Skip to content
Office for Human Subject Protection
Office of the Vice President for Research

Secondary Use of Data, Records, and Specimens

Under the revised Common Rule (45 CFR 46), secondary research of data/records/biospecimens can now be deemed exempt when:

  1. The review involves ‘secondary research’ only (meaning the information/biospecimens were originally collected for some other purpose); and
  2. One of the following criteria are met:
    1. The information/biospecimens are publically available;
    2. The information (including information about a biospecimen) is recorded in a manner that the identity of the subjects cannot be readily ascertained (either directly or indirectly through links/codes), the investigator does not contact the subject, and the investigator will not re-identify subjects;
    3. The research involves only the collection and analysis of identifiable health information regulated by the Health Insurance Portability and Accountability Act (HIPAA); or
    4. The research is conducted by or behalf of a Federal department or agency using government-generated or government-collected information obtained for non-research activities.

While these criteria seem relatively straightforward, it’s important to keep them in mind as secondary use or retrospective review protocols are developed. If Institutional Review Board (IRB) personnel cannot validate that these criteria are met, the research may require revision or may require a different level of IRB review.

Questions to consider

To facilitate IRB review, ask yourself if the following are clearly described in your study protocol.

What is the source of the information/biospecimen and does the study team have access to that source?

Perhaps biospecimens are collected from a department’s specimen repository under another IRB protocol. Perhaps the data will be retrieved from an online government database. Perhaps you will receive a dataset from a commercial entity. Is that source available to the public or available upon request? Furthermore, is access to the information/biospecimen limited or restricted and if so, how is the information/biospecimen going to be obtained? Understanding the source of the information/biospecimen and an investigator’s access to that source is critical to determine whether a proposal meets the criteria for exemption.

Is the use of information/biospecimens truly ‘secondary’?

The divide between what information/biospecimens were originally collected and why (i.e., the primary collection) and what will be used now for the retrospective review (i.e., the secondary use) is often muddy. This leaves IRB personnel unsure in determining if the protocol under review is truly ‘secondary’, so it is crucial to be clear about where information/biospecimens are coming from and why they were originally collected.

Is the dataset identifiable?

Protocols submitted to the IRB often waiver between indicating that data is de-identified and coded. Though these terms are similar they do not have the same meaning (reference OHSP Explains: Coded vs. De-Identified; Anonymized vs. Anonymous for more information on de-identification vs. coding). Each term may have different regulatory requirements, so interchanging them leaves the IRB unsure of the level of review for the study. Of note, it’s important to understand that, in some cases, collecting identifiable information is permissible (categories A, C and D listed above) while in other cases, collecting and maintaining identifiable information may bump the research to a different level of IRB review.

Is the data collection sheet that supplements the study protocol consistent with the information described in the study protocol?

If the research is undergoing review by the local IRB, the Research Subjects Review Board (RSRB), a data collection sheet identifying the specific data points that will be collected as part of the retrospective review is required to be submitted with the study protocol. Frequently, the RSRB finds the information described in the study protocol does not match the data points identified in the collection sheet, which then requires clarification. The protocol, for example may state the data is de-identified but the data collection sheet includes identifiers. Protocols will also often list all data collection points, in addition to the data collection sheet, but the two documents are inconsistent. To avoid this, it’s best practice to indicate generally the type of data being collected in the study protocol, leaving specific data collection points to be listed on the data collection sheet.

If information regulated under HIPAA is being collected, has a waiver of HIPAA authorization been requested and is it justified?

Use of protected health information regulated under HIPAA for the purposes of research still needs to comply with HIPAA requirements (category C listed above).  For retrospective reviews, this typically involves requesting a waiver of HIPAA authorization and while the waiver is often requested, the justification for the wavier is either not provided or inadequate, thereby making the waiver request unacceptable for IRB approval.

Specimen and record review protocol template

As a final best practice, to ensure all of the necessary points described above are addressed when submitting to the Research Subject’s Review Board (the University’s IRB), study teams are strongly encouraged to utilize the specimen and record review protocol template .

The protocol should be completed as directed and, in the event a section is not applicable, simply enter ‘N/A’ to identify it as such. Eliminating a section or leaving a section blank leaves IRB personnel questioning whether the section didn’t apply or just wasn’t completed.

What if my secondary analysis doesn’t meet the criteria for exemption?

When a proposal does not fit an exemption category, the research is typically reviewed via an expedited pathway. This means the IRB coordinator and board chair will conduct the review on behalf of the full board, and the protocol may need to be revised to include a waiver of consent. During the review, the IRB board chair will confirm that the research meets the criteria for IRB approval and determine whether continuing review of the research is required.

Rather than worry about the IRB review level, it is more important for study teams to ensure all study activities are accurately described in the study protocol and the information/biospecimens needed to meet the aims of the research are collected. Modifying procedures or data collection points in order to fit the research into an exemption category may cause more problems in the long-run, if the data collected for analysis is compromised.

Related resources