{"id":772,"date":"2018-05-08T07:59:52","date_gmt":"2018-05-08T07:59:52","guid":{"rendered":"https:\/\/az.research.umich.edu\/medschool\/document\/responsibility-rep-oversight-and-compliance\/"},"modified":"2026-04-07T11:32:35","modified_gmt":"2026-04-07T15:32:35","slug":"responsibility-rep-oversight-and-compliance","status":"publish","type":"document","link":"https:\/\/az.research.umich.edu\/medschool\/guidance\/responsibility-rep-oversight-and-compliance\/","title":{"rendered":"Responsibility for REP Oversight and Compliance"},"template":"","categories":[24],"tags":[],"content-type":[41],"topic":[42,43,45,66,27],"update-type":[],"class_list":["post-772","document","type-document","status-publish","hentry","category-institutional-review-boards-irbmed","content-type-guidance","topic-application-types","topic-eresearch-regulatory-management-errm","topic-hipaa-protected-health-information","topic-investigator-study-team-responsibilities","topic-repository"],"acf":{"use_legacy_editor":true,"updated_date":"2025-11-11 13:45:00","update_notice":true,"author":"IRBMED","summary":"REP application and\u00a0<a href=\"\/medschool\/guidance\/tips-rep-application-and-supplement-form\">Application Supplement Form<\/a>\u00a0capture several different levels and types of information about a <a class=\"gtip\" href=\"\/medschool\/glossary\/repository\">repository's<\/a> processes and intents, including:\r\n<ul>\r\n \t<li>information characterizing a repository to identify useful relationships for\r\n<ul>\r\n \t<li>researchers intending to deposit into a repository<\/li>\r\n \t<li>researchers intending \"secondary use\" of repository data\/biospecimens<\/li>\r\n<\/ul>\r\n<\/li>\r\n \t<li>information to assure <a class=\"gtip\" href=\"\/medschool\/glossary\/compliance\">compliance<\/a> with University policies\r\n<ul>\r\n \t<li>data security<\/li>\r\n \t<li>physical security<\/li>\r\n \t<li>repository governance<\/li>\r\n<\/ul>\r\n<\/li>\r\n<\/ul>","button_links":null,"related_content":[739,757,747,844],"legacy_path":"responsibility-rep-oversight-and-compliance","legacy_node_id":314,"legacy_related_nids":"277, 299, 288, 402","legacy_content_section":[{"legacy_section_type":"heading","legacy_heading":"Services available from large-scale repositories","legacy_subheading":"","legacy_section_text":"","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"text_area","legacy_heading":"","legacy_subheading":"","legacy_section_text":"Large-scale biorepositories such as\u00a0<a href=\"https:\/\/medresearch.umich.edu\/office-research\/about-office-research\/our-units\/central-biorepository\">UMHS Central Biorepository<\/a>\u00a0are able to provide a variety of services to depositing researchers and \"secondary use\" researchers. These may include\r\n<ul>\r\n \t<li>sample processing<\/li>\r\n \t<li>providing physical storage space for biospecimens \"sequestered\" for some time for use only by original research team<\/li>\r\n \t<li>Established standard procedures for data\/biospecimen integrity, sustainability, governance including dispute resolution, &amp;c.<\/li>\r\n \t<li>Specimens obtained under standard consent provisions unambiguous as to allowed and disallowed future uses.<\/li>\r\n<\/ul>\r\nIndividual research teams wishing to retain data\/biospecimens for future research may appreciate the efficiency of depositing into a large-scale established <a class=\"gtip\" href=\"\/medschool\/glossary\/repository\">repository<\/a> rather than starting a new repository.","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"heading","legacy_heading":"Compliance with Institutional Policy","legacy_subheading":"","legacy_section_text":"","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"text_area","legacy_heading":"","legacy_subheading":"","legacy_section_text":"Consistent with Institutional policy, the REP application and\u00a0<a href=\"\/medschool\/guidance\/tips-rep-application-and-supplement-form\">Application Supplement Form<\/a>\u00a0should also include information regarding\r\n<ul>\r\n \t<li>Physical storage and maintenance<\/li>\r\n \t<li>Governance and oversight of the <a class=\"gtip\" href=\"\/medschool\/glossary\/repository\">repository<\/a><\/li>\r\n<\/ul>\r\nAlthough the IRB may be able to provide feedback on storage and governance plans, IRB oversight does\u00a0<strong>not<\/strong>\u00a0include