Department of Health and Human Services 

OFFICE OF 

INSPECTOR GENERAL 

BIOSPECIMEN RESEARCH: 

MEETING BASIC HUMAN 

SUBJECTS PROTECTION 

REQUIREMENTS AND 

COMMUNICATING 

INFORMATIONAL RISKS 

Stuart Wright 

Deputy Inspector General for 

Evaluation and Inspections 

November 2013 

OEI-01-11-00520 
 

EXECUTIVE SUMMARY – BIOSPECIMEN RESEARCH: MEETING BASIC 

HUMAN SUBJECTS PROTECTION REQUIREMENTS AND COMMUNICATING 

INFORMATIONAL RISKS 

OEI-01-11-00520 

WHY WE DID THIS STUDY 

A biobank is a repository of biospecimens—and, in some cases, associated personally 

identifiable information (PII) and personal health information—to be used for research 

purposes. This research must comply with Federal regulations governing human subjects 

research. An institutional review board (IRB) must review and approve the research, and 

the principal investigator (PI) must obtain informed consent from all potential subjects 

unless the IRB waives the requirement for informed consent. In addition, informational 

risks (i.e., risks related to PII or personal health information), such as a breach of privacy, 

are magnified because of the long-term electronic storage of the subjects’ PII and the 

potential for the biospecimens to be used in research not specified at the time of 

collection. Researchers and bioethicists have identified human subjects’ potential loss of 

privacy and confidentiality as a challenge to research that involves biospecimens. 

HOW WE DID THIS STUDY 

We reviewed 71 studies at 32 institutions that met our inclusion criteria. We assessed 

relevant informed consent documents and IRB documents for compliance with certain 

requirements for human subjects protections, as well as additional measures contained in 

these documents to address informational risks. We also surveyed PIs and IRBs from the 

institutions that conducted the research. 

WHAT WE FOUND 

Informed consent documents for biospecimen research contained required information on 

human subjects protections, but varied in their substance and form. IRBs met basic 

requirements for membership and continuing review. Some IRBs and PIs took steps to 

address the informational risks of collecting biospecimens and storing them for future 

research. IRBs and PIs identified challenges in conducting and overseeing research 

involving biospecimens, such as determining how much information to share with human 

subjects, determining how biospecimens should be stored for future use, and dealing with 

the slow pace of change for regulations governing this type of research. 

WHAT WE RECOMMEND 

We recommend that the Office for Human Research Protections (OHRP) provide a forum 

to IRBs and PIs for discussing informational risks to human subjects. OHRP concurred 

with our recommendation. 
TABLE OF CONTENTS 

Objectives ....................................................................................................1 

Background..................................................................................................1 

Methodology................................................................................................6 

Findings......................................................................................................10 

Informed consent documents for biospecimen research contained 

required information on human subjects protections, but varied 

in their substance and form............................................................10 

IRBs met basic requirements for membership, initial review, and 

continuing review...........................................................................13 

Some IRBs and PIs took steps to address the informational risks 

associated with collecting biospecimens and storing them for 

future research................................................................................14 

IRBs and PIs identified challenges in conducting and overseeing 

research involving biospecimens ...................................................18 

Conclusion and Recommendation ............................................................20 

Agency Comments and Office of Inspector General Response .....22 

Appendix....................................................................................................23 

Agency Comments.........................................................................23 

Acknowledgments......................................................................................25 
Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520) 1 

 

 

OBJECTIVES 

For research that includes the collection of biospecimens, to determine the 

extent to which 

1.	 informed consent documents comply with human subjects 

protection regulations, 

2.	 Institutional Review Boards (IRBs) comply with regulations, and 

3.	 principal investigators (PIs) and IRBs take measures to address 

informational risks (i.e., risks related to human subjects’ personally 

identifying information (PII) or personal health information). 

BACKGROUND 

Biospecimens, which include blood, plasma, biofluids, and tissue, are 

biological materials that are taken from human subjects enrolled in clinical 

research or that remain from a clinical procedure. Biospecimens may be 

collected and used for a specific study or stored in a biobank for specified 

or unspecified future research. When stored in a biobank, biospecimens 

may also include associated PII and personal health information. 

According to Federal regulations governing the protection of human 

subjects, research involving PII about living human beings is considered 

human subjects research. Research with biospecimens that are labeled 

with PII is also considered human subjects research. In most instances, to 

comply with Federal regulations for human subjects research, an IRB must 

first approve the research protocol and informed consent document, then 

investigators must obtain informed consent from all potential subjects 

unless an IRB has waived the requirement for informed consent.1 

Historically, human subjects in research have been exposed primarily to 

physical risks, such as an adverse reaction to an experimental drug. With 

biospecimen research, informational risks, such as a breach of privacy, are 

magnified because of the long-term electronic storage of the subjects’ PII 

and the potential for the biospecimens to be used in research not specified 

at the time of collection. Informational risks include the improper use of 

subjects’ personal health information or PII to deny health insurance, life 

insurance, or employment.2

 The undesired disclosure of research results to 

1

 45 CFR § 46.109. 

2

 The Genetic Information Nondiscrimination Act of 2008 (P.L. 110-233, 122 Stat. 881)
 

prohibits employment and health care discrimination under certain conditions.
 
 

 

 

 

 

 

 

 

 

 

subjects, such as the discovery that an individual is genetically 

predisposed to a disease, is also an informational risk. Without adequate 

informed consent, subjects may not understand the potential for their 

biospecimens to be used in unspecified future research to which they may 

object.3

 One such example is the case of the cancerous tissue removed 

from Henrietta Lacks over 60 years ago. Processing the tissue led to 

production of the HeLa cell line and provided genetic information, 

including the predisposition to certain diseases on the part of her 

descendants.4 

Public Responsibility in Medicine and Research (PRIM&R), an 

association of medical researchers, including private-sector experts and 

Federal officials, that promotes research ethics, has identified human 

subjects’ potential loss of privacy and confidentiality (i.e., informational 

risks) in research that uses biospecimens as a challenge to this type of 

research.

