How to Handle Consent for Secondary Use of Data and Biospecimens

By Dr. Zubair Khalid, DVM, MS, PhD · 2026-08-28

Quick Answer

• Broad consent allows stored data and biospecimens to be used for future research within a defined scope, while specific consent limits use to the original study purpose.
• Choose broad consent when future research risks are low and samples are de-identified, but use specific or tiered consent when studies involve sensitive data or higher-risk interventions.
• Institutional review board (IRB) policies and federal regulations vary by institution and study type, so always confirm local requirements before selecting a consent model.

Understanding Consent Models for Secondary Research Use

Secondary use of data and biospecimens refers to research conducted on materials originally collected for a different purpose, such as a prior clinical trial, a biobank, or a routine clinical procedure. The central ethical question is how to honor participant autonomy when the specific future research questions are unknown at the time of collection. Researchers must decide between broad consent, specific consent, and tiered consent approaches, each carrying distinct implications for participant trust, regulatory compliance, and scientific utility.

The consent model you select affects also the initial collection process but also the long-term usability of your research materials. A poorly chosen consent framework can render valuable data unusable for future studies, force re-contact with participants, or expose your institution to compliance risks. This article provides a practical framework for making that decision based on risk, identifiability, and participant preferences.

At a Glance: Consent Model Comparison

Core Principles of Research Consent

Respect for Participant Autonomy

Respect for persons is a foundational principle in research ethics. Participants must be given sufficient information to make informed decisions about how their data and biospecimens will be used. When you collect materials for research, the consent process should clearly describe the nature of the research, the types of data or samples being collected, and the foreseeable uses of those materials. This principle becomes more complex when you anticipate future research that cannot be fully described at the time of consent.

The National Library of Medicine Research Methods Resources provides access to authoritative biomedical texts that discuss the ethical foundations of research with human subjects. These resources emphasize that consent is not a one-time administrative formality but an ongoing process of communication between researchers and participants.

Balancing Scientific Utility and Participant Protection

Research using stored data and biospecimens has substantial public health value. Studies that reuse existing materials can answer questions more quickly and at lower cost than new prospective studies. However, this utility must be balanced against the obligation to protect participant welfare and honor their preferences. The consent model you choose should reflect this balance, not simply default to whichever approach is easiest for the research team.

The Role of Institutional Oversight

Institutional review boards serve as the primary oversight mechanism for research involving human subjects. IRBs evaluate whether proposed consent procedures adequately protect participants and whether the consent model aligns with the risk profile of the research. Federal regulations governing human subjects research require that consent be obtained unless an IRB grants a waiver or alteration. These requirements apply to secondary use studies just as they do to primary data collection.

Regulatory Context for Secondary Use Consent

Federal Regulations and the Common Rule

In the United States, the Common Rule establishes the regulatory framework for human subjects research conducted or supported by federal agencies. The revised Common Rule, which took effect in 2018, explicitly recognizes broad consent as an acceptable approach for the storage and future use of identifiable data and biospecimens. This regulatory change acknowledged that requiring specific consent for every future study would create an impractical burden on researchers and diminish the value of stored materials.

The NIH Grants and Funding portal provides official policy information relevant to researchers seeking federal funding. Investigators should review the specific requirements that apply to their funding mechanism and institution, as institutional policies may impose additional restrictions beyond federal minimums.

HIPAA and Protected Health Information

When research involves protected health information, the Health Insurance Portability and Accountability Act imposes additional requirements. HIPAA authorizations for research use of protected health information must include specific elements, including a description of the information to be used or disclosed and the purposes of the use. Researchers working with clinical data must coordinate their consent approach with HIPAA authorization requirements, which may differ from the Common Rule standards.

State and Institutional Variations

State laws and institutional policies can impose requirements that exceed federal standards. Some states have specific statutes governing biobanking and genetic research, while individual institutions may have policies that restrict certain consent models. Before finalizing your consent approach, consult your institution's research compliance office and legal counsel to identify applicable state and local requirements.

Broad Consent: Definition and Appropriate Use

What Broad Consent Covers

Broad consent permits participants to agree to the storage and future use of their data and biospecimens for research within a defined scope. The scope is typically described in general terms, such as research related to the condition being studied or research within a particular disease area. Broad consent does not authorize unlimited use of materials for any purpose whatsoever. The consent document must describe the general types of research that may be conducted and the governance mechanisms that will oversee future use.

