Biobank Consent Management Data Model: IRB Fields

Q: Where can I see how a large biobank handles access?

See UK Biobank data access . Adapt the approval and legal-basis fields to the rules where your repository operates.

A biobank consent management data model is the set of fields a repository stores so that every specimen can be matched to what its donor agreed to and to the ethics approval under which it is held. The fields below are derived from the sources listed at the end of this page: the US Common Rule text on broad consent, one university IRB’s repository guidance, a vendor’s published consent-management description and the GA4GH Data Use Ontology. They are a working design, not an official standard.

This page covers the record structure. For the consent models themselves, see broad, tiered and dynamic consent for biobank specimens; for the regulation’s wording, see broad consent under 45 CFR 46.116(d).

What must a biobank consent record hold?

At minimum, one record per donor consent event that carries the elements the regulation requires the consent to state. For broad consent to storage, maintenance and secondary research use of identifiable private information or identifiable biospecimens, 45 CFR 46.116(d), as published on the eCFR (checked 2026-10-29), lists the content below. The right-hand column is a suggested field for each element.

Element required in the consent (45 CFR 46.116(d))	Suggested record field
General description of the types of research that may be conducted	permitted_research_types (text or coded list)
What information or biospecimens might be used, and whether sharing might occur	materials_covered; sharing_permitted (yes/no)
Types of institutions or researchers who might use them	permitted_recipient_types
How long the material is stored and maintained, and how long it is used for research (either may be indefinite)	storage_duration; research_use_duration (each allows an “indefinite” value)
Unless specific studies are described, a statement that the subject will not be told the details of specific studies and might have declined some	study_specific_notice_given (yes/no)
Unless disclosure of clinically relevant results is guaranteed, a statement that they may not be disclosed	results_return_statement (enumerated: guaranteed / not guaranteed)
Whom to contact about rights, storage and use, and research-related harm	contact_for_rights; contact_for_harm

Outside broad consent, the same section says consent begins with “a concise and focused presentation of the key information” (46.116(a)(5)(i)). A record should therefore also store the consent form version shown to the donor, the date, and the signed form itself.

Which IRB and ethics approval fields does the record need?

Link every consent to the approval that governs the repository. The University of Illinois Office for the Protection of Research Subjects (OPRS), in its guidance on building data or biospecimen repositories for future use (checked 2026-10-29), states that IRB approval must be received “before initiating any repository-related activity”. That is one institution’s rule, not a universal one, but it justifies a hard dependency in the model: no specimen is accessioned without an approval reference.

The same page says the repository management plan must describe consent processes, privacy and confidentiality procedures, the access process for future research, return of results and benefit sharing, governance and oversight, and custodianship. Its Databases and Repositories Form asks what is stored, who manages it, whether data are identifiable or de-identified, whether participants can withdraw, whether results are shared, and how researchers obtain samples. These questions translate into approval-level fields:

Field	Source question it reflects
approval_reference and approving body	IRB approval before repository activity
repository_manager / custodian	Who manages it; custodianship
identifiability (identifiable / de-identified)	Identifiable versus de-identified
withdrawal_permitted (yes/no)	Whether participants can withdraw
results_shared (yes/no)	Whether results are shared
access_process_ref	How researchers obtain samples; access process for future research

For the ethics review side of material collected without consent, see waiver of informed consent.

How do you record consent, waiver and PHI authorization?

Store the legal route as a required enumerated field rather than free text. The Illinois page describes full consent and authorization (the consent “must clearly state that the collected information and/or samples will be stored and used for future research”) and waiver of consent, which it ties to cases where obtaining consent is impossible or impractical, such as leftover pathology samples or de-identified samples. With a waiver and protected health information, the page says the repository must account for authorization through a waiver of authorization, a limited data set, or Safe Harbor de-identification. It also says authorization “determines who can have access to participants’ protected health information (PHI)”.

A workable enumeration is therefore: consent_route = full consent and authorization | waiver of consent; and, when PHI is involved, phi_basis = authorization | waiver of authorization | limited data set | Safe Harbor de-identification. Repositories holding data from people in the EU or UK may also need a field for the legal basis for special category data; that field is outside the sources used here.

How do you match consent to a specimen distribution?

Matching is a comparison between what the requesting study is described as doing and the consents linked to each specimen. OpenSpecimen’s published description of its consent management (checked 2026-10-29) says administrators add consent statements with a unique code, statements are standardized and reusable across studies, the system prevents duplicate statements or codes, and it “restricts the distribution in case the consents don’t match”. The same page describes capturing participant responses, pre-assigning statements to longitudinal time points, uploading a signed form, and reporting, for example, DNA specimens from participants who consented to research use or participants who turned 18 and need re-consent.

The design lesson is to model each consent statement as its own coded row, linked many-to-many with the participant and the specimen, rather than as a column on the specimen. A distribution check then becomes a query over codes. That page does not describe withdrawal handling or IRB fields; those parts of this model rest on the Illinois guidance. For software that implements such checks, see biobank software.

How can GA4GH DUO encode permitted use?

The Global Alliance for Genomics and Health (GA4GH) Data Use Ontology (DUO), as described on the GA4GH product page (checked 2026-10-29), “provides a standard set of terms that can be used to tag datasets with use permissions”. It offers computer-readable use permissions and optional modifiers, and is meant to help researchers find data and data access committees decide. The page lists the last approved version as DUO v1.0, approved 23 February 2021, classified as a data model / ontology and technical specification.

The DUO GitHub page lists term IDs including DUO:0000004 (no restriction), DUO:0000012 (RS), DUO:0000018 (NPUNCU) and DUO:0000043 (CC). A field such as duo_permission_codes on the consent statement lets the matching check above run on standard codes. The DUO pages do not show an IRB or ethics-approval term, so keep approval references in your own fields rather than mapping them to DUO.

What are the common modelling mistakes?

One consent flag per specimen. A single yes/no cannot express the duration, sharing, recipient-type and results statements the regulation lists for broad consent.
No approval link. Without an approval reference on the record, you cannot show that repository activity followed IRB approval.
Free-text legal route. Consent versus waiver versus PHI authorization drives who may see PHI, so it should be an enumerated, reportable field.
Treating withdrawal as deletion. The Illinois form asks whether participants can withdraw; the model should store that setting and any withdrawal event as separate data.
Presenting a field list as a standard. The fields here are derived from named sources; none of the sources publishes this table as a required schema.

FAQ

Is there an official biobank consent data model?

None of the sources listed below publishes one. The regulation sets required consent content, a university IRB sets repository plan content, and GA4GH DUO supplies machine-readable use terms. The model above is a synthesis of those.