5 The report also raised concerns about the oversight mechanisms 

for human subjects research, including the lack of a comprehensive 

regulatory framework that addresses biospecimen storage and use.6 

Federal Regulations and Guidance for Human Subject 

Protections 

The Public Health Service Act requires the Department of Health and 

Human Services (HHS) to establish an oversight system for all 

HHS-supported or HHS-conducted research to ensure that the rights of 

human subjects are protected.7 HHS’s Office for Human Research 

Protections (OHRP) provides clarification and guidance to researchers, 

IRBs, and institutions on complying with regulations for protecting human 

subjects while conducting HHS-supported or HHS-conducted research.8 

The regulations define “research” as “a systematic investigation, including 

research development, testing and evaluation, designed to develop or 

contribute to generalizable knowledge.”9 A human subject is a living 

individual about whom an investigator conducting research obtains 

3

 The Havasupai Tribe of Arizona successfully sued the University of Arizona for using 

tribe members’ blood samples for research on schizophrenia and depression, among other 

things, without their consent. See A. Harmon, “Indian Tribe Wins Fight to Limit 

Research of Its DNA,” The New York Times, April 21, 2010. 4

 Rebecca Skloot, The Immortal Life of Henrietta Lacks, Crown Publishers, 2010. 5

 PRIM&R, Human Tissue/Specimen Banking Working Group, Part 1, Assessment and
 

Recommendations, March 2007, p. 16. Accessed at www.primr.org on August 7, 2013.
 6 Ibid., p. 7.
 7 42 U.S.C. 289(a). 

8

 OHRP, OHRP Mission Statement. Accessed at www.hhs.gov/ohrp on August 12, 2013. 9

 45 CFR § 46.102(d). 

Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520) 2 
 

 

 

 

 

 

(1) data through intervention or interaction with the individual or 

(2) identifiable personal information.10 No current regulations address the 

unique risks associated with research that includes the collection of human 

biospecimens. 

IRBs. An IRB is a committee set up to ensure the protection of the rights 

and welfare of human subjects. Research sites must have an IRB, which 

has the authority to approve, disapprove, or recommend modifications to 

proposed research.11 Among other requirements, IRBs must have at least 

five members, and they must conduct continuing review of research at 

least annually or more frequently on the basis of an assessment of the 

research’s risk.12,13 

Informed Consent. Federal regulations require PIs to obtain informed 

consent from human subjects before they are enrolled in a study unless a 

waiver of consent has been obtained. Informed consent must be obtained 

under circumstances that provide prospective subjects the opportunity to 

consider whether or not to participate and that minimize the possibility of 

coercion or undue influence. Informed consent documents must describe 

the nature and purpose of the research; state the foreseeable risks arising 

from the study; describe the extent, if any, to which confidentiality of 

records identifying the subject will be maintained; and state that 

participation in research is voluntary.14 IRBs may require that informed 

consent documents include additional information, should the IRBs 

determine that the information would provide additional protections to the 

subjects.15 

Tiered consent and broad consent are two examples of informed consent 

models used for biospecimen research seeking consent for unspecified 

future use of subjects’ biospecimens. Tiered consent includes options for 

subjects to decline inclusion of their biospecimens in specific types of 

future research. The broad consent model simply asks subjects to consent 

to all future research.16 

The regulations allow for several exemptions from the requirements for 

informed consent and IRB review. One such exemption is for research 

10 45 CFR § 46.102(f). 

11 45 CFR § 46.109(a). 

12 45 CFR § 46.107(a). 13 45 CFR § 46.109(e). 

14 45 CFR § 46.116. 

15 45 CFR § 46.109(b). 

16 NCI and Office of Biorepositories and Biospecimen Research, NCI Best Practices for
 

Biospecimen Resources. Accessed at www.biospecimens.cancer.gov on August 9, 2013. 

Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520) 3 
 

 

 

 

 

involving previously collected information or biospecimens from which 

identifiers have been removed.17 In these instances, the research is not 

considered research on human subjects and, therefore, the requirement to 

obtain informed consent is waived. 

The Health Insurance Portability and Accountability Act (HIPAA) Privacy 

Rule. The HIPAA Privacy Rule protects the privacy of individually 

identifiable health information.18 The rule applies both in research and 

health care settings and applies to “covered entities,” including researchers 

who work within the entities.19 Researchers may meet Privacy Rule 

requirements by (1) removing PII, (2) obtaining authorization from the 

subject, or (3) obtaining a waiver from an IRB or another institutional 

board established solely to address privacy issues. 

20 

Certificates of Confidentiality. The Public Health Act authorizes NIH to 

grant Certificates of Confidentiality to research institutions so that they 

and their researchers may not be compelled by any court to provide any 

identifying information about an individual enrolled in a study. 21 

NIH 

NIH is the largest Federal funder of health research. Of the 27 NIH 

institutes and centers, 24 make awards that support basic and clinical 

research, research center operations, scientific training and fellowships, 

and construction projects. Fiscal year (FY) 2012 expenditures for 

extramural research awards, which funded research performed by 

non-Federal scientists using NIH money, totaled $21.5 billion.22 Some 

portion of NIH-funded research includes collecting and storing 

biospecimens, but the size of that portion is unknown. 

17 45 CFR § 46.101(b)(4). 

18 Social Security Act, §§ 1171–1179, as modified by P.L. 104-191 §§ 104 and 106. 

19 “Covered entities” are defined as (1) health plans, (2) health care clearinghouses, and 

(3) health care providers that electronically transmit any health information in 

transactions for which HHS has adopted billing. See 45 CFR § 160.102(a). 20 45 CFR §§ 164.502(d), 164.508(a)(1), 164.510, 164.512(i). 21 NIH, Grants and Funding: Certificates of Confidentiality: Background Information.
 

