NOT-OD-22-213: Supplemental Information to the NIH Policy for Data Management and Sharing: Protecting Privacy When Sharing Human Research Participant Data

"NIH promotes the responsible sharing of scientific data consistent with protecting research participant privacy. To advance efforts under its new Data Management and Sharing Policy (DMS Policy), NIH is providing supplemental information assisting researchers in addressing privacy considerations when sharing human research participant data. This information is not intended to provide a guide for compliance with regulatory requirements nor is it establishing binding rules for NIH awardees, but instead provides a set of principles, best practices, and points to consider for creating a robust framework for protecting the privacy of research participants when sharing data.

Background

Effective data stewardship and protection of human research participant (hereinafter “participant”) privacy are achieved in tandem through responsible scientific data sharing practices. Accordingly, NIH has developed supplemental information to the DMS Policy to assist researchers in responsible data sharing by establishing 1) operational principles for protecting participants’ privacy when sharing scientific data, 2) best practices for implementing these principles, and 3) points to consider for choosing whether to designate scientific data for controlled access.

The operational principles, best practices, and points to consider are intended to address the sharing of both identifiable and de-identified data, as well as data that have been obtained either with consent or where no consent was required. This information is not presented as part of a sequential process nor is it intended to be a how-to guide for de-identification. This supplemental information does not address the use of specimens in research or data security standards, although such standards may apply to research subject to the DMS Policy.[1] Researchers and institutions are also expected to follow all other applicable federal, Tribal, state, and local laws, regulations, and policies that govern research involving human participants and the sharing and use of scientific data derived from participants. For example, NIH has specific privacy expectations under the Genomic Data Sharing (GDS) Policy that should be followed for research subject to that Policy.[2] Data repositories may also establish specific requirements for submission of data.

NIH recommends that these operational principles, best practices, and points to consider be incorporated as early as possible into the research process. Prospective incorporation of this framework facilitates research planning and communication of plans to participants, as encouraged in the DMS Policy. DMS Plans can be updated as necessary with NIH approval. NIH encourages coordination and communication with NIH Program Officers about DMS Plans. Note: These operational principles, best practices, and points to consider may be updated in response to changes in laws, regulations, policies, technology, science, and other factors...."