If the subjects denied permission for their data/specimens to be kept long term for future research, you are not allowed to keep them even if they are de-identified.

In addition, if the data/specimens were collected under a consent which stated that the data/specimens would be destroyed at the completion of the study, the data/specimens may not be used for future research, even if de-identified and/or subjects are deceased.

Otherwise, you have several options.

  1. You may remove ALL HIPAA identifiers and any other information that may allow you to re-identify the subject.  You may then keep the data/specimens without any additional IRB approval.  
  2. You may keep data/specimens that meet the criteria of a Limited Data Set (Only HIPAA identifiers kept include full dates and address information) See the Determination of Human Subject Research Form: section titled: (Creation of a database/repository using data/specimens which cannot be readily identifiable)
  3. If the subject provided permission for you to keep their identifiable data/specimens long term for future research, you would need to do one of the following: 
  4. If you already have an IRB approved database protocol, you may submit a modification to that protocol noting that the data/specimens from the study you are now closing will be kept long term in an identifiable manner under the database protocol and request a Waiver of Consent/ HIPAA Authorization.
  5. If you do not already have an IRB approved database protocol, you will need to open a new database protocol with the IRB-HSR. Enter IRB Online, enter Protocol Builder and create a new application. 
  • If the data/specimens were collected under a Waiver of Consent (e.g. no consent from the subject such as collecting left over clinical samples) you may either:
    1. remove ALL HIPAA identifiers and any other information that may allow you to re-identify the subject.  You may then keep the data/specimens without any additional IRB approval. 
    2. keep the data/specimens in an identifiable manner and request an approval of waiver of consent/ HIPAA authorization from the IRB with your database protocol application.
  • If the data/specimens were collected under an older consent that did not mention keeping data/specimens for future research, you may either:
    1. Remove ALL HIPAA identifiers and any other information that may allow you to re-identify the subject.  You may then keep the data/specimens without any additional IRB approval. 
    2. If you already have an IRB approved database protocol, you may submit a modification to that protocol noting that the data/specimens from the study you are now closing will be kept long term in an identifiable manner under the database protocol and request a Waiver of Consent/ HIPAA Authorization.
    3. If you do not already have an IRB approved database protocol, you will need to open a new database protocol with the IRB-HSR. Enter IRB Online, enter Protocol Builder, create a new database application and request Waiver of Consent / HIPAA Authorization.