Department of Health and Human Services 
 
 
OFFICE OF 
 
INSPECTOR GENERAL 
 
 
 
 
 
B R : 
IOSPECIMEN  ESEARCH  
 
M  B H
EETING  ASIC  UMAN 
 
S  P
UBJECTS  ROTECTION 
 
R
EQUIREMENTS AND 
C
OMMUNICATING 
I R  
NFORMATIONAL  ISKS 
Stuart Wright 
Deputy Inspector General for 
Evaluation and Inspections 
 
November 2013 
OEI-01-11-00520   
EXECUTIVE SUMMARY  BIOSPECIMEN RESEARCH:  MEETING BASIC 
HUMAN SUBJECTS PROTECTION REQUIREMENTS AND COMMUNICATING 
INFORMATIONAL RISKS   
OEI-01-11-00520 
 
WHY WE DID THIS STUDY 
 
A biobank is a repository of biospecimensand, in some cases, associated personally 
identifiable information (PII) and personal health informationto be used for research  
purposes. This research must comply with Federal regulations governing human subjects 
research. An institutional review board (IRB) must review and approve the research, and 
the principal investigator (PI) must obtain informed consent from all potential subjects 
unless the IRB waives the requirement for informed consent.  In addition, informational 
risks (i.e., risks related to PII or personal health information), such as a breach of privacy, 
are magnified because of the long-term electronic storage of the subjects PII and the 
potential for the biospecimens to be used in research not specified at the time of  
collection. Researchers and bioethicists have identified human subjects potential loss of 
privacy and confidentiality as a challenge to research that involves biospecimens. 
 
HOW WE DID THIS STUDY  
 
We reviewed 71 studies at 32 institutions that met our inclusion criteria.  We assessed 
relevant informed consent documents and IRB documents for compliance with certain 
requirements for human subjects protections, as well as additional measures contained in 
these documents to address informational risks. We also surveyed PIs and IRBs from the 
institutions that conducted the research.   
 
WHAT WE FOUND 
 
Informed consent documents for biospecimen research contained required information on 
human subjects protections, but varied in their substance and form.  IRBs met basic 
requirements for membership and continuing review.  Some IRBs and PIs took steps to 
address the informational risks of collecting biospecimens and storing them for future 
research. IRBs and PIs identified challenges in conducting and overseeing research 
involving biospecimens, such as determining how much information to share with human 
subjects, determining how biospecimens should be stored for future use, and dealing with 
the slow pace of change for regulations governing this type of research. 
 
WHAT WE RECOMMEND 
 
We recommend that the Office for Human Research Protections (OHRP) provide a forum  
to IRBs and PIs for discussing informational risks to human subjects.  OHRP concurred 
with our recommendation.    
   
TABLE OF CONTENTS 
 
Objectives ....................................................................................................1 

Background..................................................................................................1 

Methodology................................................................................................6 

Findings......................................................................................................10 

Informed consent documents for biospecimen research contained   

required information on human subjects protections, but varied                 

in their substance and form............................................................10 

IRBs met basic requirements for membership, initial review, and 
continuing review...........................................................................13 

Some IRBs and PIs took steps to address the informational risks 

associated with collecting biospecimens and storing them for             

future research................................................................................14 

IRBs and PIs identified challenges in conducting and overseeing 

research involving biospecimens ...................................................18 

Conclusion and Recommendation  ............................................................20 

Agency Comments and Office of Inspector General Response .....22 

Appendix....................................................................................................23 

Agency Comments.........................................................................23 

Acknowledgments......................................................................................25 

 
   
OBJECTIVES 
For research that includes the collection of biospecimens, to determine the 
extent to which  
 
1. 	  informed consent documents comply with human subjects 

protection regulations, 

 
2. 	  Institutional Review Boards (IRBs) comply with regulations, and 
 
3. 	  principal investigators (PIs) and IRBs take measures to address 
informational risks (i.e., risks related to human subjects personally 
identifying information (PII) or personal health information).  
BACKGROUND 
Biospecimens, which include blood, plasma, biofluids, and tissue, are 
biological materials that are taken from human subjects enrolled in clinical  
research or that remain from a clinical procedure.  Biospecimens may be 
collected and used for a specific study or stored in a biobank for specified  
or unspecified future research. When stored in a biobank, biospecimens 
may also include associated PII and personal health information.   
According to Federal regulations governing the protection of human 
subjects, research involving PII about living human beings is considered 
human subjects research.  Research with biospecimens that are labeled 
with PII is also considered human subjects research.  In most instances, to  
comply with Federal regulations for human subjects research, an IRB must  
first approve the research protocol and informed consent document, then 
investigators must obtain informed consent from all potential subjects 
unless an IRB has waived the requirement for informed consent.1   
Historically, human subjects in research have been exposed primarily to 
physical risks, such as an adverse reaction to an experimental drug. With 
biospecimen research, informational risks, such as a breach of privacy, are 
magnified because of the long-term electronic storage of the subjects PII 
and the potential for the biospecimens to be used in research not specified 
at the time of collection.  Informational risks include the improper use of 
subjects personal health information or PII to deny health insurance, life 
insurance, or employment.2  The undesired disclosure of research results to 
 
 
1 45 CFR   46.109. 

2 The Genetic Information Nondiscrimination Act of  2008  (P.L. 110-233,  122 Stat. 881) 
 
prohibits employment and health care discrimination under certain conditions. 
 
