Biorepositories

1. Introduction

USC encourages the creation of repositories (sometimes called biorepositories, registries, banks, or libraries) that provide access, for use in future research, to data and human biospecimens. Some repositories are created and maintained explicitly for research purposes. Others are created and maintained for non-research purposes, but may be accessed for research uses. Such repositories must conform to applicable regulations and policies, as well as the decisions made by patients and research subjects. The purpose of this policy is to ensure that data and/or human biospecimens to be used for research are responsibly obtained, stored and distributed, and to protect the rights of individuals who have donated human biospecimens or data to repositories.

Repository activities may involve the following components:

• Identifying and obtaining consent from subjects
• Collecting and preparing biological materials
• Obtaining and updating health data
• Storing human biospecimens and managing data
• Committee review and oversight
• Distribution for use by recipient investigators

2. Scope

This policy applies to human subject research repositories established for the purpose of storing data and/or human biospecimens for future research purposes. This policy does not apply to data/human biospecimens that are collected and stored solely as part of routine clinical care or hospital procedures, such as blood banks, pathology, surveillance, or quality assurance. However, it does apply to data/human biospecimens from these sources that are then stored for future research.

Repositories that exist at the time this policy is enacted are exempt from the provisions of this policy pertaining to the establishment of repositories. However, repositories that are converted from one type to another must adhere to the provisions for establishing those types of repositories.

3. Definitions

3.1 Guardian

A guardian is a person who has primary control of data and human biospecimens and maintenance of the repository.

3.2 Repository

A repository is the storage site or mechanism by which human biospecimens are collected from one or more sources and stored or archived in a form designed for ease and speed of aggregation, search, and retrieval. Repositories include data banks, tissue banks, and registries that collect, store and distribute human tissue, specimens and/or data for use in future research projects. Any collection of human biological materials or data derived from human biological materials is considered to be a repository when there is no explicit plan to destroy the materials after the conclusion of the specific research project that generates the materials.

The collection and storage of data/human biospecimens becomes a “research repository” when there is a specific intention for the data/human biospecimens to be shared with other investigators.

3.3 Not-human subjects research

Not-human subjects research are activities that do not meet the definitions of human subjects and/or research as defined in the Code of Federal Regulations 45 Part 46 titled Policy for Protection of Human Research Subjects.

3.4 Submittal agreement

A submittal agreement is an agreement that attests that human biospecimens were obtained with written informed consent of the donor using an informed consent document approved by the local IRB, or pursuant to an IRB-approved waiver of informed consent.

3.5 Usage agreement

A usage agreement is an agreement that details the conditions for receipt and future use of data and/or human biospecimens from a repository.

3.6 Human biospecimen

Human biospecimen encompasses a wide range of human specimen types, including but not limited to:

• Sub-cellular components such as DNA or RNA
• Cells or tissues from any part of the human body
• Organs such as liver, bladder, kidney, heart, placenta, etc.
• Gametes (ova and sperm)
• Embryos and fetal tissues
• Stem cells
• Bodily products such as teeth, hair, nail clippings, sweat, urine, feces
• Blood and blood fractions, such as plasma, serum, buffy coat, red blood cells
• Saliva and buccal cells

3.7 Donor

A donor is an individual from whom a human biospecimen is derived, with their consent.

4. Policy

4.1

USC owns all human biospecimens that are placed into a USC repository. If an investigator places human biospecimens into a USC repository and subsequently leaves USC, the human biospecimens remain the property of USC and may not be taken from the repository without permission from the Vice President of Research.

4.2

Human subject specimens and data may not be sold for profit. Repositories are permitted to recover the costs of providing human biospecimens (including collection, processing, storage and distribution) provided that such costs are established in accordance with USC’s Recharge Centers policy.

4.3

Consent or waiver of consent is required for the storage and future use of data/human biospecimens entered into research repositories. Investigators conducting research that may later be of value for additional studies should address the possibility of submitting the data/human biospecimens to a repository in the initial consent.

• Re-contact of a donor for clinical studies separate from the research repository requires advanced consent from the donor.
• Return of medically relevant results should not be promised to donors in consent forms. However, it is permissible to disclose in the informed consent the possibility of returning medically relevant results. This should not be discussed as a benefit.
• Donors do not receive compensation for commercialized value of research that results from donated tissues or data. Donors should be informed of this fact.
• Donors must be allowed to withdraw their human data/biospecimens from a research repository. Donors should be informed that in the event they withdraw, it will not be possible to destroy human biospecimens and health information that have already been given to researchers.
• Donors must be informed of intended future use of data/human biospecimens. This statement may be specific or broad. If genetic analysis is planned, donors should be informed. However, the statement will dictate the limits on future uses.
• Donors must be informed of how release of data/human biospecimens will be controlled.
• All elements required by regulation under the circumstances of the proposed repository must be in place. For instance, extra protections required for children, pregnant women and fetuses, and prisoners must be used.

A waiver of the requirement to obtain consent may be granted by the IRB if all of the requirements for waiver are met.

