Section XVII:

Special Requirements and Guidance for Investigators


Title 4:

Research Involving Data Registries/Specimen Banks

Effective Date:


Revision History:

06-7-04; 12-06-04; 6-21-06; 8-23-06


To describe the policy of the VCU IRB pertaining to the establishment and usage of registries and specimen banks to be housed at VCU by VCU investigators for research purposes (see Section A for definitions).

This policy also describes VCU IRB criteria pertaining to the collection of data and/or specimens to be sent for storage at collaborating/cooperative regional or national registries or biorepositories. Plans for contributing data/specimens to, or accessing from, a foreign (non-US) based biorepository or registry will be considered on a case by case basis, however, general participant protections apply. As research registries become more and more common within protocols or as free-standing registry protocols. The IRB acts as a steward, on behalf of registry participants, to ensure the protection of their identifiable information within a research registry.


Establishing, or accessing, a human subject research registry, as defined below (Section A), requires prior VCU IRB review and approval. The PI's plan for establishing or contributing to the human subject research registry may be:
(1) fully described as part of a new protocol submission to the IRB;
(2) fully described as an amendment to an existing research protocol; or
(3) a separate, free-standing protocol.

This policy is organized as follows:

  1. Definitions

  2. Establishing a Registry
    1. Who has responsibility for the integrity of the registry and who can have access to the registry for research purposes and how is access granted?
    2. What is the process for informed consent related to the registry/specimen bank?
    3. How is system privacy and confidentiality ensured?
  3. Accessing an Existing Registry
    1. General Guidelines
    2. What is the process for informed consent related to the registry/specimen bank?
    3. How is system privacy and confidentiality ensured?
  4. IRB Reviewer Tips


  1. Definitions:

    1. A 'human subjects/research registry' is an organized collection of retrievable, identifiable information (pertaining to living humans) that is intentionally maintained for use as a prospective instrument for the conduct of research. A research registry may also be called a repository or a data or specimen bank. This WPP utilizes the term ‘registry’ to refer to all collections for research purposes. Note that collection of data or specimens for a specific protocol DOES NOT constitute a registry IF the data or specimens will not be saved for future unspecified research purposes. Contact the ORSP or OECO with questions about whether a registry is subject to IRB purview.

      Data/specimens collected for future research purposes as part of a specific protocol are a research registry and should be reviewed and approved by the IRB as part of the "parent" research protocol. In the case of collaborative research (where data collected at VCU is sent to a Data Control Center), the research protocol and/or synopsis should describe a plan for the collection, transfer, and maintenance of such registry data outside of VCU. When research tissues/data are no longer being collected at VCU for transfer to the outside Data Control Center, and VCU stipulations are met, the study can be closed with the IRB.

    2. "Usage protocol /amendment" is a human research protocol (or amendment to the protocol containing the registry) that proposes to access an IRB-approved research registry to obtain identifiable or coded data or tissues in order to answer one or more specific research questions. In order for VCU investigators to obtain identifiable data from a registry, the VCU IRB must review and approve the usage protocol/amendment prior to obtaining access to a 'human subjects/research participant registry'. At times, there will be numerous 'usage protocols' associated with a single 'registry'. 'Usage protocols' may be known as 'subsidiary protocols' or 'related' protocols. A usage protocol might also be initiated by someone at another institution (and subject only to IRB review at their institution). More information about a 'usage protocol' is in section C below.
  2. Establishing a Registry:

    The main points of IRB review and consideration include answering the following questions:

    • Who has responsibility for the integrity of the registry and who can have access to the registry for research purposes and how is access granted?
    • What is the process for informed consent related to the registry/specimen bank?
    • How is system privacy and confidentiality ensured?

    Submission and Review Guidelines (3 areas, below):

    1. Who has responsibility for the integrity of the registry and who can have access to the registry for research purposes and how is access granted?
      1. Before a Registry may be established to store data or tissues intended for future research purposes, the IRB shall review and approve plans for the registry submitted by a qualified investigator, including who will exercise control over the registry. If contributing to a registry outside of VCU, describe the control and management of the registry. For contribution to Genome Wide Association Studies (GWAS) see WPP XVII-5 Genetic Research, Section D.

      2. The registry plan should also describe the role(s) of other individuals who may have access to the registry, eg. for data entry or retrieval purposes, including non-VCU investigators, if applicable. Ideally, a registry plan references a set of Standard Operating Procedures (SOPs) that describe individuals who may have such access, for what reasons, and an explanation of their training. SOPs are recommended, but not required, and need not be reviewed by the IRB. However, the IRB may request SOPs for a particularly complex or sensitive registry.