 
Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520)      1  
 
   
subjects, such as the discovery that an individual is genetically 
predisposed to a disease, is also an informational risk.   Without adequate 
informed consent, subjects may not understand the potential for their 
biospecimens to be used in unspecified future research to which they may 
object.3  One such example is the case of the cancerous tissue removed 
from Henrietta Lacks over 60 years ago.  Processing the tissue led to 
production of the HeLa cell line and provided genetic information, 
including the predisposition to certain diseases on the part of her 
descendants.4      
Public Responsibility in Medicine and Research (PRIM&R), an 
association of medical researchers, including private-sector experts and 
Federal officials, that promotes research ethics, has identified human 
subjects potential loss of privacy and confidentiality (i.e., informational 
risks) in research that uses biospecimens as a challenge to this type of 
research.5   The report also raised concerns about the oversight mechanisms 
for human subjects research, including the lack of a comprehensive 
regulatory framework that addresses biospecimen storage and use.6    
Federal Regulations and Guidance for Human Subject 
Protections 
The Public Health Service Act requires the Department of Health and 
Human Services (HHS) to establish an oversight system for all 
HHS-supported or HHS-conducted research to ensure that the rights of 
human subjects are protected.7  HHSs Office for Human Research 
Protections (OHRP) provides clarification and guidance to researchers, 
IRBs, and institutions on complying with regulations for protecting human 
subjects while conducting HHS-supported or HHS-conducted research.8      
The regulations define research as a systematic investigation, including 
research development, testing and evaluation, designed to develop or 
contribute to generalizable knowledge.9  A human subject is a living 
individual about whom  an investigator conducting research obtains 
 
 
3 The Havasupai Tribe of  Arizona successfully  sued the University of Arizona for using  
tribe members blood samples for research on schizophrenia and depression, among other 
things, without their consent.   See A.  Harmon, Indian Tribe Wins Fight to Limit  
Research of Its DNA, The New York Times, April 21, 2010.   
4 Rebecca Skloot, The Immortal Life of  Henrietta Lacks, Crown Publishers, 2010.  
5 PRIM&R,  Human Tissue/Specimen Banking Working Group,  Part 1, Assessment  and
  
Recommendations, March 2007, p. 16. Accessed at  www.primr.org on August 7,  2013.  

6  Ibid., p. 7. 
 
7  42 U.S.C. 289(a). 

8 OHRP, OHRP  Mission Statement. Accessed at www.hhs.gov/ohrp  on August 12, 2013. 
   
9 45 CFR   46.102(d). 

 
Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520)      2  
 
   
(1) data through intervention or interaction with the individual or 
(2) identifiable personal information.10 No current regulations address the 
unique risks associated with research that includes the collection of human 
biospecimens.  
IRBs.   An IRB is a committee set up to ensure the protection of the rights 
and welfare of human subjects.  Research sites must have an IRB, which 
has the authority to approve, disapprove, or recommend modifications to 
proposed research.11  Among other requirements, IRBs must have at least 
five members, and they must conduct continuing review of research at 
least annually or more frequently on the basis of an assessment of the 
researchs risk.12,13   
Informed Consent. Federal regulations require PIs to obtain informed 
consent from human subjects before they are enrolled in a study unless a 
waiver of consent has been obtained.  Informed consent must be obtained 
under circumstances that provide prospective subjects the opportunity to 
consider whether or not to participate and that minimize the possibility of 
coercion or undue influence. Informed consent documents must describe 
the nature and purpose of the research; state the foreseeable risks arising 
from the study; describe the extent, if any, to which confidentiality of 
records identifying the subject will be maintained; and state that 
participation in research is voluntary.14  IRBs may require that informed 
consent documents include additional information, should the IRBs 
determine that the information would provide additional protections to the 
subjects.15    
Tiered consent and broad consent are two examples of informed consent 
models used for biospecimen research seeking consent for unspecified 
future use of subjects biospecimens.  Tiered consent includes options for 
subjects to decline inclusion of their biospecimens in specific types of 
future research. The broad consent model simply asks subjects to consent 
to all future research.16    
The regulations allow for several exemptions from the requirements for 
informed consent and IRB review.  One such exemption is for research 
 
 
10 45 CFR   46.102(f). 

11 45 CFR   46.109(a). 

12  45  CFR  46.107(a).  

13 45 CFR   46.109(e). 

14 45 CFR   46.116.   

15 45 CFR   46.109(b). 

16  NCI and Office of Biorepositories and Biospecimen Research, NCI Best Practices for 
 
Biospecimen Resources.  Accessed at www.biospecimens.cancer.gov on August 9, 2013.  
 
Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520)      3  
 
   
involving previously collected information or biospecimens from which 
identifiers have been removed.17  In these instances, the research is not 
considered research on human subjects and, therefore, the requirement to 
obtain informed consent is waived. 
The Health Insurance Portability and Accountability Act (HIPAA)  Privacy 
Rule. The HIPAA Privacy Rule protects the privacy of individually 
identifiable health information.18 The rule applies both in research and 
health care settings and applies to covered entities, including researchers 
who work within the entities.19  Researchers may meet Privacy Rule 
requirements by (1) removing PII, (2) obtaining authorization from the 
subject, or (3) obtaining a waiver from an IRB or another institutional 
board established solely to address privacy issues. 20  
Certificates of Confidentiality. The Public Health Act authorizes NIH to 
grant Certificates of Confidentiality to research institutions so that they 
and their researchers may not be compelled by any court to provide any 
identifying information about an individual enrolled in a study.  21  
NIH 
NIH is the largest Federal funder of health research.  Of the 27 NIH 
institutes and centers, 24 make awards that support basic and clinical 
research, research center operations, scientific training and fellowships, 
and construction projects. Fiscal year (FY) 2012 expenditures for 
extramural research awards, which funded research performed by 
non-Federal scientists using NIH money, totaled $21.5 billion.22   Some  
portion of NIH-funded research includes collecting and storing 
biospecimens, but the size of that portion is unknown.   
 
   
 
 
17 45 CFR   46.101(b)(4). 

18 Social Security Act,  11711179, as modified  by P.L. 104-191   104 and 106. 

19 Covered entities are defined as (1) health plans, (2) health care clearinghouses, and 

(3) health care providers that electronically transmit any health information in 
transactions  for which  HHS has adopted billing.  See 45  CFR  160.102(a).   
20  45  CFR  164.502(d), 164.508(a)(1), 164.510,  164.512(i). 

21 NIH, Grants and Funding: Certificates of Confidentiality: Background Information.  

Accessed at http://grants.nih.gov/grants/policy/coc/background.htm. 
 
