Banking Supplement (Long)

IRB # (if known): Study Title: Principal Investigator: Version Date:

BANKING SUPPLEMENT

* Fill in header information.

Type in text (as appropriate) §

Instructions:  Complete this form if your study will involve storage of specimens or data for future research (which constitutes “banking”). The future research could include research performed by other investigators; it could also include research performed by the same investigators in the future.  Please see the Language Resource Text for suggested language regarding specimen/data banking.

Seattle Children’s Policy: For additional information, see IRB Policy-034: Research Repositories of Human Materials and/or Data.

 If a specimen/data repository involved in this study will include protected health information, investigators must comply with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule when obtaining and maintaining the information. Please be sure to address HIPAA privacy protections with regard to the repository when answering questions in the main Institutional Review Board (IRB)-Institute of Translational Health Sciences (ITHS) application about confidentiality and the length of the research study.

Investigator Help: The National Institutes of Health (NIH) created a helpful guidance document on the impact of the HIPAA Privacy Rule on research repositories: Research Repositories, Databases, and the HIPAA Privacy Rule.

 Note: A consultation with a Human Subjects Protection Program (HSPP) analyst is required for any study where banking is involved and it is the Principal Investigator’s (PI) first time submitting a banking study to Seattle Children’s IRB. Please see the IRB Web site for more information about consultations.

1. Definitions

1.2. Banking: The storage of data or specimens for future research, including research performed by other investigators.

1.3. Research Repository: The collection, establishment and operation of a bank containing materials (e.g., human tissue, biological specimens) and/or data derived from humans for use in future research.

1.4. Data: The information derived from or about individual human beings.

Banking Supplement (long) 5/30/2018 Page 1 of 10 IRB # (if known): Study Title: Principal Investigator: Version Date:

1.5. Specimens: The tissues, isolates, DNA, cells, fluids or other materials derived from humans and linked directly or indirectly to them.

1.6. Identifier: Any information that makes the data “individually identifiable” such that the identity of the participant is or may readily be ascertained by the investigator or associated with the information. (45 CFR 46.102(f)). The HIPAA Privacy Rule enumerates 18 elements that could be used to identify the individual or the individual’s relatives, employers, or household members (see the IRB-ITHS application for the complete list). Examples of identifiers include name, social security number, patient number, email address, telephone number, and pathology accession numbers.

1.7. De-identified: Health information that has been stripped of all 18 identifiers as defined by HIPAA so that the information could not be traced back to an individual. (Note that a person’s initials are considered to be an identifier under the HIPAA Privacy Rule, because an individual's name is an identifier and initials are derived from the individual's name.) De-identified data also pertains to health information that has been assigned and retains a code or other means of identification provided that: 1.7.1. The code is not derived from or related to the information about the individual; 1.7.2. The code could not be translated to identify the individual; and 1.7.3. The covered entity does not use or disclose the code for other purposes or disclose the mechanism for re-identification.

1.8. Coded: Refers to specimens or data that are labeled with a code that links back to identifiers associated with the samples or data.

1.9. Anonymous: Refers to samples or data with no associated identifiers and no code that someone, including the researcher, could use to link it to an identifiable individual.

1.10. Protected Health Information (PHI): PHI is individually identifiable health information.

2. Repository Aims / Design

2.1. Using lay language, explain the scientific value of the repository and how it will be used.

Investigator Help: Why does the IRB request that I use lay language for this information? The IRB primarily asks this because by regulatory requirement the IRB must contain non- scientific members as well as members who are not affiliated with Seattle Children’s (i.e., community members). To facilitate the review of this study for such members, lay language should be used rather than the more scientific language found in protocols, etc.

2.2. Do you intend to maintain the repository indefinitely? Yes No  By what month and year do you expect the repository will cease to be maintained?

2.3. Based on your knowledge at this time, who will have access to the data and specimens? (Check all that apply) Members of this study’s research team. Other researchers affiliated with Seattle Children’s. Researchers from educational or non-profit research institutions not affiliated with Seattle Children’s. Researchers affiliated with industry or for-profit organizations. Others. Please Specify.

