When the HHS National Institutes of Health (NIH) first announced its intention to require greater sharing of research data, the agency immediately heard concerns about privacy protections for study subjects—already a murky issue with differing HIPAA and NIH policies and confusing concepts like de-identification in play.
NIH’s data management and sharing (DMS) policy will go into effect early next year. As of Jan. 25, most applications hospitals and other research institutions submit for NIH funding must be accompanied by a DMS plan, under a policy NIH first announced two years ago that is an update to its 2003 requirements.
Under the policy, funded investigators must manage and share data as described in the approved DMS plan, provide updates on data management and sharing activities in annual progress reports and work proactively with the appropriate program officer for approval of changes to the plan should it change during the project, NIH said on its website.[1]
To address confidentiality concerns, on Sept. 21, NIH added information on its website titled, “Supplemental Information to the NIH Policy for Data Management and Sharing: Protecting Privacy When Sharing Human Research Participant Data.”[2]
As NIH explained: “Respect for and protection of participant privacy is fundamental to the biomedical and behavioral research enterprise. NIH and the institutions it funds must protect the privacy and confidentiality of every participant as described in applicable informed consent and in line with all applicable laws, regulations, and policies.”
Focus on Consent, Ensure Reviews
The supplementary information includes six “operational principles for protecting participant privacy when sharing scientific data (more details are provided on the website)”:
-
Proactive assessment of protections. “Researchers and institutions should proactively assess the protections needed for sharing scientific data from participants, including determining whether sharing should be restricted through controlled access.”
-
Clear communication of data sharing and use in consent forms. “Researchers and institutions should develop robust consent processes that prioritize clarity regarding future sharing and use of scientific data, including limitations on future use, and general aspects regarding how data will be managed.”
-
Consideration of justifiable limitations to sharing data. “There may be justifiable limitations to sharing scientific data under the DMS Policy. The DMS Policy outlines factors that might limit sharing, including when sharing would compromise the privacy or safety of participants and when limitations are explicitly described in informed consent documents. In these instances, researchers should outline these justifications in their Data Management and Sharing Plans.”
-
Institutional review of the conditions for data sharing. “Institutions should review the conditions for sharing data, including that proposed limitations on the future use of data are appropriate and that risks have been considered, and communicate this information to repositories and/or users.”
-
Protections for all data used in research. “Scientific data used in research warrant privacy considerations regardless of whether the data are collected from non-research settings or settings that may be subject to different privacy standards than traditionally applied to research data, such as from social media and public health surveillance. Even if researchers cannot set the standards for collecting such data, they should apply protections for sharing scientific data consistent with those outlined in this supplemental information.”
-
Remaining vigilant regarding data misuse. “Responsible data sharing practices require a commitment from the entirety of the biomedical and behavioral research enterprise. Researchers and institutions should remain vigilant regarding potential misuse and work in concert with NIH to prevent unauthorized use of scientific data from NIH-supported repositories. In addition, NIH is committed to enforcing the terms of its data use agreements.”
