On November 8, 2019, the National Institutes of Health (NIH) released its Draft NIH Policy for Data Management and Sharing and Supplement Draft Guidance as part of its continuing efforts to ensure public access to research the government conducts and pays for. Today, PRIM&R submitted comments applauding the NIH for taking steps to accelerate data sharing efforts while also offering a few constructive suggestions primarily centered around privacy and funding issues. The comment period closes today, and we encourage interested parties to consider submitting their own comments.

The proposed policy would require NIH-funded researchers to provide a comprehensive plan describing how scientific data will be managed and shared before the launch of a study. In developing the Draft Policy, the NIH reviewed public responses to a 2018 Request for Information (RFI) on Proposed Provisions for a Draft Data Management and Sharing Policy for NIH Funded or Supported Research. In PRIM&R’s comments on the RFI, we offered our full support for the agency’s data sharing efforts, since they can reduce the risks research subjects might face and optimize the use of limited research resources. In the RFI, the agency noted that data sharing “informs future research pathways,” and PRIM&R agreed that improved data sharing could result in better designed, and thus safer, research protocols.

In responding to the Draft Policy, PRIM&R maintains our continued support of the NIH’s stated policy position that sharing data resulting from taxpayer funded research enhances the value of that research, advances the pace of scientific discovery, and maximizes the contributions of human research subjects. To that end, we encourage the agency to explicitly mandate that researchers they fund, in both the pre-clinical and clinical research settings, share their data unless the agency determines that there is a compelling scientific, ethical, and/or logistical reason not to do so.

PRIM&R came to this conclusion in light of recent evidence suggesting that research subjects are eager to see their data shared and their contributions put to the best use. This sentiment is also expressed by some individuals with rare diseases, despite the heightened privacy risks associated with being part of a more easily identified population. PRIM&R believes one of the largest motivators for subjects to participate in research is the belief their contributions will advance science, a possibility that is more likely when their data can be analyzed by a larger group of researchers. At the same time, we recognize there may be ethical reasons not to share data in some cases. (We also note that the fact that data will be shared should always be disclosed in the informed consent process.)

In addition, we caution the NIH that deidentification, which is currently discussed in the supplemental draft guidance, is not a viable privacy risk mitigation strategy given that it is no longer possible to guarantee that data will remain permanently deidentified. At the very least, this fact should be appropriately communicated to grantees, oversight bodies, and other relevant stakeholders in both the final policy itself as well as any supplemental draft guidance the NIH develops.

When it comes to reviewing researchers’ data sharing plans for privacy and security issues, we urge the NIH to take additional steps to supplement and support this process.

According to the current NIH proposal, data management and sharing plans would be required only once an application has gone through peer review and received a “fundable score.’’ Review of submitted data management and sharing plans will, then, be done by individual program officers throughout the year, following the NIH grant cycle. PRIM&R suggests that the agency consider convening a technical review group that includes individuals who are independent from the NIH and its grant recipients, to augment and standardize the data security and privacy review conducted by individual program officers. This technical review group could draft guidance documents that program officers could then use to review individual plans. These guidance documents could also be made public and shared with the research oversight community which is struggling with the complexities of this new domain.

Relatedly, in response to the NIH’s request for areas in which further guidance is needed, PRIM&R suggests the agency offer specific guidance on the ethical issues involved in data sharing for the research oversight community. Such guidance should help IRBs and others ensure that participants are adequately informed of the limits of deidentification and include clear recommendations for how both the facts about data sharing and its inherent risks should be conveyed during the informed consent process.

Finally, PRIM&R flags the potential for increased research oversight costs which need to be addressed in order to ensure that our community has the capacity to ensure that data is shared ethically. Currently, the Supplemental Draft Guidance on Allowable Costs for Data Management and Sharing states, “Budget estimates should not include infrastructure costs typically included in institutional overhead (e.g., Facilities and Administrative costs).” However, current Facilities and Administrative allowances may be insufficient to cover the increased institutional overhead that may accompany greater efforts to share data. Given the growing number and complexity of issues that institutional research oversight bodies will need to understand and monitor as data sharing efforts expand, we urge the NIH to revisit this area.

Feel free to cite PRIM&R’s comments or borrow any of the points we make—see the full range of issues we address in our comments here—and let us know in the comment section below if you do! The agency has created a web portal to allow interested parties to submit their comments by January 10, 2020.