Section 7: Human Biologic Materials and Data Registries 7.1 Banking Human Biological Material 1.0 Purpose The purpose of this policy and procedure is to describe the Organization’s requirements for banking human biological material (HBM) for future research. Subsequent use of stored HBM in research is addressed in HRPP policy 7.2 (Use of Human Biological Material in Research). 2.0 Policy It is the policy of the Organization that excess or additional HBM may be collected for future unspecified research as part of an addendum study attached to another protocol, or as a free standing tissue banking protocol, in accordance to HHS regulations at 45 CFR 46, HIPAA Privacy Rule, other applicable HRPP policies and Organizational requirements. 3.0 Definitions 3.1. Human Biological Materials: includes (but is not limited to) sub-cellular structures (e.g., DNA); cells; tissues (e.g., blood, bone, muscle, connective tissue, teeth, and skin); organs (e.g., liver, bladder, heart, kidney, and placenta); gametes (e.g., sperm and ova); and waste (e.g., hair, nail clippings, urine, feces, saliva, and sweat). 3.2. Excess HBM refers to HBM that is leftover after research or clinically indicated tests are conducted, and would otherwise be discarded. 3.3. Additional HBM refers to HBM that is collected for the purposes of the research, and would not otherwise have been collected had the subject not been participating; or HBM that is collected solely for banking . 3.4. Identifiable HBM refers to HBM for which the identity of the subject is or may readily be ascertained by the investigator or associated with the HBM, as per 45 CFR 46.102(e)(6). Note: Per Federal regulations, what constitutes “identifiable” will be re-examined on regular occasions; therefore, HBM currently considered not identifiable may become identifiable in the future as technologies and techniques change. 3.5. Human Biological Material (HBM) Bank (also referred to as biobank or biorepository) is a collection of human biological materials that are stored for future use in research. Samples may be obtained from specific IRB-approved trials (involving only that group of subjects participating in the associated trial), or may be collected as part of an IRB approved banking protocol involving subjects with a particular disease or condition, or involving random groups of subjects without regard to disease or condition, or normal healthy persons. Biobanks may also be composed of already existing HBM collected during the course of routine clinical care (for example, leftover clinical material in a Pathology department). 3.5.1. HBM bank may be non-local, usually associated with a cooperative group, another academic or research institution, or a research sponsor or commercial entity. The IRB recognizes that the investigators at UNMC will not have control over what studies are performed utilizing HBM obtained through these banks. 3.5.2. HBM Bank may be located within the Organization or operated entirely, or in part, by an investigator affiliated with the Organization. 4.0 IRB Review and Consent Requirements 4.1. The collection of identifiable HBM into an bank, whether as an addendum to another (clinical) protocol, or as a free standing HBM banking protocol, constitutes human subject research, and will be reviewed in accordance with all applicable federal regulations and HRPP policies. 4.2. The collection of HBM into an HBM bank may qualify for expedited review (under categories 2, 3 or 5), as per HRPP policy 2.3 (Expedited Review). 4.3. The collection of existing HBM into an HBM bank may be exempt as follows: 4.3.1. Prior to the effective date of the Revised Rule, the collection of HBM into an HBM bank may be exempt under 45 CFR 46.101(b)(4). 4.3.2. Following the effective date of the Revised Rule, the collection of HBM into an HBM bank may be exempt under rev 45 CFR 46.104(d)(4). The Organization does not utilize the exemption under 45 CFR 46.104(d)(7). 4.4. The collection of identifiable HBM into a bank requires informed consent of the person from whom the tissue is obtained. 4.4.1. If the HBM to be banked will be collected as an addendum to another (clinical) protocol, separate informed consent must be obtained from the subject. 4.4.2. Collection of HBM for banking cannot be a requirement for participation in another study for which there is the potential of direct subject benefit. 4.4.3. Excess HBM obtained from persons who refuse to consent to HBM banking may not be de-identified and banked. 4.5. If HBM is identifiable, the informed consent must include basic and additional elements of consent related to biospecimens as per 45 CFR 46.116. 4.6. The banking of excess discarded de-identified HBM obtained solely for clinical purposes does not constitute human subject research subject to 45 CFR 46. However, where the donor of the HBM is known and reasonably accessible, consent of the donor is respectful. 