR 333-025-0100)

Anonymous research: Scientific or medical research conducted in such a manner that the identity of an individual who has provided a sample, or the identity of an individual from whom genetic information has been obtained, or the identity of the individual's blood relatives cannot be determined. "Anonymous research" does not include research conducted in such a manner that the identity of such an individual, or the identity of the individual's blood relatives, can be determined by the use of a code, encryption key or other means of linking the information to a specific individual.

Blanket informed consent: The individual has consented to the use of his/her DNA sample or health information for any future research, but has not been provided with a description of, or consented to the use of, the sample in genetic research or any specific genetic research project.

De-identified Information: De-identified information is health information that does not specifically identify an individual. Also, there is no reasonable basis to believe that the information alone could be used to identify an individual. In order to be considered de-identified, the following 18 elements must be removed: name; address; names of relatives; names of employers; birth date; telephone number; fax number; e-mail addresses; social security number; medical record number; health plan beneficiary number; account number; certificate/license number; any vehicle or device serial number; web URL; Internet Protocol Address; Finger or voice prints; Photographic images (e.g. full facial photographs); and any other unique identifying number, characteristic, or code. Information may also be statistically de-identified. This is typically performed by an experienced statistician who analyzes the data and affirms that the risk is "very small" that a particular person could be identified from the information collected.

DNA sample: Any human biological specimen that is obtained or retained for the purpose of extracting and analyzing the individual's DNA to perform a genetic test. "DNA sample" includes DNA extracted from the specimen.

Genetic characteristic: A gene, chromosome or alteration thereof that may be tested to determine the existence of or risk for acquiring a disease, disorder, trait, propensity or syndrome, or to identify an individual or a blood relative. "Genetic characteristic" does not include family history or a genetically transmitted characteristic whose existence or identity is determined by means other than through a genetic test.

Genetic information: Information about an individual or the individual's blood relatives obtained from a genetic test.

Genetic research: Research using human DNA samples, genetic testing or genetic information.

Genetic test: A test for determining the presence or absence of genetic characteristics in a human individual or the individual's blood relatives, including tests of nucleic acids, such as DNA, RNA, and mitochondrial DNA, chromosomes or proteins in order to diagnose or determine a genetic characteristic.

Human subject: A living individual about whom an investigator conducting research obtains: a) data through intervention or interaction with the individual, or b) identifiable private information (e.g., samples, records).

Identification of samples: Four levels of identification of research samples are recognized. These are differentiated by the amount of information that is available about the subject from whom the sample was obtained. The levels include:

  1. Unidentified samples (anonymous): Samples that are/were obtained and stored without any identification that may link the specimen to a specific subject.
  2. Unlinked samples (anonymized or de-identified): Samples that may have been acquired from identified human subjects, but all identifiers or codes have been removed and destroyed. For unlinked samples, it would be extremely difficult for the investigator, the repository or a third party to identify the person who provided an individual sample. See also definition for de-identified information
  3. Coded samples: Samples labeled with a code rather than a name or other personal identifier. When such samples are obtained from a tissue repository, the repository usually retains information that links the code to a particular individual. Using this information, the investigator, the repository or a third party could determine which particular person or small group of identifiable individuals provided the biological specimen. Depending on the nature of the identifiers that are associated with a specimen, the sample may or may not meet the definition of a "limited data set" as provided by HIPAA. The IRB will make this determination and also determine if the use of the sample, as specified in the protocol, requires a data use agreement, tracking of disclosures, or business associate agreement. Note that for genetic research, the sample must meet the definition of limited data set in order to qualify as coded under the Oregon Genetic Privacy Law (ORS 192.547) (see section III-D).
  4. Identified samples: Samples collected and supplied to investigators with personal identifiers sufficient to allow identification of the person who provided the material.

Identifiers: Examples of identifiers include name, Social Security number, hospital number or other unique identifier. Using current information technology, a combination of descriptive data may be sufficient to allow identification of the person who provided the biological specimen and collectively may be considered an identifier (e.g., Zip code, birth date and profession are often sufficient to identify a specific individual).

