Secondary research is research with existing specimens/data initially collected for purposes other than the planned research.  The specimens/data might have initially been collected for non-research purposes (for example, as part of routine clinical care) or as part a different research protocol.  Secondary research is encouraged since it maximizes the utility of data and specimens while minimizing risk to subjects since no new procedures will need to be performed.

Examples of secondary research vs. primary research are included in the presentation given on 1/9/2021, “Secondary Research: Fact, Fiction, Fears and Fantasies” that is available on the Office of Human Subjects Research Protections (OHSRP) website in the Presentation Archive.  On the same webpage, also see the 7/9/2019 presentation titled, “Best Practices for the Approval and Conduct of Secondary Research, including Repositories” for additional information.

There are 2 circumstances in which secondary research with specimens/data collected from human subjects may not require IRB review.

1. All the individuals from which the specimens/data were collected are deceased, OR
2. The specimens/data are not identifiable to the research team (see below for further discussion on this).

Subjects are all deceased

If all the individuals from whom the specimens/data were collected are now deceased, the research does not meet the definition of human subjects research and does not require prospective IRB review.  However, if the specimens/data were collected under another research protocol, the terms of the original consent still apply.  For example, if the consent form contained any limitations on the future use of the specimens/data, those limitations must be honored.  The investigator is responsible for ensuring that any proposed research is consistent with the original consent. 

Specimens/data are not identifiable to the research team

Research, with specimens/data which are not identifiable to the research team, is not considered human subjects research and does not require IRB review and approval.  For example, the specimens/data have been fully anonymized by removing all identifiers, or they have been coded, and the investigator conducting the research does not have access to the code key and cannot otherwise re-identify the subjects. The term “coded” means that all identifying information has been replaced with a number, letter, symbol, or combination thereof (i.e., the code) and a key to decipher the code exists, enabling linkage of the identifying information to the specimens/data. See the Guidance for Determining Whether Data Constitutes Individually Identifiable Information Under 45 CFR 46 on the OHSRP website.  Investigators should consult with OHSRP if they are unsure whether data or biospecimens being used in a specific research project would be considered individually identifiable.

Secondary research is considered human subjects research that requires IRB review when the specimens/data are identifiable to the researchers and were collected for another purpose than the planned research.  The following is an example of secondary research:

• An investigator learns of preliminary data from a study that suggests cigarette smoking leads to specific epigenetic changes that increase susceptibility to certain infections. She also has a large number of pre-treatment samples from cigarette smokers that would be ideal to initially test this hypothesis. The specimens were collected under protocols focused on the study of lung cancer. The samples are coded, and the investigator holds the code key with identifiers. Her planned research with the specimens/data is not described in the objectives of the original lung cancer protocols.  The planned activity meets the definition of secondary research because the specimens/data were collected under another protocol for a different research purpose.

Note that if the planned research is related to the existing primary, secondary, or exploratory objectives described in the IRB-approved protocol (under which the specimens/data were originally collected), then it is not considered to be secondary research.  This is research that should be conducted under the primary protocol (i.e., primary research).  If the investigator is unsure whether the protocol should be amended to address the planned activities or whether the current description is adequate, the investigator should contact the IRB.  The following is an example of a proposed activity that does not meet the definition of secondary research:

• An investigator has collected samples as part of an IRB approved phase 1 protocol to determine the maximum tolerated dose of new checkpoint inhibitor drug XYZ123 for the treatment of metastatic lung cancer refractory to standard therapies. The protocol includes an exploratory objective to determine changes in immunologic profiles of subjects receiving the drug.  After the trial is already complete, the investigator decides to have all the previously stored samples analyzed for T cell subsets.  Since this additional analysis meets the exploratory objective of the original protocol, the planned activities would be considered primary research.

To determine if your planned activity with specimens/data is secondary research that will require IRB review, ask yourself the following four questions in order.  If the answer to all four of these questions is “yes,” then you are performing secondary research that requires review by the IRB.