2.4. Please complete questions 2.4.1 – 2.4.2 if other researchers might request to use the banked data/specimens for a new, separate research project:

2.4.1. Please identify the person who will be the “gatekeeper” for these stored data/specimens/medical records (this is often the study PI, but may be a coordinating center, etc).

Investigator Help: The gatekeeper is the person who is responsible for ensuring that repository data/specimens are used in a way that is consistent with regulatory requirements and the conditions of IRB approval.

2.4.2. Please acknowledge that the gatekeeper will do both of the following: Obtain documentation of IRB approval from the investigator who receives the data/specimens prior to releasing the banked data/specimens to that investigator. (Note: The IRB approval will be from the recipient investigator’s IRB); and Ensure that a modification request is submitted to the Seattle Children’s IRB if the release of the data/specimens for the proposed research was not previously reviewed and approved by the Seattle Children’s IRB.

3. Materials & Information to Be Collected

3.1. What specimens, data, or medical information will be collected and stored for the repository? (Check all that apply) Blood Urine Saliva Tissue  Specify type. Note: If you will use tissue from Seattle Children’s patients for the repository (either collected prospectively or archived), the use must be reviewed by the Department of Laboratory (Pathology) at Children’s. If you have not already done so, please submit the Tissue Request Form to the Department of Laboratory. When you receive the approval form, send a copy to the IRB. Buccal scraping/swab DNA Contact information  Specify what information will be collected. Medical/diagnostic/treatment information Surveys, Interviews, Questionnaires Photographs, Audio or Video Recordings

Other  Please specify.

3.2. Will you create or store cell lines as part of the repository activity? Yes  Please ensure that cell lines are explained in the consent form. No

3.3. Will any genetic testing be done using the stored specimens? Yes  Please ensure that genetic testing is explained in the consent form. No

3.4. Will any Genome-Wide Association Studies (GWAS) be performed with the stored specimens? (Please see IRB Policy 045 for consent form elements.)

4. Sources of Data/Specimens

4.1. Check all the applicable sources of data or specimens below: Data or specimens will be collected specifically for the repository. Data or specimens will be collected from other research projects  Please complete table below. Add rows/columns if necessary. If an investigator obtained informed consent from participants for other research projects that will serve as a source of data/specimens for the current project, please provide copies of the consent forms for IRB review. If consent was not obtained to use the data/specimens for research, please address consent and HIPAA (if you are banking PHI) waiver criteria below.

Research Project Research Project Research Project #1 #2 #3 Name of researcher Institution name Title of study IRB approval # Does the consent form allow for banking? Please Yes No Yes No Yes No attach a copy of the consent form. Are data/specimens Yes No Yes No Yes No publicly available?

Data or specimens will be collected from non-research sources (such as clinical samples). Please complete the table below:

Source #1 Source #2 Source #3 Name of institution Name of provider Did the consent form (if Yes No Yes No Yes No any) include the potential for banking

data/specimens? If yes, please attach a copy of the consent form. Are data/specimens Yes No Yes No Yes No publicly available?

4.2. How will banked specimens and/or data be used?

4.2.1. If applicable, describe any restrictions placed on future uses of the banked data and/or specimens in previous consent forms signed by patients/participants (e.g., restricted for use in cancer research or cystic fibrosis research). If not applicable, please indicate “N/A”.

4.3. If the data/specimens to be included in the repository are from patients/participants who did NOT consent for their data/specimens to be used for the currently-proposed research, and the data/specimens are not publicly available, the samples/data can only be used if the IRB determines that waivers of consent and HIPAA (if applicable) are appropriate. Please address the waiver criteria below as they apply to the patients/participants who did NOT give consent/authorization:

4.3.1. Please explain why: The research involves no more than minimal risk to research participants and their privacy.

Investigator Help: Your answer should explain measures that will be taken to maintain data security and protect privacy (e.g. section 5: Confidentiality Protections below.)

4.3.2. Please explain why: The waiver of consent and authorization will not adversely affect the rights, including the right to privacy, nor adversely affect the welfare of the participants whose records, data, or specimens are being used.

Investigator Help: Possible answers might include: a) you are not collecting information that could put participants or their families at harm, e.g., affect eligibility for insurance, employability, stigmatization; b) you are not collecting information that would alter or affect the participant’s care; or c) any publication or presentation of research results would be done in a manner that would never reveal an individual’s identity either directly or indirectly.

