Residual Clinical Samples in China: Secondary Research Without Creating an HGR Surprise

Life Sciences & Healthcare Blog · Legal cluster

The freezer is not a free research platform. Residual clinical samples collected for Trial A become a regulatory project the moment someone proposes Trial B, biomarker fishing, or offshore sequencing — and in China the trigger points are specific: the scope of informed consent, the ethics-committee (IRB/EC) approval record, the human genetic resources (HGR) framework, and the data-protection rules that govern genetic and health information. This article walks through the gate questions that determine whether a proposed secondary use of residual samples is lawful, where the Chinese entity of responsibility sits, and what a sponsor should freeze before the first aliquot ships.

Why this matters: secondary use is the fastest way to create a new regulatory exposure#

Clinical trial operations are built around a defined protocol, an approved consent form, and a scope of use that subjects agreed to. Residual samples — the aliquots left over after the protocol-defined testing — are not an asset to be mined freely; they are personal information and, where genetic material is involved, human genetic resources subject to a distinct regulatory regime. The moment a scientist proposes "let's use the leftover samples for a biomarker study" or "let's send sequencing data to our partner offshore," the legal character of the activity changes from clinical research to a new data-processing and possibly cross-border-transfer operation.

For sponsors, CROs, and hospital sites, the exposure is practical: an unapproved secondary use can invalidate the study's compliance posture, trigger an ethics-committee finding, attract a human genetic resources penalty, and undermine the data protection file. In the worst cases, samples that left the site under a narrow consent have no way to come back — the data has moved, the research has been published, and the regulatory problem is permanent. The gate questions in this article are designed to be asked before the freezer door opens.

Governing legal and statutory framework#

Human Genetic Resources framework (Regulations of the People's Republic of China on the Administration of Human Genetic Resources, 2019, amended 2023)#

The HGR regulations administer the collection, preservation, utilisation, and cross-border provision of human genetic resources — human genes, genomes, and other genetic materials and related data. Secondary use of residual clinical samples can constitute a new collection or utilisation of human genetic resources, and the cross-border transfer of genetic material or related information triggers approval or record-filing obligations. The responsible Chinese entity — typically the Chinese partner, sponsor entity, or hospital — must be identified and must hold the approvals for the specific activity. The Ministry of Science and Technology (MOST), through its human genetic resources administration, has issued penalties for unapproved utilisation and unapproved cross-border transfers of genetic resources, including cases arising from the re-use of clinical samples beyond the approved scope.

Regulations on the Administration of Human Genetic Resources, Article 27 (as amended): The utilisation of human genetic resources shall comply with ethical principles, follow relevant technical norms, and shall not be used for activities contrary to public interest... (provisions on the cross-border provision and international cooperation requiring approval or filing).

Personal Information Protection Law of the People's Republic of China (2021)#

Health information — including information collected from clinical trials — is sensitive personal information under the Personal Information Protection Law (PIPL). Articles 13 and 29 require a lawful basis and, for sensitive personal information, separate consent. A residual sample's original consent form was drafted for Trial A; if Trial B's analysis of the same sample exceeds that consent, the separate-consent requirement is not satisfied by the old form. Article 13's lawful bases and Article 29's separate consent are the data-protection gates that operate alongside the HGR framework.

Key legal analysis and enforcement precedents#

Enforcement practice under the HGR framework has repeatedly demonstrated that scope matters. The published penalty record includes administrative actions against institutions and companies that used samples or related data for purposes beyond the approved scope, and against entities that transferred human genetic resources or related information abroad without the required approval or filing. The pattern in those cases is consistent: the violation was not the collection — it was the second use, or the transfer, that had not been separately approved.

The privacy dimension runs parallel. Since PIPL took effect in November 2021, regulators have examined whether secondary use of personal information — including health data held by platforms and research institutions — has a lawful basis. The intersection of PIPL with the HGR framework creates a double gate for clinical material: a secondary use can be lawful only if it satisfies both the HGR approvals and the privacy-law consent requirements. Missing either gate is a compliance failure, and the two frameworks are enforced by different authorities — MOST for HGR, the Cyberspace Administration of China and sector regulators for data protection.

For offshore sequencing, the stakes are highest. Sending genetic data to a foreign partner without approval can be both an HGR violation and a PIPL cross-border-transfer violation, and the practical consequence — revocation of approvals, penalties, and damage to the company's ability to conduct future trials in China — is severe. The point of the gate questions is to catch this before the data moves.

The consent-scope analysis has a timing dimension that teams often miss. Under the PIPL's sensitive-personal-information rules, the separate consent for a secondary research use must be obtained before the processing begins, and the consent form should state the specific research purpose with sufficient clarity that a later use within that stated purpose remains covered. A form that says "future research" without describing the research category, the data elements, or the retention period does not carry the weight that a specific-purpose consent carries. The practical rule is to draft the secondary-use consent at the same time as the original trial consent, so that the residual-sample strategy is defined before the samples exist — not reverse-engineered when a researcher opens the freezer.