1. Is the planned activity research? Consider the following regulatory definitions of research:
   • Research (2018 Common Rule) means a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge. (45 CFR 46.102(l))
   • Clinical investigation (FDA Regulations) means any experiment that involves a test article and one or more human subjects[1], and that either must meet the requirements for prior submission to the Food and Drug Administration under section 505(i) or 520(g) of the act, or need not meet the requirements for prior submission to the Food and Drug Administration under these sections of the act, but the results of which are intended to be later submitted to, or held for inspection by, the Food and Drug Administration as part of an application for a research or marketing permit. The term does not include experiments that must meet the provisions of part 58, regarding nonclinical laboratory studies. The terms research, clinical research, clinical study, study, and clinical investigation are deemed to be synonymous for purposes of this part. (21 CFR 56.102(c))
2. Does the planned activity meet the definition human subjects research? Consider the following regulatory definitions of human subject:

• Human Subject(2018 Common Rule) means a living individual about whom an investigator (whether professional or student) conducting research:
  1. Obtains information or biospecimens through intervention or interaction with the individual, and uses, studies, or analyzes the information or biospecimens; or
  2. Obtains, uses, studies, analyzes, or generates identifiable private information or identifiable biospecimens.
• Human Subject (FDA Regulations)means an individual who is or becomes a participant in research, either as a recipient of the test article or as a control. A subject may be either a healthy human or a patient. (21 CFR 50.3(g))
• Subject (FDA regulations related it use of investigational devices) means a human who participates in an investigation, either as an individual on whom or on whose specimen an investigational device is used or as a control. A subject may be in normal health or may have a medical condition or disease. ( 812.3.(p))

1. Are you using specimens/data that were collected for other purposes (either research or non-research) for the planned research?
2. Is the planned research use of these specimens/data unrelated to the aims or objectives of the current IRB-approved protocol, under which they were originally collected?

^1. Please note that the FDA considers research involving human specimens and the use of a medical device to be “clinical investigations”, if data from the research will be used to support an IDE (including IVDs), device marketing application, or another submission to the FDA.  In this regard, research involving leftover human specimens that are de-identified is included.

Secondary research is subject to the same regulations and reviewed using the same processes as all other human subjects research.  However, depending on the specifics of the study, it may be able to be determined to be exempt from IRB review. Refer to Exempt Research on the OHSRP website. 

• Exempt: Submit an exempt protocol via the electronic IRB submission system. Exempt protocol templates and instructions for submitting for an exemption are available at the link above.  
• Non-exempt: Submit a secondary research protocol via the electronic IRB submission system. Non-exempt research needs to go through either an expedited or full board IRB review process.  Secondary research studies are typically considered minimal risk and are usually eligible for review and approval using expedited procedures.  The secondary research protocol template is available on the OHSRP website.

Secondary research that meets the definition of human subjects research is subject to the same regulatory requirements as all other human subjects research; therefore, it must undergo IRB review.  The ethical underpinning of this expectation is to assure that the proposed use of the specimens/data meets regulatory requirements and does not violate subjects’ rights.  When subjects, as part of an IRB approved protocol, provided their specimens/data, it was with an understanding they would be used for a specific named purpose. IRB review of a secondary research protocol is conducted to assure that the new use is not counter to that intent nor likely to introduce new risks, not previously disclosed to the subject or considered by the IRB.  The IRB will also ensure that appropriate privacy and confidentiality protections are put in place.

The original protocol title(s) and protocol number(s) from which the specimens/data were collected, when applicable, should be listed in the new protocol. When investigators will be using existing specimens/data collected under other research protocols, the IRB will look for information about how the investigator has access to the materials. Furthermore, the new protocol must include a summary of the consent language in all applicable consent versions (for all the original protocols) as it applies to sharing and use of specimens/data for future research.  This information could be provided in a table or in summary form in the protocol or the previous consent document versions could be uploaded as part of an Appendix. This will allow the IRB to review the original consent language to understand what information was conveyed to subjects about the use of their research specimens/data.  Any promises made in the consent regarding sharing and the future use of specimens/data must be honored.

Some examples of circumstances that could be considered include:

• If a previous subject(s) opted out of the use of their specimens/data for future research as part of the original consent, the specimens/data should not be used as part of the secondary research.
• If the original consent stated that the specimens/data would not be used for future research or would only be used for a specific type of future research (i.e., other than what is planned for this study), then the specimens/data cannot be used for secondary research without re-consent.
• If using the specimens/data for secondary research appears consistent with the terms of the original consent, then IRB can waive consent for the secondary research.