determinations as to adequacy of these plans.","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"heading","legacy_heading":"IRB Oversight","legacy_subheading":"","legacy_section_text":"","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"text_area","legacy_heading":"","legacy_subheading":"","legacy_section_text":"In order to protect <a class=\"gtip\" href=\"\/medschool\/glossary\/human-subject-0\">human subjects<\/a>, the IRB provides review, approval, and ongoing oversight for the following procedures associated with repositories:\r\n<ul>\r\n \t<li>Obtaining data\/biospecimens for inclusion in the repository<\/li>\r\n \t<li>Storage and management of data\/biospecimens in the repository<\/li>\r\n \t<li>Distribution of data\/biospecimens to other <a class=\"gtip\" href=\"\/medschool\/glossary\/investigator\">investigators<\/a><\/li>\r\n<\/ul>","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"text_area_with_subheading","legacy_heading":"","legacy_subheading":"Informed Consent\/HIPAA authorization","legacy_section_text":"Research repositories obtain data\/biospecimens collected via:\r\n<ul>\r\n \t<li>IRB <a class=\"gtip\" href=\"\/medschool\/glossary\/approved-decision\">approved<\/a> research <a class=\"gtip\" href=\"\/medschool\/glossary\/informed-consent\">informed consent<\/a>\/<a class=\"gtip\" href=\"\/medschool\/glossary\/hipaa\">HIPAA<\/a> Authorization<\/li>\r\n \t<li>Research conducted under a waiver of informed consent granted by the IRB<\/li>\r\n \t<li>Clinical informed consent permitting research use (no IRB approval)<\/li>\r\n<\/ul>\r\n<table style=\"border-collapse: collapse;width: 100%\">\r\n<tbody>\r\n<tr>\r\n<td style=\"width: 100%\">When appropriate, Repositories may request IRB approval for waiver of informed consent (and, if appropriate, HIPAA authorization) by attaching a <a href=\"\/medschool\/wp-content\/uploads\/sites\/3\/2024\/12\/res_irbmed_waiver-IC-auth_0_0.doc\">consent\/authorization waiver request form<\/a>\u00a0in\u00a0<strong>section 8.2<\/strong>\u00a0of the REP.<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\nIRB approval for the repository (REP application)\u00a0<strong>need not<\/strong>\u00a0include consideration of informed consent\/<a href=\"https:\/\/az.research.umich.edu\/medschool\/guidance\/hipaa\">HIPAA\u00a0<\/a>authorization, or approval of waiver of consent\/authorization, when\r\n<ul>\r\n \t<li>A\u00a0research repository\u00a0is created with data\/biospecimens that are anonymous, and queries into the database could not result in situations where the data\/biospecimens could become identifiable.<\/li>\r\n \t<li>A query of a\u00a0clinical\u00a0or research data repository\u00a0produces only deidentified aggregate counts and there is assurance that all\u00a0<a href=\"https:\/\/az.research.umich.edu\/medschool\/guidance\/protected-health-information-phi\">HIPAA identifiers<\/a>\u00a0are removed.\u00a0 The researcher\u00a0never\u00a0has access to identifiers.\u00a0 A data use agreement may be required by entity managing the repository.<\/li>\r\n<\/ul>\r\nIRB approval for the repository (REP application)\u00a0<strong>must\u00a0include<\/strong> consideration of informed consent\/<a href=\"https:\/\/az.research.umich.edu\/medschool\/guidance\/hipaa\">HIPAA<\/a>\u00a0authorization, or approval of waiver of consent\/authorization, when\r\n<ul>\r\n \t<li>A\u00a0<em>research repository\u00a0<\/em>containing identifiable information is created from data\/biospecimens collected for clinical purposes, or data\/biospecimens collected as part of a research study where the research or clinical consent did not contain permissions that would allow for the subject\u2019s information to be placed in the repository<\/li>\r\n \t<li>The\u00a0<em>research data repository<\/em>\u00a0contains identifiable information not collected under prior IRB approval\/HIPAA Authorization and identifiable data may be extracted for research purposes (e.g., <a class=\"gtip\" href=\"\/medschool\/glossary\/umhs\">UMHS<\/a> Research Data Warehouse [RDW]). Data could be directly identifiable, or could become identifiable if the data recipient has access to codes permitting re-identification.