In This Section

Sharing Genomic Data

Published on · Last Updated 3 months ago


Subscribe to be notified of changes or updates to this page.

12 + 0 =
Solve this simple math problem and enter the result. E.g. for 1+3, enter 4.

The NIH's NIH Policy for Data Management and Sharing makes clear that even though sharing de-identified data and specimens is not human subjects research under 45 CFR 46, the NIH Policy requires the IO and the IRB to review the investigator's plan for data submission and must consider the appropriateness of the informed consent process and document. The Policy goes beyond the regulatory requirements because the genotype and phenotype information generated about individuals will be substantial and, in some instances, sensitive (such as data related to the presence or risk of developing particular diseases or conditions and information regarding family relationships or ancestry), the confidentiality of the data and the privacy of participants must be protected.

NIH Guidance for Sharing Genomic Data

Under the NIH's policy, the Institutional Official (IO) and the IRB are responsible for certifying that plans for the submission of genotype and phenotype data to the NIH meet the requirements of the policy.

To clarify the requirements the NIH has issued a number of guidances and forms, including the following:

Data sharing plans should describe how the expectations of the policy will be met, including:

  • the consistency of the informed consent for submission to the NIH-designated data repository and subsequent sharing;
  • how informed consent will be obtained (for prospectively collected samples and data); and
  • how data will be subsequently de-identified in accord with the specific criteria for data submission.

The investigator is responsible for ensuring that the data submitted for inclusion in the NIH-designated repository is appropriately coded or de-identified. Provided the code isn't shared, the data sent will be de-identified to the recipient (the NIH). If the data is coded, the investigator may retain the key to the code that links to specific individuals.

Investigators are encouraged to obtain a Certificate of Confidentiality (CoC) from the NIH for non-NIH funded studies. Information is available at the NIH's Certificate of Confidentiality Kiosk to guide investigators seeking a CoC through the process. NIH studies are automatically issued a CoC.

Prospective Studies:

The informed consent process and informed consent document should make clear that participants' DNA will undergo genetic analysis and that resultant genotype and phenotype data will be shared with an NIH-designated data repository for research purposes. (Note: prospective means after the date of submission to the IRB.) The CHOP consent form section is stored on Consent Templates page or using the following link: Data Sharing with NIH consent form section.The NIH has also developed Guidance on obtaining informed consent for secondary research with data and biospecimens and for genomic research activities.

Retrospective Studies:

The IRB must determine whether the initial consent document, under which existing genetic materials and data were obtained, is consistent with the submission of data to the NIH-designated repository and the sharing of that data in accord with the GDS policy. (Note: retrospective means existing on or before the date of submission to the IRB.)

For studies that propose to use existing data or samples, the IRB may be forced to conclude that the original consent document is not adequate for submission to the NIH-designated repository. In these cases, the IRB may decide that it is appropriate and necessary for the investigator to seek explicit consent of the research participants for submission to the NIH-designated repository and subsequent sharing.

The criteria for a waiver of consent under 45 CFR part 46 are not applicable to the IRB's determinations (45 CFR 46 does not apply to this use). The criteria the IRB must apply in making its determinations are those set forth in the GDS policy.

Prior to sharing data with the NIH, the investigator must complete the Extramural Institutional Certification form which enumerates any data use limitations. The purpose is to ensure that the data submitted to the NIH-designated repository is consistent with the NIH's GDS Policy and with the informed consent form signed by the original study participants. Since studies can have multiple consent forms and each form may have undergone one or more revisions, each form must be included in the Extramural Institutional Certification form. It is the investigator's responsibility to review each consent form and present the limitations, if any for sharing.

Sharing data that is de-identified is not human subjects research and is therefore outside of the IRB's regulatory charge. The IRB is merely confirming the investigator's assessment (or not) of the sharing language in the consent form(s).

Steps to Follow

  • Download the current NIH Institutional Certification template
  • Fill out the first page, include all sites contributing samples for sequencing.
  • Complete the second page and ensure that any restrictions are consistent with the IRB-approved consent form(s). Each consent form in every IRB-approved iteration that alters the data sharing language must be included.
  • Submit an eIRB amendment to the study under which the data was collected and include the Institutional Certification form (signed by the investigator) with the amendment. Submit a full amendment, complete the SmartForm as applicable, and upload the Institutional Certification form signed by the investigator to section 1.03 question 1.
  • After IRB review, the Institutional Certification is signed by the appropriate officials (third page) and returned to the investigator who submits to the NIH.

NIH Resources for Completing the Extramural Certification Form

The NIH will accept genomic data into the NIH-designated data repository after receiving appropriate certification by the responsible IO of the submitting institution that they approve submission to the NIH GDS data repository.

The IRB will conduct its reviews based on the NIH's criteria above and will document its findings using Review: Genetic Data/Specimen Sharing Plan reviewer form.

What if the IRB can't verify that the sharing plan meets all 4 requirements of the policy?

After review of the investigator's application, the IRB may find that the consent documents do not meet the criteria listed above. They may either

  • Decide that it is appropriate and necessary for the investigator to seek explicit consent of the research participants for submission to the NIH-designated repository and subsequent sharing; or they may
  • Determine that re-consent is not feasible or appropriate for a given study.

The IRB may also determine that it cannot verify that one or more of the other required criteria (1-5) have been met for submission to the NIH-designated repository.

In all these cases, the researchers' data-sharing plan should explain the reasons the IRB's determined that submission to the NIH-designated repository was considered inappropriate. NIH Institutes and Centers will consider these issues on a case-by-case basis when making programmatic decisions to fund genomic research studies for which the submission criteria cannot be met.

Certification Criteria

The certification should assure that:

  • The data submission is consistent with all applicable laws and regulations, as well as institutional policies;
  • The limitations on the research use of the data, as expressed in the informed consent documents, are delineated;
  • The identities of research participants will not be disclosed to the NIH-designated data repositories; and an
  • IRB reviewed and verified that:
    1. The protocol for the collection of genomic and phenotypic data is consistent with the 45 CFR 46.
    2. Data submission and subsequent data sharing for research purposes are consistent with the informed consent of study participants from whom the data were obtained;
    3. The investigator's plan for de-identifying datasets is consistent with the standards outlined in the GDS policy;
    4. To the extent relevant and possible, consideration was given to risks to groups or populations associated with submitting data to NIH-designated data repositories and subsequent sharing; and
    5. The investigator's plan for de-identifying datasets is consistent with the standards outlined in the GDS policy;
  • The certification also needs to indicate whether the data are to be made available through unrestricted or controlled-access and whether future use is limited to not-for-profit organizations.

Frequently Asked Questions

  1. Can CHOP certify a data sharing plan that includes data/specimens obtained from an outside investigator or a repository?

    It depends. The CHOP IRB must be able to verify that the submission of data to a NIH-designated repository and subsequent sharing for research purposes is consistent with the original informed consent document. When the data/specimens were obtained from studies not originally performed at CHOP, the IRB would need evidence that the consent forms included appropriate language permitting sharing for future research. In addition, the originating site would need to provide evidence that it had tracked each subject's choices regarding sharing for future use.