Emory IRB Guidelines for Databases, Registries, and Specimen Repositories

Emory IRB Guidelines for Databases, Registries, and Specimen Repositories

(Sample Protocol Follows Below)

These guidelines apply to proposals to store data and/or specimens for future use. Many times, these proposals have futureresearch in mind, whereas others are motivated bypatient care or quality assuranceneeds. The IRB must determine when IRB oversight is required for these projects, based on the stated purpose.

When designing a protocol and consent form for future research use, considering these guidelines will help both to minimize compliance problems and ensure the greatest possible value for the stored data or specimens.

Important Principle:

IRB protocols for registries and repositories that are designed to be used and/or shared for not-yet-specified future research should not also include specific hypotheses and planned analyses. (One exception is if the repository has the resources toconduct some up-frontspecimen analyses solely to provide additional value to future researchers.)

Proposals to use the data/specimens for specific aims should be submitted separately to the IRB, unless the recipient will receive no identifiers per the registry/repository policies and procedures, in which case the recipient may not be doing “human subjects” research.All such specific aims must be within the scope of the registry or repository protocol (and consent, if applicable), which may be very broad.

Terms and Definitions

For consistency, Emory IRB will use the following terms as defined below (in other contexts, you may sometimes find these terms used differently).

Database:

A database is collection of information elements (i.e., data) arranged for ease and speed of search and retrieval. Most databases are now maintained electronically, but the term can also be applied to paper record systems.

Examples of databases include the following:

A set of observations (i.e., data) resulting from a research study
An electronic file containing patients' records
A collection of diagnosis, treatment, and follow-up information for a hospital's oncology patients
A file of outcomes information compiled for quality assurance activities
A list of prospective research subjects

Registry:

A registry or data bank is a collection of information elements or databases whose organizers:

May receive information from multiple sources;
Maintain the information over time;
Control access to the information;
Permit multiple individuals to use the information for a variety of purposes which may evolve over time
May (often) contain codes that link information and specimens to the donor's identity. When a key to the code is retained, it may be maintained either by the registry or by the provider of the data.

Registries may be publicly accessible or private. Examples of a few well-known registries and data banks include:

Centers for Disease Control & Prevention (CDC)
State Cancer Registries
The National Library of Medicine Hazardous Substances Data Bank (HSDB)
The National Practitioner Data Bank
The US Census 2000 Data Bank

Repository:

A repository or tissue bank is a collection of biological specimens (biospecimens) whose organizers receive specimens from multiple sources. Activities of a Repository include:
Maintaining the specimens over time.
Controlling access to the biospecimens.
Permitting multiple individuals to use the biospecimens for a variety of purposes, which may evolve over time.
Including phenotypic data (demographic and/or medical information) about the individuals from whom the specimens were obtained. NOTE: When a repository includes phenotype data for biospecimens, the repository is considered both a registry and a biospecimen repository.
Oftentimes maintaining codes that link the information and specimens to their donor's identify. The key to the code may be maintained by either the repository or by the provider of the data/biospecimen.

Examples of a few well-known repositories include:

The National Human Radiobiology Tissue Repository
The National Institute of General Medical Sciences (NIGMS)
Human Genetic Cell Repository

Research vs. Non-Research Databases and Repositories

Databases and repositories are frequently created and maintained for purposes totally unrelated to research. For example, Emory maintains a variety of electronic health records and data warehouse intended for diagnosis, treatment, billing, marketing, and quality improvement/control purposes.IRB oversight is required only when there is a research aspect to the database or repository – as explained in greater detail here:

Registries/Repositories Developed and Used Exclusively at Emory

If a registry/repository is developed solely for quality improvement purposes, then the registry/repository is considered to be a part of health care facility operations and does not require IRB oversight.
If a registry/repository is (a) solely for research, (b) developed for multiple purposes that include research objectives, or (c) includes additional variables that are collected purely for research, then an element of the activity is research and the registry/repositoryrequires IRB oversight.

External Registries/Repositoriesfor Which Emory is a Contributor

In the scenarios discussed below, it is assumed that the data released may be coded but will not identifiable to the external registry; and if HIPAA applies, the external registry will receive no PHI or will only receive a limited data set with a data use agreement.

If the protocol that governs the registry/repository only includes quality improvement objectives, then the registry/repository will be considered to be a part of health care facility operations and does not require IRB oversight
If the protocol that governs the registry/repository is solely for research, or if itmultiple objectives, including research objectives, then the registry/repository might require IRB oversight at Emory depending on the role played by the personnel at Emory. If the Emory personnel are merely data providers and will not serve in the role of an investigator (participate in planning, execution, analysis, and publication), then Emory is only a data provider and is not engaged in the research. (See for example,OHRP Guidance on Engagement in Human Subjects Research III.B.6(link is external)). However, if any member of the Emory team intends to serve as an investigator, then the IRB must review the protocol as Human Subjects Research.

