Secondary research is research with existing specimens/data initially collected for purposes other than the planned research.  The specimens/data might have initially been collected for non-research purposes (for example, as part of routine clinical care) or as part a different research protocol.  Secondary research is encouraged since it maximizes the utility of data and specimens while minimizing risk to subjects since no new procedures will need to be performed.

Examples of secondary research vs. primary research are included in the presentation given on 1/9/2021, “Secondary Research: Fact, Fiction, Fears and Fantasies” that is available on the Office of Human Subjects Research Protections (OHSRP) website in the Presentation Archive.  On the same webpage, also see the 7/9/2019 presentation titled, “Best Practices for the Approval and Conduct of Secondary Research, including Repositories” for additional information.

There are 2 circumstances in which secondary research with specimens/data collected from human subjects may not require IRB review.

1. All the individuals from which the specimens/data were collected are deceased, OR
2. The specimens/data are not identifiable to the research team (see below for further discussion on this).

Subjects are all deceased

If all the individuals from whom the specimens/data were collected are now deceased, the research does not meet the definition of human subjects research and does not require prospective IRB review.  However, if the specimens/data were collected under another research protocol, the terms of the original consent still apply.  For example, if the consent form contained any limitations on the future use of the specimens/data, those limitations must be honored.  The investigator is responsible for ensuring that any proposed research is consistent with the original consent. 

Specimens/data are not identifiable to the research team

Research, with specimens/data which are not identifiable to the research team, is not considered human subjects research and does not require IRB review and approval.  For example, the specimens/data have been fully anonymized by removing all identifiers, or they have been coded, and the investigator conducting the research does not have access to the code key and cannot otherwise re-identify the subjects. The term “coded” means that all identifying information has been replaced with a number, letter, symbol, or combination thereof (i.e., the code) and a key to decipher the code exists, enabling linkage of the identifying information to the specimens/data. See the Guidance for Determining Whether Data Constitutes Individually Identifiable Information Under 45 CFR 46 on the OHSRP website.  Investigators should consult with OHSRP if they are unsure whether data or biospecimens being used in a specific research project would be considered individually identifiable.

Secondary research is considered human subjects research that requires IRB review when the specimens/data are identifiable to the researchers and were collected for another purpose than the planned research.  The following is an example of secondary research:

• An investigator learns of preliminary data from a study that suggests cigarette smoking leads to specific epigenetic changes that increase susceptibility to certain infections. She also has a large number of pre-treatment samples from cigarette smokers that would be ideal to initially test this hypothesis. The specimens were collected under protocols focused on the study of lung cancer. The samples are coded, and the investigator holds the code key with identifiers. Her planned research with the specimens/data is not described in the objectives of the original lung cancer protocols.  The planned activity meets the definition of secondary research because the specimens/data were collected under another protocol for a different research purpose.

Note that if the planned research is related to the existing primary, secondary, or exploratory objectives described in the IRB-approved protocol (under which the specimens/data were originally collected), then it is not considered to be secondary research.  This is research that should be conducted under the primary protocol (i.e., primary research).  If the investigator is unsure whether the protocol should be amended to address the planned activities or whether the current description is adequate, the investigator should contact the IRB.  The following is an example of a proposed activity that does not meet the definition of secondary research:

• An investigator has collected samples as part of an IRB approved phase 1 protocol to determine the maximum tolerated dose of new checkpoint inhibitor drug XYZ123 for the treatment of metastatic lung cancer refractory to standard therapies. The protocol includes an exploratory objective to determine changes in immunologic profiles of subjects receiving the drug.  After the trial is already complete, the investigator decides to have all the previously stored samples analyzed for T cell subsets.  Since this additional analysis meets the exploratory objective of the original protocol, the planned activities would be considered primary research.

• When NIH is not the Reviewing IRB, the NIH Site PI/Lead Investigator must report research related events to the Reviewing IRB in accordance with that IRB’s instructions. Additionally, if the reportable event occurred at an NIH site, or directly impacts the NIH site, NIH PI/Lead Investigator must also report to the OHSRP office of Compliance and Training in the NIH electronic IRB system within 7 calendar days of the NIH PI//Lead Investigator becoming aware of the event.
• When the Reviewing IRB is an external IRB, and the event occurred at a non-NIH site or does not directly impact an NIH site, the NIH PI/Lead Investigator is required to ensure that the reporting requirements of the Reviewing IRB are followed. The investigator does not also report these events to the OHSRP office of Compliance and Training, except as follows:
  • External IRB determinations of serious and/or continuing non-compliance about an NIH investigator: If the NIH is relying on an external IRB and the Reviewing IRB makes a determination of serious and/or continuing non-compliance regarding an NIH investigator, the NIH PI/designee must report this in the NIH electronic IRB system within 7 calendar days of any member of the NIH research team being notified of the determination by the Reviewing IRB. The NIH PI must provide the OHSRP office of Compliance and Training with documentation from the Reviewing IRB.
  • Suspension or termination of research activities at NIH by an external IRB: If the NIH is relying on an external IRB and the Reviewing IRB suspends or terminates NIH research activities, this must be reported within 7 calendar days of any NIH member of the research team being notified.