      3. The registry PI should describe procedures for releasing identifiable or coded registry data to usage protocol investigators. Such procedures should correspond to information described within the registry informed consent form, if applicable. Note that such procedures ought to be as clearly described as possible in cases where VCU PIs will be contributing data/specimens to a collaborating regional or national registry.

    2. What is the process for informed consent related to the registry/specimen bank?
      1. What to include in the informed consent document: The informed consent document should include pertinent information, allowing the research participants or LAR to determine whether:
        1. the data/tissues collected may be used for research related to a specific problem or disease,
        2. the data/tissues collected may be used for research directed to any reasonable research question pertaining to health care, or
        3. the subject wishes to be contacted each time his or her individual data/tissues may be accessed from the registry for research purposes. The last option may be omitted from the informed consent form as determined by the PI and/or IRB. The registry PI will describe how the categories of preference indicated in the informed consent form are to be separately maintained within the registry to ensure proper usage according to registry participant's consent. For registries that are part of an intervention study, the informed consent should describe whether a subject's participation in the study is contingent on agreement for entry into the registry.

          Note that these categories may be described using different language for collaborative/cooperative registries. In order for such registries to accurately track subject preferences, the language and sequence of data use options should not be changed by the IRB, unless the language, as submitted, would not be understandable to prospective subjects.

      2. When to refer to the 'parent' protocol: If participation in the registry is required in order to be a part of the larger study, indicate this relationship within the 'parent' protocol consent document.
      3. What to do if a waiver of informed consent is requested: The PI may request waiver of consent or waiver of documentation of informed consent, as appropriate. The VCU IRB may waive some or all of the elements of informed consent (or assent) for inclusion of information collected in a registry.
      4. Such waiver, if relevant, may apply to prospective collection of information or may be applied to information collected prior to the IRB submission of the registry protocol. See WPP XI-1 and WPP XI-2.
      5. Minors: In order to collect and maintain information pertaining to a minor within a human subject registry, the IRB will consider the following information which the PI is asked to supply at the time of submission:
        1. the relevant Children's category (usually 45CFR46.404) for the registry,

        2. informed permission by parents and guardians to maintain the child's information in a registry,

        3. assent by minors, as appropriate. The IRB my approve waiver of permission and/or assent if requested by PI, and

        4. whether data or tissues maintained in the registry are subject to informed consent upon the child reaching the age of majority.

      6. DNA testing. See WPP XVII-5 for information to be included in the consent form.
    3. How is system privacy and confidentiality ensured?
      1. A plan for protecting confidentiality: This plan may be the largest portion of the registry description, since breach of confidentiality is the greatest risk for registry protocols. Address as many of the details below as possible. If VCU is sending data/specimens outside of VCU, the information below is not often available from the central collection entity. The PI should make every effort to ascertain what kinds of confidentiality protections are in place; the IRB is to consider these with discretion:
        1. methods that will be used to protect confidentiality;
        2. methods used to organize and store information, including separating information according to categories in the informed consent form;
        3. safeguards to prevent accidental or inappropriate release of information;
        4. training of persons who collect information for inclusion in the registry;
        5. identification and qualifications of persons who are authorized to access or grant access to the information in the registry; and,
        6. conditions under which information contained in the registry may be released for usage protocols.
      2. Example Methods for Preserving Confidentiality: Since the importance of confidentiality increases with increased risk to registry participants, it is important to clearly describe the entire system for the preservation of confidentiality. Examples are provided below:
        1. A coding system with the key to the code should be stored in a separate location apart from the data registry. If the registry data must have identifiers, the IRB will require extensive electronic protections, such as multiple firewalls or passwords, for accessing the registry.
        2. Access to the key is available to limited authorized individuals who are trained about the registry and human research protections, including the preservation of confidentiality.
        3. One or several passwords are needed to access the registry and/or limiting knowledge of the passwords to authorized person(s).
        4. A computer without internet access and a rigorous back-up method is recommended for registry storage of especially sensitive data.
        5. If data will be backed up, or downloaded, on a portable computer or data drive, describe methods to secure data via password protection and other mechanisms.
        6. It is recommended that the PI obtain a Certificate of Confidentiality if inappropriate release of information in the registry would be greater than minimal risk and/or information being collected and maintained is sensitive or potentially incriminating. A copy of the Certificate of Confidentiality should be provided to the VCU IRB with the registry application.
        7. Exemplar: Draft guidelines are from the National Cancer Institute Technical and Operational Guidelines for Biorepositories. These guidelines comprise best practice for VCU PIs and the IRB, and should be viewed as guidance ONLY in reviewing the extent to which outside registries/repositories have incorporated protections for maintaining the confidentiality of data and specimens. In the case of cooperative research studies, such information may be described in the protocol or attached documents.
    4. Accessing an Existing Registry:

      Plans to use identifiable or coded data retained in a research registry may qualify as humans subjects research to be submitted to the IRB for review and approval prior to obtaining the data or specimens. The submission may be in the form of a separate protocol describing specific research questions, or may be an amendment to the protocol containing the research registry. All subsequent reference to a “Usage Protocol” in this WPP pertains to a separate protocol or an amendment.