<\/li>\r\n<\/ul>","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"heading","legacy_heading":"Repository responsibilities regarding risks of secondary uses","legacy_subheading":"","legacy_section_text":"","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"text_area","legacy_heading":"","legacy_subheading":"","legacy_section_text":"Repositories should assess certain kinds of <a class=\"gtip\" href=\"\/medschool\/glossary\/risk\">risks<\/a> before making resources available for secondary <a class=\"gtip\" href=\"\/medschool\/glossary\/research\">research<\/a>, even when that research is not subject to federal regulations and <a class=\"gtip\" href=\"\/medschool\/glossary\/institutional-review-board-irb\">IRB<\/a> oversight, most often because the resources are not \"individually identifiable.\" (Secondary use that meets the definition of \"<a class=\"gtip\" href=\"\/medschool\/glossary\/human-subject-0\">human subjects<\/a> research\" also requires IRB oversight.)\r\n<table border=\"1\" cellspacing=\"1\" cellpadding=\"1\">\r\n<tbody>\r\n<tr>\r\n<td><strong>Type of risk<\/strong><\/td>\r\n<td><strong>Description\/subtype<\/strong><\/td>\r\n<td><strong>Examples<\/strong><\/td>\r\n<\/tr>\r\n<tr>\r\n<td><strong>Group risks<\/strong><\/td>\r\n<td>Individual-level risks of identification\/association with a group described by the research<\/td>\r\n<td>If the BRCA1 gene is found and reported to be associated with increased risk of breast cancer and also to occur with greater frequency among Ashkenazi Jews, each individual who identifies or is identified as Ashkenazi Jewish becomes associated with BRCA1 and increased risk of breast cancer. This association could have various negative effects for these individuals.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><strong>Group risks<\/strong><\/td>\r\n<td>Risks to groups\u00a0<em>qua groups<\/em><\/td>\r\n<td>Genetic studies of blood samples from members of the Havasupai Indian Tribe traced the group\u2019s migration from Asia across the Bering Strait to present day Arizona. This is in conflict with the Tribe\u2019s traditional belief that they originated from the Grand Canyon and threatens certain aspects of the group\u2019s identity.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><strong>Moral risks<\/strong><\/td>\r\n<td>Individual-level risks of supporting research to which one would object<\/td>\r\n<td>\r\n<ul>\r\n \t<li>Discovery of <a class=\"gtip\" href=\"\/medschool\/glossary\/genotype\">genotypes<\/a>\u00a0associated with phenotypes that some in society may deem undesirable could lead to prenatal genetic screening for the genotype and selective abortions, to which some donors of <a class=\"gtip\" href=\"\/medschool\/glossary\/de-identified\">de-identified <\/a>resources might object.<\/li>\r\n \t<li>Surveys have shown that some donors of biospecimens and data to public institutions object to those materials being used for profit.<\/li>\r\n<\/ul>\r\n<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"heading","legacy_heading":"Repository responsibilities regarding disclosures of Protected Health Information (PHI)","legacy_subheading":"","legacy_section_text":"","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"text_area","legacy_heading":"","legacy_subheading":"","legacy_section_text":"<a href=\"\/medschool\/guidance\/protected-health-information-phi\">Protected Health Information\u00a0(PHI)<\/a> includes any information in the medical record that can be used to identify an individual and that was created, used, or disclosed in the course of providing a health care service.\u00a0<a class=\"gtip\" href=\"\/medschool\/guidance\/uses-disclosures-protected-health-information-phi\">Disclosures<\/a>\u00a0of <a class=\"gtip\" href=\"\/medschool\/glossary\/protected-health-information-phi\">PHI<\/a> (sharing outside the\u00a0<a class=\"gtip\" href=\"\/medschool\/glossary\/covered-entity\">U-M covered component<\/a>) without Authorization must be tracked. For more information, see\u00a0<a class=\"gtip\" href=\"https:\/\/michmed-administration.policystat.com\/policy\/8000063\/latest\/\">UMHS Policy 01-04-335<\/a>\u00a0(available on <a class=\"gtip\" href=\"https:\/\/michmed-administration.policystat.com\/home\/\">PolicyStat<\/a>, <em>requires level-2 login<\/em>).\r\n\r\nA repository that distributes PHI to a secondary user\u00a0<strong>is not<\/strong>\u00a0directly responsible for tracking additional disclosures made\u00a0<strong>by<\/strong>\u00a0the secondary user.