An event form is the communication method used to submit specific protocol-related events that require expedited reporting in the electronic IRB system.

• Major Deviations are deviations from the IRB-approved protocol that have, or may have the potential to, negatively impact, the rights, welfare or safety of the participant, or to substantially negatively impact the scientific integrity or validity of the study.
• Minor Deviations are deviations that do not have the potential to negatively impact the rights, safety, or welfare of participants or others, or the scientific integrity or validity of the study.

• Enrollment of a participant who did not meet all inclusion/exclusion criteria
• Performing a study procedure that has not been approved by the IRB 
• Failure to report an Unanticipated Problem to IRB and/or sponsor of the study 
• Study visit conducted outside the required timeframe that, in the opinion of the investigator, may impact the safety of the participant
• Failing to obtain legally effective consent prior to initiating research procedures-this includes failure to obtained signed consent when required 
• Medication errors, such as administering the wrong study drug to a participant or the wrong dose of the right study drug 
• Implementation of recruitment procedures that have not been IRB-approved

• Receiving completed questionnaires back from participants where items are missing
• Completing a study visit outside of the required timeframe when, in the opinion of the investigator, there are no safety implications.
• Use of an expired consent form in which the information contained is not substantively different than the currently approved consent unless the deviation occurs repeatedly
• Minimal over-enrollment
• A signed copy of the consent form was not given to the participant
• Documentation deficiencies in the consent form such as: 
  • A missing investigator signature 
  • The participant signs the consent form but does not print their name in the signature block
• Note: When a participant does not sign and date the consent form prior to the initiation of research, the event is considered a major deviation.

Investigators must provide the following information to the IRB in summary format at the time of continuing review, or when otherwise specifically requested by the IRB. Investigators should provide a high-level summary of these events that have occurred since the time of the last IRB review and not a line-item listing:

• Major and minor protocol deviations
• Noncompliance reported to the IRB that is not related to a protocol deviation
• Adverse Events and Serious Adverse Events that do not meet the definition of an UP
• UPs reported to the IRB

• All Events Forms submitted in the NIH electronic IRB system are forwarded to the OHSRP office of Compliance and Training.
• Upon receipt of the event form, a Compliance Analyst reviews the form and determines if the form has been filled out correctly and includes all information required to fully understand the event(s).
• If additional information from investigators is needed, a stipulation is sent (via NIH electronic IRB system) to address deficiencies, errors, or questions related to the event form.
• The event forms are presented for consideration at the weekly meeting attended by OHSRP leadership and staff from OHSRP Compliance and Training.
• After the weekly review meeting, documentation indicating OHSRP leadership’s determination of the event is sent via NIH electronic IRB system in an outcome letter to the PI and the study team within 24-48 hours of the meeting.
  • Events that are possible UPs on protocols overseen by the NIH IRB are forwarded to the NIH IRB for review, and the NIH IRB will subsequently provide the PI with an outcome letter.
  • Events that represent noncompliance that is considered possible serious and/or continuing noncompliance are forwarded to the Research Compliance Review Committee (RCRC) for review, and the office of Compliance and Training will subsequently provide the PI with an outcome letter.
  • Events that are not referred for review by the IRB or the RCRC are acknowledged in the outcome letter with one of the following and will indicate if any additional action is needed:
    • Acknowledgement that this event has been reported in the NIH electronic IRB system
    • Noncompliance that is neither serious nor continuing
    • Major deviation that is not serious or continuing noncompliance
    • Minor deviation that is not serious or continuing noncompliance
    • The event does not constitute non-compliance by the study team
    • The event does not meet the definition of an unanticipated problem (UP)
    • The event does not meet the definition of a reportable event that needs to be reported

• This flow diagram will help determine whether the event needs to be reported to the IRB in an expedited manner or whether it can be reported as part of a high-level summary at the time of the CR.
• For additional information, please refer to Policy 801, Reporting Research Events and the accompanying Guidance-Reporting Research Events and Non-compliance found under policies 801 and 802 on the OHSRP webpage HRPP Policies & Guidelines.

Any questions about an event form can be sent to the mailto:OHSRPCompliance@od.nih.gov.  You will be provided a response within 24 hours, Monday-Friday except for federal holidays.

The step by step guide about completing an event form can be used when completing an event form.

An instruction sheet about reporting a death in NIH electronic IRB system can be found here.

• Provide complete and comprehensive answers to the required questions on the event form and to follow-up questions posed by the Compliance Analysts after their review of your submission.
• If the event is being reported outside of the required reporting window, an explanation of the delay must be provided on the reporting form.
• If the event form being submitted reports that consent was not obtained prior to the start of research, list all of the research procedures that occurred prior to obtaining the participant’s consent.
• Compliance and Training as well as members of OHSRP leadership who initially review the event forms submitted in the electronic IRB system, as well as the IRB or RCRC members who review event(s) referred to the board, pay particular attention to what corrective action has been taken or will be taken to mitigate the problem and prevent it from recurring. In most cases, a robust explanation in this regard is required.
• Electronically attach any relevant supporting documents when you submit the event form in the electronic IRB system such as:
  • If the event was reviewed by the DSMB, attach the DSMB’s follow-up report of its review.
  • If an autopsy is available, attach it with the submission.

