Plan helps certify dbGaP studies for NIH

UW creates process for certification

When the National Institutes of Health (NIH) released its policy regarding data sharing for NIH-supported genome-wide association studies (GWAS) in 2007, officials at the University of Washington in Seattle knew it would have an effect on their operations.

"We have a lot of active genetic and genomic researchers here, so we realized this was really going to affect us," says Shannon Sewards, MA, CIP, assistant director for operations for the university's human subjects division. "We knew we were going to have to get something up and running soon."

The policy requires that any studies submitted to the NIH's GWAS repository, the database of Genotypes and Phenotypes (dbGaP), be certified by institutional officials, assuring that:

  • data was properly collected;
  • data submission follows state and federal laws;
  • appropriate informed consent was obtained;
  • data has been properly deidentified;
  • and the institution has considered any risks to individuals and groups posed by the submission.

The NIH created the dbGaP in order to encourage more rapid advancement of genomic research, but in its policy noted that the personal and sensitive information generated by such studies, particularly as technology evolves, make human subjects protections critically important.

Sewards says that initially, UW handled these dbGaP certifications on a case-by-case basis, going through the NIH guidance and checking whether the requirements were met.

From that trial run, the university has developed a certification process that does the job more efficiently. Sewards discussed that process at PRIM&R's recent Advancing Ethical Research Conference.

When her department took on this project in 2008, Sewards says she couldn't find other institutional policies on which to model it. She says UW was able to craft a successful dbGaP certification process by adapting its existing study review process.

"Adapting a new process to one that's existing is less change and less worry, on behalf of staff and researchers," Sewards says.

Handling non-human subjects research

The dbGaP request process is used not just for studies undergoing IRB review, but for research activities that don't meet the federal definition of human subjects research, such as use of deidentified data.

"For IRBs themselves, it's been difficult from a conceptual point of view, because this isn't human subjects research," she says. "We're being asked to certify something that we normally wouldn't see. For example, within the past couple of months, we've been grappling with whether children who were assented at the time of the study should be consented once they reach the age of 18 for their data to remain in the dbGaP. IRBs sort of get confused with that because it's not identifiable, it doesn't meet the definition of a human subject, but they're asked to make that decision within the same lens."

To address this issue, UW created a form that investigators can use for the use of non-identifiable biological specimens and data. The investigator fills out the form and can request a dbGaP certification to accompany it.

"Because [dbGaP certification] is not an IRB action, we have to have some sort of action for it to accompany," Sewards says. "That's how we've made it work in our office, so it goes through the proper channels, it gets a number and we can track it in our database."

When a dbGaP certification request is made, the human subjects division determines whether the proposed project requires IRB review. If so, the certification request accompanies the IRB review. Projects that involve minimal risk, are exempt or are not found to be human subjects research are handled by a "minimal risk team" — staff who are also IRB members and can approve research activities.

"We're in a large IRB office, so we are fortunate in that we have two staff — we call them roving administrators," she says. "I and these two administrators have become the experts in the office, and we help guide the other staff.

"We'll attend the IRB meetings when a dbGaP certification is taking place. If there's a dbGaP certification that occurs with an expedited application or a not-human-subjects [application], we work together as a team to check each other's work. I think by keeping it more centralized, we didn't have to put forth such a huge education effort."

Local considerations

When making a determination about whether to grant a request for dbGaP certification, the UW staff must consider not just NIH's guidelines, but Washington state law.

For example, Sewards says, federal regulations do not consider a deceased person to be a human subject, but Washington state does. Because it would not be possible to obtain consent from these individuals for research use of residual clinical specimens, "it was determined that these types of specimens could not be certified," she says.

The university has created a set of documents to carry out this process, including guidance documents for investigators, IRB members and humans subjects division staff; a dbGaP form; and a checklist that staff can use to determine whether the project has all of the NIH-required elements. Sewards' office also has created consent language investigators can use to meet the NIH requirements.

She's shared these documents and the UW process with other IRBs, noting that one problem that has arisen in UW's certifications is working with other IRBs because of a lack of consistency in their processes.

"We say these are our forms, this is our guidance, please feel free to duplicate it, because in the end, it's going to make more of a consistent process, and it's going to make it easier for everybody."

But in using these resources, Sewards recommends that institutions still start with their own organizational structure and adapt this new process to it.

"Feel free to look around at what other IRBs are doing," she says. "Feel free to use our forms, and see if it works. I think it's really helpful so you're not just starting from scratch."

For more information about the University of Washington's dbGaP certification process or to see the documents developed for it, visit