4.3.3. Please explain why: The research could not practicably be carried out without the waiver of consent and waiver of authorization (e.g., inability to locate families because of the lengthy time period over which the data/specimens were created or collected; difficulty in contacting large number of families):

4.3.4. Please explain why: The research could not practicably be carried out without access to PHI (e.g., if medical records are needed to verify diagnosis, confirm identity, etc):

5. Confidentiality Protections

5.1. Are the banked data/specimens: Identifiable; OR Coded (note that participant initials are considered to be an identifier); OR Anonymous  Please explain when the data and/or specimens will be made anonymous.

5.2. PHI: Will any of the data/specimens that will be stored in the repository contain PHI? PHI = health information + any one or more of the 18 HIPAA identifiers. Please see below for a complete list of HIPAA identifiers. Yes, the repository will contain PHI. Please be sure to address HIPAA matters for this PHI in the main IRB – ITHS Application. No, the repository will not contain PHI.

5.3. If data/specimens will be identifiable or coded, check the box(es) for any of the following identifiers that will be recorded with or linked by code to the banked data. (Note: Your answers here may differ from the main IRB-ITHS application form as this question is about the nature of the data/specimens that will be banked as opposed to the nature of the data/specimens involved in the main study.)

Data that have one or more identifiers listed below linked to health information are considered protected health information (PHI) subject to HIPAA regulations. Name Social security number Medical record number Address by street location Address by town/city/zip code Dates (except year), e.g., date of birth; admission/discharge date; date of procedure; date of death Telephone number Fax number Electronic email address Web URLs Internet protocol (IP) address Health plan beneficiary number Account number Certificate/license number Vehicle identification number and serial number, including license plate number Medical device identifiers and serial numbers Biometric identifiers (finger and voice prints) Full face photographic image Any other identifier or combination of identifiers likely to identify the participant.

Note: If different types of identifiers will be collected for the bank than for the main study, please create a separate HIPAA authorization form for the banking portion of the study. In other words, if you would need to check different boxes on the first page of the HIPAA form for the main study and the banking portion of the study, you must create two separate HIPAA Authorization forms.

5.4. Describe the provisions for protecting the privacy and confidentiality of the donors throughout all stages of the research (i.e., during the collection, transmission to the repository, and storage of the materials and data) by providing information for each of the below.

Investigator Help: For example, describe the storage facilities and tracking system to be used, including how the specimens/data are received, accessed and released and stored. Include a description of the tracking mechanism for any restrictions placed on the sharing or use of specimens/data based on participants’ responses to questions in the consent form regarding optional specimens/data use.

5.4.1. Collection of data/specimens (for example, you could record data on sheets containing a code number instead of a name):

5.4.2. Transmission of data/specimens to repository (for example, you could send only de-identified or coded data/specimens outside of Children’s):

5.4.3. Storage of data/specimens:

5.4.3.1. For local storage, explain how data/specimens will be protected (check all that apply): Separate from identifiable information about participants. Please explain how the identifiable information will be stored at Seattle Children’s: Locked file cabinet with access restricted to research team members. Password protected computer with access restricted to research team members. Other. Please explain.

5.4.3.2. If data/specimens will be stored outside of Seattle Children’s, please describe the confidentiality protections that will be used (check all that apply): Sending only de-identified data/specimens (all 18 HIPAA identifiers removed; initials are considered to be an identifier under HIPAA) without any links. If you are sending coded data where the code is not derived from any identifiers, check this box. Sending data/specimens with certain identifiers. Please indicate which ones will be included (for example, patient initials, date of birth). Please describe what protections will be in place to preserve participant confidentiality. Other. Please explain.

Note: If you are sending specimens or data to investigators outside of Seattle Children’s (including to the University of Washington or Fred Hutchinson Cancer Research Center), you need to contact the Office of Sponsored Research to see if an agreement will be required. Transfers of specimens often require a Material Transfer Agreement (MTA). Transfers of data often require other types of agreements, including Data Use Agreements (DUA), Collaboration Agreements, etc.