22 NIH,  NIH Data Book   Research Grants:  Funding by Institute/Center.  Accessed at 
NIH.gov  on March 28, 2013. 
 
Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520)      4  
 
   
Biobanks and Cancer Research at the National Cancer 
Institute  
Part of NIH, the National Cancer Institute (NCI) is the principal Federal 
agency for cancer research and training.23   As part of its responsibilities, 
NCI awards and monitors grants related to the National Cancer Program.  
In FY 2012, NCI issued over 6,000 research grants worth about 
$3.1 billion.24    
Biospecimens are commonly used in cancer research because they contain 
cellular, molecular, genetic, and chemical information that helps scientists 
understand the biology of cancer.  Through this understanding, scientists 
can identify characteristics of cancer that can be targeted by a new 
generation of cancer therapies.25  
Genomics is the study of the functions and interactions of genes in a 
genome.26   The study of human genomics has led to better understanding 
of the role of genetics in cancer and the development of targeted and more 
efficient treatment.  Further advances in this field depend, in part, on 
researchers access to genetic material stored in biobanks.27  
Recent Developments  
Reviews of IRB practices related to research have found that they fell 
short of protecting human subjects and communicating potential  risks.28, 29 
In an effort to update its rules for human subjects protection to reflect 
current research practices, the Department published an advanced notice 
of proposed changes to the rules in July 2011.30   The proposed changes 
included, among other things, (1) determining a format for streamlining 
 
 
23 NCI,  NCI Mission Statement. Accessed at 
http://www.cancer.gov/aboutnci/overview/mission  on October 24, 2013. 

24 NIH,  Table #106, NIH Grants and Contracts Number of Competing and Noncompeting 

Awards and Funding Mechanism and NIH Institutes/Centers Fiscal Years 20022011. 
 
Accessed at www.report.nih.gov on  March 1, 2012. 

25 NCI and  Office of Biorepositories and Biospecimen Research, NCI Best Practices for  
Biospecimen Resources.  
26 A genome is an  organisms complete set of  DNA, including all of its genes.  Definition  
taken from  NIH.gov. Accessed on August 22, 2013. 

27 A.E. Guttmacher and  F.S. Collins, Genomic MedicineA Primer.  New England 

Journal of Medicine, 2002; 347:15121520, November 7, 2002.  

28 Institute of Medicine, The Common Rule and Continuous  Improvement in  Health Care:  
A Learning Health  System Perspective, October 2011.  Accessed at www.iom.edu on  
January 31, 2012.  
29 OIG,  IRBs: A Time for Reform, OEI-01-97-00193,  June 1998. 
   
30 76 Fed. Reg. 4451244530  (July 26, 2011).  See also OHRP, OHRP Regulatory 

Changes in ANPRM.  Accessed at 

http://www.hhs.gov/ohrp/humansubjects/anprmchangetable.html  on October 28, 2013. 
    
 
Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520)      5  
 
   
informed consent documents so that subjects providing biospecimens may 
opt in or out of future research and (2) establishing universal data-security 
measures similar to those found within HIPAA.31      
In October 2012, the Presidential Commission on the Study of Bioethical 
Issues released a report highlighting privacy concerns associated with 
whole-genome sequencing.  The report emphasized the continued benefit 
of advances in genomic sequencing for society, but also raised concerns 
about privacy, the potential misuse of information, and unanticipated 
results reported to subjects from  future research.  Although the report 
concentrated on whole-genome sequencing, the Commissions findings 
and recommendations were also directed more broadly at large research 
projects that use genetic data. 32  
In January 2013, a study from the Massachusetts Institute of Technologys 
Whitehead Institute highlighted vulnerabilities with stored biospecimens 
by using publicly available data to identify previously de-identified 
subjects enrolled in a genomic sequencing study.33  
After genetic researchers mapped the genome for the HeLa cell line and 
made the information public in March 2013, the family of Henrietta Lacks 
raised concerns about its privacy.34 In August 2013, NIH responded to 
these concerns by providing the Lacks family with some control over how  
the genomic data would be used in future research.  The series of events 
highlighted the need for broader policy addressing privacy of human 
subjects enrolled in research involving biospecimens, as well as that of 
their families, and the importance of communicating the potential 
commercial aspects of the research to human subjects.35   
METHODOLOGY 
Scope 
We reviewed  71 studies (at 32 institutions) that (1) either were active in 
2012 or were completed in 2011, (2) were funded by NCI extramural 
 
 
31  76  Fed.  Reg. 44515 (July 26, 2011). 

32 The Presidential Commission for the Study  of Bioethical Issues,  Privacy and Progress 
 
in  Whole Genome Sequencing, October  2012.  Accessed at http://www.bioethics.gov on 
 
April 23, 2013. 

33 M. Gymrek, A.L. McGuire, D. Golan, E. Halperin, and Y. Erlich, Identifying Personal 

Genomes by Surname Inference, Science, Vol.  339, January 18, 2013. 
 
34 J.J.M. Landry  et al., The Genomic and Transcriptomic Landscape of a HeLa Cell 
 
Line, Genes Genomes Genetics, March 2013.  Accessed  at g3journal.org  on August 13, 

2013. 
 
35 Carl Zimmer, A Family Consents to a Medical Gift, 62 Years Later,  The New York 

Times, August 7, 2013. 
 
Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520)      6  
 
   
grants or cooperative agreements, (3) were human subjects research as 
defined by regulations, and (4) involved the collection of biospecimens.   
We used ClinicalTrials.Gov, an NIH-maintained registry of federally and 
privately supported clinical research studies, to identify the 71 studies in 
our review.  Because information on biospecimen collection is not 
systematically gathered, we identified the clinical trials in our review 
through an optional database field indicating biospecimen retention.   
Our initial inquiry identified 86 studies, 10 of which were waived from the 
requirements for human subjects research and therefore did not have 
informed consent documents.  We excluded five others that did not meet 
our inclusion criteria.  
We assessed informed consent documents and IRB documents for 
compliance with certain requirements for human subjects protections.   
Our analysis of the informed consent documents focused on the following 
four basic required elements: 
   a statement of the nature and purpose of the study; 
   a description of any reasonably foreseeable risks or discomforts to 
the subjects;  
   a statement describing the extent, if any, to which confidentiality of 
records identifying the subjects will be maintained; and  
   a statement that participation is voluntary. 36  
Our evaluation of IRBs focused on three requirements: 
   that IRBs have at least five members, 
   that IRBs conduct initial review of research, and  
   that IRBs conduct continuing review of research at least annually 
or more frequently on the basis of research risk.  
Data Sources and Collection  
Research Protocol and Informed Consent Documents. We requested the 
research protocol, informed consent documents, and IRB chairpersons 
contact information from the PI of each of the 71 studies in our study 
population. We received all the protocols and informed consent 
documents that we requested.    
 
 
36 45 CFR   46.116. 
 
Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520)      7  
 
   
IRB Documents. We requested IRB rosters, as well as documentation of 
both initial and continuing review from the IRB chairpersons overseeing 
the studies in our study population.  Where institutions had multiple IRBs 
for different types of research, we reviewed only the IRB responsible for 
overseeing the study in question. We received IRB rosters from 31 of the 
32 institutions in our population, documentation of initial review from  
68 of the 71 studies in our population, and documentation of continuing 
review for 70 of the 71 studies.   
Survey of Principal Investigators. We surveyed the PIs conducting the 
studies in the population. We contacted the PIs by email and included a 
link to an online questionnaire.  This  questionnaire addressed PIs training 
on human subjects protections and on institutional policies and resources 
for collecting and storing biospecimens; the guidance that PIs have used in 
these areas; and their experiences conducting this type of research.  
Additionally, we asked about their perceptions of this type of research and 
challenges they experienced in conducting it.  We sent the questionnaire to 
76 PIs for whom we had email addresses.37  Sixty PIs completed the 
questionnaire. 
Survey of IRB Chairpersons.  We surveyed IRB chairpersons overseeing 
the studies in the study population. We contacted them by email and 
included a link to an online questionnaire.  The questionnaire addressed 
training and guidance related to human subjects protections and the IRB 
chairpersons experiences overseeing research that includes collecting and 
storing biospecimens.  We also asked about challenges in overseeing this 
type of research. We sent the questionnaire to 47 IRB chairpersons at the 
32 institutions in the study population.  Thirty-two chairpersons from  
twenty-four unique institutions completed the questionnaire. 
Interviews With Representatives From Research Institutions.  We  
interviewed PIs, IRB chairpersons, and other research personnel at two 
institutions. We chose the institutions because both are large, well-known 
cancer research institutions.   
Analysis  
We analyzed the informed consent and IRB documents to determine 
whether they met requirements for human subjects and how they 
addressed unique issues associated with this type of research, such as 
 
 
37 At the time we sent the questionnaire, we had 76 studies in  our study  population.  Five  
studies were eliminated at a later date because we determined that they did not meet our 
inclusion criteria. 
 
Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520)      8  
 
   
informational risks, future research, and sharing research results with 
human subjects.   
Limitations 
Our ability to identify studies that met our criteria was limited by the 
extent to which ClinicalTrials.Gov included optional, self-reported data. 
We did not determine whether IRBs met the requirement for expertise.  
Instead, we described measures IRBs took to meet that requirement. 
Finally, we did not independently verify the data PIs and IRB chairpersons 
reported to us in the survey. 
Standards 
This study was conducted in accordance with the Quality Standards for 
Inspection and Evaluation issued by the Council of the Inspectors General 
on Integrity and Efficiency.   
 
Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520)      9  
 
   
FINDINGS 
Informed consent documents for biospecimen 
research contained required information on human 
subjects protections, but varied in their substance
and form  
All 71 informed consent documents described the nature and purpose of 
the research, generally at the beginning of the documents.  In some  
instances, the descriptions of the research appeared as bulleted text; in 
other instances, the descriptions contained additional detail (sometimes 
extending to several pages) and included scientific language.  (For 
examples of the two different types, see Figure 1.) 
 
Figure 1:  Examples describing nature and purpose of research, taken 
from two informed consent documents  
 
Example 1  
This research has three  components:  
 
 the collection of tissue samples for research purposes  
   the use and sharing of  data about you and  your transplant to improve   
outcomes 
    permission to follow you lifelong  regarding your  health and well-being 
 
 Example 2   
You are being  asked to participate in a research study to look at the levels of certain 

 
enzymes (proteins that are made  by the body to limit or  prevent changes in the 

makeup of  the bodys cells), as well as oxidative DNA damage  (changes to the 

 
bodys DNA when the cells are deprived of  oxygen).  DNA  is the repository of  

 hereditary characteristics such as what color of eyes a person  will have.  These 

changes in proteins and DNA occur in all people over their lifetimes, but are more 

 pronounced in some people than in others.  This study will measure some of these 

changes in subjects who are considered at  high risk  for developing  prostate  cancer
  
 due to certain existing conditions, compared with subjects who are considered 

healthy. 
 
 
Source:  OIG analysis of informed  consent documents, 2013. 
In all instances, protecting patient information and maintaining 
confidentiality appeared in clearly marked sections of the informed 
consent documents.  The level of detail in some forms described steps that 
would be taken to protect participants, such as coding or encryption.  
Other forms cited HIPAA and indicated how that law applies or contained 
its relevant language. (For examples of the language on protecting 
confidentiality, see Figure 2.) 
   
 
Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520)      10  
 
   
Figure 2: Examples of Language on Protecting Confidentiality   
 
Example 1  
  Your specimen, information  from the specimen, and your medical information  will 

be  distributed to  researchers at this or other institutions labeled with a unique 

 
laboratory code number.  Your personal identifying information  will not be sent to  

o ther researchers.  Only the Principal Investigator and their research staff will have  

access to the link between the code and your name.  You will sign a separate HIPAA 

a uthorization form for review of your medical records information by Tissue 

Procurement personnel who are trained to maintain strict confidence.  All 

i nformation obtained  by [institution  name] is stored and  released  under conditions  

designed to protect the privacy of study participants. 