Limited Data Set: A limited data set is information that is minimally identified by including a few selected identifiers. It may only contain: the subject's dates of admission and/or discharge, their date of death (if applicable), their date of birth (which can only be used as necessary), and the subject's five digit zip code or any other geographic subdivision (e.g., state, city, county.) The subject's street address cannot be included. Because a limited data set is not fully de-identified and could potentially be used to re-identify an individual, it is still subject to privacy protections.

Minimal Risk: Minimal risk is a term defined in federal regulations. It means that the probability and magnitude of harm or discomfort anticipated in the research are not greater in and of themselves than those ordinarily encountered in daily life, or during the performance of routine physical or psychological examinations or tests.

Recontact: Disclosure of genetic research findings to a research subject or the subject's health care provider.

Repository: A repository is a storage site for collections of human biologic specimens available for study. This may be one geographic location or may be a virtual aggregation of biologic specimens from many locations. Repositories are also referred to as tissue banks, collections, resources or inventories, or by other terms.

Research: A systematic investigation designed to develop or contribute to generalizable knowledge.

Sample: In the context of this policy, a sample refers to any human biological material. This includes, but is not limited to, molecular material such as DNA, cells, tissues (blood, bone, muscle, etc.), organs (liver, bladder, heart, etc.), gametes, embryos, fetal tissue, waste (hair, nail clippings, urine, feces, etc.) and other materials of human origin.

Specific informed consent and authorization for genetic research: The individual or the individual's representative has consented to, and authorized the use of, that individual's DNA sample or genetic information for genetic research or for a specified genetic research project. The elements of "specific informed consent" and "authorization" are set forth in the Federal Common Rule (45 CFR46.116 -46.118) and HIPAA.

Specimen: When used in reference to a human biological repository, specimen refers to the quantity of material stored in the repository, whereas the term sample refers to an aliquot of the specimen supplied to investigators.

Waiver of Consent and Authorization: This is a request from the investigator to access, use and disclose existing PHI, including genetic PHI, without consent and authorization from the subject. This request must be filed using the appropriate OHSU form.


III. INFORMATION REQUIRED FOR SUBMISSION

All human subjects research projects to be conducted at OHSU must be reviewed and approved by the OHSU IRB prior to initiation. Research projects using human biologic material are covered by this requirement. Therefore, before human biologic material may be used for research purposes, researchers must submit an application to the OHSU IRB. All protocols submitted for review by the OHSU IRB must contain the following information:

  1. Justification for research design: Indicate the importance of the research and the rationale for testing. Indicate the general nature of tests that will be done on the samples. Identify any significant risks to subjects incurred by the testing. Physiological harm during sample procurement is considered a risk; however, other risks may be more important. These risks include psychological, social or financial risks to subjects. Consider the risks to individual dignity, invasion of privacy, violation of confidentiality, stigmatization of a subject or group, discrimination in insurance or employment, psychological harm, generation of conflict within a family, harm to relatives, inappropriate commercialization of findings, or use of samples in projects objectionable to the Subject.

  2. Source and retention of samples: Indicate how samples have been or will be obtained. Are samples to be obtained directly from subjects or from a repository of existing samples? Will the samples have codes or identifiers that could link the samples to the person who provided the sample? If identified or coded samples will be obtained from a repository, the investigator should include in the application a copy of the consent form used to collect the original samples and the repository's written procedures for storing and releasing samples. Indicate how long samples will be stored (if the intent is to store as long as possible, so state), and indicate what will happen to samples at the conclusion of the storage period. Note that under the Oregon Genetic Privacy Law (ORS 192.537), DNA samples and genetic information may not be retained without consent or authorization, unless for anonymous research conducted after notification as discussed in Section C below.