\u00a0<strong>However<\/strong>, the repository\u00a0<strong>is<\/strong>\u00a0responsible for ensuring via DUAs\/MOUs\/&amp;c. that the secondary user agrees to appropriate <a class=\"gtip\" href=\"\/medschool\/glossary\/privacy\">privacy<\/a> and <a class=\"gtip\" href=\"\/medschool\/glossary\/confidentiality\">confidentiality<\/a> protections, including appropriate limits on re-disclosure.\r\n<table style=\"width: 500px\" border=\"1\" cellspacing=\"1\" cellpadding=\"1\">\r\n<tbody>\r\n<tr>\r\n<td><strong>Repository<\/strong><\/td>\r\n<td><strong>Data provider<\/strong><\/td>\r\n<td><strong>Who tracks PHI disclosure into REP?<\/strong><\/td>\r\n<td><strong>Repository responsibility for PHI disclosed to 2nd user<\/strong><\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Inside U-M CE<\/td>\r\n<td>Inside U-M CE<\/td>\r\n<td>N\/A<\/td>\r\n<td>Track disclosure<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Outside U-M CE<\/td>\r\n<td>Inside U-M CE<\/td>\r\n<td>Data provider<\/td>\r\n<td>Ensure DUA(s) include protections accorded PHI<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Inside U-M CE<\/td>\r\n<td>Another non-U-M CE (e.g.\u00a0Duke)<\/td>\r\n<td>Data provider<\/td>\r\n<td>Ensure DUA(s) include protections accorded PHI<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Outside U-M CE (e.g.\u00a0SPH)<\/td>\r\n<td>Another non-U-M CE (e.g.\u00a0Duke)<\/td>\r\n<td>Data provider<\/td>\r\n<td>Ensure DUA(s) include protections accorded PHI<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Inside or Outside U-M CE<\/td>\r\n<td>not part of any CE<\/td>\r\n<td>N\/A<\/td>\r\n<td>N\/A<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null}],"update_notice_type":[98],"update_notice_start":"2025-11-11 13:45:00","update_notice_end":"2026-01-03 00:00:00","update_notice_text_blocks":[{"update_notice_text":"A new version is available of the form to upload to request a waiver of informed consent and\/or HIPAA authorization in the \"Informed Consent\/HIPAA authorization\" heading. This replaces both the earlier \"consent waiver request form\" and \"consent\/authorization waiver request form.\""}],"global_contact_block":false,"contact_name":"","contact_email":"","contact_additional_info":"Contact us at\u00a0<a href=\"mailto:irbmed@umich.edu\">irbmed@umich.edu<\/a>\u00a0or 734-763-4768 \/ (Fax 734-763-1234)\r\n\r\n2800 Plymouth Road, Ann Arbor, MI 48109-2800\r\n\r\nA <a href=\"https:\/\/medresearch.umich.edu\/office-research\/about-office-research\/our-units\/institutional-review-boards-irbmed\/irbmed-contacts-roster#irbmed-staff\">list of IRBMED staff<\/a> is available at our website.\r\n\r\nEdited By:\u00a0<a href=\"mailto:larkspur@umich.edu\">larkspur@umich.edu<\/a>\r\nLast Updated: April 7, 2026 11:30AM","global_contact_block_select":null},"_links":{"self":[{"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/document\/772","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/document"}],"about":[{"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/types\/document"}],"version-history":[{"count":3,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/document\/772\/revisions"}],"predecessor-version":[{"id":1949,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/document\/772\/revisions\/1949"}],"acf:term":[{"embeddable":true,"taxonomy":"update-type","href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/update-type\/98"}],"acf:post":[{"embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/document\/844"},{"embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/document\/747"},{"embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/document\/757"},{"embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/document\/739"}],"wp:attachment":[{"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/media?parent=772"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/categories?post=772"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/tags?post=772"},{"taxonomy":"content-type","embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/content-type?post=772"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/topic?post=772"},{"taxonomy":"update-type","embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/update-type?post=772"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}