Registries and Repositories

Databases and repositories are frequently created and maintained for purposes totally unrelated to research. For example, CHOP maintains a variety of electronic health records and data warehouse intended for diagnosis, treatment, billing, marketing, and quality improvement/control purposes. Individual departments and divisions use their own databases that have been established for clinical and quality improvement purposes. Examples include the following:

• Anesthesia electronic record system used in the operating room to record preoperative history and physical examination data, store the vital signs and anesthetic medication administration and create anesthetic records for every procedure.
• Pathology Department biospecimens and records for all of the materials received for diagnostic or treatment purposes.
• Operating room management database
• EPIC
• Quality Assurance/Quality Improvement initiatives (e.g. cardiac arrest registry, ED resuscitation registry)

These databases and repositories serve predominantly non-research purposes. However, the information they contain can be used to address important scientific questions. IRB approval is not required for creation or use of a non-research database or biospecimen collection but is required to use these resources for research purposes. See what must be reviewed by the IRB for more details.

Is IRB approval needed before establishing a new Quality Improvement Registry?

The short answer is No. However, the nature of the protocol that is submitted could affect that answer. The following scenarios outline some of the many possible situations.

Registries Developed and Used Exclusively at CHOP

• If the protocol only includes Quality Improvement objectives for the registry, this is hospital operations and does not require IRB oversight;

• If the protocol also includes research objectives or if additional variables are collected purely for research, then an element of the activity is research and requires IRB oversight;

External Registry in Which CHOP is a Participant (In the scenarios discussed below, it is assumed that the data released to the external registry are not readily identifiable.)

• If the protocol only includes Quality Improvement objectives, this is part of hospital operations and does not require IRB oversight;

• If the protocol includes Quality Improvement objectives but also includes research objectives; the registry might require IRB oversight at CHOP depending on the role played by the personnel at CHOP. If the CHOP personnel are merely data providers and will not serve in the role of an investigator (participate in planning, execution, analysis, and publication), then CHOP is only a data provider and is not engaged in the research. (See for example, OHRP Guidance on Engagement in Human Subjects Research III.B.6 ). However, if any member of the CHOP team intends to serve as an investigator, then the IRB must review the protocol as human subjects research.

Research databases may be maintained after the completion of a study. Additional questions may arise in the future that can be addressed using the same dataset. If there is an intent to set up a registry, then the informed consent document should include language for subjects to opt-in or opt-out of storage of their data for future research purposes. The subject's decision as indicated on the consent/authorization must be respected and tracked. IRB oversight is required for each new research protocol that uses identifiable or re-identifiable information contained in the database.

A research database may also be created specifically as a resource for future research. IRB oversight is required to set up and maintain a research database.

Examples of research databases include:

• Data compiled from a clinical trial
• A list of names, diagnosis, and contact information developed and maintained to identify prospective research subjects
• A collection of medical information intended for use in future research studies

Some databases created and maintained to serve multiple purposes. Examples include:

• A collection of patients' diagnosis, treatment, and follow-up information intended for and used to conduct (i.) internal quality assurance programs and (ii) generalizable studies on the effectiveness of particular treatment interventions.
• A compilation of patient information that was originally created and used for billing purposes but is now also routinely used to identify prospective research subjects

Biospecimens may be collected to achieve one or more of the objectives of a single study with disposal of the leftover materials at the end of the study. A repository is created if the leftover materials are stored for future use. If there is an intent to set up a repository, then the informed consent document should include language for subjects to opt-in or opt-out of storage of their data for future research purposes, a statement that the subject’s biospecimens may be used for commercial profit and whether the subject will or will not share in this commercial profit, and whether the research will or might include whole genome sequencing. The subject's decision as indicated on the consent/authorization must be respected and tracked.

Specimens may also be collected specifically for the purposes of future research. IRB submission is required for each new research protocol that creates a repository.