4.4

IRB approval is required to establish a research repository. The nature of the review depends on the type of repository. There are five types of repositories:

1. repositories arising from research projects initially deemed to be non-human subject research
2. repositories that meet the IRB’s definition of being exempt
3. study-specific repositories
4. non-exempt repositories
5. general use repositories

4.4.1 Non-human subjects repositories

Protocols involving coded data/human biospecimens must be submitted to the IRB to receive a Non-Human Subjects Research (NHSR) determination.

4.4.2 Exempt repositories

Exempt repositories meet the regulatory definition of being exempt. Repositories are not exempt if the data/human biospecimens retain any identifier or link that would identify, directly or indirectly, the person whose data/human biospecimens are stored. IRB approval must be obtained before a repository will be considered an exempt research repository.

4.4.3 Study-specific repositories

A study-specific repository involves the collection of data/human biospecimens in the course of a study and depositing them into a repository that will be used beyond the research goals of that specific study. IRB approval should be obtained for the repository when the original study is proposed.

4.4.4 Non-exempt repositories

The establishment and operation of any non-exempt research repository requires IRB review and oversight. A protocol must be submitted in order for this review to take place. The IRB will review and approve the protocol which must specify the conditions under which data/human biospecimens may be accepted into the repositories, how data/human biospecimens will be securely stored, and the procedures under which data/human biospecimens will be shared in order to ensure that adequate measures are employed to protect the privacy of subjects and to maintain the confidentiality and integrity of the data/human biospecimens.

4.4.5 General use repositories

General use repositories may be established by organized research units, schools, or the Office of Research, and are created for the purpose of making human biospecimens and data available to the entire university community, subject to the procedures specified in the Appendix and with IRB approval. General use repositories may be established as a repository for human biospecimens and data collected from clinical patients who are not part of any research study beyond participation in the repository. They may also be established to integrate human biospecimens and data originating from multiple research studies. A general use repository may house data and human biospecimens at a single location or may be a network of facilities spread across different locations. Networks qualify as a general use repository if they aim to serve the entire university community.

4.5

IRB approval is required to convert a research study to a research repository. Conversion of human biospecimens from an existing or completed study into a research repository requires IRB approval. If patient consent has not been obtained for future use in a research repository, then IRB approval is needed to waive informed consent. The IRB may not waive informed consent if original consent excluded the possibility of using human biospecimens in a repository. Future donors to the repository must consent to participation in the research repository.

4.6

Revisions to a research repository protocol must be approved by the IRB prior to implementation.

4.7

Requests by a recipient investigator to access identifiable data/human biospecimens from any existing non-exempt research repository require IRB approval. The principal investigator must comply with all requirements of the repository and terms of any usage and/or submittal agreements.

4.8

A summary report to the IRB of all collections, releases, or destruction of data/ human biospecimens from the research repository is required at each continuing review.

4.9

Data/human biospecimens initially collected with personally identifiable health information and subsequently released with personally identifiable health information to a research activity require IRB review and analysis and HIPAA authorization/waiver for both activities. Data/human biospecimens submitted with identifiable health information into a research repository but released without identifiers to a research activity will need IRB approval for the research activity.

4.10

Data/human biospecimens released without personally identifiable informationmay not be re-identified with personal information.Recipients of de-identified data/human biospecimens are personally responsible for ensuring that the data they received are not re-identified.

4.11

A guardian must be appointed for each research repository. Guardians are responsible for:

1. ensuring that data/human biospecimens are received and released according to USC policy and the IRB-approved protocol
2. executing a usage agreement each time data/human biospecimens are released for research purposes
3. ensuring the security and confidentiality of stored data/human biospecimens
4. distributing data/human biospecimens
5. tracking acquisitions and release of data/human biospecimens

4.12

Attribution: Investigators who use human biospecimens or data from a general use research repository or from a research repository under the guardianship of another individual must acknowledge the repository as the source of human biospecimens or data in all publications, proposals or presentations that result from the use of the human biospecimens. The recipient of the human biospecimens or data should also attribute the contributions of others in accordance with USC’s guidelines on attribution and authorship.

Appendix: Procedures

Submitting an application for IRB approval of a research repository

An application for the creation of new research repositories may be found in the iStar system. In addition, iStar will permit application for conversion of human biospecimens from an existing or completed study into a research repository.

Requesting data/human biospecimens from a research repository

• Identifiable data or human biospecimens requested from an established repository require a study submission either as a new study or as a modification to an existing study. The USC IRB must approve at a minimum the research proposal, data collection tools, consent process (or, alternately, waiver), and source repository.
• A materials transfer agreement (MTA) must be executed between USC and the receiving institution before an investigator outside of USC receives data or human biospecimens from a USC research repository. Transfer outside of USC is permitted when such transfer is consistent with patient consent.
• For anonymous or coded data, a request for determination from the IRB must be submitted.

Consent forms

The Office of Research will maintain language for consent forms to be used in general use repositories for human biospecimens and data that originate from clinical patients who are not part of any research study (other than participation in the research repository). The consent form used to obtain human biospecimens should inform participants that their human biospecimens will be shared and meet regulatory requirements.

