{"id":728,"date":"2018-05-01T10:23:16","date_gmt":"2018-05-01T10:23:16","guid":{"rendered":"https:\/\/az.research.umich.edu\/medschool\/document\/privacy-and-confidentiality-protections-individual-level-data-policy\/"},"modified":"2026-08-19T16:35:44","modified_gmt":"2026-08-19T20:35:44","slug":"privacy-and-confidentiality-protections-individual-level-data-policy","status":"publish","type":"document","link":"https:\/\/az.research.umich.edu\/medschool\/policies\/privacy-and-confidentiality-protections-individual-level-data-policy\/","title":{"rendered":"Privacy and Confidentiality Protections for Individual-Level Data Policy"},"template":"","categories":[23],"tags":[60,59],"content-type":[72],"topic":[45,75],"update-type":[],"class_list":["post-728","document","type-document","status-publish","hentry","category-central-biorepository","tag-biorepository-use","tag-data-use","content-type-policies","topic-hipaa-protected-health-information","topic-regulations-policies-federal-state-local"],"acf":{"use_legacy_editor":true,"updated_date":"2026-07-20 12:00:00","update_notice":false,"author":"Central Biorepository","summary":"The University of Michigan Medical School (\u201cUMMS\u201d) Central Biorepository (\u201cCBR\u201d) serves as central storage, access, and administrative hub for human biospecimens and data associated with or derived from them. This policy operates subject to all applicable laws, regulations, and U-M policies regarding protection of clinical and research data. It sets standards specific to CBR operations in accordance with sound ethical principles and industry benchmarks, and it aims to respect participant rights and promote public trust in the CBR.\r\n\r\nPrinciples. To adhere to a standard of minimum necessary use and disclosure of sensitive individual-level data, CBR personnel and collaborating researchers should have access to individual-level data associated with CBR biospecimens only to the extent that such access is necessary to carrying out their job duties or their research aims, as defined in their research protocol and as approved by an Institutional Review Board (\u201cIRB\u201d) or Privacy Board, as applicable.","button_links":null,"related_content":"","legacy_path":"privacy-and-confidentiality-protections-individual-level-data-policy","legacy_node_id":251,"legacy_related_nids":"","legacy_content_section":[{"legacy_section_type":"heading","legacy_heading":"Policy and Procedures","legacy_subheading":"","legacy_section_text":"","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"text_area","legacy_heading":"","legacy_subheading":"","legacy_section_text":"A.<\/strong> Data access via the CBR Laboratory Information Management System (\u201cLIMS\u201d). <\/em>The LIMS administrator manages data access permissions based on role-based needs. To gain access to individual-level data in the LIMS, users are required to complete appropriate training, sign a Training and Usage Agreement, abide by all regulations, contract terms, U-M and Michigan Medicine policies concerning sensitive data and Protected Health Information (\u201cPHI\u201d)<\/a> under the Health Insurance Portability and Accountability Act (\u201cHIPAA<\/a>\u201d) Privacy<\/a> Rule.\r\n\r\nB.<\/strong> LIMS interactions<\/a> with other information systems.<\/em>CBR LIMS is interfaced with other U-M information systems using institutionally approved methods. These interfaces are permitted as necessary for LIMS security and integrity or in furtherance of the CBR\u2019s research mission. Access to CBR individual-level data through these systems will be limited to the \u201cminimum necessary\u201d standard required to accomplish the intended purpose.\r\n\r\nC.<\/strong>\u00a0Accounting for PHI disclosures.\u00a0<\/em>As the CBR is located within a\u00a0covered component of the University of Michigan Hybrid Covered Entity under the HIPAA Privacy Rule, the CBR will:\r\n
    \r\n \t
  1. Ensure that recipients of PHI disclosed by the CBR agree in Memoranda of Understanding (MOU), or other required documents, to use appropriate data protection measures.<\/li>\r\n \t
  2. Track disclosures made by the CBR of PHI that originated within a covered component of the U-M Hybrid Covered Entity<\/a>.<\/li>\r\n \t
  3. Make any other efforts required by the HIPAA regulations or as advised by Michigan Medicine or University of Michigan Compliance Offices.<\/li>\r\n<\/ol>\r\nD. <\/strong>Approvable distributions of CBR resources.<\/em>\r\n
      \r\n \t
    1. CBR biospecimens and data will be distributed to investigators without PHI, or as HIPAA Privacy Rule Limited Data Sets, so that those investigators cannot readily \u00a0identify the participants \u00a0who contributed the CBR resources.<\/li>\r\n \t
