Research repositories obtain data/biospecimens collected via:
- IRB approved research informed consent/HIPAA Authorization
- Research conducted under a waiver of informed consent granted by the IRB
- Clinical informed consent permitting research use (no IRB approval)
IRB approval for the repository (REP application) need not include consideration of informed consent/HIPAA authorization, or approval of waiver of consent/authorization, when
- A research repository is created with data/biospecimens that are anonymous, and queries into the database could not result in situations where the data/biospecimens could become identifiable.
- A query of a clinical or research data repository produces only deidentified aggregate counts and there is assurance that all HIPAA identifiers are removed. The researcher never has access to identifiers. A data use agreement may be required by entity managing the repository.
IRB approval for the repository (REP application) must include consideration of informed consent/HIPAA authorization, or approval of waiver of consent/authorization, when
- A research repository containing identifiable information is created from data/biospecimens collected for clinical purposes, or data/biospecimens collected as part of a research study where the research or clinical consent did not contain permissions that would allow for the subject’s information to be placed in the repository
- The research data repository contains identifiable information not collected under prior IRB approval/HIPAA Authorization and identifiable data may be extracted for research purposes (e.g., UMHS Research Data Warehouse [RDW]). Data could be directly identifiable, or could become identifiable if the data recipient has access to codes permitting re-identification.
Repositories may request IRB approval for waiver of informed consent (and, if appropriate, HIPAA authorization) by attaching a consent waiver request form (or consent/authorization waiver request form) in section 8.2 of the REP.