(b) The rules adopted by the Oregon Health Authority shall address the operation and appointment of institutional review boards. The rules shall conform to the compositional and operational standards for such boards contained in the Federal Policy for the Protection of Human Subjects that is current at the time the rules are adopted. The rules must require that research conducted under paragraph (a) of this subsection be conducted with the approval of the institutional review board.

(c) Persons proposing to conduct anonymous research, coded research or genetic research that is otherwise thought to be exempt from review must obtain from an institutional review board prior to conducting such research a determination that the proposed research is exempt from review.

(2) A person proposing to conduct research under subsection (1) of this section, including anonymous research or coded research, must disclose to the institutional review board the proposed use of DNA samples, genetic testing or genetic information.

(3) The Oregon Health Authority shall adopt rules requiring that all institutional review boards operating under subsection (1)(b) of this section register with the department. The Advisory Committee on Genetic Privacy and Research shall use the registry to educate institutional review boards about the purposes and requirements of the genetic privacy statutes and administrative rules relating to genetic research.

(4) The Oregon Health Authority shall consult with the Advisory Committee on Genetic Privacy and Research before adopting the rules required under subsections (1) and (3) of this section, including rules identifying those parts of the Federal Policy for the Protection of Human Subjects that are applicable to this section.

(5) Genetic research in which the DNA sample or genetic information is coded shall satisfy the following requirements:

(a)(A) The subject has granted informed consent for the specific research project;

(B) The subject has consented to genetic research generally; or

(C) The DNA sample or genetic information is derived from a biological specimen or from clinical individually identifiable health information that was obtained or retained in compliance with ORS 192.537 (2).

(b) The research has been approved by an institutional review board after disclosure by the investigator to the board of risks associated with the coding.

(c) The code is:

(A) Not derived from individual identifiers;

(B) Kept securely and separately from the DNA samples and genetic information; and

(C) Not accessible to the investigator unless specifically approved by the institutional review board.

(d) Data is stored securely in password protected electronic files or by other means with access limited to necessary personnel.

(e) The data is limited to elements required for analysis and meets the criteria in 45 C.F.R 164.514(e) for a limited data set.

(f) The investigator is a party to the data use agreement as provided by 45 C.F.R. 164.514(e) for limited data set recipients.

(6) Research conducted in accordance with this section is rebuttably presumed to comply with ORS 192.535 and 192.539.

(7)(a) Notwithstanding ORS 192.535, a person may use a DNA sample or genetic information obtained, with blanket informed consent, before June 25, 2001, for genetic research.

(b) Notwithstanding ORS 192.535, a person may use a DNA sample or genetic information obtained without specific informed consent and derived from a biological specimen or clinical individually identifiable health information for anonymous research or coded research if an institutional review board operating under subsection (1)(b) of this section:

(A) Waives or alters the consent requirements pursuant to the Federal Policy for the Protection of Human Subjects; and

(B) Waives authorization pursuant to the federal Health Insurance Portability and Accountability Act privacy regulations, 45 C.F.R. parts 160 and 164.

(c) Except as provided in subsection (5)(a) of this section or paragraph (b) of this subsection, a person must have specific informed consent from an individual to use a DNA sample or genetic information of the individual obtained on or after June 25, 2001, for genetic research.

(8) Except as otherwise allowed by rule of the Oregon Health Authority, if DNA samples or genetic information obtained for either clinical or research purposes is used in research, a person may not recontact the individual or the physician, physician assistant, naturopathic physician or nurse practitioner of the individual by using research information that is identifiable or coded. The Oregon Health Authority shall adopt by rule criteria for recontacting an individual or the physician, physician assistant, naturopathic physician or nurse practitioner of an individual. In adopting the criteria, the department shall consider the recommendations of national organizations such as those created by executive order by the President of the United States and the recommendations of the Advisory Committee on Genetic Privacy and Research.

(9) The requirements for consent to, or notification of, obtaining a DNA sample or genetic information for genetic research are governed by the provisions of ORS 192.531 to 192.549 and the administrative rules that were in effect on the effective date of the institutional review board’s most recent approval of the study. [2001 c.588 §6; 2003 c.333 §5; 2005 c.678 §6; 2009 c.595 §171; 2014 c.45 §33; 2017 c.356 §25]

Note: See note under 192.531.