This section of the Investigator Manual provides general information about biospecimen and data research, including review requirements, consent requirement, storage, and sharing.


Biospecimens & Data: IRB Review Requirements

Under the Common Rule and UW-Madison HRPP Policy, IRB review is required for all human subjects research, defined as:

  • A systematic investigation designed to contribute to generalizable knowledge, and
  • Involves obtaining information or biospecimens from a living individual through either interaction or intervention, with the individual or access to the individual’s private information, including protected health information (PHI).

In addition, the FDA requires IRB review for the use of de-identified human specimens in clinical investigations of medical devices when the research may generate or collect data that may be submitted to the FDA for review.

IRB review is required for most research studies that use data or biospecimens obtained from human subjects. These research studies may qualify for exemption, expedited review, or require full board review. Some studies may ultimately not fit the definition of research involving human subjects but the IRB must make this determination.

Examples of biospecimen and data research requiring IRB review include, but are not limited to:

  • Prospective collection of data or biospecimens for a specific research study
  • Prospective collection and storage of data or biospecimens for future research use, including whole genome and whole exome sequencing
  • Secondary use of identifiable data or biospecimens
    • Example: Obtaining blood/tissue samples along with identifiers from a biobank or repository
    • Example: Obtaining data, including identifiers, from a health care record for research analysis
  • Secondary use of coded data or biospecimens when the investigator collected the specimens him/herself for another research project
  • Secondary use of coded data or biospecimens when the investigator has access to the code that would allow linkage of the data or specimens to identifiable information
  • Secondary use of de-identified or coded data or biospecimens in a project that will generate or collect data that will or may be submitted to the FDA
    • Example: Testing the efficacy of a diagnostic device using de-identified biospecimens collected as standard of care and no longer needed for clinical diagnostic purposes
  • Secondary use of de-identified or coded data or biospecimens in a project conducting whole genome or whole exome sequencing (if you are conducting whole genome and/or whole exome sequencing, please also review the NIH Genomic Data Sharing policy section of the Investigator Manual)
  • Secondary use of de-identified or coded biospecimens when the investigator will not have access to the code AND the data generated or collected will not be submitted to the FDA
  • Collection and/or use of de-identified biospecimens obtained through standard of care clinical procedures and that are not required for treatment or diagnostic purposes (waste) provided the project will not generate or collect data that may be submitted to the FDA.
    • Biospecimens obtained through standard of care clinical procedures may require analysis by pathology for diagnostic purposes. During this process, pathology will assess what portion of the biospecimen is required for clinical purposes and what portion, if any, is deemed waste and/or can be used for research purposes.
    • If clinical biospecimens are being obtained from UW Health patients, investigators will need to find out whether the specimens require pathology evaluation, can be deemed waste per UW Health policies, or whether an exception to pathology evaluation can be made if the specimen is not deemed as waste.
    • Resources for information on pathology workflows and the need for sign-off to use clinical biospecimens for research include the Department of Pathology and Laboratory Medicine, the UW Carbone Cancer Center, and the Office of Clinical Trials.

Examples of research NOT requiring IRB review include, but are not limited to the following (note that a formal Not Human Subjects Research request can be made to the IRB for documentation purposes, but is not required):

  • Secondary use of data from publicly available datasets (e.g., US Census data)
  • Use of biological specimens from deceased individuals in a project provided the project will not generate or collect data that may be submitted to the FDA (HIPAA regulations may still apply if PHI is used along with the specimens)
  • Some funding agencies may require IRB review and approval for research projects that are not regulated by the Common Rule or the FDA. In these cases, investigators are encouraged to speak directly with the IRB Office to determine the best course of action.

Biospecimen & Data Research: Storage

When reviewing a research study, the IRB will consider whether appropriate provisions are in place to protect the privacy interests of research subjects, the confidentiality of the research data, and the security of the data and biospecimens. The IRB will consider the following when determining whether a research study has adequate provisions to protect research subjects’ privacy interests, confidentiality of data, and security of data and specimens:

  • Risk/Benefit assessment,
  • Location of the data collection,
  • Sensitivity of the data being collected,
  • The identifiability of the data and biospecimens.

The IRB requires detailed information on the confidentiality and security of biospecimens and data to be used in research. The following is a list of items to describe in the submission materials for IRB review. For additional guidance, please see HRP 503a-TEMPLATE PROTOCOL-Registries and Repositories.

  • Describe any procedures that will be used for quality control of collected data and/or biospecimens.
  • Describe the steps that will be taken to secure the data and specimens (e.g., training, authorization of access, password protection, encryption, physical controls, and separation of identifiers and data) for storage and use.
  • Describe how and where data and/or biospecimens will be stored and maintained throughout the life of the study. Reference any relevant storage standard operating procedures, including how the data and specimens will be tracked.
  • Explain whether anyone, including the lead researcher, can identify the participants. Explain whether there will be a unique code on the biospecimens/dataset that can be used to link to a participant’s identity, but will not, by itself, reveal who the participant is.
  • Describe the procedures in place to protect participants’ privacy. By privacy, this means a person’s desire to place limits on with whom they interact or to whom they provide personal information.
  • If you will be collecting sensitive information (e.g., sexual health information, communicable disease status, genetic test results), provide a justification for this.

Sharing Data, Specimens, or Images

If you plan to share or receive specimens or data to/from external entities, you will need to address the additional requirements described below. Your protocol or application must describe how you will meet these requirements. Guidance regarding what items you must address can be found in the protocol templates or via consultation with IRB staff.

Note: If the samples being shipped or received will include dates of service associated with the provision of health care or laboratory tests (such as date of collection and date of processing) the data comprises a limited data set of protected health information (PHI) and a data use agreement (DUA) is needed. The requirement for a DUA can be achieved using a stand-alone template or through incorporation of language into the Material Transfer Agreement (MTA) which meets the requirement of HIPAA at 45 CFR 164.514(e). For more information about what is described below, see these pages about sharing and receiving data.

Sending Specimens or Data to Other Sites

If your approved protocol or application does not already address sending specimens or data to other sites, you must submit a change to obtain IRB approval before sending the specimens or data. Guidance regarding what items you must address can be found in the protocol templates or via consultation with IRB staff. Whether the researcher receiving specimens or images must obtain IRB approval depends on several factors:

  1. Will the items be analyzed solely as a professional service?
  2. Will the items being sent be completely anonymized (i.e., no one can trace them back to the individual from whom they were derived) to external personnel who is not a collaborator?
  3. Will the items being sent be coded and the code will not be released to the external researcher who is not a collaborator?
  4. Will the items be identifiable to any personnel at any site?

If the answer to any of the first three questions is yes, IRB oversight may not be required for those receiving the items. In the fourth case, IRB review is likely required. Since these can be complex determinations, we encourage you to contact the IRB office for assistance.

Receiving Specimens or Data from Other Sites

If you are planning research involving existing specimens or data received from other sites or researchers certain items must be addressed in your protocol or IRB application. If you have a currently approved IRB application which does not specifically state that specimens or data will be received from a specific site or researchers, a change must be submitted to the IRB before the items can be received. Guidance regarding what items you must address can be found, in the protocol templates, or via consultation with IRB staff. For more information on receiving samples or data more generally including when agreements must be in place, please review the Guidance on Receiving Human Subjects Research Data from an External Entity page.