1. Research Involving Human Specimens Marianna Bledsoe, M.A. HRPP 201 March 24, 2011

2. Overview of Presentation  Applicable federal regulations  Determining when human specimen research is human subjects research  Applying relevant federal regulations  Considerations for secondary use of specimens/data  Special considerations for banking  VA tissue banking guidelines  Current hot topics  Tools and Resources

3. Human Biological Specimens  Any material derived from a human subject—such as blood, urine, tissues, organs, hair, nail clippings, or any other cells or fluids  Whether collected for research purposes or as residual specimens from diagnostic, therapeutic, or surgical procedures  Does not include fungi, viruses, bacteria, etc.

4. Applicable Federal Regulations  Common Rule: 38 CFR part 16  FDA Regulations: –21 CFR Part 50, 56, 812  HIPAA Privacy and Security Rules: –45 CFR Part 160; Subparts A, C & E of Part 164  Privacy Act of 1974  HITECH Breach Notification Interim Final Rule

5. When is Specimen Research Human Subjects Research?  Is it research? –Research means a systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge. –OHRP considers creation of repositories for research purposes a research activity

6. When is Specimen Research Human Subjects Research?  Is it human subjects research? –Human subject – A living individual about whom an investigator (whether professional or student) conducting research obtains a) data through intervention or interactions with the individual, or b) identifiable private information. [38 CFR 16.102(f)] –Common Rule definition of identifiable = the identity of the subject is or may readily be ascertained by the investigator or associated with the information

7. When is Specimen Research Human Subjects Research?  Is it human subjects research (cont’d)? –For VA, research must meet both the Common Rule and Privacy Rule definitions of identifiable.

8. When is Specimen Research Exempt?  (4) Research involving the collection or study of existing data, documents, records, pathological specimens, or diagnostic specimens, if these sources are publicly available or if the information is recorded by the investigator in such a manner that subjects cannot be identified, directly or through identifiers linked to the subjects.

9. OHRP Guidance on Coded Private Information or Biological Specimens Definition of “Coded”: (1) identifying information (such as name or social security number) that would enable the investigator to readily ascertain the identity of the individual to whom the private information or specimens pertain has been replaced with a number, letter, symbol, or combination thereof (i.e., the code); and (2) a key to decipher the code exists, enabling linkage of the identifying information to the private information or specimens.

10. OHRP Guidance on Coded Private Information or Biological Specimens “In general, OHRP considers private information or specimens to be individually identifiable as defined at 45 CFR 46.102(f) when they can be linked to specific individuals by the investigator(s) either directly or indirectly through coding systems.” However, the OHRP coded specimens policy allows exceptions under certain conditions.

11. OHRP Guidance on Coded Private Information or Biological Specimens Research involving only coded information or specimens is not considered to involve human subjects if the following conditions are both met: (1) the private information or specimens were not collected specifically for the currently proposed research project through an interaction or intervention with living individuals; AND (2) the investigator(s) cannot readily ascertain the identify of the individual(s) to whom the coded private information or specimens pertain.

12. OHRP Guidance on Coded Private Information or Biological Specimens Examples of When Coded Data/Biologic Specimens Are Not Individually Identifiable to Investigators: (a)the investigators and the holder of the key enter into an agreement prohibiting the release of the key to the investigators under any circumstances, until the individuals are deceased

13. OHRP Guidance on Coded Private Information or Biological Specimens Examples of When Coded Data/Biologic Specimens Are Not Individually Identifiable to Investigators: (b) there are IRB-approved written policies and operating procedures for a repository or data management center that prohibit the release of the key to the investigators under any circumstances, until the individuals are deceased; or (c) there are other legal requirements prohibiting the release of the key to the investigators, until the individuals are deceased.

14. OHRP Guidance on Coded Private Information or Biological Specimens Only applies if: 1. Person(s) doing coding of data/specimens and person(s) holding codes are not part of the research team; AND 2. Specimens/data are not being obtained for the specific research in question by an interaction or intervention with living individuals.