Research repository protocol requirements

All research repository protocols must include:

• Explanation of the purpose of the repository.
• Description of the data/human biospecimens to be included, their sources, and how they will be collected. Documentation of local IRB approval must be provided to the USC IRB for each site contributing data/human biospecimens to the USC repository.
• Description of how consent has been or will be obtained from donors, or why a waiver of consent is justified. If applicable, how HIPAA authorization will be obtained from donors or why a waiver of authorization is justified should be provided. Consent and (if applicable) HIPAA authorization documents must be provided.
• Description of security and confidentiality measures. The following measures to protect the security and confidentiality of the data and human biospecimens in the repository must be described:
  • Coding: A method to code the data/human biospecimens, including a process to protect/maintain the key to the code and limit access to the key. The coding system must be adequate to reduce the possibility of re-identification.
  • Control of access to the data/human biospecimens: Access to the identifiable data/human biospecimens must be restricted to a limited number of repository staff. Accountability for controlling and monitoring access must be provided.
  • Security procedures: A method to limit and determine access to data/human biospecimens, including computer security and human biospecimen storage security measures.
  • Data transfer security: Methods to ensure confidentiality during the collection and release of data and human biospecimens.
  • Certificate of Confidentiality (CoC): Recommended but not required for all repositories with identifiable human biospecimens or data as an additional protective measure. The IRB may require a CoC for repositories housing potentially sensitive information. A description must be provided for how and where data/human biospecimens will be stored, and how the privacy of subjects and the confidentiality of data will be protected, including if a Certificate of Confidentiality will be obtained.
• Description of who will have access to the data/human biospecimens, what the requirements for access will be, and who is designated as the guardian. A complete description of the process for requesting and releasing data must be included.
• Description of how human biospecimens will be released. A statement should be included that separate IRB approval/determination will be required for each specific human subject research activity that uses identifiable data/human biospecimens from the repository. Each study using identifiable data is considered to be a research activity that is separate from the repository itself.
• Research repository operating procedures, including a description of how the repository will perform the following required activities:
  • Identify when and what material (data/human biospecimens) is originally received.
  • Document whether the person from whom the data/human biospecimens are to be obtained signed a legally effective consent and (if applicable) HIPAA authorization, or there was an IRB approved waiver of consent and/or HIPAA authorization. Signed consent forms and HIPAA authorization forms must be retained.
  • Include any IRB-approved consent forms for the collection of the material being submitted to the repository with the data/human biospecimen submissions.
  • Certify that the data/human biospecimen collection protocol had IRB approval from the home institution. A copy of the approval letter should be submitted.
  • Document how data/human biospecimens for which consent has been withdrawn will be hidden, and how no future use will be ensured.
  • Identify data/human biospecimens which have limitations on future uses and ensure that future uses are not contrary to those limits.
  • Secure submittal agreements from investigators placing data/human biospecimens in the repository. For data/human biospecimens obtained under waiver of consent and/or HIPAA authorization, submittal agreements should also contain an acknowledgment that investigators are prohibited from providing others with access to the identities of individuals or to information through which the identities of donors may readily be ascertained, without prior IRB approval.
  • Secure usage agreements from recipient investigators.
  • Ensure that material transfer agreements are used when necessary for the transfer of biological materials.
• Disclosure of clinically relevant results/incidental findings. Protocols submitted to the IRB for research studies should describe a mechanism for evaluating whether the results of research testing are clinically relevant and might warrant disclosure to the research participants, along with the mechanism for disclosure to participants. In general, careful consideration of the ramifications, including whether the test was performed in a CLIA approved laboratory, is mandatory. IRB approval of the proposed disclosure is required.

Conversion of a clinical database/repository to a research repository

Data/human biospecimens that have been stored in a database/repository solely for clinical, quality improvement, or other standard non-research purposes in the past can be moved into a research repository established consistent with the requirements of this policy under an IRB waiver of consent and, if applicable, waiver of HIPAA authorization.

General use research repositories

A Biorepository Ethics Committee (BEC) must be established for all general use research repositories. The BEC will oversee all access to repository human biospecimens and data, as well as procedures that offer qualified investigators the opportunity to access the repository. The repository’s guardian must act as chair of the BEC. The repository’s procedures should include evaluation of the following factors prior to providing data or human biospecimens to a recipient:

• Research plans with respect to scientific merit, priority and ability to achieve stated aims
• Method for calculating and applying recharge costs
• Whether the request is consistent with the permissions granted by donors in the consent process, and whether the request is consistent with privacy regulations
• Disposition of unused human biospecimens
• Whether IRB approval has been obtained
• Whether and how medically relevant results/incidental findings will be communicated to donors

The Vice President of Research must approve the procedures governing a general use repository prior to its establishment.

Terminating a research repository

• When there is no intent to continue to operate a repository for future research or if the data/human biospecimens are being transferred to another repository, the repository should be terminated via a modification in iStar.
• The termination request must include the disposition of the data and human biospecimens, including details on the secure transfer, donation or destruction of human biospecimens or data.

Responsible Office

Office for the Protection of Research Subjects

www.usc.edu/admin/oprs/
OPRS@usc.edu
(213) 821-1154

Issued by

Elizabeth Garrett, Provost and Senior Vice President, Academic Affairs
University of Southern California