Secondary research is research with existing specimens/data initially collected for purposes other than the planned research.  The specimens/data might have initially been collected for non-research purposes (for example, as part of routine clinical care) or as part a different research protocol.  Secondary research is encouraged since it maximizes the utility of data and specimens while minimizing risk to subjects since no new procedures will need to be performed.

Examples of secondary research vs. primary research are included in the presentation given on 1/9/2021, “Secondary Research: Fact, Fiction, Fears and Fantasies” that is available on the Office of Human Subjects Research Protections (OHSRP) website in the Presentation Archive.  On the same webpage, also see the 7/9/2019 presentation titled, “Best Practices for the Approval and Conduct of Secondary Research, including Repositories” for additional information.

There are 2 circumstances in which secondary research with specimens/data collected from human subjects may not require IRB review.

1. All the individuals from which the specimens/data were collected are deceased, OR
2. The specimens/data are not identifiable to the research team (see below for further discussion on this).

Subjects are all deceased

If all the individuals from whom the specimens/data were collected are now deceased, the research does not meet the definition of human subjects research and does not require prospective IRB review.  However, if the specimens/data were collected under another research protocol, the terms of the original consent still apply.  For example, if the consent form contained any limitations on the future use of the specimens/data, those limitations must be honored.  The investigator is responsible for ensuring that any proposed research is consistent with the original consent. 

Specimens/data are not identifiable to the research team

Research, with specimens/data which are not identifiable to the research team, is not considered human subjects research and does not require IRB review and approval.  For example, the specimens/data have been fully anonymized by removing all identifiers, or they have been coded, and the investigator conducting the research does not have access to the code key and cannot otherwise re-identify the subjects. The term “coded” means that all identifying information has been replaced with a number, letter, symbol, or combination thereof (i.e., the code) and a key to decipher the code exists, enabling linkage of the identifying information to the specimens/data. See the Guidance for Determining Whether Data Constitutes Individually Identifiable Information Under 45 CFR 46 on the OHSRP website.  Investigators should consult with OHSRP if they are unsure whether data or biospecimens being used in a specific research project would be considered individually identifiable.

Secondary research is considered human subjects research that requires IRB review when the specimens/data are identifiable to the researchers and were collected for another purpose than the planned research.  The following is an example of secondary research:

• An investigator learns of preliminary data from a study that suggests cigarette smoking leads to specific epigenetic changes that increase susceptibility to certain infections. She also has a large number of pre-treatment samples from cigarette smokers that would be ideal to initially test this hypothesis. The specimens were collected under protocols focused on the study of lung cancer. The samples are coded, and the investigator holds the code key with identifiers. Her planned research with the specimens/data is not described in the objectives of the original lung cancer protocols.  The planned activity meets the definition of secondary research because the specimens/data were collected under another protocol for a different research purpose.

Note that if the planned research is related to the existing primary, secondary, or exploratory objectives described in the IRB-approved protocol (under which the specimens/data were originally collected), then it is not considered to be secondary research.  This is research that should be conducted under the primary protocol (i.e., primary research).  If the investigator is unsure whether the protocol should be amended to address the planned activities or whether the current description is adequate, the investigator should contact the IRB.  The following is an example of a proposed activity that does not meet the definition of secondary research:

• An investigator has collected samples as part of an IRB approved phase 1 protocol to determine the maximum tolerated dose of new checkpoint inhibitor drug XYZ123 for the treatment of metastatic lung cancer refractory to standard therapies. The protocol includes an exploratory objective to determine changes in immunologic profiles of subjects receiving the drug.  After the trial is already complete, the investigator decides to have all the previously stored samples analyzed for T cell subsets.  Since this additional analysis meets the exploratory objective of the original protocol, the planned activities would be considered primary research.