15. Informed Consent  Informed consent required when there is intervention/interaction with a living individual or private identifiable information is being collected and/or used, unless waived by the IRB  Should be clear and understandable

16. Additional Informed Consent Content  Must meet requirements of human subjects regulations  In addition, should also include: –Description of specimens/data and process used for collecting them –Risks, including risks to privacy and confidentiality, and methods to protect risks –Description of the purpose of the collection and conditions for sharing –Types of research to be conducted

17. Additional Informed Consent Content –Statement of the right to withdraw –Whether results will be returned –Commercial use, if any, and plans, if any, for sharing profits –Plans for re-contact, if any  As appropriate: –Details about where and how long the specimens will be stored –Genetic uses and information on the consequences of DNA typing

18. Additional Informed Consent Content As appropriate (cont’d) –Conditions for sharing with other researchers –What will happen to specimens when no longer useful, when repository loses support, or is transferred to others

19. IRB Waivers of Consent  The research involves no more than minimal risk to the subjects;  (2) The waiver or alteration will not adversely affect the rights and welfare of the subjects;  (3) The research could not practicably be carried out without the waiver or alteration; and  (4) Whenever appropriate, the subjects will be provided with additional pertinent information after participation.

20. Secondary Use of Specimens  Research use for a purpose other than that described in the protocol  Research should be compatible with the informed consent under which the specimens were collected –See discussion of the Secretary’s Advisory Committee for Human Research Protections

21. Special Considerations for Repositories  How does the Common Rule apply? Three paths to human subjects research: –Creating a research repository/database through intervention or interaction with individual –Creating a research repository/database by obtaining identifiable private information – Obtaining identifiable private information from a research repository/database

22. Special Considerations for Repositories  Need for review and oversight of repository operating procedures and policies for protecting subject privacy and confidentiality, access and dissemination  Need for mechanism for ensuring specimen use is consistent/compatible with informed consent  Need to address custodianship issues: –Material Transfer Agreements; CRADAs –Plans if repository/bank closes –Plans for transfer if PI leaves institution

23. HIPAA Privacy and Security Rules  HIPAA does not apply to specimens per se, but may apply to information associated with the specimen  HIPAA authorization for use and disclosure of protected health information generally required but there are certain exceptions

24. HIPAA Privacy Rule Use or Disclosure of PHI for Research  With an individual’s Authorization  Must be study specific  Authorization NOT required if one of the following applies:  IRB or Privacy Board waiver  Preparatory to research (with certain representations)  Limited data set (with data use agreement)  De-identified dataset  Research solely on decedents (with certain representations and documentation)  IC, waiver of IC, or express legal permission prior to compliance date (and other conditions of transition provisions met)

25. VA Policies  VHA Handbook 1200.05--Requirements for the Protection of Human Subjects in Research  VHA Handbook 1200.12—Use of Data and Data Repositories in VHA Research  VHA Handbook 1605.1--Privacy and Release of Information  VHA Handbook 1605.2—Minimum Necessary Standard for Protected Health Information  VA Handbook 6500--Information Security Program  VHA Handbook 1106.01—Pathology and Laboratory Medicine Service Procedures

26. VA Specimen Banking Guidelines  Current requirements found on ORD web site http://www.research.va.gov/programs/tissu e_banking/default.cfm http://www.research.va.gov/programs/tissu e_banking/default.cfm

27. VA Definition of De-identified De-identified data is health or other information about an individual that:  Does not contain any of the 18 HIPAA identifiers AND  Is de-identified according to the Common Rule

28. HIPAA Identifiers 1.Names or initials 2.All geographic subdivisions smaller than a state 3.All elements of dates except the year and all ages over 89 4.Telephone numbers 5.Fax numbers 6.E-mail addresses 7.Social Security numbers (or scrambled SSNs) 8.Medical record numbers 9.Health plan beneficiary numbers

29. HIPAA Identifiers (cont’d) 10.Account numbers 11.Certificate or license numbers 12.Vehicle identifiers 13.Device identifiers and serial numbers 14.URLs 15.IP addresses 16.Biometric identifiers, including finger and voice prints 17.Full-face photographs and any comparable images 18.Any other unique identifying number, characteristic, or code

30. Specimens for a Single Research Protocol.  A waiver from ORD must be obtained if: –If specimens are stored off-site at a non-profit institution  5 years –If specimens are stored off-site at a non- academic, for-profit institution for >3 months  If the specimens are sent to a non-VA institution for testing as defined in the protocol, once the specific analyses are performed, the remainder of the specimens must be destroyed or returned to the VA for destruction.

31. Collecting and Storing Specimens for Secondary or Future Research  A tissue bank established at a VA site by a VA-paid investigator does not require ORD approval.  The ACOS/R or research office should maintain records of all tissue banks within the facility.