5.5. If the data/specimens/records are highly sensitive and confidential (that if disclosed could have negative consequences to the participants or damage their financial standing, employability, etc.), will you apply for a Certificate of Confidentiality? Yes  For more information about Certificates, please see the University of Washington guidance document titled “Certificate of Confidentiality Facts.” No  Please explain why you will not obtain a Certificate of Confidentiality.

6. Participant Follow-up

6.1. Will participants be able to withdraw their data and specimens from the repository? Yes  How will you handle a research participant’s request to withdraw from the data/specimen bank?

Investigator Help: There are generally two alternatives: the data/specimens are destroyed OR data/specimens are made anonymous by destroying the code that links them to identifiers.

No  Explain why not (for example, if all data/specimens will be anonymous) and be sure to include this information in the consent form.

6.2. Are there plans to disclose results from research on the banked data/specimens to donors, their legal representatives, or their care providers? Yes  Please explain who will give the results back to the donors, etc. and their qualifications to discuss the results (e.g., PI, research associate, genetic counselor, results will be given by letter): Note: You will also need to ensure that the more detailed questions regarding return of such results are answered in the Local Implementation Plan. No

6.3. Will you be collecting and banking data and/or specimens from children 17 years of age or younger? Yes  If yes and if you are retaining links to identifiers, please complete the questions in 6.4. No  STOP here. You are done with this supplement.

6.4. Plan for participants who turn 18 during the banking procedures. Note: If you have already answered questions pertaining to this topic for the banking portion of the study in the main IRB-ITHS application, then you may simply refer to those sections of the application for your answers below. These questions are included here to allow for the

differences that sometimes exist with the plans for banked specimens/data and underlying study procedures reflected in the main IRB-ITHS application for some studies.

Federal Regulations: Guidance on this topic.

6.4.1. If any child participants may turn age 18 during the study, please provide information about how you will re-approach them to obtain informed consent and HIPAA authorization once they become adults at age 18.

Investigator Help: Sample answer: Participants who reach the age of majority (18 years) while actively participating in this study will be re-approached by one of the research investigators. The research investigator will continue the informed consent process, acknowledging that the individual has reached the age of majority, and will ask the participant to sign the informed consent form if they voluntarily choose to continue participating in the research repository. If the individual chooses to withdraw from participating, the specimen will be destroyed. We will also ask the coordinating center to destroy any specimens that have yet to be analyzed.

6.4.2. If you will not re-approach adult participants, please explain why not, and complete the waiver criteria below for consent and HIPAA as they relate to participants who turn age 18 during the research.

Investigator Help: The factors the IRB will consider when making a determination regarding the appropriateness of this are: a) the ability of the researchers to locate and contact the donors; b) whether the collection of materials and data is ongoing or a one-time donation; c) whether the materials and data can be de-identified; d) the nature and sensitivity of the research being done with the materials and data in the repository; and e) was assent obtained from the minor at the time materials and data were collected for the repository.

6.4.2.1. Explain why: The research involves no more than minimal risk to research participants and their privacy.

Investigator Help: Sample answer: The continued record review is analogous to a chart review. The waiver would involve no more than minimal risk because when it comes to submitting personal data, there are no new privacy risks. The coordinating center is already aware of participant’s medical history to date. PHI will strictly be used to access the data, it will not be shared. PHI is only stored for clinical or research purposes that are previously IRB approved. We do not destroy identifiers because late effects do occur in these cancer patients. Our database that stores PHI is on a secured server, only available to members of the research team.

6.4.2.2. Explain why: The waiver of consent and authorization will not adversely affect the rights, including the right to privacy, nor

adversely affect the welfare of the participants whose records, data, or specimens are being used.

Investigator Help: Sample answer: The coordinating center was previously receiving medical information on participants, so there will be no new privacy risks.

6.4.2.3. Explain why: The research could not practicably be carried out without the waiver of consent and waiver of authorization.

Investigator Help: For example, if the number of participants turning 18 each year would make it very difficult to re-approach everyone; if data integrity would be severely compromised by excluding non-responders; if many participants are likely to be deceased; or if so much time will have passed that it would be very difficult to maintain accurate contact information.

6.4.2.4. Explain why: The research could not practicably be carried out without access to PHI.

Investigator Help: Sample answer: PHI is needed to ensure that the data corresponds to the correct participant.

Banking Supplement (long) 5/30/2018 Page 10 of 10