5.0 Commercialization of Banked Human Biological Material 5.1. It is reasonable to expect that the possibility exists that banked HBM may be used for commercial profit at some time in the future. Therefore, the consent form must include a statement that the subject’s HBM (even if identifiers are removed) may be used for commercial profit and must state whether the subject will or will not share in this commercial profit. This statement must not contain any exculpatory language. 5.2. If the bank will be housed within the Organization, the consent form must contain the standard statement indicating that the donated HBM is the property of the Organization. 5.3. If the bank will be housed outside the Organization, the consent form must address the issue of who owns the HBM based on the agreement with the owner of the bank. 5.4. The ICF is not meant to serve as a commercial contract where subject compensation is presented. Commercial compensation as negotiated by the researcher, representatives of the Organization, the subject, and their legal counsel is presented in a document separate from the ICF. DOCUMENT HISTORY:  Written: 1/14/2016 (Approved: 1/14/2016) - original author not recorded  Revised: 1/25/2018 - revision not documented7.2 Use of Human Biological Material in Research 1.0 Purpose The purpose of this policy and procedure is to describe the Organizations requirements for the use of human biological material (HBM) in research. 2.0 Policy It is the policy of the Organization that HBM be used in research in accordance to HHS regulations at 45 CFR 46; FDA regulations at 21 CFR 50, 56; HIPAA Privacy Rule, applicable HRPP policies, and Organizational requirements. 3.0 Definitions 3.1. Human Biological Materials: HBM includes (but is not limited to) sub-cellular structures (e.g., DNA); cells; tissues (e.g., blood, bone, muscle, connective tissue, teeth, and skin); organs (e.g., liver, bladder, heart, kidney, and placenta); gametes (e.g., sperm and ova); and waste (e.g., hair, nail clippings, urine, feces, saliva, and sweat). 3.2. Identifiable HBM refers to HBM for which the identity of the subject is or may readily be ascertained by the investigator or associated with the HBM. 3.2.1. At a minimum, HBM is identifiable when it is associated with any of the 18 HIPAA identifiers. Note: Following the effective date for the Revised Rule, what constitutes “identifiable” will be re-examined on regular occasions; therefore, HBM currently considered not identifiable may become identifiable in the future as technologies and techniques change 3.3. Coded HBM refers to HBM which is associated with a code which can be used to indirectly identify the donor of the HBM. 3.3.1. Coded HBM is considered identifiable for the purposes of this and other HRPP policies unless: 3.3.1.1. Specimens were not collected specifically for the research AND 3.3.1.2. The investigators cannot readily ascertain the identity of the individuals 4.0 IRB Review and Consent Requirements 4.1. The use of identifiable HBM previously stored in an HBM bank or pathology archive constitutes human subject research, and will be reviewed in accordance with all applicable federal regulations and HRPP policies. 4.2. The use of identifiable HBM previously stored in an HBM bank or pathology archive requires informed consent of the donor, unless: 4.2.1. Consent can be waived under 45 CFR 46.116(d) (or rev 45 CFR 46.116(f)). 4.2.2. Consent obtained at the time the HBM was obtained and banked was sufficiently detailed with regard to the future use of the HBM that a reasonable person would expect that the consent would permit the types of research conducted. 4.3. The use of non-identifiable HBM previously stored in an HBM bank does not constitute human subject research subject to 45 CFR 46; therefore, no IRB review is required and no informed consent is needed. 4.3.1. Under FDA regulations, clinical investigations using human specimens (even those that are non-identifiable) conducted in support of premarket submissions to FDA are considered human subject investigations, and therefore subject to the informed consent requirements of 21 CFR 50.20. However, FDA intends to exercise enforcement discretion as to the informed consent requirements for clinical investigators, sponsors, and IRBs if an in vitro diagnostic device investigation is performed and the requirements in section 4 of FDA Guidance “Informed Consent for In Vitro Diagnostic Device Studies Using Leftover Human Specimens that are Not Individually Identifiable” (April 25, 2006) are met. 4.4. The use of coded HBM previously stored in an HBM bank or pathology archive constitutes human subject research, and requires IRB review, unless (1) the HBM was not collected specifically for the proposed research AND (2) the investigator cannot readily ascertain the identity of the donors of the HBM. If both these conditions are met, the HBM is considered non-identifiable, and no IRB review is required. 