 
 
Example 2  
 
Your protected health information will be protected according to state and federal 
 
law.   However, there is no  guarantee that your information will remain confidential, 

 
and it may be re-disclosed at some point. 

  
Example 3   
Y our identity will be  kept as confidential as possible as required  by law.  Except as 

required  by law, you will not be identified  by name, social security number, address, 

t elephone number, or any other direct  personal  identifier.  Your  research records may 
 
be disclosed outside of  [institution name], but in this case, you  will be identified  only 

 
by a unique code  number.  Information about the code  will be  kept in a secure 

location  and access limited to  research study  personnel. 
   
 
Source:  OIG analysis of informed  consent documents, 2013. 
All informed consent documents included some description of risk and 
discomfort.  However, studies that included the noninvasive collection of 
biospecimens listed fewer physical risks because they simply followed the 
subjects health over time and did not involve additional medical 
intervention or collection of biospecimens.  Other studies included 
biospecimen retrieval, such as cancerous lung tissue, that required a 
procedure for removal and had greater physical risks.  Informed consent 
documents for genetic research that did not require a procedure to collect 
the biospecimens listed lower physical risks.  (See Figure 3 for examples 
of informed consent documents descriptions of risk and discomfort.) 
     
 
 
 
 
 
 
       
 
Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520)      11  
 
   
     Figure 3:  Examples of Language on Risks and Discomfort  
 
Example 1  
Some questions in the questionnaire may be sensitive.  You may refuse to answer 
 
any questions that make you feel uncomfortable.  Participants who have concerns 
  after completing this questionnaire are encouraged to contact their physician  or the 
study doctor.  
   
Example 2  
  Infection and/or bleeding are always possible when the skin is  broken ....  About  1%  
of patients have serious problems from an internal biopsy.  These problems include 
 
internal bleeding which may require a blood transfusion  or  surgery to correct, a 
collapsed lung, injury to the intestines, gallbladder or  kidneys, and infection  of the 
 
abdominal cavity.  You may have an allergic  reaction to the numbing medicine. This  
reaction may be mild, such as a skin  rash, or  you may have more severe symptoms  
 
like throat tightness, low blood pressure, and it  may be hard to  breathe.  In  rare  
cases, a severe reaction could cause death. 
 
 
  Example 3  
The greatest risk is breach of confidentiality.    
 
Source:  OIG analysis of informed  consent documents, 2013. 
Finally, all informed consent documents stated that participation was 
voluntary.  Some communicated at the beginning of the document that the 
research was voluntary.  In these instances, the documents often stated that 
the subject was being asked to enroll in research and could withdraw at 
any time.  In other documents, the statement that the research was 
voluntary directly followed a description of the nature and purpose of the 
research. Other informed consent documents contained a separate section 
that addressed the voluntary nature of the research.  (For examples of the 
language regarding the voluntary nature of the research, see Figure 4.)  
Figure 4: Examples of Informed Consent Language Regarding Voluntary  
Nature of Research  
  
Example 1  
You are being asked to take part in a research study.  To  join the study is  voluntary.    
 
You may refuse to  join, or you may withdraw your consent to  be in the study, for any 
 reason. 
 
 Example 2  
DO I  HAVE TO TAKE PART IN THE STUDY? 
 
 The choice to take part in this study or  not is yours.  Make your choice based on what 
 
we  have explained to you and what you  have read about the study.   

 
Taking  part is  completely voluntary and up to you. 
   
 
 
Source:  OIG analysis of informed  consent documents, 2013. 
 
 
Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520)      12 
 
   
IRBs met basic requirements for membership, initial
review, and continuing review 
We received 31 IRB rosters from 32 institutions in the study population, 
and all of those met the minimum requirement of 5 members.   The number 
of members reached as high as 40 and averaged 17 members.   
We received documentation of initial review for 68 of the 71 studies in the 
population of continuing review for 70 of the 71 studies.  All of those met  
the minimum requirement for continuing review.  Twenty-six of thirty-two  
IRB chairpersons who responded to our survey reported taking additional 
measures to protect human subjects during continuing review.  These 
measures include updating informed consent documents as new risks 
arose, auditing logs that document how biospecimens were shared, and 
conducting routine site visits to ensure that biospecimens were being used 
according to the IRB-approved protocol.  
IRB chairpersons who responded to our survey and those we interviewed 
provided information on how their IRBs address the requirement for 
expertise of their members.  It is up to each IRB to determine its operating  
structure to ensure that members have expertise for reviewing research.  
All the chairpersons who responded to our survey said that they require 
members to receive training on human subjects protection.  Some IRBs 
use subcommittees to address different types of research, such as 
biomedical research.  Others seek out expertise that may be lacking within 
the IRB. For example, one IRB chairperson we interviewed told us that he 
consults with information technology (IT) staff on a case-by-case basis 
when informational risks to subjects are elevated because of storing PII, 
rather than having someone with such expertise as a permanent part of the 
committee.  Another chairperson reported integrating an IT risk 
assessment as a formal part of his IRBs review process.   
In addition, 25 of 32 IRB chairpersons who responded to our survey 
reported that their IRBs require members to attend training on 
informational risks.  Six respondents said that the IRB itself provides 
educational opportunities both for IRB members and investigators on 
topics related to informational risk, as well as on administering informed 
consent. Four respondents said they developed guidance specifically for 
investigators conducting biospecimen research and IRB members 
overseeing such research. The guidance these respondents developed 
includes guidelines for conducting biospecimen and genetic research, 
conducting genome-wide association studies,  and determining what to 
disclose in informed consent documents for genetic research. 
 
Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520)      13  
 
   
Some IRBs and PIs took steps to address the
informational risks of collecting biospecimens and 
storing them for future research 
IRBs and PIs both play important roles in communicating informational 
risks as the informed consent documents are developed, reviewed, and 
approved. This process starts during the initial review, when the IRB 
reviews the study protocol and informed consent document and requests 
modifications, if appropriate. Our analysis of the 68 initial review 
documents demonstrates that at times, IRBs recommended modifications 
to the informed consent documents.  These modifications varied and 
included clarification on how biospecimens would be stored and used in 
the future and when it might be appropriate to contact the relatives of a 
subject diagnosed with cancer (see Figure 5). 
Figure 5: Example of IRB-Requested Modifications to Informed Consent 
During Initial Review  
 
Example 1  
 
Revise the [informed consent  document] and/or protocol and Abstract to clarify  
 whether agreement to donate residual tissue is an eligibility requirement or an option.   
It cannot be both.  
  
Example 2  
 The [relevant committee] recommended that  you review the consent form under 
reference, in particular the risks of genetic counseling.   
 
Source:  OIG analysis of informed  consent documents, 2013.  
 
Almost all IRB chairpersons32 of 33stated that they had required 
modifications to a research protocol to address these informational risks.  
Further, 24 of 60 PIs reported that IRBs had required changes to their 
study documents.38  
Informational risks to subjects were included in 58 of the 
71 IRB-approved informed consent documents   
Fifty-eight of the seventy-one IRB-approved informed consent documents 
described informational risks associated with biospecimen research, 
including breaches of confidentiality and the consequences and learning 
potentially sensitive results from genetic research (see Figure 6).  These 
risks generally appeared within the sections of the informed consent  
 
 
38 The term study documents refers to the research protocols and informed consent  
documents. 
 
Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520)      14  
 
   
documents addressing nature and purpose of the research or the sections 
addressing physical risks and discomforts. 
 
Figure 6: Informational Risks Addressed in Informed Consent Documents  
(n=71) 
Informed  consent 
13 
documents  that  did 
address  informational 
risks 
Informed  consent 
documents  that  did  not 
address  informational 
58 
risks 
 
 
Source:  OIG analysis of informed  consent documents, 2013. 
The long-term storage of biospecimens and their associated data may 
heighten the risk of a breach of confidentiality.  For example, a breach 
could involve unauthorized access to personal health information; loss or  
misplacement of data-storage devices, such as laptop computers; or the 
interception of private information transmitted over the Internet.   
Breaches could result in human subjects information being used against 
them, and 52 of the 71 informed consent documents discussed this risk.  
For example, the potential exists for genetic information to be used to 
deny health insurance or life insurance or to claim or deny paternity.  
Figure 7 shows how one IRB-approved informed consent document 
informs human subjects of this risk. 
 
 
 
 
 
 
 
 
 
   
 
Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520)      15  
 
   
Figure 7: Example Describing the Consequences of a Breach of 
Confidentiality  
 
 
The greatest risk  of sharing your genetic information is the possible loss of your 
 
privacy.  Although  no identifiable (name, address, etc.) information will be  given to 
th e National Institutes of Health (NIH, the federal government agency that stores 
ge netic information), the possibility exists that your genetic information may be  
ta ken, used for reasons outside of this project, and in the future be used to identify 
you. If your  genetic information is linked back to you in the future, it may be  used  by  
 
employers and insurance agencies to discriminate against you, or by law enforcement 
 
to link you, or  one of your  family  members, to a crime.  
 
 
Source:  OIG analysis of informed  consent documents, 2013. 
 
Biospecimen research also could identify sensitive results from a genetic 
test. Disclosing this information may be undesirable or upsetting to a 
human subject.  An example of such a risk is learning that one has a 
genetic predisposition to Alzheimers disease but can do nothing to 
decrease the chances of developing it.  Twenty-one of the informed 
consent documents we reviewed indicated that research results may be 
shared with subjects. Of those, 6 indicated that research results would be 
shared with the subjects unconditionally; the other 15 indicated that results 
would be shared with the subject only under certain conditions, such as the 
receiving of genetic counseling by the subject. 
In some cases, informed consent documents described legal protections 
designed to protect subjects (see Table 1).  For example, 18 of the 
71 informed consent documents described certificates of confidentiality.  
These informed consent documents described potential consequences of 
releasing private information to an employer or insurer and the ways in 
which a certificate protects subjects from that risk.  Similarly, 13 of the 
71 informed consent documents describe how the Genetic Information 
Nondiscrimination Act protects individuals from inappropriate use of their 
genetic information. 
 
In other cases, the informed consent documents disclosed how research on 
the collected biospecimens might lead to commercial products.  For 
example, 37 of 71 informed consent documents addressed the potential for 
a commercial product while also stating that the subjects would not 
receive any financial benefit. 
 
 
   
 
Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520)      16  
 
   
Table 1: Informational Risks and Related Issues Addressed in Informed 
Consent Documents  
   
 
Issue Addressed  Number of Informed 
Consent Documents* 
   
Informational Risks (in General)   58 
Specific Informational Risks   
Breach of Confidentiality  52 
Learning Potentially Sensitive Results from Genetic Research  21 
   
   
Possibility of a Commercial Product with No Financial Benefit for Subject   37 
   
Research Institution Has an NIH-Granted Certificate of Confidentiality  18 
   
How  the Genetic Information Nondiscrimination Act Protects Subjects  13 
 
 
*Each informed  consent document may include one or more of these elements. 
 
Source:  OIG analysis of informed  consent documents, 2013. 
 
About two-thirds of informed consent documents provided 
human subjects with some control over how their 
biospecimens would potentially be used 
Forty-nine of the seventy-one informed consent documents allowed 
subjects to select the specific types of research in which they would like to 
participate, while opting out of other types of research.   This approach, 
called tiered consent, gives human subjects a degree of control over the 
types of research for which their biospecimens are used.  For example, 
tiered consent might permit one subject to opt in for cancer research but 
opt out of research on Alzheimers disease, while permitting another 
subject to choose to participate in all types of research.  Tiered consent 
could also include a provision for a subject to indicate whether he/she 
would like to be contacted about future research.  (See Figure 8 for 
examples of informed consent language under a tiered consent 
framework.)         
 
