Privacy and Confidentiality Protections for Individual-Level Data Policy

Central Biorepository
Apr 28, 2023 12:00 pm

The University of Michigan Medical School (UMMS) Central Biorepository (CBR) is a repository of human biospecimens that serves as central storage facility, point of research access, and administrative hub for research using these biospecimens and data associated with or derived from them. This policy operates subject to all applicable laws, regulations, and U-M policies regarding protection of clinical and research data. It sets standards specific to CBR operations in accordance with sound ethical principles and industry benchmarks, and it aims to respect donor rights and promote public trust in the CBR. 

Principles. To adhere to a standard of minimum necessary use and disclosure of sensitive individual-level data, CBR personnel and collaborating researchers should have access to individual-level data associated with CBR biospecimens only to the extent that such access is necessary to carrying out their job duties or their research aims, as defined in their research protocol and as approved by an Institutional Review Board (IRB) or Privacy Board, as applicable.

  • Policy and Procedures

    A. Data access via the CBR laboratory information management system (LIMS). The LIMS administrator will assign data viewing permissions according to each individual user’s job-related need to access individual-level data in the LIMS. All users of the LIMS will be required to sign a Training and Usage Agreement and to abide by all regulations, contract terms, and U-M and Michigan Medicine policies concerning sensitive data and Protected Health Information (“PHI”) under the Health Insurance Portability and Accountability Act (“HIPAA”) Privacy Rule.

    B. LIMS interactions with other information systems. The CBR will allow the CBR LIMS to be interfaced with other U-M information systems using institutionally approved methods and only as necessary for LIMS security and integrity or in furtherance of the CBR’s research mission. Access to CBR individual-level data through these systems will be limited to the minimum necessary for these purposes.

    C. Accounting for PHI disclosures. As the CBR is located within a covered component of the University of Michigan Hybrid Covered Entity under the HIPAA Privacy Rule, the CBR will:

    1. Ensure that recipients of PHI disclosed by the CBR agree in Memoranda of Understanding or other required documents to appropriate data protection measures. 
    2. Track disclosures made by the CBR of PHI that originated within a covered component of the U-M Hybrid Covered Entity.
    3. Make any other efforts required by the HIPAA regulations or as advised by UMHS Compliance.

    D. Approvable distributions of CBR biospecimens and data.

    1. CBR biospecimens and data will be distributed to investigators preferentially in a manner such that distributed datasets do not include PHI or do qualify as HIPAA Privacy Rule Limited Data Sets, and such that those investigators cannot readily ascertain the identities of the subjects to whom the materials pertain.
    2. CBR staff will assist investigators who present a compelling research need for identifying individual-level data in applying to an IRB for review and approval of such a project, as requested. CBR biospecimens and data will be distributed to investigators who are conducting research under an IRB-approved protocol only in accordance with that protocol. No identifying individual-level data will be distributed without such approval.

    E. Subsequent use of CBR materials by recipients: Memoranda of Understanding; Material Transfer Agreements. Each recipient of CBR biospecimens or data will be required to enter into a Memorandum of Understanding to define the rights and obligations of the CBR and the recipient concerning confidentiality protections and subsequent use, redistribution, and disposition of the materials and any future derivatives of them. Material Transfer Agreements are only applicable to recipients external to the University of Michigan and are administered via the U-M Office of Technology Transfer. Each of these will, as appropriate:

    1. establish the permitted uses and disclosures of the research materials;
    2. identify who may use or receive the materials;
    3. prohibit the recipient from using or further disclosing or distributing the materials, except as permitted by the agreement, by IRB or Privacy Board approval, by another valid University of Michigan agreement, or by law;

    4. require the recipient to use appropriate safeguards to prevent a use or disclosure that is not permitted by the agreement;

    5. require the recipient to report to the CBR any unauthorized use or disclosure of which it becomes aware;

    6. prohibit the recipient from identifying or contacting the individuals to whom the materials pertain; and

    7. prohibit the CBR from providing the recipient with the key to any coded materials.

    F. Biospecimen labeling. CBR standard practice is to label biospecimen containers with no direct identifiers. When biospecimen containers enter CBR custody with such identifiers, containers will be relabeled without direct identifiers as soon as is practicable. When use of identifiers on labels is necessary for quality improvement purposes, both the amount of identifying information used and the duration of its use will be the minimum necessary for that purpose.

    G. Biospecimen and data transfer from the CBR. Biospecimens will be transferred from the CBR in barcoded containers with no identifying information printed on the label. No deviations from this standard will be allowed unless approved by an IRB or Privacy Board, as appropriate. Data will be transferred using only secured means approved by UMHS Compliance.

    H. Disposition of CBR materials. Biospecimens, data, and related regulatory documents will be disposed of or destroyed as required and in accordance with all applicable standards and directives. Biospecimen labels will be disposed with biospecimen containers unless they are removed before disposal.

  • References and Definitions

    Identifying information: any item or combination of items in the research data that could lead directly or indirectly to the identification of a research subject.

    45 CFR Part 46 
    45 CFR Parts 160, 162, and 164

    CBR Standard Operating Procedure LG002 “Biospecimen Disposal Processing and Documentation.”

    Michigan Medicine Compliance Program: http://med.umich.edu/u/compliance/index.htm 

  • History of Policy

    A. Original Approval Date

    July 16, 2015

    B. Revisions

    1. 06/15/2017: Scope of this policy harmonized with that of the CBR Certificate of Confidentiality; §II.H adjusted to reflect practice.
    2. 03/19/2018: Minor corrections of terminology made in §§III(C) and III(E).

    3. 02/27/2020: Changed UMHS references to Michigan Medicine; minor language and format revisions in §II(D),(E).

    4. 04/28/2023: Updated definitions, format, header, and footer. 


  • Approved By

    Signed by: Victoria Blanc, Director of University of Michigan Medical School Central Biorepository on 28 April 2023.
    (original signed document on file at CBR)


Contact us at CBR-Requests@med.umich.edu or 734-647-8809 

2800 Plymouth Road, NCRC Building 60, Room 1661, Ann Arbor, MI 48109-2800

Edited By: dagi@umich.edu
Last Updated: June 9, 2023 10:00 AM