Research Using Human Biological Specimens | Human Research Protection Program (HRPP)

Common Types of Research Involving Human Specimens
Prospective vs. Retrospective Collection of Specimens
Consent Topics

Common Types of Research Involving Human Specimens

Because the federal definition of human subject extends to people who are sources of biological specimens and identifiable private information, research with these materials often requires review and approval by the IRB. The level of IRB review and oversight is based on the level of risk the study poses. Specimen research risks potentially include one or both of the following:

The risk of harm from procedures used to obtain specimens, and/or
The risk associated with the loss of privacy and confidentiality due to personally identifiable information that may be associated with specimens.

Some of the most common types of research involving human specimens are summarized in the tables below.

Table 1: De-identified or coded specimens – investigators have no access to private information and no subject contact

TABLE 1: RESEARCH USING SPECIMENS WITHOUT IDENTIFIERS - MINIMAL RISK - NO SUBJECT CONTACT
STUDY FEATURES		IRB REQUIREMENTS
INVESTIGATOR	No subject/donor contact No access to identifying data (even temporarily)	PI confirms that the project does NOT qualify as Human Subjects Research. If so, certify using the Self-Certification Form. Do not submit this form to IRB. If the study qualifies as human subjects research, submit an Exempt Certification (Category 4) OR Expedited Review (Category 5).
SPECIMENS	Sources might include specimen banks, repositories, commercial entities Specimens are de-identified, de-linked (identifiers irreversibly stripped), or coded and the PI does not have access to the key
CONSENT	Study adheres to the scope of research allowed by the original consent (if applicable)
RISK	Minimal Private data non-existent or securely protected

Details: According to guidance from the Office on Human Research Protections (OHRP), the human subject definition does not apply to research involving de-identified or coded specimens, under specific conditions. Therefore, IRB review is not required. See the Not Human Subjects Research page for more information and certify using the Self-Certification Form.

Table 2: Specimens initially obtained with limited private information, but the investigators do not record/keep this information; no subject contact

TABLE 2: RESEARCH USING HUMAN SPECIMENS: ACCESS TO IDENTIFIERS, BUT IDENTIFIERS ARE NOT RECORDED OR LINKED TO SPECIMENS - MINIMAL RISK - NO SUBJECT CONTACT
STUDY FEATURES		IRB REQUIREMENTS
INVESTIGATOR	No subject contact Access to limited identifiers	Exempt Certification (Category 4)
SPECIMENS	Pre-existing, on-the-shelf Collected for a purpose other than the proposed research Researcher can have access to associated identifiers (minimum necessary to meet study goals), but is not allowed to record identifiers or link them to the specimens Specimens and data are secured appropriately
CONSENT	Study adheres to the scope of research allowed by the original consent Request a waiver of consent/authorization for the study
RISK	Minimal

Details: At times, you may receive specimens that have identifiable information associated with them, but you do not need to keep the identifiers linked to the specimens. If you do not record the identifiers or link them to the specimens, the research may be eligible for review under exempt category #4.

Specifically, exempt category #4 applies to research that involves the collection or study of existing* data, documents, records, pathological specimens, or diagnostic specimens, if these sources are publicly available** or if the information is recorded by the investigator in such a manner that subjects cannot be identified, directly or through identifiers linked to the subjects.

Table 3: Specimens with limited private information; no subject contact

TABLE 3: RESEARCH USING HUMAN SPECIMENS: ACCESS TO AND RECORDING OF IDENTIFIERS - MINIMAL RISK- NO SUBJECT CONTACT
STUDY FEATURES		IRB REQUIREMENTS
INVESTIGATOR	No subject contact May have access to and record identifiers	Expedited Review (Category 5)
SPECIMENS	Collected for non-research purposes or for research purposes under certain circumstances (see expedited review category 5) Associated identifiers are minimum necessary to meet study goals, and private information will not be reused or inappropriately disclosed Specimens and data are secured appropriately
CONSENT	Study adheres to the scope of research allowed by the original consent Request a waiver of consent/authorization for this project
RISK	Minimal, provided investigator securely protects private data

Details: Research involving previously collected specimens that have identifiers associated most likely qualifies for expedited review category 5 with no subject contact. Although the investigator does not interact with subjects, access to private information is allowed. Use of specimen-associated identifiers must be restricted and privacy protection measures must be in place:

It usually is not necessary to obtain additional consent from donors of previously collected specimens, provided that the study meets the criteria for waving consent in minimal risk research.

However, if consent was obtained for the original specimen collection and the proposed research falls outside the uses specified in the original consent form, the investigator will need to consent donors. The study should be identified as "Subject Contact," and the IRB must review and approve all materials used for re-consenting. The IRB strongly encourages subject contact to be made by letter, not by phone, and preferably by someone known to the donor who was involved in the original specimen collection.