    Also note that research protocols using human tissues removed at the time of diagnostic or therapeutic procedures must be reviewed and approved by the Clinical Laboratories responsible for the clinical examination and diagnosis of these tissues. The policy describing this requirement is available at http://www.ohsu.edu/research/rda/irb/docs/policies/tissuereview.pdf. The form required for submission of such protocols for review is the "Tissue Use Review form".

  3. Consent and authorization procedures: Indicate who will obtain consent and authorization for the use of the samples and attach a copy of any proposed consent/authorization form in OHSU format (use the genetic consent form template for genetic research). Whether previously stored samples can be used without additional informed consent and authorization depends on the date on which the samples were collected, the original consent form used, whether or not samples can be linked to individual subjects, and whether or not any genetic research is proposed. A HIPAA compliant application form is available for any investigator who requests use of existing samples with waiver of Consent and Authorization.

    A human biological sample or genetic information obtained on or after June 12, 2003, may be used without consent in genetic research only if the sample is anonymous, and only if prior to the time the research is conducted, the subject was notified that anonymous research might take place in the future and, at the time notification took place, the subject did not request that the sample or information be withheld from anonymous research (ORS 192.531-549).

    Reminder: Samples are anonymous only if there is no possibility that the individuals providing the samples could be identified or located. Anonymous means that an investigator may NOT hold a code to the samples that could allow a sample to be linked to the individual who provided it.

    Requirements for samples or information obtained prior to June 12, 2003, are less restrictive under the Oregon Genetic Privacy law, regardless of whether genetic research is involved. For these samples, the IRB may, at its discretion, grant a waiver of additional consent and authorization, depending on whether subjects were originally informed of the possibility of future research, or if the conditions for Waiver of Consent and Authorization given at 45 CFR 46.116(d) and according to HIPAA are met, even if samples are coded or identified. See additional restrictions for use of pre-existing collections (Section VII).

  4. Minimization of risk and protection of confidentiality: Describe procedures to minimize risks to subjects. Specifically indicate whether samples will be anonymous, unlinked, coded or identified. If samples are unlinked or coded, specify the process by which they will be unlinked or coded. Describe the security measures that will be used to protect against a loss of confidentiality (note that it is the principal investigator's responsibility to instruct laboratory staff of these security measures to maintain confidentiality). Indicate which individuals will have access to the information, including code-breaking lists, if any.

    For genetic research, there are additional requirements under the law for coded research (ORS 192.547). These requirements include:

    • The code is:
      • Not derived from individual identifiers;
      • Kept securely and separately from the DNA samples and genetic information; and
      • Not accessible to the investigator unless specifically approved by the institutional review board.
    • Data is stored securely in password protected electronic files or by other means with access limited to necessary personnel.
    • The data is limited to elements required for analysis and meets the criteria in 45C.F.R 164.514(e) for a limited data set.

    If identified material is unlinked for use, it will not be possible to relay research results back to subject. While this will protect confidentiality, it may also place the subject at risk for failing to get information about a treatable health condition, and this risk should also be considered. If samples or information will be relayed outside of OHSU, indicate under what circumstances and what identifiers, if any, the relayed samples or information will bear. Note that transfer of samples to other researchers with identifiers is strongly discouraged. Obtaining a Certificate of Confidentiality is recommended to protect confidentiality of human repository specimens and data. Depending upon the reason for relaying genetic PHI outside of OHSU and the type of identifiers attached to the PHI, a data use agreement or business associate agreement may be required.

  5. Contact with subjects: Clearly describe the process by which subjects will be recruited into the study. Indicate whether access to medical records is required for the project and how access to these records will be obtained. If the investigator wishes to contact the relatives of a subject, the investigator must ask the subject to contact his/her relatives to seek their permission. If the subject declines to contact relatives, or the relatives decline contact by the investigator, no contact may occur. If permission is granted for contact, the informed consent and authorization process must be repeated with each relative. Note that if health information on family members is collected, but those members are not consented, that information may be kept with identifiers (consent may be waived) only after demonstrating to the IRB, with detailed information in the proposal, that strong data security measures are in place. Copies of family history questionnaires or other data sheets used to record information about the subject or family members should be provided with the proposal.