32. Collecting and Storing Specimens for Secondary or Future Research  The researcher must obtain a waiver from ORD before banking human biological specimens for future research use at an off-site location.  Specimens may not be banked for future research use at a non-academic, for- profit institution.  Off-site tissue banks are approved on a per protocol basis.

33. Collecting and Storing Specimens for Secondary or Future Research  Exception: National Cancer Institute (NCI)-sponsored cooperative tissue banks listed on the next slide. As a result of a letter of understanding with the NCI, these banks are designated as VA-approved if they are used for one of their protocols (for example, the SWOG-supported tissue bank can be used for SWOG protocols without ORD approval).

34. VA-Approved NCI Tissue Banks  Clinical Trials Cooperative Groups Tissue Resources –American College of Surgeons Oncology Group (ACOSOG) –Cancer and Leukemia Group B (CALGB) –Eastern Cooperative Oncology Group (ECOG) –Gynecologic Oncology Group (GOG) –North Central Cancer Treatment Group (NCCTG) –National Surgical Adjuvant Breast and Bowel Project (NSABP) –Radiation Therapy Oncology Group (RTOG) –Southwest Oncology Group (SWOG ) –National Cancer Institute of Canada Clinical Trials Group (NCIC CTG)  Cooperative Breast Cancer Tissue Resource  Cooperative Human Tissue Network  Gynecologic Oncology Group Tissue Network  Cancer Prevention Network

35. Storage of Specimens  Specimens must be labeled with a code that does not contain any of the 18 HIPAA identifiers.  In the case of storage at non-profits, the key to the code must be maintained at the VA unless there is a compelling reason otherwise. If the storage is at a for-profit institution, then it is mandatory that the code be maintained at the VA.

36. Additional Requirements for Specimens Stored at For-Profit Sites  Only analyses/tests listed in the protocol and informed consent may be performed.  The code must be maintained at the VAMC.  All specimens must be de-identified to meet both Common Rule and HIPAA requirements.  Limited DNA/RNA analyses may be performed.

37. Additional Requirements (cont’d)  HIPAA authorization must be a separate stand alone document and expire at the end of the study.  Use of initials outside of VA is generally not permitted.  Before company personnel may view files at the VA, they must complete VA security and privacy training.  Specimens must be destroyed within 1 year of the study completion date. The company should inform the PI in writing when samples are destroyed.

38. Data Linked to Banked or Stored Specimens  If data linked to the sample leaves the VA, then it should be de-identified or stored in a database that is encrypted according to FIPS 140-2 standards.  See VA Handbook 6500 “Information Security”

39. Application Process  The investigator must complete VA form 10-0436. This is a pdf form that can be filled in and saved using Acrobat Reader version 7 or higher (http://www.va.gov/vaforms/medical/pdf/vha-10-0436- fill.pdf).http://www.va.gov/vaforms/medical/pdf/vha-10-0436- fill.pdf  The additional required information can be scanned and attached to the pdf or to the e-mail. –Research protocol –Tissue bank manual /SOPs [non-profits] –VA consent form –HIPAA authorization

40. Application Process (cont’d)  The application should be e-mailed to Kristina Hill (Kristina.Hill@va.gov). It should be sent from the research office.Kristina.Hill@va.gov  Alternatively, the form and requested information can be faxed to: (202) 495-6156.

41. Application Process (cont’d)  After the application is reviewed, the PI and ACOS/R will receive a memo listing any issues that need to be addressed.  Frequent issues with applications include informed consent issues, use of identifiers, long term storage, and mandatory banking or genetic testing which is not permissible except when integral to study design.

42. Multi-Site Trials  If several VAMCs are planning to participate in the same clinical trial, then only one of the VA sites needs to apply for a waiver.

43. In the Works  Changes to the HIPAA Privacy Rule  HITECH Breach Notification Requirements Final Rule  New VA Handbook on Specimen Research

44. Current Hot Topics  Return of Research Results and Incidental Findings  Group Harms  Intellectual Property/Ownership/Custodianship  Identifiability –Differing definitions –Impact of emerging genetic technologies and extent and availability of databases containing patient/subject information

45. Current Policy Discussions Secretary’s Advisory Committee on Human Research Protections –http://www.hhs.gov/ohrp/sachrphttp://www.hhs.gov/ohrp/sachrp –FAQs on Specimen Research (October 2008 – October 2010) –Implications of the Havasupai Case (July 21, 2010) –Discussion of Identifiability (October 20, 2010) –Subcommittee on Harmonization exploring secondary use of specimens, HITECH