When Broad Consent Is Appropriate

Broad consent is most appropriate when the following conditions are present:

• The research involves minimal risk to participants
• The data or biospecimens will be de-identified or coded before analysis
• The research questions are likely to evolve over time
• Re-contacting participants for each new study would be impractical or impossible

The NIH Data Management and Sharing Policy describes expectations for data sharing that often require broad consent to enable future research use. Investigators planning to share data should consider whether their consent documents permit the anticipated sharing activities.

Limitations of Broad Consent

Broad consent has recognized limitations. Participants may not fully understand the range of future research uses they are authorizing, particularly when those uses involve technologies or research methods that did not exist at the time of consent. Some participants may be comfortable with broad consent for de-identified data but prefer more specific consent for identifiable information or sensitive categories of data. Researchers should document their rationale for selecting broad consent and be prepared to justify that choice to their IRB.

Specific Consent: Definition and Appropriate Use

What Specific Consent Covers

Specific consent limits the use of data and biospecimens to the research described in the original consent document. If a researcher later wishes to use the materials for a different purpose, they must either obtain new consent from participants or seek an IRB waiver of consent. Specific consent provides the strongest protection for participant autonomy because it ensures that participants know exactly how their materials will be used.

When Specific Consent Is Appropriate

Specific consent is appropriate when:

• The research involves more than minimal risk
• The data or biospecimens are identifiable
• The research involves sensitive topics or populations
• The research questions are well-defined and unlikely to change substantially

For studies involving genetic research, reproductive health, mental health, or other sensitive areas, specific consent may be the most ethically defensible approach. Participants in these studies may have strong preferences about how their data are used, and specific consent respects those preferences most directly.

Practical Challenges with Specific Consent

The primary challenge with specific consent is that it limits the future utility of stored materials. Researchers who anticipate conducting multiple studies on the same data or samples may find that specific consent requires repeated re-contact with participants, which can be costly and time-consuming. In some cases, participants may be lost to follow-up, making re-consent impossible. These practical considerations should be weighed against the ethical benefits of specific consent.

Tiered Consent: A Middle Ground

How Tiered Consent Works

Tiered consent offers participants a menu of options for how their data and biospecimens may be used in the future. Common tiers include:

• Use only for the original study
• Use for research on the same condition or disease
• Use for any health-related research
• Use for any research purpose

Participants select the level of authorization with which they are comfortable. This approach respects individual preferences while providing researchers with more flexibility than specific consent alone.

Advantages of Tiered Consent

Tiered consent can increase participant willingness to contribute to research because it gives them meaningful control over how their materials are used. Participants who might decline to participate under a broad consent model may agree to participate when they can choose a more limited scope. Tiered consent also provides a mechanism for accommodating participants with varying comfort levels within a single study.

Complexity and Data Management Requirements

The main disadvantage of tiered consent is complexity. Consent forms become longer and more complicated, and data management systems must track each participant's consent choices accurately. Researchers must ensure that their data infrastructure can enforce the selected restrictions, which may require additional investment in data management systems. The EQUATOR Network provides reporting guidelines that can help researchers document their consent procedures transparently in publications.

Decision Framework for Selecting a Consent Model

Step 1: Assess the Risk Level of the Research

Begin by evaluating the risk profile of your research. Studies involving minimal risk, such as those using de-identified data or samples that have already been collected, may be suitable for broad consent or even an IRB waiver of consent. Studies involving more than minimal risk, such as those that could lead to re-identification of participants or that involve sensitive information, generally require more specific consent approaches.

Step 2: Evaluate Identifiability of Data and Biospecimens

Consider whether your data or biospecimens are identifiable, coded, or de-identified. Identifiable materials require stronger consent protections because the link between the materials and the participant remains intact. De-identified materials may qualify for exemption from consent requirements under certain regulatory provisions, though you should confirm this with your IRB.

Step 3: Consider Participant Preferences and Community Expectations

Research with communities that have historically been marginalized or exploited may require additional attention to consent processes. Some communities have expressed strong preferences about how their data and biospecimens are used, and researchers should engage with community stakeholders when designing consent approaches. The Committee on Publication Ethics Core Practices emphasizes the importance of transparency and accountability in research conduct, which extends to consent practices.