EXAMPLE: Emory IRB Biomedical Protocol

NOTE: In this sample protocol, we have redacted information from previous protocols that were a satisfactory representation of what the IRB needs to see in the scientific protocol documentation. This document is to serve as a guideline for researchers who desire to create a new database registry or sample repository. In no way does this guarantee that there will not need to be any changes to your protocol document upon following this guideline.

Full Study Title:

Short Title:

Principle Investigators:

Protocol Number:

Date:

Funding Source(s):

Abstract:(can also be used as lay summary)

Briefly explain the purpose of your Repository/Database, and briefly what procedures will be done
“The purpose of this IRB protocol is to outline the creation of a biobank repository collected from [Insert specific patients/areas of collection].”
“Data/samples will be collected from [population] by [how selected, and whether you will interact/intervene or gather leftover/secondary specimens and information]”
“Once the database/repository is underway, it will support scientific investigations that will use information in the database to identify [Insert further goals that maintaining these data will hopefully achieve]

Introduction and Background:

Provide relevant introductory/background information as a solid basis for the necessity of such databases/repositories:
Key thoughts to introduce things such as a pattern in previous research, or further reasons why the database/repository should exist and these specific data or specimens should be collected, e.g.:
“A significant number of previous studies have indicated relationship(s) between... Evidence from these studies seems to suggest that researching specific biomarkers would assist in predicting outcomes…”

Objectives:

State the specific details surrounding the objectives in creating your database/repository; broad objectives are acceptable – try to predict all possible future uses.
“Theaim of this protocolis to develop a biobankrepositorycollected from our patientshere at Emory. The intended scope of use of therepositoryis for research related to...”
NOTE: information here mustalign with language in the consent form, if applicable

Location of database/repository:

Planned duration of registry/repository: when data/specimens will be destroyed, if known; if unknown, describe general stewardship plan

Access to Data/Specimens:This section should explain who will be given access to samples and/or data and how.

Description of “gatekeeper” for access to stored data/specimens (individual or team)
Scope of researchers who may be granted use of data/specimens (e.g. within institution, outside of institution)
How and when gatekeeper will request IRB Approval Documentation, if recipient researchers will be given data/samples with any identifiers
Example language (will vary depending on your protocol): “The information in the database/repository will be shared with Emory and non-Emory investigators to help them study [Insert aims of registry/repository]. These studies will require authorization by the [gatekeeper description]. Studies that might be approved to use the information in the database will be those…[describe as broadly as desired]. No one using the samples and/or data, and its derivatives, is authorized to and is forever prohibited from using this material for any attempt at cloning a human being. Information that may be released to researchers may include, but is not limited to: [Insert potential information]. Identifiers, like names, addresses, and social security numbers will not be released, unless requestor provides documentation of IRB approval and the proposed use is within the scope of the original registry/repository consent form or there are plans for additional consent.”
Example language if there is a method to allow requestors to query the data directly (will vary depending on your protocol): “Access to this database will be restricted by a database manager and will be password protected. The only individuals who will be able to see patient identifiers like name, address, and social security number will be the Principal Investigator, research coordinators, recruiters, and the database managers. Other investigators will have different passwords that will provide restricted access to the database. Those with restricted access will be able to query the database for scientific information/variables but will not be able to view information on patient identifiers such as name, address, and social security number. If investigators with restricted access want to conduct studies which require them to obtain patient identifiers so that patients can be contacted for follow-up information/follow-up visits, these investigators will have to submit a documentation of separate IRB approval to get permission to obtain patient identifiers and contact patients.”

Subject Selection/Recruitment:

Describe the demographic targets that you intend to recruit in your database/repository, always including age range
Describe the specific INCLUSION and EXCLUSION criteria for participants in your study
Describe the method you will use to recruit your participants

Informed Consent:

Describe how you will obtain informed consent for the participants involved in the study, e.g.:
“A trained research assistant or other qualified researcher will ask the patient/subject whether he/she is willing to participate in the database. If the patient/subject answers in the affirmative, the assistant will explain the database/repository project in greater detail and commence the informed consent process. Only IRB-approved staff will obtain consent from patients to be included in the database. Completed informed consent forms will be kept in a locked filing cabinet in the study coordinator's office.”
If requesting a waiver of informed consent:
Explain in detail why it would be impracticable to obtain consent (or assent, parental permission) from participants
Justifications cannot generally involve desire to capture 100% of data except for epidemiological/surveillance studies; or inadequate resources to obtain consent.

Potential Recontact for Future Study Enrollment:

State whether you will ask participants if they wish to be recontacted for future research studies for which they might be eligible; should align with the informed consent form.

