From the event "Specimen Science: Ethics and Policy Implications," held at Harvard Law School on November 16, 2015. This event is a collaboration between The Center for Child Health and Policy at Case Western Reserve University and University Hospitals Rainbow Babies & Children’s Hospital; the Petrie-Flom Center for Health Law Policy, Biotechnology, and Bioethics at Harvard Law School; the Multi-Regional Clinical Trials Center of Harvard and Brigham and Women's Hospital; and Harvard Catalyst | The Harvard Clinical and Translational Science Center. It is supported by funding from the National Human Genome Research Institute and the Oswald DeN. Cammann Fund at Harvard University. For more information, visit our website at http://petrieflom.law.harvard.edu/events/details/specimen-science-ethics-and-policy

1. ROPES & GRAY LLP
Legal & Regulatory Issues in Biospecimen
Research: National and International
Considerations
David Peloquin, Mark Barnes & Barbara E. Bierer

2. ROPES & GRAY
Agenda
• United States
– Human Subjects Protection Regulations
– Privacy Law
– State Laws
• International Comparisons
– Europe
– China
2

3. ROPES & GRAY
Human Subjects Protection
Regulations
• Common Rule
– Governs research involving human subjects that
is funded by one of 18 federal departments and
agencies, generally requiring IRB review of
research and informed consent of subjects
• Human Subjects: Living individuals about whom the
investigator obtains (i) data through intervention or
interaction with the individual, or (ii) identifiable private
information
3

4. ROPES & GRAY
Human Subjects Protection
Regulations
• Common Rule
– Is a specimen identifiable private information?
• Private information includes information that has
been given for a specific purpose which the
individual can reasonably expect will not be made
public
• Private information is identifiable only when the
identity of the individual may readily be ascertained
by the investigator
4

5. ROPES & GRAY
Human Subjects Protection
Regulations
• Common Rule
– Office for Human Research Protections (“OHRP”)
guidance states that previously collected
biospecimens labeled with a code will not be
considered to contain identifiable private
information, if:
• The investigator does not have access to the key to the
code
• There is a policy, agreement or legal requirement in
place prohibiting release of the code until the subject’s
death
5

6. ROPES & GRAY
Human Subjects Protection
Regulations
• Common Rule
– When an investigator obtains identifiable private
information with the specimens, an IRB can under
certain circumstances waive the informed
consent requirement
• Research involves no more than minimal risk
• Waiver will not adversely affect rights and welfare
of the subject
• Research could not practicably be carried out
without waiver or alteration
• Subjects will be provided with additional pertinent
information after participation6

7. ROPES & GRAY
Human Subjects Protection
Regulations
• FDA
– Applies to “clinical investigations,” i.e.,
experiments that involve use of an FDA-regulated
product on human subjects if the product is
subject to prior submission requirements, or the
results of the study will be submitted to FDA in
support of a marketing authorization
– In FDA’s device regulations, “subject” is defined
to include an individual “on whose specimen an
investigational device is used or as a control”
7

8. ROPES & GRAY
Human Subjects Protection
Regulations
• FDA
– Generally require IRB approval of the research
and informed consent of the subject
• No general ability of an IRB to waive the
requirement of informed consent
– FDA exercises enforcement discretion not to
require informed consent of subjects in certain
device studies using specimens where (1) the
research is approved by an IRB, and (2)
specimens are not “individually identifiable”
8

9. ROPES & GRAY
Privacy Law
• Health Insurance Portability and
Accountability Act of 1996 (“HIPAA”)
– Applies to “covered entities” and their “business
associates” use of protected health information
(“PHI”)
• A biospecimen itself is not PHI subject to
HIPAA
– Biospecimens are often labeled with PHI (e.g.,
biospecimens labeled with surgery or office visit
date(s))
9

10. ROPES & GRAY
Privacy Law
• When a biospecimen is labeled with PHI, a
legal basis is needed under HIPAA to use
or disclose the PHI for research purposes
– One basis is the “authorization” of the subject
10

11. ROPES & GRAY
Privacy Law
• In 2013, OCR decreased the burden on
obtaining PHI for a biobank
– Researchers can combine a mandatory
authorization for research study with an optional
authorization for contribution of PHI to another
research study, e.g., a biobank
– Authorization can be drafted broadly enough to
encompass future research so long as research
is described “adequately” such that it is
“reasonable” for a subject to expect that his or her
PHI will be used for such research
11

12. ROPES & GRAY
Privacy Law
• Where subject authorization cannot be
obtained, a researcher can seek waiver of
authorization from an IRB or privacy board
by showing the following:
– The use or disclosure of PHI involves no more
than a minimal risk of privacy
– The research could not practicably be conducted
without the waiver or alteration of authorization
– Access to the PHI is required for the research
12