Step 4: Review Institutional Policies and Funding Requirements

Check your institution's policies on consent for secondary use and review any requirements imposed by your funding source. The NIH Grants and Funding portal provides information about grant requirements, and the NIH Data Management and Sharing Policy describes expectations for data sharing that may affect your consent approach.

Step 5: Document Your Decision and Rationale

Document your consent model selection and the rationale for that choice in your research protocol. This documentation should address the risk assessment, identifiability considerations, participant preference considerations, and institutional requirements that informed your decision. Your IRB will review this documentation as part of the approval process.

flowchart TD
    A[Research Question Defined] --> B{Are data or samples identifiable?}
    B -->|No| C[Consider IRB exemption or waiver]
    B -->|Yes| D{Does research involve more than minimal risk?}
    D -->|No| E{Will future research questions change?}
    D -->|Yes| F[Use specific or tiered consent]
    E -->|Yes| G[Consider broad consent]
    E -->|No| H[Consider specific consent]
    F --> I[Document decision in protocol]
    G --> I
    H --> I
    C --> I

Practical Implementation Steps

Drafting Consent Language

When drafting consent documents for secondary use, use plain language that participants can understand. Avoid technical jargon and describe the scope of future research in terms that are meaningful to a lay audience. The consent document should clearly state whether the participant is being asked to authorize broad, specific, or tiered use of their materials.

Building Data Management Systems

Your data management system must be capable of tracking consent restrictions and enforcing them when data are accessed or shared. This may involve implementing role-based access controls, audit trails, and automated checks that prevent unauthorized use of restricted materials. The NIH Data Management and Sharing Policy provides guidance on data management practices that support responsible sharing.

Training Research Staff

Research staff who handle data and biospecimens must understand the consent restrictions that apply to the materials they work with. Provide training on the consent model used in your study, the importance of honoring participant choices, and the procedures for reporting and addressing consent violations.

Establishing Governance Mechanisms

For studies using broad consent, establish governance mechanisms that will oversee future research use. This may include a data access committee, a biospecimen utilization committee, or similar body that reviews proposed uses of stored materials. These committees should include diverse perspectives and should have clear criteria for approving or denying research proposals.

Records and Measurements

Maintaining Consent Documentation

Maintain complete records of consent documents, including the version of the consent form used, the date of consent, and any restrictions selected by the participant. These records must be retained for the duration of the research and for any additional period required by institutional policy or regulation.

Tracking Consent Compliance

Implement procedures for tracking compliance with consent restrictions. This includes monitoring data access logs, reviewing research protocols that propose to use stored materials, and conducting periodic audits of consent documentation. The Committee on Publication Ethics Core Practices provides guidance on maintaining research integrity, which includes accurate record-keeping.

Measuring Participant Understanding

Consider conducting assessments of participant understanding as part of the consent process. While not required by regulation, these assessments can help you identify areas where your consent documents may be unclear and can inform improvements to the consent process.

Common Failure Patterns

Using Broad Consent for Sensitive Data

A common error is applying broad consent to research involving sensitive data or populations where participants would likely want more specific control. This can lead to participant distrust and may expose the institution to legal or regulatory risk if participants object to the use of their materials.

Failing to Track Consent Restrictions

Another frequent failure is neglecting to implement systems that track and enforce consent restrictions. When data are shared or accessed without regard to consent limitations, the institution may be in violation of its obligations to participants and regulators.

Inadequate Documentation of Consent Decisions

Researchers sometimes fail to document the rationale for their consent model selection, making it difficult to justify their approach during audits or in response to participant inquiries. Thorough documentation protects both the research team and the institution.

Overlooking State and Institutional Requirements

Federal regulations are not the only source of consent requirements. State laws and institutional policies may impose additional obligations, and failing to identify these requirements can result in non-compliance.

Welfare and Safety Context

Protecting Vulnerable Populations

Research involving vulnerable populations, including children, pregnant women, prisoners, and individuals with diminished decision-making capacity, requires additional safeguards. These populations may require more specific consent approaches or additional protections beyond those provided by standard consent procedures.

Addressing Participant Concerns About Privacy

Participants may be concerned about the privacy of their data and biospecimens, particularly when those materials are used for research purposes they did not anticipate. Researchers should be prepared to address these concerns and should have procedures in place for responding to participant inquiries about how their materials are being used.

