Sharing Genomic Data

Data sharing plans should describe how the expectations of the policy will be met, including:

• the consistency of the informed consent for submission to the NIH-designated data repository and subsequent sharing;
• how informed consent will be obtained (for prospectively collected samples and data); and
• how data will be subsequently de-identified in accord with the specific criteria for data submission.

The investigator is responsible for ensuring that the data submitted for inclusion in the NIH-designated repository is appropriately coded or de-identified. Provided the code isn't shared, the data sent will be de-identified to the recipient (the NIH). If the data is coded, the investigator may retain the key to the code that links to specific individuals.

Investigators are encouraged to obtain a Certificate of Confidentiality (CoC) from the NIH for non-NIH funded studies. Information is available at the NIH's Certificate of Confidentiality Kiosk to guide investigators seeking a CoC through the process. NIH studies are automatically issued a CoC.

For studies that propose to use existing data or samples, the IRB may be forced to conclude that the original consent document is not adequate for submission to the NIH-designated repository. In these cases, the IRB may decide that it is appropriate and necessary for the investigator to seek explicit consent of the research participants for submission to the NIH-designated repository and subsequent sharing.

The criteria for a waiver of consent under 45 CFR part 46 are not applicable to the IRB's determinations (45 CFR 46 does not apply to this use). The criteria the IRB must apply in making its determinations are those set forth in the GDS policy.

Prior to sharing data with the NIH, the investigator must complete the Extramural Institutional Certification form which enumerates any data use limitations. The purpose is to ensure that the data submitted to the NIH-designated repository is consistent with the NIH's GDS Policy and with the informed consent form signed by the original study participants. Since studies can have multiple consent forms and each form may have undergone one or more revisions, each form must be included in the Extramural Institutional Certification form. It is the investigator's responsibility to review each consent form and present the limitations, if any for sharing.

Sharing data that is de-identified is not human subjects research and is therefore outside of the IRB's regulatory charge. The IRB is merely confirming the investigator's assessment (or not) of the sharing language in the consent form(s).

Steps to Follow

• Download the current NIH Institutional Certification template
• Fill out the first page, include all sites contributing samples for sequencing.
• Complete the second page and ensure that any restrictions are consistent with the IRB-approved consent form(s). Each consent form in every IRB-approved iteration that alters the data sharing language must be included.
• Submit an eIRB amendment to the study under which the data was collected and include the Institutional Certification form (signed by the investigator) with the amendment. Submit a full amendment, complete the SmartForm as applicable, and upload the Institutional Certification form signed by the investigator to section 1.03 question 1.
• After IRB review, the Institutional Certification is signed by the appropriate officials (third page) and returned to the investigator who submits to the NIH.

NIH Resources for Completing the Extramural Certification Form

• About Institutional Certifications;
• Completing an Institutional Certification Form.

The NIH will accept genomic data into the NIH-designated data repository after receiving appropriate certification by the responsible IO of the submitting institution that they approve submission to the NIH GDS data repository.

The IRB will conduct its reviews based on the NIH's criteria above and will document its findings using Review: Genetic Data/Specimen Sharing Plan reviewer form.

What if the IRB can't verify that the sharing plan meets all 4 requirements of the policy?

After review of the investigator's application, the IRB may find that the consent documents do not meet the criteria listed above. They may either

• Decide that it is appropriate and necessary for the investigator to seek explicit consent of the research participants for submission to the NIH-designated repository and subsequent sharing; or they may
• Determine that re-consent is not feasible or appropriate for a given study.

The IRB may also determine that it cannot verify that one or more of the other required criteria (1-5) have been met for submission to the NIH-designated repository.

In all these cases, the researchers' data-sharing plan should explain the reasons the IRB's determined that submission to the NIH-designated repository was considered inappropriate. NIH Institutes and Centers will consider these issues on a case-by-case basis when making programmatic decisions to fund genomic research studies for which the submission criteria cannot be met.

Certification Criteria

The certification should assure that:

• The data submission is consistent with all applicable laws and regulations, as well as institutional policies;
• The limitations on the research use of the data, as expressed in the informed consent documents, are delineated;
• The identities of research participants will not be disclosed to the NIH-designated data repositories; and an
• IRB reviewed and verified that:
  1. The protocol for the collection of genomic and phenotypic data is consistent with the 45 CFR 46.
  2. Data submission and subsequent data sharing for research purposes are consistent with the informed consent of study participants from whom the data were obtained;
  3. The investigator's plan for de-identifying datasets is consistent with the standards outlined in the GDS policy;
  4. To the extent relevant and possible, consideration was given to risks to groups or populations associated with submitting data to NIH-designated data repositories and subsequent sharing; and
  5. The investigator's plan for de-identifying datasets is consistent with the standards outlined in the GDS policy;
• The certification also needs to indicate whether the data are to be made available through unrestricted or controlled-access and whether future use is limited to not-for-profit organizations.

The NIH has additional Resources for Data Management and Sharing Policy.