Secondary use means taking data or biospecimens that were already collected for one purpose — a prior study, a clinical encounter, a biobank deposit — and using them for a new research question. When that material is identifiable (or contains identifiable biospecimens, per the Common Rule’s separate biospecimen category), the new use does not get a free pass just because the material already exists. Whoever wants to reuse it still has to land in one of a small number of defined regulatory pathways before starting the new analysis.
This guide walks through those pathways under the U.S. Common Rule (45 CFR 46) and, where it independently applies, HIPAA: exemption, IRB waiver of consent, prospective broad consent obtained at original collection, and de-identification that removes the material from human-subjects jurisdiction entirely. It is a distinct question from how to analyze existing data — see Secondary Data Analysis Explained for the research-methods side (dataset sourcing, strengths/limitations of reusing data). This page is about the consent/IRB mechanics that have to be resolved before that analysis can lawfully happen.
Why identifiability is the whole question
Under 45 CFR 46.102(e), the Common Rule only reaches a “human subject” if an investigator obtains identifiable private information or identifiable biospecimens about a living individual. If the secondary-use dataset is fully de-identified — and stays that way, with no realistic path back to re-identification by the investigator receiving it — the activity generally falls outside Common Rule/IRB jurisdiction altogether. That is why so much secondary-use guidance from research offices starts with a single question: is what you’re receiving identifiable, coded/linkable, or de-identified? The answer determines which of the pathways below is even available.
“Coded” or “linked” data — identifiers stripped from the dataset itself but retrievable through a key held by someone else — is treated as identifiable for Common Rule purposes unless the investigator receiving it has no ability to obtain the key. Institutions commonly route this scenario through an honest broker arrangement, where a third party manages the key and releases only de-identified material to the research team.
Pathway 1: The secondary-research exemption (45 CFR 46.104(d)(4))
The 2018 revised Common Rule added a specific exemption category for secondary research use of identifiable private information or identifiable biospecimens. Under 45 CFR 46.104(d)(4), the activity can be exempt from full Common Rule requirements if at least one of these is true:
- The identifiable private information or identifiable biospecimens are already publicly available.
- Information (including about biospecimens) is recorded by the investigator in a way that subjects’ identities cannot readily be ascertained directly or through linked identifiers, the investigator does not contact subjects, and the investigator will not re-identify subjects.
- The research involves only the use of identifiable health information where that use is already regulated under HIPAA’s Privacy Rule (45 CFR Parts 160 and 164, Subparts A and E) for health care operations, research, or public health purposes as HIPAA defines those terms.
“Exempt” under the Common Rule is a regulatory determination, not a self-declaration — institutions require someone with delegated authority (an IRB office, exemption-determination official, or the IRB itself) to make and document that call; a researcher generally cannot decide their own project is exempt. Source: 45 CFR 46.104(d)(4), current eCFR text; Columbia TC IRB and University of Pittsburgh HRPO guidance on the exemption category, cross-corroborated.
Pathway 2: IRB waiver of informed consent for secondary use
If the material doesn’t fit the exemption above (for example, it’s identifiable, not publicly available, and not solely HIPAA-regulated health information), the study still needs IRB review, and the IRB can consider waiving the requirement for new informed consent under 45 CFR 46.116(f). To grant that waiver, the IRB has to find, among the other 46.116(f) criteria, that the research involves no more than minimal risk, that the waiver won’t adversely affect subjects’ rights and welfare, and that the research could not practicably be carried out without it — a condition that’s often genuinely met for secondary-use studies, since going back to a large or historical cohort for re-consent may be impossible. This is the same waiver mechanism covered in general at Waiver of Informed Consent; secondary-use studies are one of its most common real-world applications, alongside the separate question of whether documentation of consent (46.117) can also be waived.
One limit worth flagging directly: if a subject was specifically asked for broad consent to future secondary use at the time of original collection and refused, an IRB cannot then use the 46.116(f) waiver pathway to bring that subject’s data or biospecimens into a secondary study anyway (45 CFR 46.116(e)-(f)). A prior refusal forecloses the waiver route for that individual’s material.