• Receiving completed questionnaires back from participants where items are missing
• Completing a study visit outside of the required timeframe when, in the opinion of the investigator, there are no safety implications.
• Use of an expired consent form in which the information contained is not substantively different than the currently approved consent unless the deviation occurs repeatedly
• Minimal over-enrollment
• A signed copy of the consent form was not given to the participant
• Documentation deficiencies in the consent form such as: 
  • A missing investigator signature 
  • The participant signs the consent form but does not print their name in the signature block
• Note: When a participant does not sign and date the consent form prior to the initiation of research, the event is considered a major deviation.
• If consent was silent on secondary research, then IRB will consider whether the proposed use is acceptable with a waiver, or alternatively, if re-consent is required.
• Please note that under the revised Common Rule (which applies to new protocols approved on or after January 21, 2019), there are new consent requirements which could affect what is allowable within a secondary research protocol. Please see FAQ 9.  
• The IRB will consider if the secondary research would impose new or significantly greater risks (including privacy risks) not described in the original consent form.
• The IRB will also consider if the study population(s) may have known concerns about the proposed secondary use. An example of this would be Native American or Alaskan Native populations who have distinct culture, beliefs and values and have concerns for potential community harms based on past abuses and violations related to clinical research. Secondary research may require additional ethical review by an Indian Health Service or Tribal IRB and permission from a tribal government.

As with all human subjects research, either the specific consent of the subject to participate in the research must be obtained, or the IRB must waive consent.  The future use language in consent forms does not contain all the required elements of consent.  Typically, the future use language is very broad, so it does not adequately describe the purpose of the planned study.  In addition, secondary research is a new research project that the IRB has not previously reviewed, so a determination that the project meets the IRB approval criteria must be made. 

Any permission granted for future use is best thought of as a statement of intent by the subject, that allows the IRB to waive consent for the future use of the specimens/data for research that is compatible with the original consent.

Under the revised Common Rule (which applies to the consent forms associated with new protocols approved on or after January 21, 2019), the original consent form must include:

• A statement that clarifies whether or not identifiers might be removed from the data or biospecimens and that, after such removal, the information or biospecimens could be used for future research studies or distributed to another investigator for future research studies without additional informed consent
• A statement that the subject’s biospecimens (even if identifiers are removed) may be used for commercial profit and whether the subject will or will not share in this commercial profit;
• For research involving biospecimens, a statement that the research will (if known) or might include whole genome sequencing (i.e., sequencing of a human germline or somatic specimen with the intent to generate the genome or exome sequence of that specimen), if applicable.

Furthermore, for new studies approved on or after the compliance date, OHSRP advises that if the investigator intends to share coded or identifiable specimens/data for future research, there should be language in the original consent form informing the subject of this.  See the current Consent Templates for Use at NIH Sites.

If the primary research protocol has therapeutic intent or a prospect of direct benefit to the subject, then agreement to unspecified future use should be optional.  This is to avoid any possible coercion of subjects who wishes to participate in research that has the prospect to benefit them but who otherwise might not wish to have their specimens/data used for future unspecified research.  If the primary research protocol does not have any prospect of direct benefit, then agreement to future use does not have to be optional. In other words, the team could remove the ‘yes’ or ‘no’ check boxes, and the language would then communicate that if the subject chooses to participate in the research study, then their specimens and data may be used or shared for future research.

The sharing of specimens/data with other investigators does not require IRB approval per se.  However, the new use of the specimens/data for research may require IRB approval. In order to share specimens/data from a protocol, the consent must allow for sharing, or at least not prohibit it.  The proposed research use of the shared specimens/data should be consistent with the terms of the consent under which it was collected.  Subjects agreed to participate in a specific study, not anyone's study. If the original consent says the specimens/data will never be shared, you must honor the terms of the consent.  This means that the specimens/data cannot be shared even if de-identified.  If you still would like to share the specimens/data, you would have to re-consent the applicable subjects with a consent document that is transparent about the plan for sharing. See the flow diagram below and FAQ 12 for examples.

In addition, please note that under the revised Common Rule (which applies to new protocols approved on or after January 21, 2019), there are new consent requirements which could limit the type of secondary research that is allowable as a result of the sharing.  Please see FAQ 9.

The step by step guide about completing an event form can be used when completing an event form.

An instruction sheet about reporting a death in NIH electronic IRB system can be found here.

• Provide complete and comprehensive answers to the required questions on the event form and to follow-up questions posed by the Compliance Analysts after their review of your submission.
• If the event is being reported outside of the required reporting window, an explanation of the delay must be provided on the reporting form.
• If the event form being submitted reports that consent was not obtained prior to the start of research, list all of the research procedures that occurred prior to obtaining the participant’s consent.
• Compliance and Training as well as members of OHSRP leadership who initially review the event forms submitted in the electronic IRB system, as well as the IRB or RCRC members who review event(s) referred to the board, pay particular attention to what corrective action has been taken or will be taken to mitigate the problem and prevent it from recurring. In most cases, a robust explanation in this regard is required.
• Electronically attach any relevant supporting documents when you submit the event form in the electronic IRB system such as:
  • If the event was reviewed by the DSMB, attach the DSMB’s follow-up report of its review.
  • If an autopsy is available, attach it with the submission.