46. Biorepository Best Practices  International Society for Biological and Environmental Repositories (ISBER) “2008 Best Practices for Repositories” http://www.isber.org/Pubs/BestPractices2008.pdf http://www.isber.org/Pubs/BestPractices2008.pdf  National Cancer Institute Best Practices for Biospecimen Resources (June 2007) http://biospecimens.cancer.gov/global/pdfs/NCI_Best_Pr actices_060507.pdf http://biospecimens.cancer.gov/global/pdfs/NCI_Best_Pr actices_060507.pdf

47. Other Resources  Report of the Public Responsibility in Medicine and Research (PRIM&R) Human Tissue/Specimen Banking Working Group (March 2007) http://www.primr.org/uploadedFiles/PRIMR_Site_Home/Public _Policy/Recently_Files_Comments/Tissue%20Banking%20W hite%20Paper%203-7-07%20final%20combined.pdf http://www.primr.org/uploadedFiles/PRIMR_Site_Home/Public _Policy/Recently_Files_Comments/Tissue%20Banking%20W hite%20Paper%203-7-07%20final%20combined.pdf

48. Contact Information  Marianna Bledsoe, M.A.  Senior Program Manager for Biorepositories and Biobanking  E-mail: Marianna.Bledsoe@va.govMarianna.Bledsoe@va.gov  Phone: 202-443-5781  Fax: 202-495-6156

49. Acknowledgements  Marilyn Mason, PhD.  Kristina Hill, MPH

50. Selected SACHRP FAQs

51. FAQ # 1 Approved by SACHRP July 22, 2009 Tissue biopsies were obtained for clinical diagnostic purposes, which have now been satisfied. The hospital pathology department is willing to provide a portion of the remaining biopsy specimens to an investigator who will perform research assays. In order to allow matching with relevant clinical information, the specimens will be provided with identifiers such that the investigator can readily ascertain the identity of subjects. Is consent of the patient from whom the biopsy was taken (or waiver of consent) required for the secondary research use?

52. Response # 1 Approved by SACHRP July 22, 2009 Yes. Under this scenario, informed consent of the subjects should either be obtained or waived under 45 CFR 46.116(d) because the samples are identifiable to the recipient investigator.

53. HIPAA Issues for FAQ #1 Approved by SACHRP October 27, 2009  Assuming the hospital is a HIPAA covered entity, the use or disclosure of patient identifiers for the research purpose would also require a HIPAA authorization from the patient or a waiver of authorization by an IRB or Privacy Board.

54. FAQ # 2 Approved by SACHRP July 22, 2009 Tissue biopsies were obtained for clinical diagnostic purposes, which have now been satisfied. The hospital pathology department is willing to provide a portion of the remaining biopsy specimens to an investigator who will perform research assays. The specimens will be coded such that the investigator will not be able to readily ascertain the identity of individuals. Is consent of the patient from whom the biopsy was taken (or waiver of consent) required for the secondary research use?

55. Response # 2 Approved by SACHRP July 22, 2009 No. Under this scenario, neither consent nor waiver is required, because the activity is not considered to be research involving human subjects.

56. HIPAA Issues for FAQ #2 Approved as modified by SACHRP October 27, 2009  If the information associated with the specimens is de-identified in accordance with the HIPAA Privacy Rule, neither authorization nor waiver of authorization is required, because it would no longer be considered Protected Health Information.  Note, however, that information associated with the specimens that is not individually identifiable per OHRP guidance (i.e., coded) may not necessarily be de-identified for HIPAA Privacy Rule purposes. For example, the coded information may not be considered to be de- identified under the Privacy Rule if the code is derived from a patient identifier or certain data elements, such as dates of service or zip codes, remain with the information. Thus, the use or disclosure of the information for research may still require a form of HIPAA permission, such as a HIPAA authorization, IRB or Privacy Board waiver of authorization, or, if the information constitutes a “limited data set” a data use agreement with the recipient of the information.

57. FAQ # 6 Approved by SACHRP October 27, 2009 Blood samples were obtained for research purposes, with informed consent of the subjects, and the original study has been completed. The samples remain under the control of the original investigator. Another investigator wants to use a portion of the remaining samples to perform research unrelated to the original study. If the sample is identifiable to the secondary user, is this considered to be human subjects research under the purview of the IRB? If so, what are the consent considerations ?

