Policies

Privacy and Confidentiality Protections for Individual-Level Data Policy

Central Biorepository
Jun 15, 2017 12:00 pm

This policy operates subject to all applicable laws, regulations, and U-M policies regarding protection of clinical and research data. It sets standards specific to Central Biorepository (CBR) operations in accordance with sound ethical principles and industry benchmarks, and it aims to respect donor rights and promote public trust in the CBR.

Principles. To adhere to a standard of minimum necessary use and disclosure of sensitive individual-level data, CBR personnel and collaborating researchers should have access to individual-level data associated with CBR biospecimens only to the extent that such access is necessary to carrying out their job duties or their research aims, as defined in their research protocol and as approved by an Institutional Review Board (IRB) or Privacy Board, as applicable.

  • Policy and Procedures

    A. Data access via the CBR laboratory information management system (LIMS). The LIMS administrator will assign data viewing permissions according to each individual user’s job-related need to access individual-level data in the LIMS. All users of the LIMS will be required to sign a Training and Usage Agreement and to abide by all regulations, contract terms, and U-M and UMHS policies concerning sensitive data and Protected Health Information (“PHI”) under the Health Insurance Portability and Accountability Act (“HIPAA”) Privacy Rule.

    B. LIMS interactions with other information systems. The CBR will allow the CBR LIMS to be interfaced with other U-M information systems using institutionally approved methods and only as necessary for LIMS security and integrity or in furtherance of the CBR’s research mission. Access to CBR individual-level data through these systems will be limited to the minimum necessary for these purposes.

    C. Accounting for PHI disclosures. As the CBR is located within a covered component of the University of Michigan Hybrid Covered.

    Entity under the HIPAA Privacy Rule, the CBR will:

    1. Ensure that recipients of PHI disclosed by the CBR agree in Data Use Agreements to appropriate data protection measures.
    2. Track disclosures made by the CBR of PHI that originated within a covered component of the U-M Hybrid Covered Entity.
    3. Make any other efforts required by the HIPAA regulations or as advised by UMHS Compliance.

    D. Approvable distributions of CBR biospecimens and data.

    1. CBR biospecimens and data typically will be distributed to investigators only in a manner such that distributed datasets do not include PHI or do qualify as HIPAA Privacy Rule Limited Data Sets, and such that those investigators cannot readily ascertain the identities of the subjects to whom the materials pertain.
    2. CBR staff will assist investigators who present a compelling research need for identifying individual-level data in applying to an IRB for review and approval of such a project. CBR biospecimens and data will be distributed to investigators who are conducting research under an IRB-approved Protocol only in accordance with that protocol. No identifying individual-level data will be distributed without such approval.

    E. Subsequent use of CBR materials by recipients:, Material and Data Use Agreements; Material Transfer Agreements. Each recipient of CBR biospecimens or data will be required to enter into a formal agreement to define the rights and obligations of the CBR and the recipient concerning confidentiality protections and subsequent use, redistribution, and disposition of the materials and any future derivatives of them. Material Transfer Agreements are only applicable to recipients external to the University of Michigan. These agreements will:

    1. establish the permitted uses and disclosures of the research materials;
    2. identify who may use or receive the materials;
    3. prohibit the recipient from using or further disclosing or distributing the materials, except as permitted by the agreement, by IRB or Privacy Board approval, by another valid University of Michigan agreement, or by law;

    4. require the recipient to use appropriate safeguards to prevent a use or disclosure that is not permitted by the agreement;

    5. require the recipient to report to the CBR any unauthorized use or disclosure of which it becomes aware;

    6. prohibit the recipient from identifying or contacting the individuals to whom the materials pertain; and

    7. prohibit the CBR from providing the recipient with the key to any coded materials.

    F. Biospecimen labeling. CBR standard practice is to label biospecimen containers with no direct identifiers. When biospecimen containers enter CBR custody with such identifiers, containers will be relabeled without direct identifiers as soon as is practicable. When use of identifiers on labels is necessary for quality improvement purposes, both the amount of identifying information used and the duration of its use will be the minimum necessary for that purpose.

    G. Biospecimen and data transfer from the CBR. Biospecimens will be transferred from the CBR in barcoded containers with no identifying information printed on the label. No deviations from this standard will be allowed unless approved by an IRB or Privacy Board, as appropriate. Data will be transferred using only secured means approved by UMHS Compliance.

    H. Disposition of CBR materials. Biospecimens, data, and related regulatory documents will be disposed of or destroyed as required and in accordance with all applicable standards and directives. Biospecimen labels will be disposed with biospecimen containers unless they are removed before disposal for recordkeeping purposes, such as to document disposal after a withdrawal of consent.

  • References and Definitions

    Identifying information: any item or combination of items in the research data that could lead directly or indirectly to the identification of a research subject.

    45 CFR Part 46 (2009)
    45 CFR Parts 160, 162, and 164

    CBR Standard Operating Procedure LG002 “Biospecimen Disposal Processing and Documentation.”

    UMHS Compliance Program: http://med.umich.edu/u/compliance/index.htm 

  • History of Policy

    A. Original Approval Date

    July 16, 2015

    B. Revisions

    1. 06/15/2017: Scope of this policy harmonized with that of the CBR Certificate of Confidentiality; §II.H adjusted to reflect practice.

  • Approval on behalf of the UMMS CBR Governance Committee

    Signed by: Victoria Blanc, Director of University of Michigan Medical School Central Biorepository on 15 June 2017
    (original signed document on file at CBR)

Questions?

Contact us at CBR.Requests@umich.edu or 734-647-8809 

2800 Plymouth Road, NCRC Building 60, Room 1660, Ann Arbor, MI 48109-2800

A list of Central Biorepository contacts is available in the Personnel Directory.

Edited By: mhayward@umich.edu
Last Updated: June 29, 2018 2:00 PM