Operational vulnerabilities and transactional pitfalls#

The recurring failure points in residual-sample programmes:

• Consent-scope mismatch: the signed consent covers Trial A only; Trial B, biomarker research, or biobanking exceeds the scope. A generic "future research" clause is no longer presumed sufficient for sensitive health data under current practice, and separate consent is required for each materially different use.
• EC/IRB coverage gap: the ethics committee approved the original protocol, but no ethics approval exists for the secondary use. Samples are processed while the paperwork is "being prepared" — a state that regulators and inspectors treat as unapproved.
• Offshore movement without a map: someone proposes sending sequencing data or samples to a partner abroad, and nobody has identified whether the transfer triggers HGR approval, HGR filing, or PIPL cross-border-transfer rules (security assessment, standard contract, or certification).
• Unidentified responsible entity: the HGR framework requires a Chinese entity to own the compliance obligations. If the sponsor is foreign, the CRO is agnostic, and the hospital disclaims responsibility, there may be no entity holding the approvals — and enforcement looks for exactly that gap.
• Silent cloud mirrors: the CRO or sequencing lab keeps a "convenience copy" of sequence data on a foreign cloud service for analysis tools. Nobody documented it as a cross-border transfer because nobody thought of it as one — until the inspector asks where the data is stored.

Clinical-sample gates from a Chengdu practice#

In my clinical-research and health-data practice in Chengdu, the residual-sample conversation usually begins with a scientist’s proposal — “we still have aliquots from Trial A, let’s run the biomarker analysis” — and the question that decides the matter is scope. The signed consent form covered Trial A; Trial B, biomarker fishing and biobank deposit each exceed that consent unless the form was drafted for them, and a generic “future research” clause is not presumed sufficient for sensitive health data under current practice. The ethics layer is the second gate: the EC/IRB approval covers the protocol as approved, and secondary use that was not in the approval is a new review, not a footnote. The HGR layer is the third and the one most often missed: where the samples are genetic material or carry related genetic information, the human genetic resources rules apply to the utilisation and to any cross-border transfer, and sequence data sent to a partner abroad on the strength of a friendly email is a transfer that the approval regime applies to. The enforcement record is consistent: institutions and companies have been penalised for using samples beyond the approved scope and for transferring genetic resources without approval or filing. My advice to sponsors, CROs and sites is to run the four gates — consent, ethics, cross-border, and data-security — before the first aliquot ships, and to verify each gate in writing rather than assuming the hospital’s ethics file, the CRO’s data practices and the sponsor’s HGR approvals are all in order.

Strategic compliance roadmap and action plan#

Run the four gate questions before any secondary use begins:

1. Consent gate: does the signed consent and EC approval cover this proposed use — Trial B, biomarker fishing, biobank deposit, or other? If not, obtain new consent or narrow the proposal to the consented scope.
2. Cross-border gate: are materials, related genetic information, or derived data leaving mainland China, including to a cloud service used for analysis? Map every flow — samples, sequence data, derived results — and identify the HGR approval or filing and PIPL transfer mechanism for each.
3. Responsibility gate: who is the responsible Chinese entity under HGR practice for this activity — sponsor, CRO, hospital, or lab? Confirm that the entity exists, holds the approvals, and has signed the compliance obligations in the trial contracts.
4. Evidence gate: can the CRO and lab prove there is no silent cloud mirror of sequence data, no unauthorised onward transfer, and no shared dataset outside the approved scope? Require documented infrastructure maps and contractual restrictions.

If any answer is fuzzy, freeze outbound movement and run the full HGR plus privacy map before the first aliquot ships. After the map is complete, document it in the study file, and treat every subsequent request for sample use as a new gate review — not a formality.

The hospital and CRO contracts should carry the gate requirements explicitly. The clinical trial agreement and the laboratory services agreement should state that residual samples may only be used for secondary research after the sponsor has confirmed consent coverage, ethics approval, and the HGR and privacy analysis, and that no sample or derived data may leave mainland China without the documented approvals. The contractual layer matters because the CRO and the lab may not be motivated to ask the questions; a contract that makes the gate a condition of the work converts the sponsor's compliance programme into the vendor's obligation, and it gives the sponsor the audit right to verify that the vendor's infrastructure — including its cloud storage — holds no silent mirror of the data. The responsible-Chinese-entity question also has a practical edge for global sponsors. In our work with multinational biopharma teams on China trials, the entity that signs the HGR filings is usually a Chinese sponsor entity, a CRO with a Chinese licence, or the hospital itself, and the choice determines which approvals are even available. A foreign sponsor that has no Chinese entity in the chain will find that the HGR approval route is not open to it directly, and the documentation must identify the Chinese partner that holds the obligations before the study design is finalised. Identifying that entity early is what turns an HGR surprise into a scheduled approval.

What not to do#

Do not treat the freezer as a research budget. Do not let "the subjects signed a broad consent" carry the weight of a specific secondary-use approval. Do not send sequence data to a partner abroad on the strength of a friendly email. And do not assume that the hospital's ethics file, the CRO's data practices, and the sponsor's HGR approvals are all in order — verify each one, in writing, before the first aliquot ships. The cost of the gate review is trivial; the cost of an unapproved sample that has already moved is not.

Read next: HGR compliance · Subject injury & insurance · Clinical data

Cluster: Life sciences legal hub · Life sciences blog