Responding to Consent Violations

If a consent violation occurs, respond promptly and transparently. Notify the appropriate institutional officials, assess the scope of the violation, and take corrective action to prevent recurrence. The Committee on Publication Ethics Core Practices provides guidance on handling research misconduct and other integrity issues.

Professional Escalation Criteria

When to Consult Your IRB

Consult your IRB early in the planning process if you are uncertain about the appropriate consent model for your research. IRBs can provide guidance on regulatory requirements and institutional policies, and they can help you identify potential issues before they become problems.

When to Involve Legal Counsel

Involve legal counsel when your research involves complex regulatory questions, such as those involving HIPAA, state genetic privacy laws, or international data transfers. Legal counsel can help you navigate these requirements and can review consent documents for legal sufficiency.

When to Engage Community Stakeholders

Engage community stakeholders when your research involves populations that have expressed concerns about research participation or when you are uncertain about community expectations regarding consent. Community engagement can help you design consent processes that are culturally appropriate and that build trust.

Limitations and Scope of This Guidance

Regulatory Changes Over Time

Consent requirements evolve as regulations are revised and as new ethical considerations emerge. The guidance in this article reflects current understanding, but researchers should monitor regulatory developments and update their practices accordingly.

Institutional Variation

Institutional policies vary widely, and the requirements at your institution may differ from those described here. Always consult your institution's research compliance office for guidance specific to your setting.

International Considerations

Research conducted outside the United States or involving participants in other countries may be subject to different consent requirements. The General Data Protection Regulation in the European Union and other international frameworks impose their own requirements for secondary use of data.

Frequently Asked Questions

What is the difference between broad consent and specific consent?

Broad consent authorizes future research use of data and biospecimens within a defined scope, while specific consent limits use to the original study purpose. Broad consent is appropriate for low-risk research with de-identified materials, while specific consent is better suited for higher-risk or sensitive research.

Can I use broad consent for genetic research?

Broad consent can be used for genetic research if the research involves minimal risk and the data are appropriately protected. However, some institutions and communities have expressed concerns about broad consent for genetic research, and you should consult your IRB and consider community expectations.

What happens if a participant withdraws consent?

When a participant withdraws consent, you must stop using their data and biospecimens for research purposes. You should have procedures in place for identifying and removing withdrawn participants' materials from your research database and for ensuring that their data are not used in future studies.

Do I need consent for research using de-identified data?

Research using de-identified data may qualify for exemption from consent requirements under the Common Rule. However, you should confirm with your IRB that your data meet the regulatory definition of de-identified and that your research qualifies for the exemption.

How does HIPAA affect consent for secondary use?

HIPAA imposes additional requirements when research involves protected health information. You may need to obtain a HIPAA authorization in addition to informed consent, and the authorization must include specific elements required by the HIPAA Privacy Rule.

What is tiered consent and when should I use it?

Tiered consent offers participants a menu of options for how their data and biospecimens may be used in the future. It is appropriate when participants may have varying comfort levels with different types of research and when you want to maximize participant willingness to contribute.

Can I share data collected under broad consent?

Data collected under broad consent can be shared if the consent document permits sharing and if the sharing is consistent with the scope of the broad consent. The NIH Data Management and Sharing Policy describes expectations for data sharing that may affect your approach.

What should I do if my consent documents do not permit the research I want to conduct?

If your consent documents do not permit the proposed research, you must either obtain new consent from participants or seek an IRB waiver of consent. The IRB may grant a waiver if the research involves minimal risk and if obtaining consent would be impracticable.

Using the Evidence

Related Articles

• The Role of the Research Ethics Committee: What Researchers Need to Know
• Scientific Data Provenance For Reproducible Research
• What Is a Data Dictionary? A Practical Guide for Research Teams
• Open Science Practices: A Guide for Researchers
• What Is a Data Lake? Architecture, Use Cases, and Best Practices

References and Further Reading

• Research Methods Resources. National Library of Medicine.
• EQUATOR Network. EQUATOR Network.
• Core Practices. Committee on Publication Ethics.
• NIH Grants and Funding. National Institutes of Health.
• ORCID for Researchers. ORCID.
• Data Management and Sharing Policy. National Institutes of Health.
• NCBI Literature Resources. National Center for Biotechnology Information.
• PubMed. National Library of Medicine.

This article is educational and does not replace institutional policy, professional advice, or applicable safety and regulatory requirements.