  6. Recontact with subjects: Recontact of a research subject or a patient from whom samples or information was obtained originally for clinical purposes should not occur unless the subject was informed during the initial treatment or research consent and authorization process, that recontact may occur under specified circumstances. Reasons for recontacting research subjects can include recontact for release of clinically relevant research results. If this is desired, precautions must be taken both to minimize the potential harm to subjects of receiving bad news and to guard against the unintended release of the information. The precautions needed in conveying genetic testing results depend on the age at onset of the disorder, the burden of illness, and the availability of treatment or prevention. The communication of genetic information carries with it the responsibility to interpret the results and provide care for the individual; and, thus, it is ideally done in the setting of a clinical rather than research relationship with the subject. Because of the complexity of the results of most genetic tests, subjects cannot be required to inform relatives of the results of the research. The IRB may consider allowing recontact for the purposes of disclosing research results if the following conditions are met: 1) the findings are scientifically valid and confirmed (and where relevant the laboratory producing the results is CLIA certified), 2) the findings have significant implications for the subject's or the public's health, and 3) a course of action to ameliorate or treat the subject's or the public's health concerns is readily available. In the event these conditions are met, the results may only be released to the subject or any other party with the subject's permission, and appropriate medical advice and referral must be provided (OAR 333-025-0130).

  7. Withdrawal: Subjects have the right to withdraw from research at any time. Samples or information that are labeled in such a way that the subject from which the sample or information was obtained can be identified must be destroyed upon request, regardless of whether the sample or information are currently being used in an ongoing research project. The researcher has the option of removing all identifiers from the sample or information and continuing to use them, but only if the subject is informed of this intent during the consent and authorization process.



IV. LEVEL OF REVIEW REQUIRED

  1. Research involving identified or coded biologic samples will usually be reviewed at a convened meeting of the full IRB. The expedited review process is available for research involving human biologic material if the research involves only minimal risk and is also limited to one of the categories specified in the Federal Register. For example, research involving a single small blood draw or a cheek swab can fall into one of these categories. However, the financial, psychological and social risks of genetic studies may prevent them from meeting the minimal risk criterion for expedited review, and these factors will be carefully considered prior to granting an expedited review. Unlinking (anonymizing) samples may help to reduce the level of risk involved.
  2. Exemption from continuing IRB oversight can only be granted for genetic studies if samples are anonymous, pre-existing, and meet notification requirements as stated in the previous section.