4.5. If the coded HBM is identifiable (as above), informed consent is required unless: 4.5.1. Consent can be waived under 45 CFR 46.116(d) (or rev 45 CFR 46.116(f)). 4.5.2. Consent obtained at the time the HBM was obtained and banked was sufficiently detailed with regard to the future use of the HBM that a reasonable person would expect that the consent would permit the types of research conducted. 4.6. The use of HBM previously stored in an HBM bank may qualify for expedited review (under category 5), as per HRPP policy 2.3 (Expedited Review). 4.7. The use of HBM previously stored in an HBM bank may be exempt under 45 CFR 46.101(b)(4) (prior to the effective date of the Revised Rule), or rev 45 CFR 46.104(d)(4) (following the effective date of the Revised Rule). The Organization does not utilize the exemption under rev 45 CFR 46.104(d)(8). DOCUMENT HISTORY:  Written: 1/14/2016 (Approved: 1/14/2016) - original author not recorded  Revised: 1/25/2018 - revision not documented7.3 Data Registries 1.0 Purpose The purpose of this policy and procedure is to describe the Organization’s requirements for creation and operation of a data registry, and for research use of data from a registry. 2.0 Policy 2.1. It is the policy of the Organization that internal registries, as defined in section 3.1 below, utilized, either wholly or in part, for human subject research must be reviewed and approved by the IRB. All IRB approved registries must comply with the following requirements. 2.1.1. The purpose and goals of the registry are clearly justified. 2.1.2. The registry complies with all applicable requirements of HHS regulations at 45 CFR 46. 2.1.3. The minimum amount of PHI necessary to accomplish the purpose and goals of the registry is entered into the registry. 2.1.4. There is acceptable security to safeguard the confidentiality and integrity of data in the registry, and which satisfies the requirements of Organizational policies regarding data and PHI security. 2.1.5. There are procedures in place for release of PHI from the registry that comply with Organization privacy policies. 2.1.6. As necessary, a Data Use Agreement (DUA), Data Transfer Agreement (DTA), or a Business Associate Agreement (BAA) is in place before any data is released. 2.2. It is the policy of the Organization that External Data Registries (as defined in Section 3.3 below) must be reviewed by the ORA. 3.0 Definitions 3.1. Internal Data Registry is a repository of clinical or other patient data housed and administered within the Organization under the oversight of the UNMC IRB. The data may be used for: a) human subject research, b) assessment of patient outcomes; c) improve healthcare delivery; or d) other non-research purposes. 3.2. External Data Registry is a repository of clinical or other patient data which is housed and administered at an external site normally under the oversight of an external IRB or other oversight body. The data may be used for: a) human subject research, b) assessment of patient outcomes; c) improve healthcare delivery; or d) other non-research purposes. 3.3. Private information includes information about behavior that occurs in a context in which an individual can reasonably expect that no observation or recording is taking place, and information that has been provided for specific purposes by an individual and that the individual can reasonably expect will not be made public (for example, a medical record). 3.4. *Identifiable Private Information refers to private information for which the identity of the subject is or may readily be ascertained by the investigator or associated with the information, as per 45 CFR 46.102(e)(5). Note: Per Federal regulations, what constitutes “identifiable” will be re-examined on regular occasions; therefore, HBM currently considered not identifiable may become identifiable in the future as technologies and techniques change. 4.0 IRB Review and Consent Requirements for Internal Data Registries 4.1. The creation of a registry that is utilized, either wholly or in part, for human subject research is subject to IRB review, and healthcare professionals who develop and maintain the registry must submit a Data Registry Application. If the registry will also include collection of human biological material (HBM) the Human Biological Material Banking Application must be completed instead. 4.2. The collection of identifiable private information into a registry that is utilized, either wholly or in part, for human subject research constitutes human subject research, and will be reviewed in accordance with all applicable federal regulations and HRPP policies. Specifically, the IRB must find that 4.2.1. The registry complies with all applicable requirements of HHS regulations at 45 CFR 46. 4.2.2. The purpose and goals of the registry are clearly justified. 4.2.3. The minimum amount of PHI necessary to accomplish the purpose and goals of the registry is entered into the registry. 