• When NIH is not the Reviewing IRB, the NIH Site PI/Lead Investigator must report research related events to the Reviewing IRB in accordance with that IRB’s instructions. Additionally, if the reportable event occurred at an NIH site, or directly impacts the NIH site, NIH PI/Lead Investigator must also report to the OHSRP office of Compliance and Training in the NIH electronic IRB system within 7 calendar days of the NIH PI//Lead Investigator becoming aware of the event.
• When the Reviewing IRB is an external IRB, and the event occurred at a non-NIH site or does not directly impact an NIH site, the NIH PI/Lead Investigator is required to ensure that the reporting requirements of the Reviewing IRB are followed. The investigator does not also report these events to the OHSRP office of Compliance and Training, except as follows:
  • External IRB determinations of serious and/or continuing non-compliance about an NIH investigator: If the NIH is relying on an external IRB and the Reviewing IRB makes a determination of serious and/or continuing non-compliance regarding an NIH investigator, the NIH PI/designee must report this in the NIH electronic IRB system within 7 calendar days of any member of the NIH research team being notified of the determination by the Reviewing IRB. The NIH PI must provide the OHSRP office of Compliance and Training with documentation from the Reviewing IRB.
  • Suspension or termination of research activities at NIH by an external IRB: If the NIH is relying on an external IRB and the Reviewing IRB suspends or terminates NIH research activities, this must be reported within 7 calendar days of any NIH member of the research team being notified.

To determine if your planned activity with specimens/data is secondary research that will require IRB review, ask yourself the following four questions in order.  If the answer to all four of these questions is “yes,” then you are performing secondary research that requires review by the IRB.

1. Is the planned activity research? Consider the following regulatory definitions of research:
   • Research (2018 Common Rule) means a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge. (45 CFR 46.102(l))
   • Clinical investigation (FDA Regulations) means any experiment that involves a test article and one or more human subjects[1], and that either must meet the requirements for prior submission to the Food and Drug Administration under section 505(i) or 520(g) of the act, or need not meet the requirements for prior submission to the Food and Drug Administration under these sections of the act, but the results of which are intended to be later submitted to, or held for inspection by, the Food and Drug Administration as part of an application for a research or marketing permit. The term does not include experiments that must meet the provisions of part 58, regarding nonclinical laboratory studies. The terms research, clinical research, clinical study, study, and clinical investigation are deemed to be synonymous for purposes of this part. (21 CFR 56.102(c))
2. Does the planned activity meet the definition human subjects research? Consider the following regulatory definitions of human subject:

• Human Subject(2018 Common Rule) means a living individual about whom an investigator (whether professional or student) conducting research:
  1. Obtains information or biospecimens through intervention or interaction with the individual, and uses, studies, or analyzes the information or biospecimens; or
  2. Obtains, uses, studies, analyzes, or generates identifiable private information or identifiable biospecimens.
• Human Subject (FDA Regulations)means an individual who is or becomes a participant in research, either as a recipient of the test article or as a control. A subject may be either a healthy human or a patient. (21 CFR 50.3(g))
• Subject (FDA regulations related it use of investigational devices) means a human who participates in an investigation, either as an individual on whom or on whose specimen an investigational device is used or as a control. A subject may be in normal health or may have a medical condition or disease. ( 812.3.(p))

1. Are you using specimens/data that were collected for other purposes (either research or non-research) for the planned research?
2. Is the planned research use of these specimens/data unrelated to the aims or objectives of the current IRB-approved protocol, under which they were originally collected?

^1. Please note that the FDA considers research involving human specimens and the use of a medical device to be “clinical investigations”, if data from the research will be used to support an IDE (including IVDs), device marketing application, or another submission to the FDA.  In this regard, research involving leftover human specimens that are de-identified is included.

The step by step guide about completing an event form can be used when completing an event form.

An instruction sheet about reporting a death in NIH electronic IRB system can be found here.

• Provide complete and comprehensive answers to the required questions on the event form and to follow-up questions posed by the Compliance Analysts after their review of your submission.
• If the event is being reported outside of the required reporting window, an explanation of the delay must be provided on the reporting form.
• If the event form being submitted reports that consent was not obtained prior to the start of research, list all of the research procedures that occurred prior to obtaining the participant’s consent.
• Compliance and Training as well as members of OHSRP leadership who initially review the event forms submitted in the electronic IRB system, as well as the IRB or RCRC members who review event(s) referred to the board, pay particular attention to what corrective action has been taken or will be taken to mitigate the problem and prevent it from recurring. In most cases, a robust explanation in this regard is required.
• Electronically attach any relevant supporting documents when you submit the event form in the electronic IRB system such as:
  • If the event was reviewed by the DSMB, attach the DSMB’s follow-up report of its review.
  • If an autopsy is available, attach it with the submission.

