Secondary Research

If your research involves the use of specimens or data from one or more humans to test the safety or effectiveness of an investigational medical device (e.g. AI/machine learning, in vitro diagnostic (IVD), etc.), the study is considered a clinical investigation under the FDA regulations (see 21 CFR 812.3(h)). This research likely requires creation of a protocol, prospective IRB review and approval (21 CFR 56) and a device determination and either IRB consent or waiver of consent (21 CFR 50).  This is because under the FDA regulations, a human subject is not defined based on identifiability.   For more information, please consult with the IRB.

Secondary research that meets the definition of human subjects research is subject to the same regulatory requirements as all other human subjects research; therefore, it must undergo IRB review.  The ethical underpinning of this expectation is to assure that the proposed use of the specimens/data meets regulatory requirements and does not violate subjects’ rights.  When subjects, as part of an IRB approved protocol, provided their specimens/data, it was with an understanding they would be used for a specific named purpose. IRB review of a secondary research protocol is conducted to assure that the new use is not counter to that intent nor likely to introduce new risks, not previously disclosed to the subject or considered by the IRB.  The IRB will also ensure that appropriate privacy and confidentiality protections are put in place.

As with all human subjects research, either the specific consent of the subject to participate in the research must be obtained, or the IRB must waive consent. The future use language in consent forms does not contain all the required elements of consent. Typically, the future use language is very broad, so it does not adequately describe the purpose of the planned study. In addition, secondary research is a new research project that the IRB has not previously reviewed, so a determination that the project meets the IRB approval criteria must be made. 

Any permission granted for future use is best thought of as a statement of intent by the subject, that allows the IRB to waive consent for the future use of the specimens/data for research that is compatible with the original consent.

The sharing of specimens/data with other investigators does not require IRB approval per se.  However, the new use of the specimens/data for research may require IRB approval. In order to share specimens/data from a protocol, the consent must allow for sharing, or at least not prohibit it.  The proposed research use of the shared specimens/data should be consistent with the terms of the consent under which it was collected.  Subjects agreed to participate in a specific study, not anyone's study. If the original consent says the specimens/data will never be shared, you must honor the terms of the consent.  This means that the specimens/data cannot be shared even if de-identified.  If you still would like to share the specimens/data, you would have to re-consent the applicable subjects with a consent document that is transparent about the plan for sharing.

In addition, please note that under the revised Common Rule (which applies to new protocols approved on or after January 21, 2019), there are new consent requirements which could limit the type of secondary research that is allowable as a result of the sharing. 

If the terms of the original consent prohibit sharing, then you should consult with the IRB to determine if there is a path forward.  If the IRB provides guidance that sharing might be allowed, they will require you to re-consent subjects prior to any sharing.

The other situation in which you should seek IRB approval is if you are getting identifiable results/data returned to you from your collaborator, and the research is not described in the primary protocol.  In this case, you are considered to be conducting new secondary research yourself.  In other words, if you are sharing coded specimens (for which you have the code key) with an investigator who does not have the code key, and you are getting individual level data back (not aggregate data), this is human subjects research.  The rationale is that you are receiving new information about your subjects that you can link back to identifiers.  This activity needs IRB approval not because the specimens are being shared, but because identifiable data is being returned to the NIH research team that will be used for research.

Note that if you are only sharing or collaborating in research involving specimens/data for which the NIH research team has no access to identifiers or the ability to re-identify, this is not considered to be human subjects research.  Furthermore, the investigator does not need to submit for a request for determination of "not human subjects research" as was required in the past.

If you wish to share or receive human biospecimens and/or human data outside NIH under a Material Transfer Agreement, a Data Transfer/Use Agreement or a Research Collaborator Agreement, an Investigator Attestation must be completed and provided to the appropriate Tech Transfer contact. 

Sharing and secondary research with existing specimens/data must comply with the terms of the original informed consent document.  Researchers are expected to review all previous versions of the consent form to determine who consented to what.  If the original consent form addresses the use and sharing of specimens/data for future research, the new plan for sharing and research should be consistent with the language in the original consent document.  If there is language in the original consent form which is contrary to sharing or future research generally or conflicts with the specific sharing and research plan, the investigator cannot proceed.  This is true, even if the specimens/data are being used or shared in a de-identified manner, or if the subjects are deceased.

Some examples of prohibitive or restrictive language include:

• “Your specimens will be destroyed at the end of this study.” These means the specimens cannot be stored for future research.
• “Your specimens/data will be used for future research on cancer.” This would restrict any secondary research to only cancer-related research.
• If some subjects opt-out of future research with specimens/data by checking a box in the consent, then the NIH investigator must track this information over time. Failing to check any box is considered the same as not agreeing, i.e., opting out of future research.
• “Your data will never be shared outside of the NIH.” This would restrict the use to only NIH investigators. You would not be able to share even de-identified specimens/data outside of NIH.
• “Your data will never be shared outside of the NIH research team working on the protocol.” This would restrict the use to only the NIH research team members named on the primary protocol.

