NIH Policy for Data Management and Sharing
The National Institutes of Health (NIH) has issued the final NIH Policy for Data Management and Sharing (DMS Policy) to promote the management and sharing of scientific data generated from NIH-funded or conducted research. This Policy is effective January 25, 2023 and applies to research funded or conducted by NIH that results in the generation of scientific data. The DMS policy establishes the requirements to submit Data Management and Sharing Plans to the NIH. Investigators are responsible for adherence to their plans.
DMS Policy Impact on IRB Submissions
As part of the criteria for IRB approval outlined in the federal regulations, the IRB must confirm that informed consent has been sought from participants and that there are adequate provisions to maintain confidentiality of data. Hence, this policy has impact on confidentiality plans and informed consents submitted to the IRB.
Data Management and Sharing Plans should be submitted to the IRB so that the IRB may review plans for data sharing, along with measures of security, confidentiality, and any limitations to data sharing.
- Data Management and Sharing Plans should align with the confidentiality plan outlined in HSERA or the standalone protocol.
- The NIH emphasizes that “access to scientific data derived from humans should be controlled, even if de-identified and lacking explicit limitations on subsequent use.” Additionally, controlled-access repositories should be considered if the data “could be considered sensitive, such as including information regarding potentially stigmatizing traits, illegal behaviors, or other information that could be perceived as causing group harm or used for discriminatory purposes.”
- Likewise, “privacy protections should be considered regardless of whether the data meet technical and/or legal definitions of “de-identified” and can legally be shared without additional protections.”
- Questions on NIH requirements for Data Management and Sharing Plans should be directed to Penn’s Office of Research Services or the NIH Grant Manager.
Data sharing and use should be clearly communicated in consent processes. The NIH encourages researchers to “develop robust consent processes that prioritize clarity regarding future sharing and use of scientific data, including limitations on future use, and general aspects regarding how data will be managed.” Likewise, “scientific data that are collected, shared, or used without informed consent also deserve privacy considerations.”
- The IRB has updated the Penn Informed Consent templates to align with the NIH Guidance entitled, Informed Consent for Secondary Research with Data and Biospecimens: Points to Consider and Sample Language for Future Use and/or Sharing. Tracked versions with explanation of the changes are available for the biomedical and social behavioral templates. The changes to template language is not significant. The major change to the templates is additional embedded guidance for NIH studies.
- Investigators should ensure that their Data Management and Sharing Plans align with what is presented as part of the informed consent process. This ensures that participants’ autonomy is respected.
- NIH recommends that “scientific data be de-identified to the greatest extent that maintains sufficient scientific utility. Unless participants explicitly consent to sharing identifiable data (e.g., under the broad consent provision of the Common Rule), data should generally be shared only in a de-identified format.”