NIH Data Management and Sharing Policy

NIH's DMS Policy requires that researchers follow the laws and regulations protecting research subjects and encourages researchers to:

• Implement an informed consent process that ensures that research participants understand how their data will be managed and shared
• Plan for the protection of participant privacy and confidentiality (e.g., through the use of de-identification)
• Consider if the scientific data generated should be shared via a controlled-access data repository

See NIH's "Writing a Data Management & Sharing Plan" guidance and this FAQ on protecting research participants for more details.

Also see "Supplemental Information to the NIH Policy for Data Management and Sharing: Protecting Privacy When Sharing Human Research Participant Data" for principles and best practices for protecting participant privacy.

An institutional review board (IRB), is responsible for reviewing and approving research to ensure that the rights and welfare of human participants are protected.

The following Johns Hopkins IRBs can offer guidance and support on meeting NIH requirements for data management and sharing.

If your research proposes to use and share JHM data, the IRB approval process may include a review by the JHM Data Trust.

JHM data is patient- or member-related data stored by Johns Hopkins Medicine participating organizations in their clinical enterprise systems, including billing, finance, health plan, and clinical administrative records or systems. The data stored in these systems may include individual-level research results or data streams from patient monitoring devices.

Note that researchers do not need to initiate Data Trust reviews. If needed, these reviews are automatically initiated as part of the IRB process.

For more about JHM data and JHM participating organizations, see the JHM Data Trust Policy. For more about sharing JHM data, see the Data Trust's FAQs on "External Data Sharing" and "Review of Data Requests."

Researchers' intentions for scientific data management and sharing, as proactively described in data management and sharing (DMS) plans, is strongly encouraged to be part of the informed consent process.

While NIH expects that researchers will take steps to maximize scientific data sharing, it does not proscribe how sharing should be specified in the informed consent process.

NIH Guidance

While the NIH DMS Policy does not expect that informed consent given by participants will be obtained in any particular way, it has developed the following resources for developing consent language related to data sharing:

• Informed Consent for Secondary Research with Data and Biospecimens: Points to Consider and Sample Language for Future Use and/or Sharing
• NIH Guidance on Consent for Future Research Use and Broad Sharing of Human Genomic and Phenotypic Data Subject to the NIH Genomic Data Sharing Policy

Note that NIH institutes and centers may have their own guidance for informed consent language (e.g., the National Institute on Alcohol Abuse and Alcoholism [NIAAA] and the National Institute of Mental Health [NIMH])

Guidance from Johns Hopkins Institutional Review Boards (IRBs)

Johns Hopkins Medicine IRBs

• JHM IRB Combined Informed Consent/HIPAA Authorization Template (December 2018, Version 16) - see section 4
• Genomic Data Sharing/Genome-Wide Association Studies (GWAS) Consent Language

Note that additional consent forms for specific situations are on the JHM IRB Forms page.

For more information on the informed consent process as governed by the Johns Hopkins Medicine IRBs, see the Organizational Policies page, specifically policies 109.7, 109.8, 111.14, 116.1, 116.3, 116.4, 116.5, 117.1, D403.1, and PER1. 

Office of the IRB, Johns Hopkins Bloomberg School of Public Health

• Consent Form Guidance - see section VI "Consent Process, Consent Forms, Recruitment and Other Participant Interaction Issues"
• Adult Signed Consent Form RCR1 - see the sections, "What happens to data that are collected in the study?," "How will the confidentiality of your data be protected?," "What happens to data and biospecimens that are collected in the study?," and "Genomic Data Sharing."
• Genomic Data Sharing Language

Note that additional consent forms for specific situations are on the Consent Forms page.

Guidance from Other Sources

• Meyer MN. Practical Tips for Ethical Data Sharing. Advances in Methods and Practices in Psychological Science. 2018;1(1):131-144. doi:10.1177/2515245917747656 - Includes advice on data management and sharing language for consent forms

NIH Guidance

• Supplemental Information to the NIH Policy for Data Management and Sharing: Responsible Management and Sharing of American Indian/Alaska Native Participant Data

Guidance from Other Sources

• Carroll, S.R., Rodriguez-Lonebear, D. and Martinez, A., 2019. Indigenous Data Governance: Strategies from United States Native Nations. Data Science Journal, 18(1), p.31.
• Collaborative Research Center for American Indian Health [CRCAIH] (2019). CRCAIH Research Data Management Toolkit: Version 2. Sioux Falls, SD: Collaborative Research Center for American Indian Health.
• Gachupin FC, Molina F. How to Conduct Research in American Indian and Alaska Native Communities, VIII(1). Tucson, Arizona: University of Arizona, Department of Family and Community Medicine, College of Medicine, February 2019.
• Harding, A., Harper, B., Stone, D., O'Neill, C., Berger, P., Harris, S., & Donatuto, J. (2012). Conducting research with tribal communities: sovereignty, ethics, and data-sharing issues. Environmental health perspectives, 120(1), 6–10.

NIH Guidance

Supplemental information to the NIH Policy for Data Management and Sharing offers guidance on the de-identification of human subjects data. For the full guidance, go to "Protecting Privacy When Sharing Human Research Participant Data."

In general, data should be shared only in a de-identified format, while also maintaining the scientific utility of the data.

NIH directs researchers to the following standards, methods and tools.

Standards for Data Identifiability

• The Common Rule [45 CFR 46.102(e)(5)]
• The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule [45 CFR 164.514(b)(1) and 45 CFR 164.514(b)(2)]

Methods and Tools for De-identification

• Guidance Regarding Methods for De-identification of Protected Health Information in Accordance with the HIPAA Privacy Rule
• Guidance on Image De-identification - From the Cancer Imaging Archive
• De-identification Tools - Curated by the National Institute of Standards and Technology
• NLM-Scrubber - A clinical text de-identification tool from the National Library of Medicine
  • Webinar, "Patient Privacy in the Era of Big Data," which includes a demonstration of NLM-Scrubber

JHU Guidance and Support

• Guide on Protecting Human Subject Identifiers - Includes basic tips for removing key identifiers, advanced techniques for de-identification, and software recommendations. Produced by JHU Data Services.
• Johns Hopkins ICTR De-identification Best Practices
• Johns Hopkins ICTR Core for Clinical Research Data Acquisition - Offers fee-based data de-identification services to conform to HIPAA privacy standards.