 
 
 
 
 
 
 
   
 
Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520)      17  
 
   
Figure 8: Examples of Language for Tiered Informed Consent 
  
Example 1  
My specimens may be kept for use in research to learn about, prevent,  or treat HIV.  
 
 
 Yes __     No__ 
 
 My specimens may be kept for use in research to learn about, prevent,  or treat other 

health  problems such as human  papillomavirus (HPV) infections and anal or genital 

 cancer. 
 
 
 
Yes ___   No  ___ 
 
 
Someone may  contact me in the future to ask me to take part in more research.  
 
 
Yes ___   No  ___ 
 
 
Example 2  
I elect to___ or  not to___ have  leftover blood and tissue specimens stored in  a tissue 

 
bank for optional studies. 

 Participants initials ___ 
 
 I elect to___ or  not to___ have  the results of any future research disclosed to  me.  
Participants initials ___  
  
I elect to___ or  not to___ provide contact information  on the attached page for 

 
relatives to be  contacted about the study. 

Participants initials ___ 
Source:  OIG analysis of informed consent documents, 2013. 
 
 
Source:  OIG analysis of informed  consent documents, 2013. 
 
 
IRBs and PIs identified challenges in conducting and 
overseeing biospecimen research 
In conducting research, PIs and IRBs must balance the competing 
demands of protecting human subjects and making scientific progress.  All 
respondents seemed to recognize those competing demands.  They face 
challenges in achieving that balance. 
First, PIs identified a challenge in determining the level of detail to 
provide to potential subjects about the various risks associated with 
participating in biospecimen research.  Their concern was that providing 
extensive detail could deter subjects from participating.  Not only can such 
an explanation be time-consuming, but it also can raise potential subjects  
concerns about risks that they might face should they decide to participate.  
As one principal investigator stated, [The] primary challenge is 
recruitment resulting in fewer subjects enrolled than expected.   The 
 
Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520)      18  
 
   
informed consent form is long, arduous, and implies greater risk than is 
realistically present. 
Second, storing biospecimens for future use and controlling access to them 
also presents challenges, especially for individual PIs.  Of the 51 PIs who 
responded to our question as to who controls distribution of their 
biospecimens, 23 PIs said they themselves did, 18 said IRBs did, and        
4 said the institutions research management office did.  Tracking PII 
associated with the biospecimens can be handled with a simple 
spreadsheet or a sophisticated database, but the challenge is ensuring that 
the PII is secure. In addition, monitoring the distribution and associated 
level of consent for each biospecimen can be difficult.  Furthermore, 
repositories need emergency alarms and, to safeguard the biospecimens in 
the event of a power failure, backup power systems.  Purchasing and 
maintaining these systems can be costly, and such costs are borne more 
easily by institutions than by individual PIs.  
Third, the rapid pace of change in biospecimen research and the slower 
pace of regulatory and policy changes can create uncertainty.  One IRB 
chairperson captured this uncertainty when he told us, We are left to 
apply generic regulatory standards to a very specific and often confusing 
type of research, which can be difficult.  Among the 32 IRB chairpersons 
who responded to our survey, 8 cited a lack of clarity in Federal 
regulations as a challenge in overseeing research that includes collecting 
biospecimens.  On the other hand, 55 of 60 PIs responding to our survey 
stated that regulations clearly articulate what is expected of them as 
researchers.   
   
 
Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520)      19  
 
   
CONCLUSION AND RECOMMENDATION 
As the field of biospecimen research advances, researchers are using the 
existing and familiar human subjects protection system to inform human 
subjects about risks. Overall, our evaluation found that informed consent 
documents met the basic requirements for human subject protections; in 
addition, IRBs met basic requirements for membership, initial review, and 
continuing review. 
The majority of informed consent documents addressed the informational 
risks of biospecimen research.  These include breaches of confidentiality  
and learning about potentially sensitive results from genetic research.  The 
majority of informed consent documents also gave subjects some control 
over how their information will be used in future research.  
Researchers and IRBs involved in biospecimen research are trying to 
address challenges regarding how much information to share with 
potential subjects, how to store and share biospecimens, and how to deal 
with a regulatory system that progresses at a slower pace than scientific 
research. 
Because the field is in flux and the regulatory system moves slowly, the 
research community has much discretion in determining how to address 
these challenges.  The Department is also working to address challenges 
with human subjects research protections, having issued an advance notice 
of proposed rulemaking in July 2011.   
In 2012, the Presidential Commission on the Study of Bioethical Issues 
released a report that raised concerns about privacy, the potential misuse 
of information, and unanticipated results reported to subjects from future 
research. More recently, in January 2013, that Commission announced 
that it would examine what patients and participants are told by health care 
professionals not only after a procedure or a test  is performed, but also 
before, as part of the informed consent process.  
Determining how to communicate informational risks to human subjects 
will be a challenge, but doing so effectively will be an important 
contribution to scientific advancement.  To facilitate this process, we 
recommend that OHRP: 
Provide IRB members and investigators with a forum for 
discussing informational risks to human subjects  
Federal regulations require that informed consent documents include a 
statement of the foreseeable risks arising from the study.  Historically, 
human subjects enrolled in clinical research have been exposed primarily 
to physical risks, such as an adverse reaction to an experimental drug.    
 
Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520)      20  
 
   
More recently, researchers ability to collect and store information from  
biospecimens has raised concerns about informational risks that may arise 
from clinical research.  These risks, such as a breach of privacy, are 
magnified because of the long-term electronic storage of the subjects PII 
and personal health information, and the potential for biospecimens to be 
used in research not specifiedor even envisionedat the time of their 
initial collection. 
OHRP could help ensure that IRB members and investigators address 
informational risks in biospecimen research by providing them with a 
forum for discussing challenges and best practices related to 
communicating these risks. Considering such risks would help provide 
additional protections to subjects who enroll in studies that would include 
the collection and future use of biospecimens.  Possible approaches 
include an online forum, Webinars, an OHRP-sponsored conference, or 
presentations at other scientific meetings.     
 