    2. Identifiable CBR biospecimens and data will only be distributed to investigators who are conducting research under an IRB-approved protocol.<\/li>\r\n<\/ol>\r\nE.<\/strong> Subsequent use of CBR resources by recipients: <\/em>Memoranda of Understanding; Material Transfer Agreements. <\/em>Each recipient of CBR biospecimens or data will be required to sign a Memorandum of Understanding defining the rights and obligations concerning confidentiality protections, use, redistribution, and disposition of the materials or their derivatives. <\/em>Material Transfer Agreements are only applicable to recipients external to the University of Michigan and are administered via the U-M Innovation Partnerships unit.\r\n\r\nAs applicable, these documents will:\r\n
        \r\n \t
      1. establish the permitted uses and disclosures of the research resources;<\/li>\r\n \t
      2. designate the authorized personnel or groups responsible for the custody and use of the resources;<\/li>\r\n \t
      3. prohibit the recipient from using, further disclosing, or redistributing the resources, unless authorized within the document, an IRB or Privacy Board, other valid University of Michigan agreement, or law;<\/li>\r\n \t
      4. require the recipient to use appropriate safeguards to prevent unauthorized use or disclosure;<\/li>\r\n \t
      5. require the recipient to immediately report any unauthorized use, disclosure or inadvertent re-identification to the Michigan Medicine Compliance Office;<\/li>\r\n \t
      6. prohibit the recipient from identifying or contacting the individuals to whom the resources pertain; and<\/li>\r\n \t
      7. state the biohazardous nature of the human biospecimen.<\/li>\r\n<\/ol>\r\nF. <\/strong>Biospecimen labeling.<\/em> CBR standard practice is to label biospecimen containers without direct identifiers. Any container that enters CBR custody with such identifiers, will be relabeled to remove them. If identifiers on labels are necessary, their use will be limited to the minimum necessary for that purpose.\r\n\r\nG.<\/strong> Biospecimen and data transfer from the CBR. <\/em> Biospecimens will be transferred from the CBR in barcoded containers with no identifying information printed on the label. No deviations from this standard will be allowed unless approved by an IRB or Privacy Board, as appropriate. Data will be transferred using only secured means that meet Michigan Medicine privacy standards.\r\n\r\nH.\u00a0<\/strong>Disposition of CBR resources. <\/em>Biospecimens, data, and related regulatory documents will be disposed of or destroyed as required and in accordance with all applicable standards and directives. Biospecimen labels will be disposed with biospecimen containers unless they are removed and destroyed before container disposal.","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"heading","legacy_heading":"References and Definitions","legacy_subheading":"","legacy_section_text":"","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"text_area","legacy_heading":"","legacy_subheading":"","legacy_section_text":"Identifying information<\/em>: any item or combination of items in the research\u00a0data that could lead directly or indirectly to the identification of a research<\/a> subject.\r\n\r\nCBR program:<\/em> A U-M research effort that participates in the CBR by collecting biospecimens and storing all or some of those biospecimens in the CBR.\r\n\r\nCBR resources:<\/em> Materials or biospecimens collected under a CBR program and data associated with or derived from those biospecimens for research.\r\n\r\n45 CFR Part 46<\/a>\r\n45 CFR Parts 160, 162, and 164\r\n\r\nCBR Standard Operating Procedure LG002 \u201cBiospecimen Disposal Processing and Documentation.\u201d\r\n\r\nMichigan Medicine Compliance Program: Corporate Compliance<\/a> https:\/\/umhealth.sharepoint.com\/sites\/Corporate-Compliance\/","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"heading","legacy_heading":"History of Policy","legacy_subheading":"","legacy_section_text":"","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"text_area","legacy_heading":"","legacy_subheading":"","legacy_section_text":"A.<\/strong>\u00a0Original Approval Date<\/a>\r\n

        July 16, 2015<\/p>\r\nB.\u00a0<\/strong>Revisions\r\n

          \r\n \t
        1. 06\/15\/2017: Scope of this policy harmonized with that of the CBR Certificate of Confidentiality<\/a>; \u00a7II.H adjusted to reflect practice.<\/li>\r\n \t
        2. 03\/19\/2018: Minor corrections of terminology made in \u00a7\u00a7III(C) and III(E).<\/li>\r\n \t
        3. 02\/27\/2020: Changed UMHS references to Michigan Medicine; minor language and format revisions in \u00a7II(D),(E).<\/li>\r\n \t
        4. 04\/28\/2023: Updated definitions, format, header, and footer.<\/li>\r\n \t
        5. 07\/20\/2026:\r\n