• For FDA regulated studies, investigators are required to report events to the study sponsor as described in the protocol and to immediately (i.e., no longer than 10 days) report Serious Adverse Events (SAE)s or Unanticipated Adverse Device Effect (UADEs) to the study sponsor.
• If the event is also an actual or suspected UP that occurred on your study, you should also submit an event form to the IRB within 7 calendar days of becoming aware of the event.
• OHSRP office of Compliance and Training must be provided a copy of any official FDA communication regarding an inspection (e.g., FDA Form 483) issued regarding an NIH research protocol and/or investigator. This must occur within 7 calendar days of receipt of the FDA communication.

Information regarding when IND Safety Reports should be submitted with an event form and how to classify the information in the report (UP vs. New Information) can be found in the section of the OHSRP website that has FAQs related to IND Safety Report Submissions.

• The RCRC is responsible for reviewing possible serious or continuing non-compliance in human subjects research for which the NIH IRB is the Reviewing IRB (whether the protocol is currently open or closed), or for human subjects research conducted by NIH Investigators without IRB approval, that has been referred from the office of Compliance and Training.
• The RCRC has the final authority to determine whether there is non-compliance that is serious and/or continuing and to determine corrective action.
• As a duly convened committee, the RCRC may exercise the full authority of an IRB including suspension or termination of IRB approval of research.
• The determination by the RCRC is provided in writing to the Principal Investigator and study contacts.

• When the reported event is referred for RCRC review, you (as the PI) will be notified via NIH electronic IRB system in an outcome letter. You will also receive an email noting the date and time of the RCRC meeting at which the event will be reviewed. This email also explains that, if you choose to do so, you may attend the meeting to address the RCRC and answer any questions posed by the Committee members. You should respond to this email.
• You are also invited to provide, in advance of the meeting, any additional written information that you believe will be helpful to the RCRC members in their review of the event. You should provide any supplemental written information 7-10 days in advance of the scheduled RCRC meeting.
• After the meeting, an Analyst from the Office of Compliance & Training will send you an outcome letter via NIH electronic IRB system notifying you about the RCRC determination of the event and informing you of any required follow-up action item/s or stipulations.

• Investigators are expected to comply with NIH HRPP Policy 104, Managing Research-Related Complaints from Subjects.
• You should communicate respectfully with the participant who has the concern/complaint.
• You should report the participant’s research-related complaint to the study PI.
• The PI will address the complaint as soon as feasible, and/or refer the matter to other NIH or IC offices, as appropriate.
• If the investigator is unable to resolve the participant’s complaint, the OHSRP office of Compliance and Training should be contacted to provide assistance in handling and responding to complaints.
• You should document the participant’s concern in the medical (e.g., CRIS) or research record.
• Unresolved participant complaints should be reported at the time of the CR.

• While designated contacts are identified in the consent form and include the PI and any other study investigator specifically listed on the form, if the participant wants to speak with a non-study team member about a concern, they can contact the IRB Office as listed in the consent form. Participants seen at the Clinical Center (CC) may also contact the NIH CC Patient Representative.
• Institutes/Centers (ICs) who have investigators who conduct human subjects research at other locations that do not have a designated Patient Representative may also have specific individuals or offices within the IC listed on the ICF who participants can contact about their study related concerns.
• Participants may also bring their concerns or complaints to OHSRP.
• To the extent that the participant has explained their concern, you should document the participant’s concern in the medical (e.g., CRIS) or research record.
• Unresolved participant complaints should be reported at the time of the CR.

• You can find these requirements in NIH Policy 103, Education Program, and additional information can be found in the accompanying Guideline for Investigator HSR Training.
• See additional information about this topic on the OHSRP website CITI training FAQs. You can also send questions to the OHSRP office of Compliance & Training via email.

Information on how to check required training records can be found at the Training FAQs link on the OHSRP website.

If the investigator is covered by the NIH FWA, they should click on the green box labeled “CITI Training” on the NIH CITI Training page to gain entry to the NIH CITI portal and complete the required CITI course/refresher.  Additional Information related to expired CITI training can be found by going to the NIH CITI Training page on the OHSRP website and clicking on the green box labeled “Expired CITI Training.”

• NIH HRPP Policy 301, Informed Consent, describes the requirements for informed consent when human subjects research is conducted.  
• Additional information about how to handle situations such as use of the short form process when you have an unexpected enrollment of a participant who is non-English speaking and who cannot read the English long form as well as other situations (e.g., consent obtained via telephone and how to document such a process) can be found under the OHSRP website FAQs Everything you need to know about consent.