Skip to content

Who Can Build a Data or Biospecimen Repository? 

Data and/or biospecimen repositories, registries, or banks may be maintained by:

  • An investigator or department within the University of Utah and its covered entity
  • An external investigator or institution
  • A sponsor (industry, government agency, or non-profit organization)

Organizers of a repository control access to data and/or biospecimens. It is important that the management of the repository include physical and procedural mechanisms for the secure receipt, storage, and transmission of the data and/or biospecimens.

Is IRB Approval Necessary to Build a Registry?

There are many scenarios in which a database or registry is created or used. Generally:

  • Building and maintaining a registry or database for current research purposes needs IRB approval.
  • Building and maintaining a registry or database for future research purposes needs IRB approval.
  • Creating and maintaining a registry or database for quality improvement purposes does not need IRB approval. However, if an investigator later wants to access that registry or database for research, IRB approval should be sought.
  • Using identifiable data from any database or registry for research purposes needs IRB approval. See Use of Collected Data or Biospecimens.


The IRB considers each project on a case-by-case basis and will apply the appropriate human research protection regulations and HIPAA regulations, as applicable. Some projects may not be considered human subjects research but still be subject to HIPAA privacy regulations.

Investigators who collect data and biospecimens to be entered into a repository must:

  1. Create a management plan
  2. Obtain IRB approval, as applicable.

Investigators receiving data and/or biospecimens from the repository must also agree in writing to specific conditions required by the repository’s IRB.

IRB Applications for Repository Protocols

Researchers who wish to develop or maintain a research data and/or biospecimen repository must submit an application for IRB review and receive IRB approval before initiating any repository-related activity. A repository protocol may be submitted to the IRB to accomplish one of the following purposes:

  • Define the operating parameters for establishing and maintaining a new research repository.
  • Convert an existing non-research repository into a research repository.

A repository’s operating procedures must include detailed mechanisms for controlling the collection, storage, use, and sharing of its samples and information.

The University of Utah IRB is responsible for any research repository maintained at the University of Utah or its affiliate institutions.

In addition to the usual information contained in a human research protocol and an IRB application, the IRB expects that protocols for establishing and operating a research repository will include at least the following specific information:

  • A detailed description of the physical and procedural mechanisms for the secure receipt, storage, and transmission of information and/or biospecimens to ensure the protection of participants’ privacy and confidentiality.
  • The specific conditions under which data and/or biospecimens may be accepted into the repository.
  • The specific conditions under which data and/or biospecimens may be shared with or released to research investigators.

Additional Considerations for Building Repositories

The use of data or samples from a repository requires the submission of a new study application to the IRB, disclosing the proposed use of the biospecimens, according to the requirements for biospecimen use. Samples may not be released until final IRB approval has been issued. See Use of Collected Data or Biospecimens for more information.

Samples that have been collected or will be collected solely for non-research purposes, such as pathology samples, may be used and stored for research. The investigator must either obtain full consent and authorization from participants or provide justification for the use of a waiver of consent and other method to account for authorization.

The IRB will often request that these samples be de-identified without a link to identifiers to protect the privacy and confidentiality of the participants.

According to the Common Rule, deceased individuals do not meet the definition of a human subject; however, the IRB is still responsible for assuring HIPAA regulations are followed and must review research involving specimens collected from postmortem individuals. The IRB will also consider ethical issues concerning potential harm to the decedents’ families or other associated groups (e.g., race, sect, etc.).

Typically, consent is not required to use and store autopsy specimens; however, if the research involves genetic testing of these samples for heritable traits, a consent form signed by the responsible family member(s) may be required. Written consent from the responsible family member(s) should be gained in conjunction with or following the autopsy consent process. Collection of autopsy specimens may not occur without IRB approval.

In addition to the new study application, the Research Using Decedents Information form must also be completed and attached to the new study application.

VA research involving human biospecimens removed at autopsy must be consistent with the permission given by the person authorized to grant permission for autopsy.

There are few opportunities for tissue samples to be publicly available, but there may be limited circumstances of tissue samples being made available to qualified researchers for valid research purposes at a reasonable cost.

Publicly available samples must be characterized as de-identified samples. If the identity of the sample is known, the identity must be recognizable in the public domain and not entitled to a presumption of anonymity.

VA biospecimens may be stored outside the VA with IRB, and VA R&D committee approvals.

Several guidance documents are posted on the VA tissue banking website that you can refer to when VA biospecimens are collected and banked for research including:

  • Elements to include in a biorepository protocol
  • Elements to include in an informed consent form when biospecimens will be banked
  • Stewardship of biospecimen collections when they are banked inside or outside the VA

Not Finding What You're Looking For?

Check out our A-Z Index or Contact Us and we'll help you!  email the irb

Last Updated: 6/22/23