• For FDA regulated studies, investigators are required to report events to the study sponsor as described in the protocol and to immediately (i.e., no longer than 10 days) report Serious Adverse Events (SAE)s or Unanticipated Adverse Device Effect (UADEs) to the study sponsor.
• If the event is also an actual or suspected UP that occurred on your study, you should also submit an event form to the IRB within 7 calendar days of becoming aware of the event.
• OHSRP office of Compliance and Training must be provided a copy of any official FDA communication regarding an inspection (e.g., FDA Form 483) issued regarding an NIH research protocol and/or investigator. This must occur within 7 calendar days of receipt of the FDA communication.

Information regarding when IND Safety Reports should be submitted with an event form and how to classify the information in the report (UP vs. New Information) can be found in the section of the OHSRP website that has FAQs related to IND Safety Report Submissions.

• The RCRC is responsible for reviewing possible serious or continuing non-compliance in human subjects research for which the NIH IRB is the Reviewing IRB (whether the protocol is currently open or closed), or for human subjects research conducted by NIH Investigators without IRB approval, that has been referred from the office of Compliance and Training.
• The RCRC has the final authority to determine whether there is non-compliance that is serious and/or continuing and to determine corrective action.
• As a duly convened committee, the RCRC may exercise the full authority of an IRB including suspension or termination of IRB approval of research.
• The determination by the RCRC is provided in writing to the Principal Investigator and study contacts.

• When the reported event is referred for RCRC review, you (as the PI) will be notified via NIH electronic IRB system in an outcome letter. You will also receive an email noting the date and time of the RCRC meeting at which the event will be reviewed. This email also explains that, if you choose to do so, you may attend the meeting to address the RCRC and answer any questions posed by the Committee members. You should respond to this email.
• You are also invited to provide, in advance of the meeting, any additional written information that you believe will be helpful to the RCRC members in their review of the event. You should provide any supplemental written information 7-10 days in advance of the scheduled RCRC meeting.
• After the meeting, an Analyst from the Office of Compliance & Training will send you an outcome letter via NIH electronic IRB system notifying you about the RCRC determination of the event and informing you of any required follow-up action item/s or stipulations.

• Investigators are expected to comply with NIH HRPP Policy 104, Managing Research-Related Complaints from Subjects.
• You should communicate respectfully with the participant who has the concern/complaint.
• You should report the participant’s research-related complaint to the study PI.
• The PI will address the complaint as soon as feasible, and/or refer the matter to other NIH or IC offices, as appropriate.
• If the investigator is unable to resolve the participant’s complaint, the OHSRP office of Compliance and Training should be contacted to provide assistance in handling and responding to complaints.
• You should document the participant’s concern in the medical (e.g., CRIS) or research record.
• Unresolved participant complaints should be reported at the time of the CR.

• While designated contacts are identified in the consent form and include the PI and any other study investigator specifically listed on the form, if the participant wants to speak with a non-study team member about a concern, they can contact the IRB Office as listed in the consent form. Participants seen at the Clinical Center (CC) may also contact the NIH CC Patient Representative.
• Institutes/Centers (ICs) who have investigators who conduct human subjects research at other locations that do not have a designated Patient Representative may also have specific individuals or offices within the IC listed on the ICF who participants can contact about their study related concerns.
• Participants may also bring their concerns or complaints to OHSRP.
• To the extent that the participant has explained their concern, you should document the participant’s concern in the medical (e.g., CRIS) or research record.
• Unresolved participant complaints should be reported at the time of the CR.

• You can find these requirements in NIH Policy 103, Education Program, and additional information can be found in the accompanying Guideline for Investigator HSR Training.
• See additional information about this topic on the OHSRP website CITI training FAQs. You can also send questions to the OHSRP office of Compliance & Training via email.

Information on how to check required training records can be found at the Training FAQs link on the OHSRP website.

If the investigator is covered by the NIH FWA, they should click on the green box labeled “CITI Training” on the NIH CITI Training page to gain entry to the NIH CITI portal and complete the required CITI course/refresher.  Additional Information related to expired CITI training can be found by going to the NIH CITI Training page on the OHSRP website and clicking on the green box labeled “Expired CITI Training.”

• NIH HRPP Policy 301, Informed Consent, describes the requirements for informed consent when human subjects research is conducted.  
• Additional information about how to handle situations such as use of the short form process when you have an unexpected enrollment of a participant who is non-English speaking and who cannot read the English long form as well as other situations (e.g., consent obtained via telephone and how to document such a process) can be found under the OHSRP website FAQs Everything you need to know about consent.