david peloquin, "legal considerations and international perspectives"

ROPES & GRAY LLP

Legal & Regulatory Issues in Biospecimen

Research: National and International

Considerations

David Peloquin, Mark Barnes & Barbara E. Bierer

ROPES & GRAY

Agenda

• United States

– Human Subjects Protection Regulations

– Privacy Law

– State Laws

• International Comparisons

– Europe

– China

2

ROPES & GRAY

Human Subjects Protection

Regulations

• Common Rule

– Governs research involving human subjects that is funded by one of 18 federal departments and agencies, generally requiring IRB review of research and informed consent of subjects

• Human Subjects: Living individuals about whom the investigator obtains (i) data through intervention or interaction with the individual, or (ii) identifiable private information

3

ROPES & GRAY


Regulations

• Common Rule

– Is a specimen identifiable private information?

• Private information includes information that has been given for a specific purpose which the individual can reasonably expect will not be made public

• Private information is identifiable only when the identity of the individual may readily be ascertained by the investigator

4

ROPES & GRAY


Regulations

• Common Rule

– Office for Human Research Protections (“OHRP”) guidance states that previously collected biospecimens labeled with a code will not be considered to contain identifiable private information, if:

• The investigator does not have access to the key to the code

• There is a policy, agreement or legal requirement in place prohibiting release of the code until the subject’s death

5

ROPES & GRAY


Regulations

• Common Rule

– When an investigator obtains identifiable private information with the specimens, an IRB can under certain circumstances waive the informed consent requirement

• Research involves no more than minimal risk

• Waiver will not adversely affect rights and welfare of the subject

• Research could not practicably be carried out without waiver or alteration

• Subjects will be provided with additional pertinent information after participation 6

ROPES & GRAY


Regulations

• FDA

– Applies to “clinical investigations,” i.e., experiments that involve use of an FDA-regulated product on human subjects if the product is subject to prior submission requirements, or the results of the study will be submitted to FDA in support of a marketing authorization

– In FDA’s device regulations, “subject” is defined to include an individual “on whose specimen an investigational device is used or as a control”

7

ROPES & GRAY


Regulations

• FDA

– Generally require IRB approval of the research and informed consent of the subject

• No general ability of an IRB to waive the requirement of informed consent

– FDA exercises enforcement discretion not to require informed consent of subjects in certain device studies using specimens where (1) the research is approved by an IRB, and (2) specimens are not “individually identifiable”

8

ROPES & GRAY

Privacy Law

• Health Insurance Portability and Accountability Act of 1996 (“HIPAA”)

– Applies to “covered entities” and their “business associates” use of protected health information (“PHI”)

• A biospecimen itself is not PHI subject to HIPAA

– Biospecimens are often labeled with PHI (e.g., biospecimens labeled with surgery or office visit date(s))

9

ROPES & GRAY

Privacy Law

• When a biospecimen is labeled with PHI, a legal basis is needed under HIPAA to use or disclose the PHI for research purposes

– One basis is the “authorization” of the subject

10

ROPES & GRAY

Privacy Law

• In 2013, OCR decreased the burden on obtaining PHI for a biobank

– Researchers can combine a mandatory authorization for research study with an optional authorization for contribution of PHI to another research study, e.g., a biobank

– Authorization can be drafted broadly enough to encompass future research so long as research is described “adequately” such that it is “reasonable” for a subject to expect that his or her PHI will be used for such research

11

ROPES & GRAY

Privacy Law

• Where subject authorization cannot be obtained, a researcher can seek waiver of authorization from an IRB or privacy board by showing the following:

– The use or disclosure of PHI involves no more than a minimal risk of privacy

– The research could not practicably be conducted without the waiver or alteration of authorization

– Access to the PHI is required for the research

12

ROPES & GRAY

Industry Research

• Commercial pharmaceutical companies have biobanks of specimens that are used for intracompany research that is not subject to the above-listed regulations

– Research is not federally funded and thus not subject to the Common Rule

– Research results are not submitted to FDA

– Companies are not “covered entities” subject to HIPAA

13

ROPES & GRAY

State Law Considerations

• State Law Considerations

– May impose requirements on research independent of federal requirements

– Genetic testing of banked specimens introduces special concerns

• Many state laws require specific, explicit consent for genetic testing and/or release of the results of genetic tests