      The VCU IRB may determine that a usage protocol is not covered by this policy if the data/specimens in the registry cannot be linked, directly or indirectly (via code), to any living human entity or if the dataset to be obtained will have no codes or identifiers AND if the registry data was not obtained for the specific protocol in question. The OHRP Guidance Document: "Research Involving Coded Private Information or Biological Specimens" will be used to determine applicability for IRB review.

      Submission and Review Guidelines (3 areas, below):

      1. General Guidelines:
        1. Development of the usage protocol or amendment: The usage protocol should reference the IRB number of the registry in the application and in the VCU Research Plan/Synopsis if the registry is located at VCU. If accessing a registry outside of VCU, the PI should clearly describe where the registry is located, how specimens/data were obtained, and the management of the registry.
        2. Initial Review: If a usage protocol is determined by the IRB to be ‘no greater than minimal risk,’ expedited review is permitted under Expedited Category 9. The following notes clarify this policy:
          1. The regulations itemizing expedited categories do not adequately address access of a registry, but Expedited Category 9 allows for the review of protocols where categories 2-8 do not apply (with certain other conditions). This expedited review category is recommended for use in this case and deemed “consistent with the intent of Expedited Category 9 referenced in the Federal Register 63(216):60364-60367, 1998.”  
          2. If the usage protocol is determined to be no greater than minimal risk, it need not first be reviewed by the Full Board, rather its initial expedited review, “consistent with the intent of Expedited Category 9,” is permitted by VCU.
        3. Continuing Review: Continuing review should be conducted under Expedited Category 9.
      2. What is the process for informed consent related to the registry/specimen bank?
        1. For purposes of IRB submission and review, the approved registry informed consent document, which is referenced in the usage protocol, is submitted together with the usage protocol. The usage protocol PI is to make an assessment that the registry informed consent form applies to the type of research proposed in the usage protocol. If the IRB is in agreement with the PI’s assessment, the registry protocol ICF may be referenced as the applicable ICF for the usage protocol. In other words, it is determined that the subject’s participation in the usage protocol has been prospectively agreed to ‘in principle’ through the registry informed consent. The IRB will make the final determination as to whether the registry protocol ICF applies to the proposed usage protocol.
        2. If the usage protocol requires a consent form that differs from that of the registry consent form, the IRB may: 1) determine that a waiver of consent is appropriate, or 2) require a separate consent process for the usage protocol. In such cases, the IRB may require that subjects who consented to having data or specimens collected and stored in the biorepository/registry may be asked to consent again.
        3. Note that in cases where the informed consent and/or assent form for the registry protocol is revised or amended, there may be implications for the ‘in principle’ informed consent for all affiliated usage protocols. The usage protocol PI and the registry PI are responsible for ascertaining that the registry consent/assent form is current and that it applies to the usage protocol.
      3. How is system privacy and confidentiality ensured? It is recommended that the PI obtain a Certificate of Confidentiality if the 'usage protocol' involves access or additional collection of data that is exceptionally sensitive or potentially incriminating, leading to greater than minimal risk and if the registry did not have a Certificate of Confidentiality. A copy of the Certificate of Confidentiality should be provided to the VCU IRB with the usage protocol application. It is understood that in cases where the risk associated with a breach of confidentiality is low, a Certificate of Confidentiality may not be relevant.
      • Most registry protocols or protocols containing plans for a registry can be reviewed by the VCU IRB via an appropriate category for expedited review. If a registry proposes to collect and store sensitive data or specimens, such that the potential risk is greater than minimal risk, the IRB will utilize Full Board review.
      • At the time of continuing review, a list of all usage protocols that accessed the registry should be provided in the IRB submission.


It is the responsibility of registry principal investigator to ensure the integrity of the registry and to ensure that the registry is protected. It is also the responsibility of the registry principal investigator to monitor and record all access to the registry, including maintaining a list of all usage protocols. It is the responsibility of the VCU IRB to carry out this policy.


"Research Involving Coded Private Information or Biological Specimens", Office of Human Research Protections, DHHS, Guidance Document, August 10, 2008.

M. Sobel & K. Hansen (2006) “Banking of human biological materials for research.” In E. Bankert & R. Amdur (Eds.) Institutional Review Board: Management and Function. Boston: Jones & Bartlett

First Generation Guidelines on NCI-Generated Biorepositories

NCI Office of Biorepositories and Biospecimen Research