If the initial consent contained restrictive language and you wish to be able to do future research or share the specimens/data, consult with the IRB.  Depending on the type of limitations, the IRB may require you to re-consent the subjects to allow the sharing or research to go ahead.  After that point, the specimens/data, of those that provide consent, would now be able to be used.

If the original consent form (for new protocols approved before January 21, 2019) was silent on the topic of sharing and future research, then IRB will consider whether the proposed use is acceptable with a waiver or if re-consent is required.

Per the revised Common Rule (for new protocols approved on or after January 21, 2019), there are new consent requirements which affect what is allowable as part of secondary research.

Furthermore, for protocols approved on or after the revised Common Rule implementation date, OHSRP advises that if the investigator intends to use coded or identifiable specimens/data for future research, there should be language in the consent form informing the subject of this.

Consent to use specimens/data for future research is not sufficient to allow the investigator to move forward with secondary research with identifiable specimens/data.  This type of consent language simply allows the investigator to store the materials for future research (or use the materials once completely anonymized (stripped of all identifiers)).  If the investigator will conduct new research using existing identifiable specimens/data, generally they are expected to submit a new research protocol and seek IRB approval.

A waiver of consent is when the requirement to obtain informed consent for research is formally waived by the IRB.  The waiver applies to the proposed research activity, not to the sharing of specimens/data. The IRB will consider whether the proposed use is consistent with the terms of the original consent and whether there are any new risks.  If the conditions described below in the next FAQ are met, then the IRB may grant the waiver.  The IRB will not grant a waiver that is counter to the terms of the original consent, nor can the IRB grant a waiver for broad, unspecified future use.

When requesting a waiver for a research protocol being reviewed and approved on or after January 21, 2019, address and provide justification in the protocol for the following specific regulatory criteria:

1. The research involves no more than minimal risk to the subjects.
   1. Example of a justification: The only risk to subjects is a possible breach of confidentiality.
2. The research could not practicably be carried out without the requested waiver or alteration (i.e., It is not possible to conduct the research unless consent is not required).
   1. Example of a justification: The required number of specimens to conduct the research is so large that it would impede scientific validity and introduce bias if only those who were willing to consent were included.
   2. Example of a justification: Many of the subjects are lost to follow-up, or the research team has not been in contact with them for many years.
3. The research could not practicably be carried out without using such information or biospecimens in an identifiable format.
   1. Example of a justification: The research involves specimens and different types of data (medical records, imaging, lab results) that all must be linked together by a subject identifier to allow analysis.
4. The waiver will not adversely affect the rights and welfare of the subjects.
   1. Example of a justification: Conducting the planned research with existing specimens/data (originally collected under informed consent) will not cause any harm to subjects.
5. Whenever appropriate, the subjects or legally authorized representatives will be provided with additional pertinent information after participation.
   1. Example of a justification: We do not intend to contact subjects to share the results of our research.
   2. Example of a justification: The results of this research will not generate new clinically actionable findings.

No.  Identifiable specimens/data can be stored even after the primary protocol is closed; you do not have to discard or de-identify them.  The primary protocol must only remain open if you are using the specimens/data for research purposes described in the protocol.  The specimens/data can be stored unused until there is approval of a secondary research protocol.  However, although it is permissible to store them, you cannot access or use the identifiable specimens/data for research without an IRB-approved protocol in place.

If the proposed research is directly related to the primary protocol’s aims/objectives, then you can consider adding the new research to the primary protocol.  However, if the new project is unrelated to the primary protocol’s aims/objectives, it would be considered new research and needs to be submitted as its own protocol.  A protocol needs to be cohesive, and disconnected ideas and experiments are not considered approvable research.

A repository is an organized system to collect, maintain and store specimens/data, most often for future research use. The materials may be prospectively collected from humans for inclusion in a repository, or the repository may house existing materials originally collected for other purposes, including non-research purposes.  Repositories can also be referred to as registries, data banks, databases, or biobanks.

Repositories that are designed to prospectively collect specimens/data from humans for research purposes and/or to maintain and distribute specimens/data (that are linked to identifiers) to researchers must have IRB approval and oversight.  Accordingly, a repository protocol should first be submitted for IRB review.  The repository protocol itself generally does not describe the details of the secondary research.  Any secondary research involving the identifiable specimens/data from the repository would require submission of a separate protocol to the IRB. Another option would be for the investigator conducting the secondary research to receive all of the specimens and data in an anonymized or coded and linked format, with no access to the code key. In this case, the investigator(s) overseeing the repository protocol would be acting as an “honest broker” and either permanently anonymize the specimens and data before sharing them or coding them and maintaining the code key, so that only they are in a position to re-link to the original identifiers.