Understanding Material Transfer Agreements in Research

Unfunded Agreements and You Material, Data and Information Sharing OFFICE OF RESEARCH PROJECT AND ADMINISTRATION Anthony Beckman Amy Crosby Lydia Moore Josef Mejido - Export Control Forrest Crawford Huron Consultant Arden Smith Huron Consultant

Types of Agreements Negotiated by Agreement Administrators MTAs (Material Transfer Agreements) CDAs / NDAs (Confidentiality / Non-Disclosure Agreements) DUAs and DTAs (Data Use/Transfer Agreements)

Unfunded agreements are now online: IORA Agreements: https://rochesteragreements.huronresearch suite.com/Agreements 1. Department completes the forms in IORA Click on the Agreements tab. Click on Create Agreement . Complete the Smartforms with as much information as possible. Click Submit to send it to ORPA.

I am stuck on a question in the forms what should I do? A. You can use the Help Center in IORA Agreements and view the Unfunded Agreement Guide (the Tables of Contents is clickable) or other helpful information. B. You can reach out to Amy or Lydia to: Set up a Zoom meeting and they can walk you through entering the information for the agreement. Answer any questions via email or phone. C. You can visit the IORA website at: https://www.rochester.edu/iora-project/iora-training-grants/ Here will find helpful videos and written materials

MTAs A material transfer agreement is a contract used to define the terms and conditions for the exchange of research materials. A MTA sets forth rights to use the materials and allocates the rights that result from their use.

Reasons Material Providers Put a MTA in Place Proprietary and/or Confidential Materials/Information Restrict Use Hazardous Material / Special Regulations Potential Liability Obtain rights to the results of the research for which the material or information is to be used Ensure correct and appropriate acknowledgement is included in any publication regarding the use of the material

Should there be an MTA when receiving materials? Sometimes materials are provided without an MTA Can be an issue if: PI wishes to share the same material with another internal OR external collaborator PI moves to another institution and wishes to take the material with them. Best Practice is to always request a MTA when sending or receiving materials.

Think TWICE Before Sharing MICE * Mice use and distribution may be restricted by an MTA (material transfer agreement) to a specific PI and/or research project. Contact ORPA with questions: MTA@rochester.edu

Data Use Agreements (DUAs) A data use agreement is a contract that is used to define the terms and conditions upon which data is transferred between organizations. Also called data transfer agreement (DTA) or data transfer and use agreement (DTUA) Things to consider: HIPAA FERPA Intellectual Property GDPR EU countries

Reason for DUA Used when transferring proprietary or sensitive data, to control the use of the data 1. Proprietary data: research results or intellectual property data. 2. Sensitive data: Protected Health Information (PHI), Personally Identifiable Information (PII) ORPA strongly recommends a DUA for the sharing of data derived from human subjects outside the UR. Outside means with a non-employee of the UR (including students).

Data Use Agreements (DUA) 4 Types of Human Data 1. De-Identified Data 2. Limited Data Set (HIPAA) 3. Personal Health Information (PHI) (HIPAA) 4. Personally Identifiable Information (PII) The term PII, as defined in OMB Memorandum M-07- 1616 refers to information that can be used to distinguish or trace an individual s identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual. U.S. General Services Administration. https://www.gsa.gov/reference/gsa-privacy-program/rules-and-policies- protecting-pii-privacy-act.

De-identified, limited data set, or fully-identifiable PHI / PII data? De-identified Data Set a. Names; b. All geographic subdivisions smaller than a State, including: street address, city, county, precinct, zip codes and their equivalent geocodes, except for the initial three digits of a zip code if, according to the current publicly-available data from the Bureau of Census: (1) the geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000; and (2) the initial three digits of the zip code for all such geographic units containing 20,000 or fewer people is changed to 000. c. All elements of dates (except year) for dates directly related to an individual, including: birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older; d. Telephone numbers; e. Fax numbers; f. E-mail addresses; g. Social Security numbers; h. Medical record numbers; i. Health plan beneficiary numbers; j. Account numbers; k. Certificate/license numbers; l. Vehicle identifiers and serial numbers, including license plate numbers; m. Device identifiers and serial numbers; n. Web Universal Resource Locators (URLs); o. Internet Protocol (IP) address numbers; p. Biometric identifiers, including finger and voice prints; q. Full face photographic images and any comparable images; and r. Any other unique identifying numbers, characteristics or code Contains no HIPAA identifiers Best Practice is to execute a DUA whenever you send or receive data The De-Identified Data Set must EXCLUDE all of the following direct identifiers of the individual or of the individual s relatives, employers or household members to be considered De-Identified Data:

De-identified, limited data set, or fully-identifiable PHI / PII data? cont d Limited Data Set (LDS) Contains dates, city, state, or zip code information Requires a DUA for PHI under HIPAA, if no patient consent Fully-Identifiable PHI/PII Data Set Contains HIPAA identifiers other than dates / zip codes RSRB verifies consent form matches party sending data to Security questionnaire Further Questions? Reach out to our Privacy Officer: Kathleen Tranelli Kathleen_Tranelli@URMC.Rochester.edu 585-784-6154

What comes first RSRB or DUA? You can enter both the RSRB and Agreements information at the same time. When you enter the RSRB information they will instruct you to talk to ORPA about a DUA anytime you include data sharing in the protocol. If you have already entered the information into Agreements you can provide the DUA number to RSRB. RSRB DOES NOT NEED TO SEE THE FULLY EXECUTED DUA, HOWEVER ORPA DOES NEED TO SEE THE RSRB APPROVAL/ WAIVER.

Transferring Materials or Data to Industry Transfer needs to be for a specific project / purpose UR needs to retain right to publish Industry can often be over-reaching in their requests Takes longer to negotiate

CDAs / NDAs A Confidential Disclosure Agreement / Non Disclosure Agreement is an agreement under which one or both parties agree to maintain confidentiality regarding confidential and/or proprietary information that one party receives from the other party.

Reasons for a CDA Clinical Trial A company may wish to share information for the purpose of determining whether an academic institution might be interested in establishing a clinical trial to test the company s drug / biologic / device. Research Collaboration: A company, academic institution or non-profit may wish to discuss a possible research collaboration.

Do we need a CDA / NDA? One-way vs. Two-way CDAs One-way CDAs protect the ONE party who is sharing confidential and/or proprietary information. (Common for Clinical Trial CDAs) Two-way CDAs protect BOTH parties who are disclosing confidential and/or proprietary information. (Common for collaboration CDAs) Master CDAs Helps streamline process for sharing clinical trial protocols with PIs We have over 25 and counting We may need to reach out to UR Ventures if we are sharing Confidential Information regarding intellectual property developed at the UR.

What to do when a PI leaves the University of Rochester? When a principal investigator leaves the University of Rochester, it is suggested that the department administrator or PI contact our office to see whether or not there are any active MTAs/CDAs/DUAs involving the PI. (MTA@Rochester.edu). The PI should notify us whether or not they plan to: 1) continue using materials/data they received from another institution at their new place of employment; 2) transfer material or data made/developed/obtained while at the University of Rochester to their new place of employment; 3) no longer use materials or data in existing agreement(s).

Thanks! Questions? Have more questions contact: Amy at acrosby@orpa.Rochester.edu