The NIH and HIPAA have guidance and regulations regarding mandatory future use of biospecimens and/or data collected in research that offers treatment/intervention to participants.
-
NIH guidance focuses on ethical considerations, voluntariness, undue influence, and coercion of mandatory contribution of data/biospecimens for future use.
-
HIPAA regulation defines access to and use of PHI in “conditional” and “unconditional” terms. Conditional authorization is a participant giving authorization that enables researchers to conduct the study. Unconditional authorization is additional use beyond what is needed to be able to reach the endpoints of the currently proposed research. Any unconditional use (not required to meet the aims of the current study) must be optional.
Storing and using data or biospecimens for future research is considered unconditional authorization under HIPAA. This means it must be optional—participants must actively choose to allow it. Researchers cannot assume consent just because someone didn’t opt out. Instead, participants must clearly indicate that they agree to future use of their data or biospecimens, separate from their agreement to join the current study.
A more detailed discussion of these regulations and guidelines are summarized below:
- Ethical Considerations, Voluntariness, Undue Influence, and Coercion: Discussions of voluntariness and undue influence within NIH guidance iterate that participants must be given the choice whether or not they wish to have their data and/or biospecimens stored and shared for future use. Suppose the treatment/intervention is only available through research. In that case, the potential participant should not be placed in a position where they may feel compelled to contribute data/biospecimens to have access to a treatment that offers prospect of direct benefit to them, especially since the organization storing and using the data/biospecimens for future use (e.g., industry sponsors) have the potential to financially benefit from the future research conducted on these data/biospecimens.
- HIPAA Compound Authorization: The DHHS’s Privacy Rule and HIPAA regulations (45 CFR 164.508(b)(3)) outline “compound authorization” which allows authorization to be obtained for more than one use of an individual’s PHI for research. The regulations outline that while there can be more than one use of PHI presented together for research, it stipulates that one authorization component can be mandatory, or “conditional,” while any additional components must be optional, or “unconditional.”
- Access to and use of Protected Health Information (PHI) is often required to conduct a research study. When this is the case, participants must authorize that use—this is known as a conditional authorization, because participation in the study depends on granting access to their PHI. If someone chooses not to provide this authorization, they cannot participate in the study, as researchers need the information to provide appropriate care or conduct the research. However, any use of PHI beyond what is necessary for the current study—such as storing data or biospecimens for future, unrelated research—must be optional. This is referred to as unconditional authorization, because it is not required to participate in the current study or to meet its research goals.
- Prospect of Direct Benefit: NIH guidance does stipulate that it “may be reasonable to consider requiring storage and sharing” if there is no prospect of direct benefit to the participant. The guidance describes instances where the sole purpose of the protocol is a repository to collect data/biospecimens for future use. A research study without treatment/intervention does not provide a prospect for direct benefit to the participant, thus the collection for future use may be mandatory.