Accessed at http://grants.nih.gov/grants/policy/coc/background.htm. 22 NIH, NIH Data Book – Research Grants: Funding by Institute/Center. Accessed at 

NIH.gov on March 28, 2013. 

Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520) 4 
 

 

 

 

 

 

Biobanks and Cancer Research at the National Cancer 

Institute 

Part of NIH, the National Cancer Institute (NCI) is the principal Federal 

agency for cancer research and training.23 As part of its responsibilities, 

NCI awards and monitors grants related to the National Cancer Program. 

In FY 2012, NCI issued over 6,000 research grants worth about 

$3.1 billion.24 

Biospecimens are commonly used in cancer research because they contain 

cellular, molecular, genetic, and chemical information that helps scientists 

understand the biology of cancer. Through this understanding, scientists 

can identify characteristics of cancer that can be targeted by a new 

generation of cancer therapies.25 

Genomics is the study of the functions and interactions of genes in a 

genome.26 The study of human genomics has led to better understanding 

of the role of genetics in cancer and the development of targeted and more 

efficient treatment. Further advances in this field depend, in part, on 

researchers’ access to genetic material stored in biobanks.27 

Recent Developments 

Reviews of IRB practices related to research have found that they fell 

28, 29 short of protecting human subjects and communicating potential risks.

In an effort to update its rules for human subjects protection to reflect 

current research practices, the Department published an advanced notice 

of proposed changes to the rules in July 2011.30 The proposed changes 

included, among other things, (1) determining a format for streamlining 

23 NCI, NCI Mission Statement. Accessed at 

http://www.cancer.gov/aboutnci/overview/mission on October 24, 2013. 24 NIH, Table #106, NIH Grants and Contracts Number of Competing and Noncompeting 

Awards and Funding Mechanism and NIH Institutes/Centers Fiscal Years 2002–2011. 

Accessed at www.report.nih.gov on March 1, 2012. 25 NCI and Office of Biorepositories and Biospecimen Research, NCI Best Practices for 

Biospecimen Resources. 

26 A genome is an organism’s complete set of DNA, including all of its genes. Definition 

taken from NIH.gov. Accessed on August 22, 2013. 27 A.E. Guttmacher and F.S. Collins, “Genomic Medicine—A Primer.” New England 

Journal of Medicine, 2002; 347:1512–1520, November 7, 2002. 28 Institute of Medicine, The Common Rule and Continuous Improvement in Health Care: 

A Learning Health System Perspective, October 2011. Accessed at www.iom.edu on 

January 31, 2012. 

29 OIG, IRBs: A Time for Reform, OEI-01-97-00193, June 1998. 30 76 Fed. Reg. 44512–44530 (July 26, 2011). See also OHRP, OHRP Regulatory 

Changes in ANPRM. Accessed at 

http://www.hhs.gov/ohrp/humansubjects/anprmchangetable.html on October 28, 2013.
 

Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520) 5 
 

 

 

informed consent documents so that subjects providing biospecimens may 

opt in or out of future research and (2) establishing universal data-security 

measures similar to those found within HIPAA.31 

In October 2012, the Presidential Commission on the Study of Bioethical 

Issues released a report highlighting privacy concerns associated with 

whole-genome sequencing. The report emphasized the continued benefit 

of advances in genomic sequencing for society, but also raised concerns 

about privacy, the potential misuse of information, and unanticipated 

results reported to subjects from future research. Although the report 

concentrated on whole-genome sequencing, the Commission’s findings 

and recommendations were also directed more broadly at large research 

projects that use genetic data. 32 

In January 2013, a study from the Massachusetts Institute of Technology’s 

Whitehead Institute highlighted vulnerabilities with stored biospecimens 

by using publicly available data to identify previously de-identified 

subjects enrolled in a genomic sequencing study.33 

After genetic researchers mapped the genome for the HeLa cell line and 

made the information public in March 2013, the family of Henrietta Lacks 

raised concerns about its privacy.34 In August 2013, NIH responded to 

these concerns by providing the Lacks family with some control over how 

the genomic data would be used in future research. The series of events 

highlighted the need for broader policy addressing privacy of human 

subjects enrolled in research involving biospecimens, as well as that of 

their families, and the importance of communicating the potential 

commercial aspects of the research to human subjects.35 

METHODOLOGY 

Scope 

We reviewed 71 studies (at 32 institutions) that (1) either were active in 

2012 or were completed in 2011, (2) were funded by NCI extramural 

31 76 Fed. Reg. 44515 (July 26, 2011). 32 The Presidential Commission for the Study of Bioethical Issues, Privacy and Progress
 

in Whole Genome Sequencing, October 2012. Accessed at http://www.bioethics.gov on
 

April 23, 2013. 

33 M. Gymrek, A.L. McGuire, D. Golan, E. Halperin, and Y. Erlich, “Identifying Personal 

Genomes by Surname Inference,” Science, Vol. 339, January 18, 2013.
 34 J.J.M. Landry et al., “The Genomic and Transcriptomic Landscape of a HeLa Cell
 

Line,” Genes Genomes Genetics, March 2013. Accessed at g3journal.org on August 13, 

2013.
 35 Carl Zimmer, “A Family Consents to a Medical Gift, 62 Years Later,” The New York 

Times, August 7, 2013. 

Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520) 6 
 

 

grants or cooperative agreements, (3) were human subjects research as 

defined by regulations, and (4) involved the collection of biospecimens. 

We used ClinicalTrials.Gov, an NIH-maintained registry of federally and 

privately supported clinical research studies, to identify the 71 studies in 

our review. Because information on biospecimen collection is not 

systematically gathered, we identified the clinical trials in our review 

through an optional database field indicating biospecimen retention. 