Collection Procedures:The following procedures are examples of typical procedures found in database/repository protocols. Your protocol may indicate more procedures depending on the extent of your data collection.

1. Collect Medical Record Data if patient/subject is recruited from a clinical or hospital site:

Example level of detail: “A trained research assistant will then access the patient's medicalrecords and collect pertinent medical record-information to be entered into the database, such asmedical history, family history of disease, medication usage, health behaviors, laboratory results,angiographic results, procedure results etc.”

2. Collect (and Analyze, if applicable)Samples:

Detail types of materials being collected (e.g. whole blood, tumor samples, other sources of genetic material, blood derivatives) and whether any cell lines will be established.
Detail any assays/analyses being done as part of repository, independent of specific research aims
Explain whether there will or will not be any variability to the analyses or types of samples collected based on specific needs of downstream researchers
If your study involves blood draws, describe the following:
Quantity of blood collected
NOTE: In order for your study to be considered for expedited review, quantity of blood drawn is limited as follows:
“(a) from healthy, nonpregnant adults who weigh at least 110 pounds. For these subjects, the amounts drawn may not exceed 550 ml in an 8 week period and collection may not occur more frequently than 2 times per week; or
“from other adults and children [2], considering the age, weight, and health of the subjects, the collection procedure, the amount of blood to be collected, and the frequency with which it will be collected. For these subjects, the amount drawn may not exceed the lesser of 50 ml or 3 ml per kg in an 8 week period and collection may not occur more frequently than 2 times per week.”
Sample storage details
Sample collection setting/transportation details/qualifications of phlebotomist

3. Collection of Follow-up Data:

Describe the purpose and how you intend to collect follow-up data from your participants including, but not limited to:
Routine, standard of care visits
Additional blood draws
Follow-up phone calls/questionnaires
If a patient declines to participate in all portions of the study, the patient will not be assigned a study ID number and the study coordinators/data collectors will refrain from collecting any data on the patient. If a patient agrees to participate in some portions of the study but not others, the patient will be assigned a study ID and the study coordinators/data collectors will be instructed to collect data only on those aspects of the study to which the patient has agreed to participate. These procedures will help prevent unauthorized inclusion of a patient's data in the database.

Potential Risks, Discomforts, and Benefits:

Describe potential risks, discomforts, and benefits with the very minimum being a potential breach of confidentiality

Incidental Findings:

Based on the nature of the research expected to be done with the data/specimens, determine if any expected or incidental findings should ever be shared with participants
Keep in mind that when a registry/repository will be use broadly for many types of future research, it will be hard to predict what kinds of findings might result
Return of results should be based on at least the following factors:
Whether data/specimens will be shared with any identifiers (if not, including no study ID, then sharing results will be impossible)
Whether findings could be medically actionable
Whether findings can be reproducible via CLIA lab tests
Useful guidance from the Presidential Commission for the Study of Bioethical Issues on Incidental Findings
Include information about how findings will be shared in the informed consent form, if applicable

Compensation:

Describe detailed notes on participant compensation if applicable

Safeguards to Protect Patient Confidentiality:

Describe the security safeguards you will use to prevent a potential breach of confidentiality
Describe how you will exclude any participant data from participants who withdraw from the study, or opt out of certain parts, e.g.:
“If a patient declines to participate in all portions of the study, the patient will not be assigned a study ID number and the study coordinators/data collectors will refrain from collecting any data on the patient. If a patient agrees to participate in some portions of the study but not others, the patient will be assigned a study ID and the study coordinators/data collectors will be instructed to collect data only on those aspects of the study to which the patient has agreed to participate. These procedures will help prevent unauthorized inclusion of a patient's data in the database.”
Explain in detail what HIPAA identifiers will be retained about the participants, and whether study ID numbers will be used to separate samples/data from more direct identifiers while in storage.
Explain how data/specimens will be prepared for sharing – deidentification, coding, anonymization?

Data and Safety Monitoring and Reporting:A DSM plan would be appropriate if there are more than minimal risk procedures involved in the study, e.g. lumbar puncture. Otherwise, sample language below is applicable:

“We believe that a specific Data and Safety Monitoring Plan (DSMP) is not specifically required for this specific IRB protocol because of the following reasons:

No specific patient interventions, let alone high risk interventions, are going to be performed as part of this protocol, except for the occasional additional blood draw from an arm vein
The research proposed in this protocol is not in any way blinded and we will not be enrolling vulnerable patient populations
This is not a multi-site study
No actual data is going to be generated as part of this protocol. Blood will only be banked and will not be analyzed.

However, we will of course record the incidence of any adverse reactions associated with a specific blood draw. If this does occur, the exact nature of the adverse reaction will also be recorded into the database.”