   
 
Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520)      21  
 
   
AGENCY COMMENTS AND OFFICE OF INSPECTOR GENERAL  
RESPONSE 
OHRP concurred with our recommendation to provide IRB members and 
researchers with a forum for discussing informational risks to human 
subjects. It highlighted past efforts as well as plans to provide a forum to  
discuss informational risks with relevant stakeholders at upcoming 
regional and national conferences.  OHRP also emphasized the 
informational risks present in research for which IRBs have issued waivers 
from the requirement to collect informed consent.  Although permitted by  
human subjects regulations, such waivers prevent human subjects from  
being fully advised of those informational risks.    
 
 
 
 
 
   
 
Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520)      22  
 
   
APPENDIX A 
     Agency Comments 
 
 
 
Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520)      23
  
 
  Agency Comments (Continued) 
Page 2 - lns1x:ctor General 
We concur with the OIG Report'~ recommendation that the Onice for Human Research 
l'rotections (OHRP) should provide a forum for IRB members and investigators to  ddrcss 
informational risks in biospecirncn research.  Indeed. OHRP has already provided such fora on a 
number <>f occasions, and \\ill continue to do so. In March of20ll, the Secretary's Advisory 
Committee on Human Research Protections (SACHRP) held a panel on the topic of returning 
indtvidual results to subj~.-cts, which is or1c elc:ment of the issue . .In October of2011. SACHRP 
submitted recommendation.~ titled FAQs, Terms and Recommendations on informed Consent and 
Research Use of!Jiuspcc/mens.  In October of20ll SACHRP also included comments related to 
informed consc;1t and biospecimen research in Its comments on the Advance Notice of Propo <ed 
Rulcmaking of July, 2011 titled lluman !mbjects ReJearch Protections< Enhancing Protections 
f or Researclr Subjt~CIJ< and Ruducing Burden. Delay, and Ambigullyfor lmestlga/ors.  We expect 
that SACHRP will return to this tssuc in the near future.  In October of this year, OHRP will 
sponsor a wcbinar titled !Jit,banking  When Issues with Tissues Com a 'Knocldn' us part of its 
webinar seric.S; these webinars an: recorded and are al so viewable on YouTube aflcr they 
happe n. ;\nd in October the L~su  will also be addrcJ.sc<l ru; part of the program ofan OIIRP 
Research Community Forum titled Innovative Straugies. Taking the J'rott~ctiott ofHuman 
Subje,to~ to 1/te Nex tl.evel, in Nashville, 1c nncsscc . We fully expect other future Re$earch 
Community Fora to include this topic . And finally, 0! IRl' staO'working with the platming 
committee-S of tho.: annual meetin&of Public Rcsponsihility in Medicine atld Rcs.:u.re h have 
ensured that this issue: will also be part of the program of this year's meeting in November. 
OHRP will certainly look for other opportunities to advance discu~sion of thi topic as well. 
Thank you for the opportunity to comment on the drafl Report.  Please feel free to tontact me if 
you hav..: any questions. 
Howard K. Koh, M.D., 1\l.P.II. 
Biospecimen Research : Human Subjects Requirements and Informational Risks (OEI-01-11-00520)  24   
 
ACKNOWLEDGMENTS 
This report was prepared under the direction of Joyce Greenleaf, Regional 

Inspector General for Evaluation and Inspections in the Boston regional 

office, and Deputy Regional Inspectors General Russell Hereford and 

Kenneth Price. 

Christopher Galvin served as the team leader for this study, and 

Elizabeth Havener served as the lead analyst.  Central office staff who 

provided support include Heather Barton, Althea Hosein, Christine Moritz, 

and Talisha Searcy. 
 
 
Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520)      25  
 
   
Office of Inspector General
http://oig.hhs.gov  
 
The mission of the Office of Inspector General (OIG), as mandated by Public Law 95-452, as  
amended, is  to protect the integrity of the Department of  Health and Human Services  
(HHS)  programs, as well as the health and welfare of beneficiaries  served by those 
programs.  This statutory mission  is  carried  out through  a nationwide network  of  audits, 
investigations, and inspections conducted by the  following operating components: 
Office of Audit Services 
The Office  of  Audit Services  (OAS) provides auditing services  for HHS, either by  conducting  
audits  with its own audit resources or by  overseeing  audit work done by others.  Audits  
examine the performance of HHS programs and/or its grantees and contractors in carrying  
out their respective responsibilities and are intended  to provide independent assessments of 
HHS programs and operations.  These assessments help reduce waste, abuse, and  
mismanagement and promote economy and efficiency  throughout  HHS. 
Office of Evaluation and Inspections 
The Office  of  Evaluation and Inspections (OEI)  conducts national evaluations to  provide 
HHS, Congress, and the public with timely, useful, and reliable information on significant 
issues.  These evaluations focus on preventing fraud,  waste, or abuse  and promoting  
economy, efficiency, and effectiveness of departmental programs.  To promote impact, OEI 
reports also present practical recommendations for improving program operations.  
Office of Investigations 
The Office of Investigations (OI) conducts criminal, civil, and administrative investigations  
of  fraud and misconduct  related to HHS programs, operations, and beneficiaries.  With 
investigators working in all 50 States and the District of Columbia, OI  utilizes its resources 
by actively  coordinating with the Department  of Justice  and other Federal, State, and local 
law enforcement authorities.  The investigative efforts of OI often lead to  criminal 
convictions, administrative sanctions,  and/or  civil monetary  penalties.  
Office of Counsel to the Inspector General 
The Office of Counsel to the  Inspector  General (OCIG) provides general legal services to 
OIG, rendering  advice and opinions on HHS programs  and operations and providing all 
legal support for OIGs  internal operations.  OCIG represents  OIG in all civil and 
administrative fraud and abuse cases involving HHS programs,  including False Claims Act, 
program exclusion, and civil monetary penalty cases.  In  connection with these cases, OCIG 
also negotiates and monitors corporate integrity agreements.  OCIG renders advisory 
opinions, issues compliance program  guidance, publishes fraud alerts, and provides other  
guidance  to  the health care industry concerning the anti-kickback statute and other  OIG  
enforcement authorities.