Pathway 3: Prospective broad consent obtained at collection
If an institution anticipated future secondary use and built it into the original consent process, the relevant mechanism is broad consent under 45 CFR 46.116(d) — a single, defined consent obtained up front that covers storage and future, not-yet-specified secondary research use of identifiable private information or identifiable biospecimens. Broad consent only works prospectively: it has to be obtained before or at the time of original collection, with enumerated required elements, and any actual downstream use still requires a limited IRB review step confirming the use fits what was disclosed. It cannot be applied retroactively to material collected without it — for material already sitting in a dataset or biobank without prior broad consent, the choice is between the exemption and waiver pathways above.
Biobanks in particular often combine several consent models — see Biobank Specimen Consent Models: Broad, Tiered, and Dynamic Consent Compared for how broad consent sits alongside tiered and dynamic-consent alternatives.
HIPAA runs in parallel, not instead of the Common Rule
When the identifiable material includes protected health information from a covered entity, HIPAA’s Privacy Rule applies as a separate, concurrent legal regime — meeting a Common Rule pathway does not automatically satisfy HIPAA, and vice versa. HIPAA offers its own secondary-use routes: a specific research authorization, an IRB or Privacy Board waiver/alteration of authorization under 45 CFR 164.512(i) (a different waiver standard from the Common Rule’s 46.116(f), though the two are often reviewed together), use of a HIPAA limited data set under a data use agreement, or full HIPAA de-identification under the Safe Harbor or Expert Determination method (45 CFR 164.514(a)-(b)). See Limited Data Set vs. De-Identified Data (HIPAA) for how those two specific HIPAA categories differ, and De-Identification for the general concept.
What this looks like in practice
Consider a researcher who wants to reuse blood samples and clinical records originally collected for an unrelated prior study, to test a new hypothesis. The practical sequence is usually:
- Determine identifiability: are the samples/records identifiable, coded with a retrievable key, or fully de-identified in the requesting investigator’s hands?
- If fully de-identified and no re-identification will occur, the new use is typically outside Common Rule jurisdiction — though institutional policy and, separately, HIPAA may still apply if PHI is involved.
- If identifiable, check whether the 46.104(d)(4) exemption criteria are met (public availability, no re-identification/no contact, or HIPAA-regulated-only use) and get that determination documented by the IRB office.
- If not exempt, submit for IRB review and request a waiver of consent under 46.116(f), addressing minimal risk, no adverse effect on subjects, and impracticability of re-consent.
- If the original consent form included Common Rule-compliant broad consent for future secondary research, confirm the new use fits its scope and complete the required limited IRB review before proceeding.
None of these pathways are mutually interchangeable shortcuts — each has its own documentation burden, and an IRB office will typically want the identifiability analysis in writing before it will process an exemption or waiver request.
How this differs from related CASRAI pages
- Secondary Data Analysis Explained covers the research-methods side of reusing existing datasets (sourcing, strengths, limitations); this page covers the consent/IRB compliance side of the same underlying activity.
- Broad Consent Under 45 CFR 46.116(d) is the prospective, collection-time consent mechanism; this page covers what happens when that prior consent doesn’t exist and the material must instead go through exemption or waiver review.
- Honest Broker covers the specific intermediary role used to keep coded/linked data out of an investigator’s identifiable hands.
- Quality Improvement vs. Human Subjects Research addresses a related but distinct threshold question — whether an activity is human subjects research at all, rather than how to reuse data once it clearly is.
Frequently asked questions
Does secondary use of identifiable data always require a new IRB submission?
Not necessarily. If it qualifies for the 45 CFR 46.104(d)(4) exemption, it still requires a documented exemption determination but not full IRB review. If prior broad consent already covers the intended use, a limited IRB review (a lighter-weight step than full review) is required rather than a full new protocol. Only when neither applies does the study typically need full IRB review with a waiver-of-consent request.
Can de-identified data ever become identifiable again and trigger these requirements?
Yes. If a dataset described as de-identified is re-identified, or was never truly de-identified under the applicable standard (Common Rule’s re-identification test or HIPAA’s Safe Harbor/Expert Determination standards), the material is treated as identifiable and the relevant pathway analysis applies from that point.
Is a data use agreement a substitute for an IRB determination?
No. A data use agreement is a contractual instrument governing how a data set may be used and shared between institutions; it does not itself satisfy Common Rule or HIPAA requirements. Both are commonly required together for secondary use of a HIPAA limited data set.