58. Response # 6 Approved by SACHRP October 27, 2009 Yes. This is human subjects research under the purview of the IRB. The IRB should consider whether the secondary use is compatible with the original terms of consent given by the subjects.

59. HIPAA Issues for FAQ #6 Approved by SACHRP October 27, 2009  A HIPAA authorization for research must be research-study specific. Thus, assuming a HIPAA covered entity is involved, a new HIPAA authorization would be required for the subsequent unrelated research use or disclosure, or another form of HIPAA permission obtained (e.g., waiver of authorization).

60. FAQ # 7 Approved by SACHRP October 27, 2009 Blood samples were obtained for research purposes, with informed consent of the subjects, and the original study has been completed. The samples remain under the control of the original investigator, who now wants to collaborate with another investigator to perform research unrelated to the original study. If the original consent was silent on the question of subsequent uses, is informed consent (or waiver of consent) required before the sample can be used for other purposes?

61. Response # 7 Approved by SACHRP October 27, 2009  Yes. Under these circumstances, the IRB should consider the original terms of consent, and determine whether a waiver might be appropriate or whether additional consent is required.  The criteria for waiver of consent under 45 CFR 46.116(d) include that the research involves no more than minimal risk; the waiver would not adversely affect the rights and welfare of subjects; the research could not practicably be carried out without the waiver; and whenever appropriate, the subjects will be provided with pertinent information after participation.  Points to consider in applying these criteria include the nature of the research; the protections in place to maintain privacy and confidentiality (e.g., coding, limited/controlled access, honest broker mechanisms); the change in level of risk, if any; the ability to locate or contact subjects; risk of introducing bias into the research ; potential anxiety or confusion for subjects; the number of subjects; the length of time since specimens were first collected; and the likelihood that subjects would object to the proposed secondary use, based on the nature of original collection.

62. FAQ # 9 Approved by SACHRP October 27, 2009 Patients undergoing surgery agree to donate any excess tissue (i.e., beyond that needed for clinical purposes) to a tissue bank. The creation of the bank is reviewed as human subjects research and approved by the IRB. The consent form makes it clear that the specimens and associated clinical data will be used for research, but does not specify or limit that use. If specimens are provided to the researchers with clinical information that allows the researcher to readily ascertain the identity of the subjects, do those researchers need separate IRB approval of the proposed research use of the specimens and data?

63. Response # 9 Approved by SACHRP October 27, 2009 Yes, the provision of identifiable information with the specimen means the research to be conducted with the specimen is a separate human subjects research protocol and separate IRB approval would be required.

64. FAQ # 10 Approved by SACHRP October 27, 2009 Patients undergoing surgery agree to donate any excess tissue (i.e., beyond that needed for clinical purposes) to a tissue bank. The creation of the bank is reviewed and approved by the IRB. The consent form makes it clear that the specimens and associated clinical data will be used for research, but does not specify or limit that use. If specimens are provided to the researchers with clinical information that allows the researcher to readily ascertain the identity of the subjects, is a new consent from the patient/subject [or IRB waiver of informed consent] required?

65. Response # 10 Approved by SACHRP October 27, 2009  Yes, a new consent is required unless IRB determines that the original consent was adequate to allow the subsequent research use, or the IRB determines a waiver is appropriate.  The criteria for waiver of consent under 45 CFR 46.116(d) include that the research involves no more than minimal risk; the waiver would not adversely affect the rights and welfare of subjects; the research could not practicably be carried out without the waiver; and whenever appropriate, the subjects will be provided with pertinent information after participation.  Points to consider in applying these criteria include the nature of the research; the protections in place to maintain privacy and confidentiality (e.g., coding, limited/controlled access, honest broker mechanisms); the change in level of risk, if any; the ability to locate or contact subjects; risk of introducing bias into the research ; potential anxiety or confusion for subjects; the number of subjects; the length of time since specimens were first collected; and the likelihood that subjects would object to the proposed secondary use, based on the nature of original collection.

66. A Real Life Example

67. Real Example  A non-VA researcher approaches a VA ophthalmologist wanting to obtain residual fluid that is used to wash eyes during treatment for cataracts. This fluid is waste that would ordinarily be discarded. The non-VA researcher will use the material to study the mechanisms of cataract formation in mice. No identifying information is sought.  Is this human subjects research?  Is an FWA and IRB approval required at the VA site?  What if the VA opthalmologist were providing identifiers along with the specimens? Would a FWA or IRB approval be required at the VA site?