For the purposes of the remainder of this page, both registries and repositories will be referred to as repositories. The advantage to investigators of creating, maintaining, and/or using a research repository lies in the prospective collection, the safe storage and back-up, controlled access to and use of data/biospecimens. The information and specimens can be accessed by multiple investigators for multiple research projects. Some of the potential research uses may be anticipated at the time of collection but most cannot be specified at the time the repository is created.

A repository protocol may be submitted to the IRB either to:

• Define the operating parameters for establishing and maintaining a research repository; or
• Convert an existing research database, non-research database, or non-research repository into a research repository.

The IRB can approve relatively broad parameters for collecting, storing, sharing, and using the repository's information and/or specimens in research, provided the protocol incorporates a series of research protections that permit multiple uses of repository information and/or specimens by multiple investigators and/or for multiple research projects with minimal additional review by the IRB. To maximize the utility of the data/biospecimens retained in the repository requires careful planning and clear operating policies and procedures (SOP). The mechanisms put in place will determine the requirements for IRB oversight of future uses of the materials in the repository.

Researchers who wish to develop or maintain a repository that is being developed for the purposes of current or future research, need to submit an application for IRB review. IRB approval, or determination of exemption, is required before initiating any repository-related activity. Operators of the repository must implement physical and procedural mechanisms for the secure receipt, storage, and transmission of information and specimens. These procedures must be reviewed by the IRB and must be sufficient to ensure the protection of subjects' privacy and the confidentiality of subjects' information.

In addition to the usual information contained in a human research protocol and an IRB application, the IRB expects that will include at least the following specific information:

• The specific conditions under which data/biospecimens may be accepted into the repository, including requirement for the FWA number for each site IRB and a copy of the IRB approval letter;
• A detailed description of the physical and procedural mechanisms for the secure receipt, storage, and transmission of information and specimens to ensure the protection of subjects' privacy and the confidentiality of subjects' data/specimens,
• The specific conditions under which data and/or specimens may be shared with or released to research investigators including policies pertaining prohibiting or permitting the sharing of PHI associated with the data/biospecimens,
• Protocol for the collectors of data/specimens
• Template consent and written authorization or combined consent/authorization for the collection sites that includes a clear description of each of the following:
  • The general concept and purpose of repository;
  • The name and location of the repository(ies);
  • The nature and types of future research in as much specific detail as possible;
  • A summary of the physical and procedural mechanisms for protecting subjects' privacy and the confidentiality of data/biospecimens;
  • The conditions (if any) under which subject's may withdraw their consent/authorization to use of specimens;
  • The conditions and requirements under which data/biospecimens and materials derived from biospecimens may be shared with recipient-investigators;
  • The elements of PHI (if any) to be shared with recipient investigators;
  • Itemization of the risks related to a breach of confidentiality including impact on privacy, insurability, stigmatization, etc.;
  • Where human genetic research is anticipated, information about the consequences of DNA typing (e.g., regarding possible paternity determinations, impact on insurability, etc.) and related confidentiality risks.

Investigators who collect the data/biospecimens (the collector) that will be stored in a repository must agree in writing to specific conditions stipulated by the Repository IRB (the IRB exercising oversight of the repository. Collectors other responsibilities include:

• Obtaining appropriate IRB approval from their local IRB
• Obtaining and documenting informed consent/authorization as required by their IRB;
• Following the protocol procedures including:
  • Obtaining the required data/biospecimens in the appropriate form and storage medium and at the specified timepoints;
  • Coding and labeling the samples before shipping or uploading the data/biospecimens to the registry/repository;
  • Removing all unnecessary PHI from the data/biospecimens;
  • Methods for maintaining and securing PHI associated with the data/biospecimens sent to the registry/repository and any links (key) between the donor and the data/biospecimens as specified in the protocol.

Responsibilities of the Recipient

Investigators receiving data/biospecimens from the repository (the recipient) must also agree in writing to specific conditions required by the Repository IRB and must adhere to local IRB oversight requirements. The nature of the local IRB oversight requirements depends upon the whether or not the received data/biospecimens are potentially identifiable.