4.2.4. There is acceptable security to safeguard the confidentiality and integrity of data in the registry, and which satisfies the requirements of Organizational policies regarding data and PHI security. 4.2.5. There are procedures in place for release of PHI from the registry that comply with Organization privacy policies. 4.2.6. As necessary, a Data Use Agreement (DUA), Data Transfer Agreement (DTA), or a Business Associate Agreement (BAA) is in place before any data is released. 4.3. The collection of identifiable private information into a data registry that is utilized, either wholly or in part, for human subject research may qualify for expedited review (as per HRPP policy 2.3) or may be exempt (as per HRPP policy 2.6). 4.4. The collection of identifiable private information into a registry that is utilized, either wholly or in part, for human subject research requires informed consent of the person from whom the data is obtained. 4.4.1. If the data to be entered into the registry will be collected as an addendum to another (clinical) protocol, separate informed consent must be obtained from the subject. 4.4.2. Collection of data for a registry cannot be a requirement for participation in another study for which there is the potential of direct subject benefit. 4.5. The informed consent must include basic and additional elements of consent related to identifiable private information as per 45 CFR 46.116. 5.0 ORA Review and Consent Requirements for External Data Registries 5.1. Submission of clinical data with or without identifiers that has been collected solely for clinical purposes to an external data registry (that is utilized, either wholly or in part, for human subject research) does not constitute engagement in human subject research. It is therefore not subject to UNMC IRB approval, provided the healthcare professional submitting the data (1) is not involved with the research (aside from submitting the clinical data), and (2) will not, in the future, use data in the external registry for research in which he/she is participating. 5.1.1. Healthcare professionals who submit clinical data to external data registries as described above must submit the Data Registry Application to the ORA. The information will be entered into the IRB database for tracking purposes. 5.1.2. If the clinical data contains PHI, authorization for disclosure of the PHI to the External Data Registry must be obtained in accordance with 45 CFR 164.508(c), or authorization must be waived by the UNMC IRB or the Privacy Board associated with the External Data Registry in accordance with 45 CFR 164.512(i). 5.1.3. In consideration of such factors as sensitivity of the data collected, the subject population, whether the registry is under the oversight of an external IRB or government entity, and Organizational requirements, Assistant Vice-Chancellor for Regulatory Affairs, in consultation with the IO, may require submission of additional information regarding administration of the registry, data security, and processes for release of data. 5.2. If the healthcare professional submitting the data is involved with the research (for example, will be an author on manuscripts, or plans to subsequently use data in the registry for different research purposes) then the Organization is engaged, and the submission of identifiable private information constitutes research. It is therefore subject to UNMC IRB approval (per section 4.2 above) and the requirement for informed consent (per sections 4.5 and 4.6 above). 5.3. The appropriate agreements (Data Use Agreement, Data Transfer Agreement) must be fully executed prior to final release of the Data Registry or Medical Records Research. 6.0 Research Use of Data from a Registry 6.1. The Data Registry Application must be submitted in accordance with HRPP policy 2.1 (Submission of Items for Review by the IRB). 6.2. Applications which require review by the full IRB will be processed and reviewed in accordance with HRPP policy 2.2. 6.3. Applications that are eligible for review by the expedited method will be processed and reviewed in accordance with HRPP policy #2.3. 6.4. Applications which appear to be eligible for exemption will be processed and reviewed in accordance with HRPP policy #2.6. 6.5. The use of identifiable private information previously stored in a data registry requires informed consent of the donor, unless: 6.5.1. Consent can be waived under 45 CFR 46.116(d) (or rev 45 CFR 46.116(f)), and, if PHI is involved, authorization is waived under 45 CFR 164.512(i). 6.5.2. Consent obtained at the time the data was placed into the registry was sufficiently detailed with regard to the future use of the data that a reasonable person would expect that the consent would permit the types of research conducted. DOCUMENT HISTORY:  Written: 1/14/2016 (Approved: 1/14/2016) - original author not recorded  Revised: 3/2/2018 - revision not documented