The statute requires researchers conducting non-exempt research to obtain informed consent of the individual research subject or his or her representative. The consent must comply with statutory requirements and the Department of Human Services must adopt rules conforming to the Federal Policy for the Protection of Human Subjects, 45 CFR 46, particularly addressing the operation and appointment of Institutional Review Boards, which Boards must register with DHS pursuant to DHS rule.

If the research anticipates DNA samples or genetic information that is coded, identified, identifiable, or linked to identifiers, the statute imposes additional requirements.

If the genetic research is coded, the research subject must grant informed consent for the specific research project or genetic research generally. The research must be approved by an IRB after disclosure to the board by the researcher of the risks of coding. Approval of the IRB does not need to take any particular form, so long as the IRB is fully informed in the course of the researcher’s presentation and approves the protocol with the clear understanding that coding is an element of the research. The code must not be derived from individual identifiers, must be kept securely and separately from the DNA samples and genetic information, and must not be accessible to the investigator unless specifically approved by the IRB. The data must be stored securely in electronic files or by other means with access limited to necessary personnel. The data must also be limited to elements required for analysis and meet the criteria for a “limited data set” (45 CFR 164.514 (e)). Finally, the investigator must be a party to the data use agreement. An agreement into which a “covered entity” enters with the recipient (e.g., researcher) of a limited data set that establishes the ways in which the limited data set may be used and how it will be protected (45 C.F.R. 164.514 (e)).