Our initial inquiry identified 86 studies, 10 of which were waived from the 

requirements for human subjects research and therefore did not have 

informed consent documents. We excluded five others that did not meet 

our inclusion criteria. 

We assessed informed consent documents and IRB documents for 

compliance with certain requirements for human subjects protections. 

Our analysis of the informed consent documents focused on the following 

four basic required elements: 

 a statement of the nature and purpose of the study; 

 a description of any reasonably foreseeable risks or discomforts to 

the subjects; 

 a statement describing the extent, if any, to which confidentiality of 

records identifying the subjects will be maintained; and 

 a statement that participation is voluntary. 

36 

Our evaluation of IRBs focused on three requirements: 

 that IRBs have at least five members, 

 that IRBs conduct initial review of research, and 

 that IRBs conduct continuing review of research at least annually 

or more frequently on the basis of research risk. 

Data Sources and Collection 

Research Protocol and Informed Consent Documents. We requested the 

research protocol, informed consent documents, and IRB chairperson’s 

contact information from the PI of each of the 71 studies in our study 

population. We received all the protocols and informed consent 

documents that we requested. 

36 45 CFR § 46.116. 

Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520) 7 
Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520) 8 

 

IRB Documents. We requested IRB rosters, as well as documentation of 

both initial and continuing review from the IRB chairpersons overseeing 

the studies in our study population. Where institutions had multiple IRBs 

for different types of research, we reviewed only the IRB responsible for 

overseeing the study in question. We received IRB rosters from 31 of the 

32 institutions in our population, documentation of initial review from 

68 of the 71 studies in our population, and documentation of continuing 

review for 70 of the 71 studies. 

Survey of Principal Investigators. We surveyed the PIs conducting the 

studies in the population. We contacted the PIs by email and included a 

link to an online questionnaire. This questionnaire addressed PIs’ training 

on human subjects protections and on institutional policies and resources 

for collecting and storing biospecimens; the guidance that PIs have used in 

these areas; and their experiences conducting this type of research. 

Additionally, we asked about their perceptions of this type of research and 

challenges they experienced in conducting it. We sent the questionnaire to 

76 PIs for whom we had email addresses.37 Sixty PIs completed the 

questionnaire. 

Survey of IRB Chairpersons. We surveyed IRB chairpersons overseeing 

the studies in the study population. We contacted them by email and 

included a link to an online questionnaire. The questionnaire addressed 

training and guidance related to human subjects protections and the IRB 

chairpersons’ experiences overseeing research that includes collecting and 

storing biospecimens. We also asked about challenges in overseeing this 

type of research. We sent the questionnaire to 47 IRB chairpersons at the 

32 institutions in the study population. Thirty-two chairpersons from 

twenty-four unique institutions completed the questionnaire. 

Interviews With Representatives From Research Institutions. We 

interviewed PIs, IRB chairpersons, and other research personnel at two 

institutions. We chose the institutions because both are large, well-known 

cancer research institutions. 

Analysis 

We analyzed the informed consent and IRB documents to determine 

whether they met requirements for human subjects and how they 

addressed unique issues associated with this type of research, such as 

37 At the time we sent the questionnaire, we had 76 studies in our study population. Five 

studies were eliminated at a later date because we determined that they did not meet our 

inclusion criteria. 
 

informational risks, future research, and sharing research results with 

human subjects. 

Limitations 

Our ability to identify studies that met our criteria was limited by the 

extent to which ClinicalTrials.Gov included optional, self-reported data. 

We did not determine whether IRBs met the requirement for expertise. 

Instead, we described measures IRBs took to meet that requirement. 

Finally, we did not independently verify the data PIs and IRB chairpersons 

reported to us in the survey. 

Standards 

This study was conducted in accordance with the Quality Standards for 

Inspection and Evaluation issued by the Council of the Inspectors General 

on Integrity and Efficiency. 

Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520) 9 
FINDINGS 

Informed consent documents for biospecimen

research contained required information on human

subjects protections, but varied in their substance

and form 

All 71 informed consent documents described the nature and purpose of 

the research, generally at the beginning of the documents. In some 

instances, the descriptions of the research appeared as bulleted text; in 

other instances, the descriptions contained additional detail (sometimes 

extending to several pages) and included scientific language. (For 

examples of the two different types, see Figure 1.) 

Figure 1: Examples describing nature and purpose of research, taken 

from two informed consent documents 

 

 

 

Example 1 

This research has three components: 

• the collection of tissue samples for research purposes 

• the use and sharing of data about you and your transplant to improve 

outcomes 

• permission to follow you lifelong regarding your health and well-being 

Example 2 

You are being asked to participate in a research study to look at the levels of certain 

enzymes (proteins that are made by the body to limit or prevent changes in the 

makeup of the body’s cells), as well as oxidative DNA damage (changes to the 

body’s DNA when the cells are deprived of oxygen). DNA is the repository of
 

hereditary characteristics such as what color of eyes a person will have. These 

changes in proteins and DNA occur in all people over their lifetimes, but are more 

pronounced in some people than in others. This study will measure some of these 

changes in subjects who are considered at high risk for developing prostate cancer
 

due to certain existing conditions, compared with subjects who are considered 

healthy.
 

 

 

Source: OIG analysis of informed consent documents, 2013. 

In all instances, protecting patient information and maintaining 

confidentiality appeared in clearly marked sections of the informed 

consent documents. The level of detail in some forms described steps that 

would be taken to protect participants, such as coding or encryption. 

Other forms cited HIPAA and indicated how that law applies or contained 

its relevant language. (For examples of the language on protecting 

confidentiality, see Figure 2.) 

Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520) 10 
Figure 2: Examples of Language on Protecting Confidentiality 

 

 

 

 

 

 

Example 1 

Your specimen, information from the specimen, and your medical information will 

be distributed to researchers at this or other institutions labeled with a unique 

laboratory code number. Your personal identifying information will not be sent to
 

other researchers. Only the Principal Investigator and their research staff will have
 

access to the link between the code and your name. You will sign a separate HIPAA 

authorization form for review of your medical records information by Tissue 

Procurement personnel who are trained to maintain strict confidence. All 

information obtained by [institution name] is stored and released under conditions
 

designed to protect the privacy of study participants. 

Example 2 

Your protected health information will be protected according to state and federal
 

law. However, there is no guarantee that your information will remain confidential, 

and it may be re-disclosed at some point. 

Example 3 

Your identity will be kept as confidential as possible as required by law. Except as 

required by law, you will not be identified by name, social security number, address, 

telephone number, or any other direct personal identifier. Your research records may
 

be disclosed outside of [institution name], but in this case, you will be identified only 

by a unique code number. Information about the code will be kept in a secure 

location and access limited to research study personnel.
 

 

 

Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520) 11 

Source: OIG analysis of informed consent documents, 2013. 

All informed consent documents included some description of risk and 

discomfort. However, studies that included the noninvasive collection of 

biospecimens listed fewer physical risks because they simply followed the 

subjects’ health over time and did not involve additional medical 

intervention or collection of biospecimens. Other studies included 

biospecimen retrieval, such as cancerous lung tissue, that required a 

procedure for removal and had greater physical risks. Informed consent 

documents for genetic research that did not require a procedure to collect 

the biospecimens listed lower physical risks. (See Figure 3 for examples 

of informed consent documents’ descriptions of risk and discomfort.) 
 Figure 3: Examples of Language on Risks and Discomfort 

 

 

 

 

 

Example 1 

Some questions in the questionnaire may be sensitive. You may refuse to answer 

any questions that make you feel uncomfortable. Participants who have concerns 

after completing this questionnaire are encouraged to contact their physician or the 

study doctor. 

Example 2 

Infection and/or bleeding are always possible when the skin is broken .... About 1% 

of patients have serious problems from an internal biopsy. These problems include 

internal bleeding which may require a blood transfusion or surgery to correct, a 

collapsed lung, injury to the intestines, gallbladder or kidneys, and infection of the 

abdominal cavity. You may have an allergic reaction to the numbing medicine. This 

reaction may be mild, such as a skin rash, or you may have more severe symptoms 

like throat tightness, low blood pressure, and it may be hard to breathe. In rare 

cases, a severe reaction could cause death. 

Example 3 

The greatest risk is breach of confidentiality. 

 

Source: OIG analysis of informed consent documents, 2013. 

Finally, all informed consent documents stated that participation was 

voluntary. Some communicated at the beginning of the document that the 

research was voluntary. In these instances, the documents often stated that 

the subject was being asked to enroll in research and could withdraw at 

any time. In other documents, the statement that the research was 

voluntary directly followed a description of the nature and purpose of the 

research. Other informed consent documents contained a separate section 

that addressed the voluntary nature of the research. (For examples of the 

language regarding the voluntary nature of the research, see Figure 4.) 

Figure 4: Examples of Informed Consent Language Regarding Voluntary 

Nature of Research 

 

 

Example 1 

You are being asked to take part in a research study. To join the study is voluntary. 

You may refuse to join, or you may withdraw your consent to be in the study, for any 

reason. 

Example 2 

DO I HAVE TO TAKE PART IN THE STUDY?
 

The choice to take part in this study or not is yours. Make your choice based on what
 

we have explained to you and what you have read about the study. 

Taking part is completely voluntary and up to you.
 

Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520) 12 

Source: OIG analysis of informed consent documents, 2013. 
 

 

IRBs met basic requirements for membership, initial

review, and continuing review 

We received 31 IRB rosters from 32 institutions in the study population, 

and all of those met the minimum requirement of 5 members. The number 

of members reached as high as 40 and averaged 17 members. 

We received documentation of initial review for 68 of the 71 studies in the 

population of continuing review for 70 of the 71 studies. All of those met 

the minimum requirement for continuing review. Twenty-six of thirty-two 

IRB chairpersons who responded to our survey reported taking additional 

measures to protect human subjects during continuing review. These 

measures include updating informed consent documents as new risks 

arose, auditing logs that document how biospecimens were shared, and 

conducting routine site visits to ensure that biospecimens were being used 

according to the IRB-approved protocol. 

IRB chairpersons who responded to our survey and those we interviewed 

provided information on how their IRBs address the requirement for 

expertise of their members. It is up to each IRB to determine its operating 

structure to ensure that members have expertise for reviewing research. 

All the chairpersons who responded to our survey said that they require 

members to receive training on human subjects protection. Some IRBs 

use subcommittees to address different types of research, such as 

biomedical research. Others seek out expertise that may be lacking within 

the IRB. For example, one IRB chairperson we interviewed told us that he 

consults with information technology (IT) staff on a case-by-case basis 

when informational risks to subjects are elevated because of storing PII, 

rather than having someone with such expertise as a permanent part of the 

committee. Another chairperson reported integrating an IT risk 

assessment as a formal part of his IRB’s review process. 

In addition, 25 of 32 IRB chairpersons who responded to our survey 

reported that their IRBs require members to attend training on 

informational risks. Six respondents said that the IRB itself provides 

educational opportunities both for IRB members and investigators on 

topics related to informational risk, as well as on administering informed 

consent. Four respondents said they developed guidance specifically for 

investigators conducting biospecimen research and IRB members 

overseeing such research. The guidance these respondents developed 

includes guidelines for conducting biospecimen and genetic research, 

conducting genome-wide association studies, and determining what to 

disclose in informed consent documents for genetic research. 

Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520) 13 
Some IRBs and PIs took steps to address the

informational risks of collecting biospecimens and 

storing them for future research 

IRBs and PIs both play important roles in communicating informational 

risks as the informed consent documents are developed, reviewed, and 

approved. This process starts during the initial review, when the IRB 

reviews the study protocol and informed consent document and requests 

modifications, if appropriate. Our analysis of the 68 initial review 

documents demonstrates that at times, IRBs recommended modifications 

to the informed consent documents. These modifications varied and 

included clarification on how biospecimens would be stored and used in 

the future and when it might be appropriate to contact the relatives of a 

subject diagnosed with cancer (see Figure 5). 

Figure 5: Example of IRB-Requested Modifications to Informed Consent 

During Initial Review 

 

 

Example 1 

Revise the [informed consent document] and/or protocol and Abstract to clarify 

whether agreement to donate residual tissue is an eligibility requirement or an option. 

It cannot be both. 

Example 2 

The [relevant committee] recommended that you review the consent form under 

reference, in particular the risks of genetic counseling. 

Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520) 14 

Source: OIG analysis of informed consent documents, 2013. 

Almost all IRB chairpersons—32 of 33—stated that they had required 

modifications to a research protocol to address these informational risks. 

Further, 24 of 60 PIs reported that IRBs had required changes to their 

study documents.38 

Informational risks to subjects were included in 58 of the 

71 IRB-approved informed consent documents 

Fifty-eight of the seventy-one IRB-approved informed consent documents 

described informational risks associated with biospecimen research, 

including breaches of confidentiality and the consequences and learning 

potentially sensitive results from genetic research (see Figure 6). These 

risks generally appeared within the sections of the informed consent 

38 The term “study documents” refers to the research protocols and informed consent 

documents. 
 

   

     

 

documents addressing nature and purpose of the research or the sections 

addressing physical risks and discomforts. 

Figure 6: Informational Risks Addressed in Informed Consent Documents 

(n=71) 

58

13 Informed consent

documents that did

address informational

risks

Informed consent

documents that did not

address informational

risks

Source: OIG analysis of informed consent documents, 2013. 

The long-term storage of biospecimens and their associated data may 

heighten the risk of a breach of confidentiality. For example, a breach 

could involve unauthorized access to personal health information; loss or 

misplacement of data-storage devices, such as laptop computers; or the 

interception of private information transmitted over the Internet. 

Breaches could result in human subjects’ information being used against 

them, and 52 of the 71 informed consent documents discussed this risk. 

For example, the potential exists for genetic information to be used to 

deny health insurance or life insurance or to claim or deny paternity. 

Figure 7 shows how one IRB-approved informed consent document 

informs human subjects of this risk. 

Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520) 15 
Figure 7: Example Describing the Consequences of a Breach of 

Confidentiality 

 

 

The greatest risk of sharing your genetic information is the possible loss of your 

privacy. Although no identifiable (name, address, etc.) information will be given to 

the National Institutes of Health (NIH, the federal government agency that stores 

genetic information), the possibility exists that your genetic information may be 

taken, used for reasons outside of this project, and in the future be used to identify 

you. If your genetic information is linked back to you in the future, it may be used by 

employers and insurance agencies to discriminate against you, or by law enforcement 

to link you, or one of your family members, to a crime. 

Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520) 16 

Source: OIG analysis of informed consent documents, 2013. 

Biospecimen research also could identify sensitive results from a genetic 

test. Disclosing this information may be undesirable or upsetting to a 

human subject. An example of such a risk is learning that one has a 

genetic predisposition to Alzheimer’s disease but can do nothing to 

decrease the chances of developing it. Twenty-one of the informed 

consent documents we reviewed indicated that research results may be 

shared with subjects. Of those, 6 indicated that research results would be 

shared with the subjects unconditionally; the other 15 indicated that results 

would be shared with the subject only under certain conditions, such as the 

receiving of genetic counseling by the subject. 

In some cases, informed consent documents described legal protections 

designed to protect subjects (see Table 1). For example, 18 of the 

71 informed consent documents described certificates of confidentiality. 

These informed consent documents described potential consequences of 

releasing private information to an employer or insurer and the ways in 

which a certificate protects subjects from that risk. Similarly, 13 of the 

71 informed consent documents describe how the Genetic Information 

Nondiscrimination Act protects individuals from inappropriate use of their 

genetic information. 

In other cases, the informed consent documents disclosed how research on 

the collected biospecimens might lead to commercial products. For 

example, 37 of 71 informed consent documents addressed the potential for 

a commercial product while also stating that the subjects would not 

receive any financial benefit. 
 

 

 

Table 1: Informational Risks and Related Issues Addressed in Informed 

Consent Documents 

Issue Addressed Number of Informed 

Consent Documents* 

Informational Risks (in General) 

Specific Informational Risks 

Breach of Confidentiality 

Learning Potentially Sensitive Results from Genetic Research 

Possibility of a Commercial Product with No Financial Benefit for Subject 

Research Institution Has an NIH-Granted Certificate of Confidentiality 

How the Genetic Information Nondiscrimination Act Protects Subjects 

58 

52 

21 

37 

18 

13 

*Each informed consent document may include one or more of these elements. 

Source: OIG analysis of informed consent documents, 2013. 

About two-thirds of informed consent documents provided 

human subjects with some control over how their 

biospecimens would potentially be used 

Forty-nine of the seventy-one informed consent documents allowed 

subjects to select the specific types of research in which they would like to 

participate, while opting out of other types of research. This approach, 

called tiered consent, gives human subjects a degree of control over the 

types of research for which their biospecimens are used. For example, 

tiered consent might permit one subject to opt in for cancer research but 

opt out of research on Alzheimer’s disease, while permitting another 

subject to choose to participate in all types of research. Tiered consent 

could also include a provision for a subject to indicate whether he/she 

would like to be contacted about future research. (See Figure 8 for 

examples of informed consent language under a “tiered consent” 

framework.) 

Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520) 17 
Figure 8: Examples of Language for Tiered Informed Consent 

 

Source: OIG analysis of informed consent documents, 2013. 