Table 4: Specimens obtained for research and/or banking through subject contact using minimal risk procedures

TABLE 4: RESEARCH AND/OR BANKING INVOLVING HUMAN SPECIMENS: MINIMAL RISK- SUBJECT CONTACT
STUDY FEATURES		IRB REQUIREMENTS
INVESTIGATOR	Subject contact through interaction and/or intervention using minimal risk procedures Access to identifiers	Expedited Review (Categories 2, 3 and/or 5)
SPECIMENS	Collected prospectively Collected specifically for the research project by the investigator or collaborators using minimal risk procedures and/or Surgical or diagnostic specimens that would be otherwise thrown away Associated identifiers are minimum necessary to meet study goals, and private information will not be reused or inappropriately disclosed Specimens and data are secured appropriately Possibly retained for future use
CONSENT	Consent required HIPAA authorization or waiver may be required if identifiers are used
RISK	Specimens obtained using procedures posing no more than minimal risk Private data secured and disclosed only to those specified in the IRB-approved protocol

Details: Research using human specimens qualifies for expedited review by the IRB if the study procedures pose no more than a minimal risk to participants.

If specimens will be banked for future research, provide information on what types of specimens will be collected, where the specimens will be stored, with whom the specimens will be shared and how the specimens will be kept confidential.

Use IRB consent templates and follow the consent guidance below. If necessary, also obtain HIPAA authorization.

Table 5: Specimens obtained for research and/or banking through subject contact using procedures that pose greater than minimal risk

TABLE 5: RESEARCH AND/OR BANKING INVOLVING HUMAN SPECIMENS: PROCEDURES POSE GREATER THAN MINIMAL RISK Examples: Specimens will be collected – using procedures posing greater than minimal risk – as part of a larger protocol such as a clinical trial or intervention study. Greater than minimal risk procedures will be used to obtain additional specimens – materials in excess of that required for diagnosis or treatment.
STUDY FEATURES		IRB REQUIREMENTS
INVESTIGATOR	Subject contact through interaction or intervention Access to identifiers	Full Committee Review
SPECIMENS	Obtained prospectively Obtained using procedures that pose greater than minimal risk, including collection that is: Part of a larger trial, or Solely for banking, or Retained for future use Associated identifiers are minimum necessary to meet study goals, and private information will not be reused or inappropriately disclosed Specimens and data are secured appropriately
CONSENT	Consent required HIPAA authorization required
RISK	Specimens obtained using procedures posing greater than minimal risk Private data secured and disclosed only to those specified in the IRB-approved protocol

Details: A study proposing to collect specimens using procedures that pose greater than minimal risk to participants must undergo full committee review by the IRB.

Use IRB consent templates and follow the consent guidance below. If necessary, also obtain HIPAA authorization.

Other Considerations:

NIH Genomic Data Sharing (GDS) Policy and the Genome-Wide Association Studies (GWAS): The NIH has strict standards for the data that it will accept. Review our guidance if you plan to submit data and/or specimens to the NIH.
Collecting Specimens from Minors: Refer to the Children and Minors in Research page. There are also guidelines on Skin Biopsies in Children for the Purpose of Research.
CLIA: Laboratories performing testing on human specimens and reporting patient-specific results must be certified under the provisions of the Clinical Laboratory Improvement Amendments of 1998 (CLIA).

Prospective vs. Retrospective Collection of Specimens

When specimens are obtained/collected may affect the level of review that is required for your study. If the research is not human subjects research, it does not matter whether or not the specimens existed or were collected before the study is proposed.

If the specimens are “existing” (i.e., on the shelf at the time of IRB approval) when the research is first submitted to the IRB

The study may require one of the following:

Not human subjects research and no IRB application if the researcher never obtains identifiers or codes, or there are agreements to prevent sharing identities; or
Exempt certification (category 4), if the researcher obtains identifiers but does not record them in research records (including dates); or
At least an expedited review if the researcher records identifiers.

If specimens are obtained/collected after the research is first proposed (i.e. prospective collection)

The study may require one of the following:

Not human subjects research and no IRB application if the researcher never obtains identifiers or codes, or there are agreements to prevent sharing identities.
Exempt certification (category 4) cannot apply because information or specimens are not pre-existing.
Most common: At least an expedited review if the researcher obtains or records identifiers (even temporarily) or codes without agreements to prevent sharing identities.

Consent Topics

Consent forms used for studies proposing to collect specimens for research purposes and/or banking should include the following topics, as applicable.

Types of specimens that will be kept	Who will have access* to specimens and data (e.g. UCSF researchers only, other academic collaborators, industry sponsor)
The name of the institution/department/laboratory where specimens will be housed (a basic description of the repository)	A description of the procedures for protecting the privacy of subjects and maintaining the confidentiality of data
General descriptions of the types of research the specimens can be used for (e.g. cancer, diabetes, cardiovascular research)	Statement that specimens may be used in the development of tests, products, or discoveries that may have potential commercial value and that subjects will not be paid or receive money
The duration of specimen retention	Instructions for donors to request destruction of remaining samples in the future
Types of data or medical information will be collected with the specimens and for how long the information will be collected	If genetic testing will be performed, include information about the consequences of DNA typing

* Based on current research trends, we strongly recommend including the genomic data sharing language in the consent form to allow future sharing, even if you don't anticipate it now. The existing consent templates include the GDS required language. If you develop your own verbiage, consult the NIH GDS consent checklist to document that all of the required elements are included.