• For FDA regulated studies, investigators are required to report events to the study sponsor as described in the protocol and to immediately (i.e., no longer than 10 days) report Serious Adverse Events (SAE)s or Unanticipated Adverse Device Effect (UADEs) to the study sponsor.
• If the event is also an actual or suspected UP that occurred on your study, you should also submit an event form to the IRB within 7 calendar days of becoming aware of the event.
• OHSRP office of Compliance and Training must be provided a copy of any official FDA communication regarding an inspection (e.g., FDA Form 483) issued regarding an NIH research protocol and/or investigator. This must occur within 7 calendar days of receipt of the FDA communication.

Information regarding when IND Safety Reports should be submitted with an event form and how to classify the information in the report (UP vs. New Information) can be found in the section of the OHSRP website that has FAQs related to IND Safety Report Submissions.

• The RCRC is responsible for reviewing possible serious or continuing non-compliance in human subjects research for which the NIH IRB is the Reviewing IRB (whether the protocol is currently open or closed), or for human subjects research conducted by NIH Investigators without IRB approval, that has been referred from the office of Compliance and Training.
• The RCRC has the final authority to determine whether there is non-compliance that is serious and/or continuing and to determine corrective action.
• As a duly convened committee, the RCRC may exercise the full authority of an IRB including suspension or termination of IRB approval of research.
• The determination by the RCRC is provided in writing to the Principal Investigator and study contacts.

• When the reported event is referred for RCRC review, you (as the PI) will be notified via NIH electronic IRB system in an outcome letter. You will also receive an email noting the date and time of the RCRC meeting at which the event will be reviewed. This email also explains that, if you choose to do so, you may attend the meeting to address the RCRC and answer any questions posed by the Committee members. You should respond to this email.
• You are also invited to provide, in advance of the meeting, any additional written information that you believe will be helpful to the RCRC members in their review of the event. You should provide any supplemental written information 7-10 days in advance of the scheduled RCRC meeting.
• After the meeting, an Analyst from the Office of Compliance & Training will send you an outcome letter via NIH electronic IRB system notifying you about the RCRC determination of the event and informing you of any required follow-up action item/s or stipulations.

• Investigators are expected to comply with NIH HRPP Policy 104, Managing Research-Related Complaints from Subjects.
• You should communicate respectfully with the participant who has the concern/complaint.
• You should report the participant’s research-related complaint to the study PI.
• The PI will address the complaint as soon as feasible, and/or refer the matter to other NIH or IC offices, as appropriate.
• If the investigator is unable to resolve the participant’s complaint, the OHSRP office of Compliance and Training should be contacted to provide assistance in handling and responding to complaints.
• You should document the participant’s concern in the medical (e.g., CRIS) or research record.
• Unresolved participant complaints should be reported at the time of the CR.

• While designated contacts are identified in the consent form and include the PI and any other study investigator specifically listed on the form, if the participant wants to speak with a non-study team member about a concern, they can contact the IRB Office as listed in the consent form. Participants seen at the Clinical Center (CC) may also contact the NIH CC Patient Representative.
• Institutes/Centers (ICs) who have investigators who conduct human subjects research at other locations that do not have a designated Patient Representative may also have specific individuals or offices within the IC listed on the ICF who participants can contact about their study related concerns.
• Participants may also bring their concerns or complaints to OHSRP.
• To the extent that the participant has explained their concern, you should document the participant’s concern in the medical (e.g., CRIS) or research record.
• Unresolved participant complaints should be reported at the time of the CR.

• You can find these requirements in NIH Policy 103, Education Program, and additional information can be found in the accompanyingGuideline for Investigator HSR Training.
• See additional information about this topic on the OHSRP website CITI training FAQs. You can also send questions to the OHSRP office of Compliance & Training via email.

Information on how to check required training records can be found at the Training FAQs link on the OHSRP website.

If the investigator is covered by the NIH FWA, they should click on the green box labeled “CITI Training” on the NIH CITI Training page to gain entry to the NIH CITI portal and complete the required CITI course/refresher.  Additional Information related to expired CITI training can be found by going to the NIH CITI Training page on the OHSRP website and clicking on the green box labeled “Expired CITI Training.”

• NIH HRPP Policy 301, Informed Consent, describes the requirements for informed consent when human subjects research is conducted.  
• Additional information about how to handle situations such as use of the short form process when you have an unexpected enrollment of a participant who is non-English speaking and who cannot read the English long form as well as other situations (e.g., consent obtained via telephone and how to document such a process) can be found under the OHSRP website FAQs Everything you need to know about consent.