 

 

 

 

Example 1 

My specimens may be kept for use in research to learn about, prevent, or treat HIV. 

Yes __ No__ 

My specimens may be kept for use in research to learn about, prevent, or treat other 

health problems such as human papillomavirus (HPV) infections and anal or genital 

cancer. 

Yes ___ No ___ 

Someone may contact me in the future to ask me to take part in more research. 

Yes ___ No ___ 

Example 2 

I elect to___ or not to___ have leftover blood and tissue specimens stored in a tissue 

bank for optional studies. 

Participant’s initials ___ 

I elect to___ or not to___ have the results of any future research disclosed to me. 

Participant’s initials ___ 

I elect to___ or not to___ provide contact information on the attached page for 

relatives to be contacted about the study. 

Participant’s initials ___ 

 

Source: OIG analysis of informed consent documents, 2013. 

IRBs and PIs identified challenges in conducting and 

overseeing biospecimen research 

In conducting research, PIs and IRBs must balance the competing 

demands of protecting human subjects and making scientific progress. All 

respondents seemed to recognize those competing demands. They face 

challenges in achieving that balance. 

First, PIs identified a challenge in determining the level of detail to 

provide to potential subjects about the various risks associated with 

participating in biospecimen research. Their concern was that providing 

extensive detail could deter subjects from participating. Not only can such 

an explanation be time-consuming, but it also can raise potential subjects’ 

concerns about risks that they might face should they decide to participate. 

As one principal investigator stated, “[The] primary challenge is 

recruitment resulting in fewer subjects enrolled than expected. The 

Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520) 18 
 

 

informed consent form is long, arduous, and implies greater risk than is 

realistically present.” 

Second, storing biospecimens for future use and controlling access to them 

also presents challenges, especially for individual PIs. Of the 51 PIs who 

responded to our question as to who controls distribution of their 

biospecimens, 23 PIs said they themselves did, 18 said IRBs did, and 

4 said the institution’s research management office did. Tracking PII 

associated with the biospecimens can be handled with a simple 

spreadsheet or a sophisticated database, but the challenge is ensuring that 

the PII is secure. In addition, monitoring the distribution and associated 

level of consent for each biospecimen can be difficult. Furthermore, 

repositories need emergency alarms and, to safeguard the biospecimens in 

the event of a power failure, backup power systems. Purchasing and 

maintaining these systems can be costly, and such costs are borne more 

easily by institutions than by individual PIs. 

Third, the rapid pace of change in biospecimen research and the slower 

pace of regulatory and policy changes can create uncertainty. One IRB 

chairperson captured this uncertainty when he told us, “We are left to 

apply generic regulatory standards to a very specific and often confusing 

type of research, which can be difficult.” Among the 32 IRB chairpersons 

who responded to our survey, 8 cited a lack of clarity in Federal 

regulations as a challenge in overseeing research that includes collecting 

biospecimens. On the other hand, 55 of 60 PIs responding to our survey 

stated that regulations clearly articulate what is expected of them as 

researchers. 

Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520) 19 
 

CONCLUSION AND RECOMMENDATION 

As the field of biospecimen research advances, researchers are using the 

existing and familiar human subjects protection system to inform human 

subjects about risks. Overall, our evaluation found that informed consent 

documents met the basic requirements for human subject protections; in 

addition, IRBs met basic requirements for membership, initial review, and 

continuing review. 

The majority of informed consent documents addressed the informational 

risks of biospecimen research. These include breaches of confidentiality 

and learning about potentially sensitive results from genetic research. The 

majority of informed consent documents also gave subjects some control 

over how their information will be used in future research. 

Researchers and IRBs involved in biospecimen research are trying to 

address challenges regarding how much information to share with 

potential subjects, how to store and share biospecimens, and how to deal 

with a regulatory system that progresses at a slower pace than scientific 

research. 

Because the field is in flux and the regulatory system moves slowly, the 

research community has much discretion in determining how to address 

these challenges. The Department is also working to address challenges 

with human subjects research protections, having issued an advance notice 

of proposed rulemaking in July 2011. 

In 2012, the Presidential Commission on the Study of Bioethical Issues 

released a report that raised concerns about privacy, the potential misuse 

of information, and unanticipated results reported to subjects from future 

research. More recently, in January 2013, that Commission announced 

that it would examine what patients and participants are told by health care 

professionals not only after a procedure or a test is performed, but also 

before, as part of the informed consent process. 

Determining how to communicate informational risks to human subjects 

will be a challenge, but doing so effectively will be an important 

contribution to scientific advancement. To facilitate this process, we 

recommend that OHRP: 

Provide IRB members and investigators with a forum for 

discussing informational risks to human subjects 

Federal regulations require that informed consent documents include a 

statement of the foreseeable risks arising from the study. Historically, 

human subjects enrolled in clinical research have been exposed primarily 

to physical risks, such as an adverse reaction to an experimental drug. 

Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520) 20 
 

More recently, researchers’ ability to collect and store information from 

biospecimens has raised concerns about informational risks that may arise 

from clinical research. These risks, such as a breach of privacy, are 

magnified because of the long-term electronic storage of the subjects’ PII 

and personal health information, and the potential for biospecimens to be 

used in research not specified—or even envisioned—at the time of their 

initial collection. 

OHRP could help ensure that IRB members and investigators address 

informational risks in biospecimen research by providing them with a 

forum for discussing challenges and best practices related to 

communicating these risks. Considering such risks would help provide 

additional protections to subjects who enroll in studies that would include 

the collection and future use of biospecimens. Possible approaches 

include an online forum, Webinars, an OHRP-sponsored conference, or 

presentations at other scientific meetings. 

Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520) 21 
 

 

AGENCY COMMENTS AND OFFICE OF INSPECTOR GENERAL 

RESPONSE 

OHRP concurred with our recommendation to provide IRB members and 

researchers with a forum for discussing informational risks to human 

subjects. It highlighted past efforts as well as plans to provide a forum to 

discuss informational risks with relevant stakeholders at upcoming 

regional and national conferences. OHRP also emphasized the 

informational risks present in research for which IRBs have issued waivers 

from the requirement to collect informed consent. Although permitted by 

human subjects regulations, such waivers prevent human subjects from 

being fully advised of those informational risks. 

Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520) 22 
 

 

APPENDIX A 

Agency Comments 

Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520) 23
 
Agency Comments (Continued) 

Page 2 - lns1x:ctor General 

We concur with the OIG Report'~ recommendation that the Onice for Human Research 

l'rotections (OHRP) should provide a forum for IRB members and investigators to ddrcss 

informational risks in biospecirncn research. Indeed. OHRP has already provided such fora on a 

number <>f occasions, and \\ill continue to do so. In March of20ll, the Secretary's Advisory 

Committee on Human Research Protections (SACHRP) held a panel on the topic of returning 

indtvidual results to subj~.-cts, which is or1c elc:ment of the issue . .In October of2011. SACHRP 

submitted recommendation.~ titled FAQs, Terms and Recommendations on informed Consent and 

Research Use of!Jiuspcc/mens. In October of20ll SACHRP also included comments related to 

informed consc;1t and biospecimen research in Its comments on the Advance Notice of Propo <ed 

Rulcmaking of July, 2011 titled lluman !mbjects ReJearc·h Protections< Enhancing Protections 

f or Researclr Subjt~CIJ< and Ruducing Burden. Delay, and Ambigullyfor lm•estlga/ors. We expect 

that SACHRP will return to this tssuc in the near future. In October of this year, OHRP will 

sponsor a wcbinar titled !Jit,banking When Issues with Tissues Com•• a 'Knocldn' us part of its 

webinar seric.S; these webinars an: recorded and are al so viewable on YouTube aflcr they 

happe n. ;\nd in October the L~su will also be addrcJ.sc<l ru; part of the program of an OI·IRP 

Research Community Forum titled Innovative Strau•gies.· Taking the J'rott~ctiott ofHuman 

Subje,·to~ to 1/te Nex tl.evel, in Nashville, ·1 cnncsscc . We fully expect other future Re$earch 

Community Fora to include this topic . And finally, 0! IRl' staO'working with the platming 

committee-S of tho.: annual meetin&of Public Rcsponsihility in Medicine atld Rcs.:u.re h have 

ensured that this issue: will also be part of the program of this year's meeting in November. 

OHRP will certainly look for other opportunities to advance discu~sion of thi ·topic as well. 

Thank you for the opportunity to comment on the drafl Report. Please feel free to t·ontact me if 

you hav..: any questions. 

Howard K. Koh, M.D., 1\l.P.II. 

Biospecimen Research : Human Subjects Requirements and Informational Risks (OEI-01-11-00520) 24 
 

ACKNOWLEDGMENTS 

This report was prepared under the direction of Joyce Greenleaf, Regional 

Inspector General for Evaluation and Inspections in the Boston regional 

office, and Deputy Regional Inspectors General Russell Hereford and 

Kenneth Price. 

Christopher Galvin served as the team leader for this study, and 

Elizabeth Havener served as the lead analyst. Central office staff who 

provided support include Heather Barton, Althea Hosein, Christine Moritz, 

and Talisha Searcy.
 

Biospecimen Research: Human Subjects Requirements and Informational Risks (OEI-01-11-00520) 25 
Office of Inspector General

http://oig.hhs.gov 

The mission of the Office of Inspector General (OIG), as mandated by Public Law 95-452, as 

amended, is to protect the integrity of the Department of Health and Human Services 

(HHS) programs, as well as the health and welfare of beneficiaries served by those 

programs. This statutory mission is carried out through a nationwide network of audits, 

investigations, and inspections conducted by the following operating components: 

Office of Audit Services 

The Office of Audit Services (OAS) provides auditing services for HHS, either by conducting 

audits with its own audit resources or by overseeing audit work done by others. Audits 

examine the performance of HHS programs and/or its grantees and contractors in carrying 

out their respective responsibilities and are intended to provide independent assessments of 

HHS programs and operations. These assessments help reduce waste, abuse, and 

mismanagement and promote economy and efficiency throughout HHS. 

Office of Evaluation and Inspections 

The Office of Evaluation and Inspections (OEI) conducts national evaluations to provide 

HHS, Congress, and the public with timely, useful, and reliable information on significant 

issues. These evaluations focus on preventing fraud, waste, or abuse and promoting 

economy, efficiency, and effectiveness of departmental programs. To promote impact, OEI 

reports also present practical recommendations for improving program operations. 

Office of Investigations 

The Office of Investigations (OI) conducts criminal, civil, and administrative investigations 

of fraud and misconduct related to HHS programs, operations, and beneficiaries. With 

investigators working in all 50 States and the District of Columbia, OI utilizes its resources 

by actively coordinating with the Department of Justice and other Federal, State, and local 

law enforcement authorities. The investigative efforts of OI often lead to criminal 

convictions, administrative sanctions, and/or civil monetary penalties. 

Office of Counsel to the Inspector General 

The Office of Counsel to the Inspector General (OCIG) provides general legal services to 

OIG, rendering advice and opinions on HHS programs and operations and providing all 

legal support for OIG’s internal operations. OCIG represents OIG in all civil and 

administrative fraud and abuse cases involving HHS programs, including False Claims Act, 

program exclusion, and civil monetary penalty cases. In connection with these cases, OCIG 

also negotiates and monitors corporate integrity agreements. OCIG renders advisory 

opinions, issues compliance program guidance, publishes fraud alerts, and provides other 

guidance to the health care industry concerning the anti-kickback statute and other OIG 

enforcement authorities.