Privacy and Confidentiality Protections for Individual-Level Data Policy

A. Data access via the CBR Laboratory Information Management System (“LIMS”). The LIMS administrator manages data access permissions based on role-based needs. To gain access to individual-level data in the LIMS, users are required to complete appropriate training, sign a Training and Usage Agreement, abide by all regulations, contract terms, U-M and Michigan Medicine policies concerning sensitive data and Protected Health Information (“PHI”) under the Health Insurance Portability and Accountability Act (“HIPAA”) Privacy Rule.

B. LIMS interactions with other information systems.CBR LIMS is interfaced with other U-M information systems using institutionally approved methods. These interfaces are permitted as necessary for LIMS security and integrity or in furtherance of the CBR’s research mission. Access to CBR individual-level data through these systems will be limited to the “minimum necessary” standard required to accomplish the intended purpose.

C. Accounting for PHI disclosures. As the CBR is located within a covered component of the University of Michigan Hybrid Covered Entity under the HIPAA Privacy Rule, the CBR will:

1. Ensure that recipients of PHI disclosed by the CBR agree in Memoranda of Understanding (MOU), or other required documents, to use appropriate data protection measures.
2. Track disclosures made by the CBR of PHI that originated within a covered component of the U-M Hybrid Covered Entity.
3. Make any other efforts required by the HIPAA regulations or as advised by Michigan Medicine or University of Michigan Compliance Offices.

D. Approvable distributions of CBR resources.

1. CBR biospecimens and data will be distributed to investigators without PHI, or as HIPAA Privacy Rule Limited Data Sets, so that those investigators cannot readily  identify the participants  who contributed the CBR resources.
2. Identifiable CBR biospecimens and data will only be distributed to investigators who are conducting research under an IRB-approved protocol.

E. Subsequent use of CBR resources by recipients: Memoranda of Understanding; Material Transfer Agreements. Each recipient of CBR biospecimens or data will be required to sign a Memorandum of Understanding defining the rights and obligations concerning confidentiality protections, use, redistribution, and disposition of the materials or their derivatives. Material Transfer Agreements are only applicable to recipients external to the University of Michigan and are administered via the U-M Innovation Partnerships unit.

As applicable, these documents will:

1. establish the permitted uses and disclosures of the research resources;
2. designate the authorized personnel or groups responsible for the custody and use of the resources;
3. prohibit the recipient from using, further disclosing, or redistributing the resources, unless authorized within the document, an IRB or Privacy Board, other valid University of Michigan agreement, or law;
4. require the recipient to use appropriate safeguards to prevent unauthorized use or disclosure;
5. require the recipient to immediately report any unauthorized use, disclosure or inadvertent re-identification to the Michigan Medicine Compliance Office;
6. prohibit the recipient from identifying or contacting the individuals to whom the resources pertain; and
7. state the biohazardous nature of the human biospecimen.

F. Biospecimen labeling. CBR standard practice is to label biospecimen containers without direct identifiers. Any container that enters CBR custody with such identifiers, will be relabeled to remove them. If identifiers on labels are necessary, their use will be limited to the minimum necessary for that purpose.

G. Biospecimen and data transfer from the CBR. Biospecimens will be transferred from the CBR in barcoded containers with no identifying information printed on the label. No deviations from this standard will be allowed unless approved by an IRB or Privacy Board, as appropriate. Data will be transferred using only secured means that meet Michigan Medicine privacy standards.

H. Disposition of CBR resources. Biospecimens, data, and related regulatory documents will be disposed of or destroyed as required and in accordance with all applicable standards and directives. Biospecimen labels will be disposed with biospecimen containers unless they are removed and destroyed before container disposal.

Identifying information: any item or combination of items in the research data that could lead directly or indirectly to the identification of a research subject.

CBR program: A U-M research effort that participates in the CBR by collecting biospecimens and storing all or some of those biospecimens in the CBR.

CBR resources: Materials or biospecimens collected under a CBR program and data associated with or derived from those biospecimens for research.

45 CFR Part 46
45 CFR Parts 160, 162, and 164

CBR Standard Operating Procedure LG002 “Biospecimen Disposal Processing and Documentation.”

Michigan Medicine Compliance Program: Corporate Compliance https://umhealth.sharepoint.com/sites/Corporate-Compliance/

A. Original Approval Date

July 16, 2015

B. Revisions

1. 06/15/2017: Scope of this policy harmonized with that of the CBR Certificate of Confidentiality; §II.H adjusted to reflect practice.
2. 03/19/2018: Minor corrections of terminology made in §§III(C) and III(E).
3. 02/27/2020: Changed UMHS references to Michigan Medicine; minor language and format revisions in §II(D),(E).
4. 04/28/2023: Updated definitions, format, header, and footer.
5. 07/20/2026:
   • Minor clarifications throughout.
   • Added references of CBR resources and CBR program. Updated nomenclature accordingly.
   • Updated the “office of technology transfers’ with the current “Innovation Partnerships” unit.
   • Revised bullet II.E.7.
   • Updated reference to the current Corporate Compliance link.

Signed by: Victoria Blanc, Director of University of Michigan Medical School Central Biorepository on 28 April 2023.
(original signed document on file at CBR)