• Such laws were often not designed with researchers in mind

• Some laws apply to “predictive” genetic tests; others to all genetic tests

14

ROPES & GRAY

State Law Requirements

• New York

– Requires that if genetic testing is to be carried out on human tissue stored for research purposes, the specimens must be stripped of all identifying information, the research must be approved by an IRB, and the individual must have provided consent for future research uses of the specimen (N.Y. Civ. Rights Law § 79-l(9))

15

ROPES & GRAY

Coming Changes

• Common theme of U.S. regulatory regimes is that they apply when specimens are “identifiable” to investigators

• Common Rule NPRM would expand the definition of “human subject” to include a living individual about whom the investigator “obtains, uses, studies, or analyzes biospecimens”

16

ROPES & GRAY

Europe

• Council of Europe

– 47-member state cooperative organization establishing human rights standards

– Issued recommendations in 2006 regarding the use of biological materials in research; draft revisions issued in 2014

– Differentiates between identifiable and non-identifiable biological materials; all coded specimens are considered identifiable

17

ROPES & GRAY

Europe


– If biospecimens are collected expressly for storage for research, consent of the donor must be “as specific as possible with regard to any foreseen research uses”

18

ROPES & GRAY

Europe


– When an investigator wishes to store for future research identifiable biospecimens collected for non-research purposes, “reasonable efforts” must be made to contact the subject and obtain consent for the proposed research use

– If subject cannot be contacted, specimens can be used for research so long as:

• The research serves an important scientific interest

• The aims of research could not reasonably be achieved using other materials

• There is not evidence that the subject has expressly opposed the research uses in question

19

ROPES & GRAY

Europe


– Draft guidance heightens the consent requirement for storage of identifiable specimens, by requiring that consent be obtained for secondary use of such specimens

– Consent need not be obtained if the specimens are anonymized, provided that no restrictions were placed on use of the specimens by the subject before anonymization

20

ROPES & GRAY

Europe

• European Privacy Law

– European Economic Area (EEA) privacy law is governed by the Data Protection Directive of 1995 (Directive 95/46/EC)

– Governs the use of “personal data,” i.e., any information relating to an identified or identifiable natural person taking into account physical, physiological, mental, economic, cultural, and social identity

21

ROPES & GRAY

Europe


– Facts and circumstances test of anonymization creates uncertainty regarding when specimens are “personal data”

– EU countries differ on whether anonymization is judged by whether the person holding the data can re-identify the data, or whether any person can re-identify the data

22

ROPES & GRAY

Europe


– Processing of sensitive personal data generally requires consent

– Legal basis is needed to transfer “personal data” from EEA member states to countries that offer inadequate data protection, e.g., the United States

• Safe Harbor (declared invalid in October 2015 by the Court of Justice of the European Union)

• “Unambiguous consent” of the data subject

• Model contractual clauses

23

ROPES & GRAY

Europe


– The Data Protection Directive is likely to be replaced in near future by a General Data Protection Regulation (GDPR) that will be binding throughout the European Economic Area

– The GDPR requires consent to be “specific, informed, and explicit” — three terms that have been interpreted to prohibit a “broad consent”

– Compare this to the NPRM’s move toward a broad consent

24

ROPES & GRAY

China

• Restriction on Export of Human Genetic Resources

– Under 1998 “Interim Measures for the Administration of Human Genetic Resources” investigators in China must obtain approval from the Human Genetic Resources Administration of China (“HGRAC”) before exporting human tissues or genetic data derived from such tissues

25

ROPES & GRAY

China

• Restriction on Export of Human Genetic Resources

– In reviewing applications for export of materials, HGRAC considers:

• The terms of the informed consent under which specimens were collected

• Whether the research project for which the specimen is used has a precise objective or purpose

• Whether apportionment of ownership and IP rights in the specimen is fair

• Whether the foreign institution has adequate capabilities to carry out the proposed research

26

ROPES & GRAY

Summary

• Challenges for Multi-National Research

– Ensure export requirements are met

– Track different types of consent under which biospecimens were obtained

– Various requirements for de-identification

– Requires a sophisticated infrastructure

27

david peloquin, "legal considerations and international perspectives"

Healthcare