V. CONSENT AND AUTHORIZATION REQUIREMENTS

  1. The OHSU IRB must approve the consent and authorization process and its documentation (consent/authorization form) for all proposals. Elements of the consent and authorization process may be waived or modified by the OHSU IRB under some circumstances as defined by 45CFR46, HIPAA and Oregon state law. Note, however, that FDA-regulated studies are not eligible for a waiver or alteration of the elements of the informed consent process, unless covered by emergency treatment provisions. In general, prospective collection of coded or identified samples must be done using written consent and authorization. General consent statements given in conjunction with consent for a clinical or surgical procedure may not be presumed to cover research use of specimens unless research use, including genetic testing, is specifically listed as a possibility (see Section III-C).
  2. Investigators must retain signed consent/authorization forms, but these should not be stored in a way that could identify an otherwise unidentified sample.
  3. In addition to the standard elements of consent and authorization required for all research involving human subjects, the following material must be included in consent/authorization forms for use of human biologic material (see also the sample genetic consent/authorization form for suggested wording):
    1. Purpose: The consent/authorization form should describe the purpose of the research and, in the case of genetic research, specify the genetic characteristic that will be tested for. In general, a subject cannot meaningfully consent to and authorize an unspecified use of a specimen.
    2. Procedures: The consent/authorization form should explain the procedures for collecting and identifying specimens. If storage and future use of samples is planned, the consent/authorization form must inform subjects that their samples will be stored and the anticipated duration of storage. If specimens are to be submitted to a repository, explain whether the subjects' samples may be given to other investigators and for what purpose, and whether samples will be identified as described in the Confidentiality section.
    3. Confidentiality: Explain how information will be kept confidential, both at OHSU and upon transfer to any other laboratory or institution. Specifically indicate what identifiers will be kept with the sample (if any), and/or the level of identification as defined in the Definitions section.
    4. Recontact/subject access to research results: Indicate whether subjects will be contacted in the future and under what circumstances. Indicate whether research results can be made available to subjects and under what circumstances.
    5. Risks: Explain the risks and benefits of the research. The risks information should include not only the physical risk of getting the specimen, but also the potential financial, psychological and social risks of disclosure of test results. Risks of participating in genetic studies, in particular, potentially include the effects of the knowledge that subjects are carriers of a disease gene that might affect their life course, employability or insurability, and family relationships (particularly when the results may reveal sensitive information about paternity). The primary risks of these studies are therefore emotional or financial, rather than physical.
    6. Alternatives: Explain that subjects always have the option of choosing not to participate in research. In protocols involving an experimental treatment, subjects should be offered the option to participate in the part of the research involving the experimental treatment without participating in the part involving sampling and/or genetic analysis.
    7. Costs: Additional costs might be required for some genetic research studies, such as the costs of genetic counseling. If results will need to be repeated in a clinical laboratory, those costs must also be mentioned. Subjects should also be informed of the implications, including potential insurability, of authorizing disclosure to a third party payer that the genetic test was performed, and that he/she has the option of paying the cost of the genetic test out of pocket rather than filing an insurance claim.
    8. Commercial Development: If there is any intent to develop a commercial product from the specimens obtained in a research protocol, subjects must be so informed, and they must be informed whether there is any plan to compensate them for the use of their samples.
    9. Liability: The Genetic Privacy Law liability statement must be included when genetic research is involved (see sample CF).
    10. Participation: Indicate that in the case of identified or coded samples, subjects have the right to withdraw their samples from research in the future should they decide to do so. Subjects should be informed that their decision not to participate in the tissue sampling aspects of a research protocol will not compromise their ability to participate in the treatment aspects, and it will also not compromise their clinical care. Please note that while the HIPAA regulations permit a consent/authorization form to state that PHI will be retained indefinitely, the Oregon Genetic Privacy law is more stringent and must permit subjects to withdraw identified or coded samples.

  4. Waiver of written consent and authorization: Federal regulations permit the OHSU IRB to waive the requirement to obtain documented informed consent and authorization for some categories of research, and some types of research involving human biological samples fall into these categories. Note, however, additional restrictions for genetic research as discussed in previous sections. The use or disclosure of PHI must involve no more than minimal risk to subjects' privacy (see definition of minimal risk research). Also, the OHSU IRB will not waive consent and authorization when release of information to the subject or their health care provider is considered likely. For existing coded or identifiable samples (those already collected and stored), the NBAC recommends that IRBs consider research to be of minimal risk if the study adequately protects the confidentiality of the personally identifiable information associated with the sample. A HIPAA-compliant application for Waiver of Consent and Authorization is available. The application must justify the category of minimal risk and contain information to address the following issues:
    1. What is the source of the information?
    2. How many subjects/records will be accessed?
    3. Is there written assurance that the PHI will not be reused or disclosed to any other person or entity, except for other research for which the use or disclosure of PHI would be permitted by HIPAA research regulations?
    4. Is there an adequate plan to protect the PHI from improper use and disclosure?
    5. Is there an adequate plan to destroy the identifiers and/or PHI at the earliest opportunity?
    6. Would Waiver of Consent and Authorization adversely affect the subject's rights or welfare? The investigator should ascertain that the waiver will not violate any state or federal statute or customary practice regarding entitlement to privacy. Also, protocols will not qualify for Waiver of Consent and Authorization if the results might result in stigmatization of a race or ethnic group, and investigators should consider this possibility before applying for a waiver of consent and authorization.
    7. The research cannot practicably be done without access to the PHI.
    8. The research cannot practicably be carried out without the waiver of consent and authorization. The investigator should provide a full explanation of why obtaining consent is not possible. If appropriate, define when subjects will be provided with pertinent information after participation in the project. (This requirement pertains to research protocols that involve deception. It is very unlikely that a protocol involving biological specimens will involve deception.)


