Sharing Genomic Data

This document makes clear that even though sharing de-identified data and specimens is not human subjects research under the 45 CFR 46, the NIH Policy requires the IO and the IRB to review the investigator's plan for data submission and must consider the appropriateness of the informed consent process and document. The Policy goes beyond the regulatory requirements because the genotype and phenotype information generated about individuals will be substantial and, in some instances, sensitive (such as data related to the presence or risk of developing particular diseases or conditions and information regarding family relationships or ancestry), the confidentiality of the data and the privacy of participants must be protected.

Data Sharing Plans

Data sharing plans should describe how the expectations of the policy will be met, including:

  • the consistency of the informed consent for submission to the NIH-designated data repository and subsequent sharing;
  • how informed consent will be obtained (for prospectively collected samples and data); and
  • how data will be subsequently de-identified in accord with the specific criteria for data submission.

The investigator is responsible for ensuring that the data submitted for inclusion in the NIH-designated repository is appropriately coded or de-identified. Provided the code isn't shared, the data sent will be de-identified to the recipient (the NIH). If the data is coded, the investigator may retain the key to the code that links to specific individuals.

Additional Protections for GDS

Investigators are encouraged to obtain a Certificate of Confidentiality (CoC) from the NIH for non-NIH funded studies. Information is available at the NIH's Certificate of Confidentiality Kiosk to guide investigators seeking a CoC through the process. NIH studies are automatically issued a CoC.

Informed Consent

Prospective Studies:

The informed consent process and informed consent document should make clear that participants' DNA will undergo genetic analysis and that resultant genotype and phenotype data will be shared with an NIH-designated data repository for research purposes. (Note: prospective means after the date of submission to the IRB.) The CHOP consent form section is stored on Consent Templates page or using the following link: Data Sharing with NIH consent form section.

Retrospective Studies:

The IRB must determine whether the initial consent document, under which existing genetic materials and data were obtained, is consistent with the submission of data to the NIH-designated repository and the sharing of that data in accord with the GDS policy. (Note: retrospective means existing on or before the date of submission to the IRB.)

For studies that propose to use existing data or samples, the IRB may be forced to conclude that the original consent document is not adequate for submission to the NIH-designated repository. In these cases, the IRB may decide that it is appropriate and necessary for the investigator to seek explicit consent of the research participants for submission to the NIH-designated repository and subsequent sharing.

The criteria for a waiver of consent under 45 CFR part 46 are not applicable to the IRB's determinations (45 CFR 46 does not apply to this use). The criteria the IRB must apply in making its determinations are those set forth in the GDS policy.

Extramural Institutional Certification

Prior to sharing data with the NIH, the investigator - not the IRB - must complete the Extramural Institutional Certification form which enumerates any data use limitations. The purpose is to ensure that the data submitted to the NIH-designated repository is consistent with the NIH's GDS Policy and with the informed consent form signed by the original study participants. Since studies can have multiple consent forms and each form may have undergone one or more revisions, each form must be included in the Extramural Institutional Certification form. It is the investigator's obligation to review each consent form and present the limitations, if any for sharing; it is not the IRB's job.

The CHOP IRB expects that the investigator will review and summarize all consent forms (index subject, sibling, parents, other relatives, controls, etc.) and all amended versions of each consent form (initial submission and all amended versions to the consent sharing language). Some NIH institutes suggest that it is the IRB's job to fill out page 2 of the form. However the CHOP IRB declines to do so. Sharing data that is de-identified is not human subjects research and is therefor outside of the IRB's regulatory charge. The IRB is merely confirming the investigator's assessment (or not) of the sharing language in the consent form(s).

Steps to Follow
  • Download the current NIH Institutional Certification template either below or following this link: https://osp.od.nih.gov/scientific-sharing/institutional-certifications/
  • Fill out the first page, include all sites contributing samples for sequencing.
  • ┬áComplete the second page and ensure that any restrictions are consistent with the IRB-approved consent form(s). Each consent form in every IRB-approved iteration that alters the data sharing language must be included.
  • Provide the Institutional Certification form to the IRB along with a summary of the sharing language in every single version of the participant consent forms for each site.
  • After IRB review, the Institutional Certification is signed by the appropriate officials (third page) and submitted to NIH.
NIH Resources for Completing the Extramural Certification Form

Certification by the Institutional Official (IO)

Certification Criteria

The certification should assure that:

  • The data submission is consistent with all applicable laws and regulations, as well as institutional policies;
  • The limitations on the research use of the data, as expressed in the informed consent documents, are delineated;
  • The identities of research participants will not be disclosed to the NIH-designated data repositories; and an
  • IRB reviewed and verified that:
    1. The protocol for the collection of genomic and phenotypic data is consistent with the 45 CFR 46.
    2. Data submission and subsequent data sharing for research purposes are consistent with the informed consent of study participants from whom the data were obtained;
    3. The investigator's plan for de-identifying datasets is consistent with the standards outlined in the GDS policy;
    4. To the extent relevant and possible, consideration was given to risks to groups or populations associated with submitting data to NIH-designated data repositories and subsequent sharing; and
    5. The investigator's plan for de-identifying datasets is consistent with the standards outlined in the GDS policy;
  • The certification also needs to indicate whether the data are to be made available through unrestricted or controlled-access and whether future use is limited to not-for-profit organizations.

The NIH will accept genomic data into the NIH-designated data repository after receiving appropriate certification by the responsible IO of the submitting institution that they approve submission to the NIH GDS data repository.

The IRB will conduct its reviews based on the NIH's criteria above and will document its findings using the Review: Genetic Data/Specimen Sharing Plan.

What if the IRB can't verify that the sharing plan meets all 4 requirements of the policy?

After review of the investigator's application, the IRB may find that the consent documents do not meet the criteria listed above. They may either

  • Decide that it is appropriate and necessary for the investigator to seek explicit consent of the research participants for submission to the NIH-designated repository and subsequent sharing; or they may
  • Determine that re-consent is not feasible or appropriate for a given study.

The IRB may also determine that it cannot verify that one or more of the other required criteria (1-5) have been met for submission to the NIH-designated repository.

In all these cases, the researchers' data-sharing plan should explain the reasons the IRB's determined that submission to the NIH-designated repository was considered inappropriate. NIH Institutes and Centers will consider these issues on a case-by-case basis when making programmatic decisions to fund genomic research studies for which the submission criteria cannot be met.

Additional Information

The NIH Office of Scientific Policy has additional resources regarding Scientific Data Sharing that provides additional materials related to their GDS Policy for researchers and IRBs.

Top