13. ROPES & GRAY
Industry Research
• Commercial pharmaceutical companies
have biobanks of specimens that are used
for intracompany research that is not
subject to the above-listed regulations
– Research is not federally funded and thus not
subject to the Common Rule
– Research results are not submitted to FDA
– Companies are not “covered entities” subject to
HIPAA
13

14. ROPES & GRAY
State Law Considerations
• State Law Considerations
– May impose requirements on research
independent of federal requirements
– Genetic testing of banked specimens introduces
special concerns
• Many state laws require specific, explicit consent for
genetic testing and/or release of the results of genetic
tests
• Such laws were often not designed with researchers in
mind
• Some laws apply to “predictive” genetic tests; others to
all genetic tests
14

15. ROPES & GRAY
State Law Requirements
• New York
– Requires that if genetic testing is to be carried out
on human tissue stored for research purposes,
the specimens must be stripped of all identifying
information, the research must be approved by an
IRB, and the individual must have provided
consent for future research uses of the specimen
(N.Y. Civ. Rights Law § 79-l(9))
15

16. ROPES & GRAY
Coming Changes
• Common theme of U.S. regulatory
regimes is that they apply when
specimens are “identifiable” to
investigators
• Common Rule NPRM would expand the
definition of “human subject” to include a
living individual about whom the
investigator “obtains, uses, studies, or
analyzes biospecimens”
16

17. ROPES & GRAY
Europe
• Council of Europe
– 47-member state cooperative organization
establishing human rights standards
– Issued recommendations in 2006 regarding the
use of biological materials in research; draft
revisions issued in 2014
– Differentiates between identifiable and non-
identifiable biological materials; all coded
specimens are considered identifiable
17

18. ROPES & GRAY
Europe
• Council of Europe
– If biospecimens are collected expressly for
storage for research, consent of the donor must
be “as specific as possible with regard to any
foreseen research uses”
18

19. ROPES & GRAY
Europe
• Council of Europe
– When an investigator wishes to store for future
research identifiable biospecimens collected for
non-research purposes, “reasonable efforts” must
be made to contact the subject and obtain
consent for the proposed research use
– If subject cannot be contacted, specimens can be
used for research so long as:
• The research serves an important scientific interest
• The aims of research could not reasonably be achieved using other
materials
• There is not evidence that the subject has expressly opposed the
research uses in question 19

20. ROPES & GRAY
Europe
• Council of Europe
– Draft guidance heightens the consent
requirement for storage of identifiable specimens,
by requiring that consent be obtained for
secondary use of such specimens
– Consent need not be obtained if the specimens
are anonymized, provided that no restrictions
were placed on use of the specimens by the
subject before anonymization
20

21. ROPES & GRAY
Europe
• European Privacy Law
– European Economic Area (EEA) privacy law is
governed by the Data Protection Directive of
1995 (Directive 95/46/EC)
– Governs the use of “personal data,” i.e., any
information relating to an identified or identifiable
natural person taking into account physical,
physiological, mental, economic, cultural, and
social identity
21

22. ROPES & GRAY
Europe
• European Privacy Law
– Facts and circumstances test of anonymization
creates uncertainty regarding when specimens
are “personal data”
– EU countries differ on whether anonymization is
judged by whether the person holding the data
can re-identify the data, or whether any person
can re-identify the data
22

23. ROPES & GRAY
Europe
• European Privacy Law
– Processing of sensitive personal data generally
requires consent
– Legal basis is needed to transfer “personal data”
from EEA member states to countries that offer
inadequate data protection, e.g., the United
States
• Safe Harbor (declared invalid in October 2015 by
the Court of Justice of the European Union)
• “Unambiguous consent” of the data subject
• Model contractual clauses
23

24. ROPES & GRAY
Europe
• European Privacy Law
– The Data Protection Directive is likely to be
replaced in near future by a General Data
Protection Regulation (GDPR) that will be binding
throughout the European Economic Area
– The GDPR requires consent to be “specific,
informed, and explicit” — three terms that have
been interpreted to prohibit a “broad consent”
– Compare this to the NPRM’s move toward a
broad consent
24

25. ROPES & GRAY
China
• Restriction on Export of Human Genetic
Resources
– Under 1998 “Interim Measures for the
Administration of Human Genetic Resources”
investigators in China must obtain approval from
the Human Genetic Resources Administration of
China (“HGRAC”) before exporting human tissues
or genetic data derived from such tissues
25

26. ROPES & GRAY
China
• Restriction on Export of Human Genetic
Resources
– In reviewing applications for export of materials,
HGRAC considers:
• The terms of the informed consent under which specimens
were collected
• Whether the research project for which the specimen is used
has a precise objective or purpose
• Whether apportionment of ownership and IP rights in the
specimen is fair
• Whether the foreign institution has adequate capabilities to
carry out the proposed research
26

27. ROPES & GRAY
Summary
• Challenges for Multi-National Research
– Ensure export requirements are met
– Track different types of consent under which
biospecimens were obtained
– Various requirements for de-identification
– Requires a sophisticated infrastructure
27