VI. GUIDELINES FOR REPOSITORIES

  1. A repository that is utilized for human subjects research should have written procedures for procuring (including recruitment, and informed consent and authorization processes) and storing samples, determining who will have access to samples, and protecting personally identifiable information. As for all other research protocols, those aimed at setting up repositories of biological samples must be submitted to the OHSU IRB for review and approval prior to collecting specimens.
  2. Specimens maintained in a repository may only be released to collaborators who are both competent researchers and knowledgeable in the legal and ethical issues involved in confidentiality and consent and authorization in human research, regardless of whether the researchers are located at OHSU or elsewhere. Samples from repositories at OHSU should not be provided to non-OHSU investigators without written documentation of local IRB approval, or documentation from the local IRB indicating that the protocol is exempt from review.
  3. A written usage agreement for recipient-investigators should include the following: "Recipient acknowledges that the conditions for use of this research material are governed by the specimen repository Institutional Review Board (IRB) in accordance with Department of Health and Human Services regulations at 45CFR46, and HIPAA Privacy regulations. Recipient agrees to comply fully with all such conditions and to report promptly to the specimen repository any proposed changes in the research project and any unanticipated problems involving risks to subjects or others. Recipient remains subject to applicable state or local laws or regulations, and institutional policies that provide additional protections for human subjects. This research material may only be utilized in accordance with the conditions stipulated by the specimen repository IRB. Any additional use of this material requires prior review and approval by the specimen repository IRB and, where appropriate, by an IRB at the recipient site, which must be convened under an applicable OHRP approved Assurance."
  4. Depending on the nature of the information that is released with a sample, a data use agreement or business associate agreement may be required. The IRB approval will indicate if one of these additional agreements is necessary.
  5. Use of samples from a repository must be restricted to the stipulations indicated in the original consent/authorization form used to procure the specimen, unless the sample is studied without identifiers.
  6. Investigators must obtain review from the OHSU IRB when samples from repositories will be studied at OHSU or when OHSU faculty members are co-investigators, regardless of the location of the repository. IRB review and approval must be complete before samples are released for use.
  7. Investigators and repositories must maintain records to assure compliance with any specified restrictions of sample use, including any restrictions placed by the person providing the specimen. Investigators receiving samples with identifiers or codes are legally and ethically responsible for maintaining the confidentiality of the subjects and for complying with all HIPAA requirements and the Oregon Genetic Privacy Law, 192.531-549, when applicable.


VII. USE OF PRE-EXISTING COLLECTIONS

  • Specimens collected, tested and/or stored solely for clinical care of a specific patient are not considered part of research and are not covered by this policy. However, if an investigator wishes to use specimens originally collected for clinical purposes for research purposes, that activity is covered by this policy and IRB review is required. Also note that research protocols using human tissues removed at the time of diagnostic or therapeutic procedures must be reviewed and approved by the Clinical Laboratories responsible for the clinical examination and diagnosis of these tissues. The policy describing this requirement is available on the Tissue Review Policy. The form required for submission of such protocols is the "Tissue Use Review form"
  • Many existing collections of human biologic material were begun before guidelines for research involving human biologic specimens were developed. Many of these specimens may have been obtained without consent or with only general clinical consent, and recontacting the individuals who provided the specimens may be difficult or impossible. In such situations, investigators should either submit an application to the IRB for a HIPAA-compliant Waiver of Consent and Authorization, or should adopt a policy to anonymize their collection. The IRB should approve procedures to make a collection anonymous. Note also the additional restrictions for genetic research as discussed in Section III-C.